;)
;)
;)
A user with http-xml access can get the user list/password hashes:
DataRecord read = new DataRecord() ;
read.setName("userList") ;
read.addField("username", myname);
read.addField("password", md5(mypass)) ;
read.setAction(DataRecord.SELECT);
boolean loaded = crmconn.load( read );
So he can attempt to use any of the obtained username/password hash values again in further http-xml calls. Is this behaviour expected ?