From cb82874e920e830064e8529c7462ad0e0bb938ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Axel=20D=C3=B6rfler?= Date: Thu, 25 Jun 2015 17:47:27 +0200 Subject: [PATCH] multiuser_utils: Fixed verifying empty password. * verify_password() would accept all passwords if the there was none set, instead of accepting only an empty password. --- src/bin/multiuser/multiuser_utils.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/bin/multiuser/multiuser_utils.cpp b/src/bin/multiuser/multiuser_utils.cpp index 97551f4fb7..dbf2c49806 100644 --- a/src/bin/multiuser/multiuser_utils.cpp +++ b/src/bin/multiuser/multiuser_utils.cpp @@ -103,8 +103,12 @@ verify_password(passwd* passwd, spwd* spwd, const char* plainPassword) } // If no password is required, we're done. - if (requiredPassword == NULL || strlen(requiredPassword) == 0) - return true; + if (requiredPassword == NULL || requiredPassword[0] == '\0') { + if (plainPassword == NULL || plainPassword[0] == '\0') + return true; + + return false; + } // crypt and check it char* encryptedPassword = crypt(plainPassword, requiredPassword);