Comment 9 for bug 1178032

Revision history for this message
Jeremy Stanley (fungi) wrote : Re: ldap list members returns passwords

This seems more like a hardening improvement we should make (whether we globally filter these, remove access to them in the backend by default, or both), but I think we should be safe to open this bug and only issue a security note unless other access vectors come to light during public analysis.