ldapauthmanager

maintainer alerque · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's own domain, which is plausibly maintained by the upstream author; building from this source is normal AUR packaging practice and the worst case of a swapped source is unverified code execution, not malicious remote execution or data exfiltration.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own domain, which is plausibly maintained by the upstream author; building from this source is normal AUR packaging practice and the worst case of a swapped source is unverified code execution, not malicious remote execution or data exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://projects.jethrocarr.com/p/oss-ldapauthmanager/downloads/get/ldapauthmanager-1.4.0.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:
    
      2# Contributor: Caleb Maclennan <caleb@alerque.com>
    
      3
    
      4pkgname=ldapauthmanager
    
      5pkgver=1.4.0
    
      6pkgrel=1
    
      7url=https://projects.jethrocarr.com/p/oss-ldapauthmanager/
    
      8pkgdesc="An LDAP user manager and password self-service webaapp."
    
      9arch=('any')
    
      10license=('AGPL')
    
      11depends=('php-ldap')
    
      12source=("https://projects.jethrocarr.com/p/oss-ldapauthmanager/downloads/get/ldapauthmanager-1.4.0.tar.bz2"
    
      13		'apache.conf')
    
      14md5sums=('4b41c3c9deaf2750e3ffcaaf9a0c6c22'
    
      15         '68861b3c06fc0db69ab45e7f9d5acfe4')
    
      16backup=('etc/webapps/ldapauthmanager/apache.conf'
    
      17        'etc/webapps/ldapauthmanager/config-settings.php')
    
      18
    
      19post_install () {
    
      20    echo "## You will need to create a database ##"
    
      21    echo "$ mysql -u root -p < /usr/share/webapps/ldapauthmanager/sql/version_LATESTDATE_install.sql"
    
      22
    
      23    echo "##### WARNING #####"
    
      24    echo "This webapp requires the rootdn's user and password in plain text in the config files"
    
      25    echo "and uses this to bind to the LDAP server. This of course must me readable by the httpd"
    
      26    echo "daemon, so basically the password to your LDAP rootdn which has control over you posix"
    
      27    echo "user accounts (the whole point of this program!) is sitting around in plain text to be"
    
      28    echo "read by anybody that can host files or inject code to be run as the httpd user. It then"
    
      29    echo "procedes to authenticate users by downloading their password fields and manually"
    
      30    echo "running the crypto checks on them. Even then it does not re-bind as that user but"
    
      31    echo "keeps right on going as the rootdn and tries to enforce access restrictions itself."
    
      32    echo "##### WARNING #####"
    
      33}
    
      34
    
      35post_upgrade () {
    
      36    echo "## You will need to update your database ##"
    
      37    echo "$ mysql -u root -p < /usr/share/webapps/ldapauthmanager/sql/version_LATESTDATE_upgrade.sql"
    
      38}
    
      39
    
      40package () {
    
      41    cd "$srcdir/$pkgname-$pkgver"
    
      42    # Change hard coded "Group" to "Groups" in order to match other Arch related docs for setting up
    
      43    # system authentication using LDAP. This needs to be fixed to be an option upstream!
    
      44    find ./ -type f -print0 | xargs -n1 -0 sed -i 's/ou=Group/ou=Groups/g'
    
      45
    
      46    mkdir -p "$pkgdir"/etc/webapps/ldapauthmanager
    
      47    mkdir -p "$pkgdir"/usr/share/webapps/ldapauthmanager
    
      48
    
      49    find ./ -type f -execdir chmod 0644 {} \;
    
      50    cp -ra htdocs scripts sql resources ldap radius "$pkgdir"/usr/share/webapps/ldapauthmanager/
    
      51    install -Dm0600 htdocs/admin/config.php "$pkgdir"/etc/webapps/ldapauthmanager/config.php
    
      52    mv "$pkgdir"/{usr/share/webapps/ldapauthmanager/htdocs/include/sample-config,etc/webapps/ldapauthmanager/config-settings}.php
    
      53
    
      54    install -Dm0664 "$srcdir"/apache.conf "$pkgdir"/etc/webapps/ldapauthmanager/apache.conf
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2