]> git.ipfire.org Git - thirdparty/dovecot/core.git/commitdiff
auth: Don't crash if trying to add password with TAB or LF to auth cache.
authorTimo Sirainen <tss@iki.fi>
Fri, 22 May 2015 23:07:56 +0000 (19:07 -0400)
committerTimo Sirainen <tss@iki.fi>
Fri, 22 May 2015 23:07:56 +0000 (19:07 -0400)
This would happen only if the passwords were stored as plaintext in passdb
and the valid password actually contained TAB or LF.

src/auth/auth-request.c

index 1406f5f8aa8ab1b115ede94afdbb78923431af18..36f9437f763e701f062933be393afce94328c813 100644 (file)
@@ -457,11 +457,7 @@ static void auth_request_save_cache(struct auth_request *request,
                        str_append(str, passdb->default_pass_scheme);
                        str_append_c(str, '}');
                }
-               if (strchr(request->passdb_password, '\t') != NULL)
-                       i_panic("%s: Password contains TAB", request->user);
-               if (strchr(request->passdb_password, '\n') != NULL)
-                       i_panic("%s: Password contains LF", request->user);
-               str_append(str, request->passdb_password);
+               str_append_tabescaped(str, request->passdb_password);
        }
 
        if (!auth_fields_is_empty(request->extra_fields)) {