Redmine

The is_member function in Redmine.pm searches users which have the required permissions to access the repository. The used SQL however doesn't restrict the returned data to actual users but includes groups as well. This results in the following exception:

[perl:error] [pid 29442] [client 127.0.0.1:49599] Use of uninitialized value $salt in concatenation (.) or string at /usr/share/perl5/Apache/Redmine.pm line 483.\n

If the user doesn't provide a login here, it defaults to an empty string in the query. Unfortunately, an empty login applies to both the Anonymous user as well as all groups. Thus, if there are any groups, this can result in multiple lines being returned as a SQL result set that do not belong to actual users.

The attached patch by Planio fixes the SQL query so that only actual users are queried here.