Bug #787: digest auth never detects password changes

diff --git a/lib/rfc2617.c b/lib/rfc2617.c
index 344ed2305b485959a19bee8ce690c334cd5db88e..cf95ef98708403afac5e1bd5cb7c3695c1095401 100644 (file)
--- a/lib/rfc2617.c
+++ b/lib/rfc2617.c
@@ -13,7 +13,7 @@
 
 
 /*
- * $Id: rfc2617.c,v 1.8 2003/07/12 00:34:01 hno Exp $
+ * $Id: rfc2617.c,v 1.9 2003/11/07 17:23:03 hno Exp $
  *
  * DEBUG:
  * AUTHOR: RFC 2617 & Robert Collins
@@ -79,11 +79,16 @@ CvtBin(const HASHHEX Hex, HASH Bin)
     unsigned char j;
 
     for (i = 0; i < HASHHEXLEN; i++) {
+       unsigned char n;
        j = Hex[i];
        if (('0' <= j) && (j <= '9'))
-           Bin[i / 2] |= ((j - '0') << ((i % 2 == 0) ? 4 : 0));
+           n = j - '0';
        else
-           Bin[i / 2] |= ((j - 'a' + 10) << ((i % 2 == 0) ? 4 : 0));
+           n = j - 'a' + 10;
+       if (i % 2 == 0)
+           Bin[i / 2] = n << 4;
+       else
+           Bin[i / 2] |= n;
     }
     Bin[HASHLEN] = '\0';
 }

diff --git a/src/auth/digest/auth_digest.cc b/src/auth/digest/auth_digest.cc
index 84374372d2e6e0b305d2cf5f07a803b4e4f99e84..33ba36d9686cd2392ff85a8b4a9b033064df0e23 100644 (file)
--- a/src/auth/digest/auth_digest.cc
+++ b/src/auth/digest/auth_digest.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: auth_digest.cc,v 1.31 2003/08/10 11:00:48 robertc Exp $
+ * $Id: auth_digest.cc,v 1.32 2003/11/07 17:23:04 hno Exp $
  *
  * DEBUG: section 29    Authenticator
  * AUTHOR: Robert Collins
@@ -693,7 +693,14 @@ digest_request_h::authenticate(HttpRequest * request, ConnStateData::Pointer con
     debug(29, 9) ("\nResponse = '%s'\n"
                   "squid is = '%s'\n", digest_request->response, Response);
 
-    if (strcasecmp(digest_request->response, Response)) {
+    if (strcasecmp(digest_request->response, Response) != 0) {
+        if (!digest_request->flags.helper_queried) {
+            /* Query the helper in case the password has changed */
+            digest_request->flags.helper_queried = 1;
+            digest_request->credentials_ok = Pending;
+            return;
+        }
+
         if (digestConfig->PostWorkaround && request->method != METHOD_GET) {
             /* Ugly workaround for certain very broken browsers using the
              * wrong method to calculate the request-digest on POST request.
@@ -1449,6 +1456,7 @@ authenticateDigestDecodeAuth(auth_user_request_t * auth_user_request, const char
          * username cache */
         /* store user in hash's */
         authenticateUserNameCacheAdd(auth_user);
+
         /*
          * Add the digest to the user so we can tell if a hacking
          * or spoofing attack is taking place. We do this by assuming

diff --git a/src/auth/digest/auth_digest.h b/src/auth/digest/auth_digest.h
index 99996d1d6b2f78b8201b1a5c7da04f6446df1929..7b02dfd4fdd20bd646d1515ee95f16d57b2330cb 100644 (file)
--- a/src/auth/digest/auth_digest.h
+++ b/src/auth/digest/auth_digest.h
@@ -87,6 +87,9 @@ unsigned int authinfo_sent:
 
 unsigned int nonce_stale:
         1;
+
+unsigned int helper_queried:
+        1;
     }
 
     flags;