Avoiding LDAP data in plain text when you check the source code from a browser

Re: Avoiding LDAP data in plain text when you check the source code from a browser

by Randy Thornton -
Number of replies: 0
Picture of Documentation writers


Yes, it is potentially dangerous if someone can see that.

You're using https of course on your site, so your browser to Moodle communication is secure. You're using ldaps of course on your site, so your Moodle to ldap server connection is secure.

So, the ldap bind user password is vulnerable only on your own desktop in your browser session and cache:  it's as secure as your computer is.

If you are concerned about people walking up to your computer and seeing the password, or installing rogue PHP scripts on your desktop, you have more serious issues than this one setting.

If you are concerned about other Moodle administrators seeing this information, then they should probably not be administrators, but you should consider reducing their roles to Manager level or below. (Or investigate creating a custom role for them that does not allow them to see this section of the admin menus.)

The ldap_bind process requires this password to be sent to the ldap directory server in plaintext. It can't be hashed like user passwords are. And as an admin, you WANT to be able to see these: not being able to see these would make installing and troubleshooting them far more difficult than it is already ;). That is why you must have ldaps (and https) to be secure.


Also, I'm sure you are aware, but Moodle 2.7 will be out of security patch support very soon.