Almost.. the last change optimized the cleanup of persistent PAM connections

a little too much, causing passwords to fail if the length of the username
differs between two requests in some PAM implementations.

diff --git a/helpers/basic_auth/PAM/pam_auth.c b/helpers/basic_auth/PAM/pam_auth.c
index 92c932609319783b2c2b9d0e5ec165a899678da2..df7e67ae5ba741d4971fdaf95c55882a83568e2e 100644 (file)
--- a/helpers/basic_auth/PAM/pam_auth.c
+++ b/helpers/basic_auth/PAM/pam_auth.c
@@ -1,5 +1,5 @@
 /*
- * $Id: pam_auth.c,v 1.13 2003/11/05 09:37:43 hno Exp $
+ * $Id: pam_auth.c,v 1.14 2003/11/05 18:06:34 hno Exp $
  *
  * PAM authenticator module for Squid.
  * Copyright (C) 1999,2002,2003 Henrik Nordstrom <hno@squid-cache.org>
@@ -235,6 +235,8 @@ start:
        if (ttl != 0) {
            if (retval == PAM_SUCCESS)
                retval = pam_set_item(pamh, PAM_USER, user);
+           if (retval == PAM_SUCCESS)
+               retval = pam_set_item(pamh, PAM_CONV, &conv);
        }
        if (retval == PAM_SUCCESS)
            retval = pam_authenticate(pamh, 0);
@@ -247,19 +249,17 @@ error:
            fprintf(stdout, "ERR\n");
        }
        /* cleanup */
-       if (ttl != 0) {
-           retval = pam_set_item(pamh, PAM_CONV, &conv);
-#ifdef PAM_AUTHTOK
-           if (retval == PAM_SUCCESS)
-               retval = pam_set_item(pamh, PAM_AUTHTOK, NULL);
-#endif
-       }
        if (ttl == 0 || retval != PAM_SUCCESS) {
            retval = pam_end(pamh, retval);
            if (retval != PAM_SUCCESS) {
                fprintf(stderr, "WARNING: failed to release PAM authenticator\n");
            }
            pamh = NULL;
+#ifdef PAM_AUTHTOK
+       } else if (ttl != 0) {
+           if (retval == PAM_SUCCESS)
+               retval = pam_set_item(pamh, PAM_AUTHTOK, NULL);
+#endif
        }
     }