[Deprecated] DMZ 1.5.3 (DataMapper OverZealous Edition)

[eluser]cahva[/eluser]
I tested this now with a fresh install of CI 1.7.2 and latest DMZ 1.5.3 with the example application.

It will log you in if you just remove the password input from the form and put existing user to the username field:

Login view with just password commented out:

Code:

echo $user->render_form(array(
            'username',
            //'password'
        ),
        'login',
        array(
            'save_button' => 'Log In',
            'reset_button' => 'Clear'
        )
    );

I know I wasnt crazy And yeah I got the same query with "password" = 0 so I'm really baffled why is this happening.

It wont login if there is a password field in the form, so empty or wrong password wont let you in. This happens if you remove the password field from the form. So its a potential security hole when you could for example just send the form from outside without password field.

My setup is Wampserver with PHP5.3, mysql 5. I tested this just by copying fresh CI in c:/Wamp/www/ folder, set the config.php, database.php. Then copied from the latest DMZ datamapper files and finally copied the example application folder.