Hello, when using LDAP authentication for users, loganalyzer creates an entry in SQL database, in table 'logcon_users'.
The entry contains the md5 hashed password for the user.
I think LDAP password should not be stored in database. They are useless for loganalyzer and md5 hash can be cracked.
I suggest changing src/include/functions__users.php, function CheckLDAPUserLogin as follow:
$md5pass = md5(DB_RemoveBadChars($password));
to
$md5pass = '';
So that LDAP users will not have password stored in SQL database.