starred/cypht

Fork 0

mirror of https://github.com/cypht-org/cypht.git synced 2026-04-25 21:15:56 +03:00

[GH-ISSUE #821] Spaces in passwords are not handled correctly when adding servers #489

New issue

Closed

opened 2026-02-25 21:35:09 +03:00 by kerem · 8 comments

kerem commented

2026-02-25 21:35:09 +03:00

Owner

Originally created by @ivanov17 on GitHub (Nov 4, 2023).
Original GitHub issue: https://github.com/cypht-org/cypht/issues/821

Originally assigned to: @Shadow243 on GitHub.

🐛 Bugreport

When I try to add a new IMAP or SMTP server on the Servers page and specify a password that contains spaces, I get the message Unable to save this server, are the username and password correct?.

At the same time, in the IMAP server logs I see the error authentication failure: checkpass failed. But the password provided is correct.

When I use a password of the same length but without spaces, the authentication succeeds and I can receive or send emails. This means that Cypht does not handle spaces in passwords correctly in this case.

In principle, SMTP and IMAP servers can accept any Unicode characters in passwords. This means that Cypht must also accept any Unicode characters and handle them as expected.

However, the login page handles spaces in passwords properly.

Also, this either does not affect the issue https://github.com/cypht-org/cypht/issues/820 or may just be an additional factor. At least I still can't save the settings permanently, even using a password without spaces.

Version & Environment

Rev: v1.4.0

OS: CentOS Stream 9 container

PHP: 8.2.12

Steps to reproduce

Set a password containing spaces for your IMAP or SMTP account
Go to Servers page
Try to add an IMAP or SMTP server to your Cypht account

Originally created by @ivanov17 on GitHub (Nov 4, 2023). Original GitHub issue: https://github.com/cypht-org/cypht/issues/821 Originally assigned to: @Shadow243 on GitHub. ## 🐛 Bugreport  When I try to add a new IMAP or SMTP server on the `Servers` page and specify a password that contains spaces, I get the message `Unable to save this server, are the username and password correct?`. At the same time, in the IMAP server logs I see the error `authentication failure: checkpass failed`. But the password provided is correct. When I use a password of the same length but without spaces, the authentication succeeds and I can receive or send emails. This means that Cypht does not handle spaces in passwords correctly in this case. In principle, SMTP and IMAP servers can accept any Unicode characters in passwords. This means that Cypht must also accept any Unicode characters and handle them as expected. However, the login page handles spaces in passwords properly. Also, this either does not affect the issue https://github.com/cypht-org/cypht/issues/820 or may just be an additional factor. At least I still can't save the settings permanently, even using a password without spaces. ### Version & Environment  Rev: `v1.4.0`  OS: CentOS Stream 9 container PHP: 8.2.12 ### Steps to reproduce 1. Set a password containing spaces for your IMAP or SMTP account 2. Go to `Servers` page 3. Try to add an IMAP or SMTP server to your Cypht account

kerem closed this issue

2026-02-25 21:35:09 +03:00

kerem commented

2026-02-25 21:35:09 +03:00

Author

Owner

@marclaporte commented on GitHub (Nov 4, 2023):

I am OK for spaces in the password, but not spaces as first or last character because it causes too many support requests when people copy-paste passwords (which make sense when they are super-long)
https://github.com/cypht-org/cypht/pull/780

@marclaporte commented on GitHub (Nov 4, 2023): I am OK for spaces in the password, but not spaces as first or last character because it causes too many support requests when people copy-paste passwords (which make sense when they are super-long) https://github.com/cypht-org/cypht/pull/780

kerem commented

2026-02-25 21:35:09 +03:00

Author

Owner

@Shadow243 commented on GitHub (Nov 4, 2023):

We are already initiating a solution to the case, but it appears that the error lies in spaces being transformed into plus signs, especially when they are in the middle of passwords.

@Shadow243 commented on GitHub (Nov 4, 2023): We are already initiating a solution to the case, but it appears that the error lies in spaces being transformed into plus signs, especially when they are in the middle of passwords.

kerem commented

2026-02-25 21:35:09 +03:00

Author

Owner

@ivanov17 commented on GitHub (Nov 4, 2023):

@marclaporte In this case, Cypht also stores passwords for remote services, and hypothetically they can be anything. I think the main concern here should be to properly store whatever password the user wants to store.

There is an interesting discussion on spaces in passwords on StackExchange: https://security.stackexchange.com/questions/32691/why-not-allow-spaces-in-a-password

In the comments, among other things, the following opinion is found:

If you notice at creation time that there are trailing spaces in a password then warn the user that this is not recommended. Don't stop them from doing this but tell them that their password will not be as secure.

Perhaps a better solution would be to warn the user about leading or trailing spaces.

@ivanov17 commented on GitHub (Nov 4, 2023): @marclaporte In this case, Cypht also stores passwords for remote services, and hypothetically they can be anything. I think the main concern here should be to properly store whatever password the user wants to store. There is an interesting discussion on spaces in passwords on StackExchange: <https://security.stackexchange.com/questions/32691/why-not-allow-spaces-in-a-password> In the comments, among other things, the following opinion is found: > If you notice at creation time that there are trailing spaces in a password then warn the user that this is not recommended. Don't stop them from doing this but tell them that their password will not be as secure. Perhaps a better solution would be to warn the user about leading or trailing spaces.

kerem commented

2026-02-25 21:35:09 +03:00

Author

Owner

@marclaporte commented on GitHub (Nov 7, 2023):

For the record, I am supportive of spaces in passwords (just not first/last character). Ref: https://xkcd.com/936/

@marclaporte commented on GitHub (Nov 7, 2023): For the record, I am supportive of spaces in passwords (just not first/last character). Ref: https://xkcd.com/936/

kerem commented

2026-02-25 21:35:10 +03:00

Author

Owner

@marclaporte commented on GitHub (Dec 14, 2023):

@ivanov17 Good point that the user may not be able to modify the password from an external service. But I have never seen a password with a trailing space in my long career in IT. OTOH, I have many times helped users with an accidental trailing space that would cause multiple tries and to lock their account. As long as users are warned, I am OK.

@Shadow243: Your decision.

@marclaporte commented on GitHub (Dec 14, 2023): @ivanov17 Good point that the user may not be able to modify the password from an external service. But I have never seen a password with a trailing space in my long career in IT. OTOH, I have many times helped users with an accidental trailing space that would cause multiple tries and to lock their account. As long as users are warned, I am OK. @Shadow243: Your decision.

kerem commented

2026-02-25 21:35:10 +03:00

Author

Owner

@marclaporte commented on GitHub (Dec 15, 2023):

We already have a PR for this: https://github.com/cypht-org/cypht/pull/780

@marclaporte commented on GitHub (Dec 15, 2023): We already have a PR for this: https://github.com/cypht-org/cypht/pull/780

kerem commented

2026-02-25 21:35:10 +03:00

Author

Owner

@Shadow243 commented on GitHub (Mar 23, 2024):

This issue has been solved by this: https://github.com/cypht-org/cypht/pull/822

@Shadow243 commented on GitHub (Mar 23, 2024): This issue has been solved by this: [https://github.com/cypht-org/cypht/pull/822](https://github.com/cypht-org/cypht/pull/822)

kerem commented

2026-02-25 21:35:10 +03:00

Author

Owner

@marclaporte commented on GitHub (Mar 23, 2024):

@ivanov17 Please test and re-open if issue persists.

@marclaporte commented on GitHub (Mar 23, 2024): @ivanov17 Please test and re-open if issue persists.

kerem referenced this issue

2026-02-25 21:36:24 +03:00

[PR #489] [MERGED] Cypht view on a folder in mobile mode: Should have a search box #843