From: Timo Sirainen <tss@iki.fi>
Date: Fri, 4 Jan 2013 22:37:26 +0000 (+0200)
Subject: auth: Don't keep username duplicated in userdb_reply string.
X-Git-Tag: 2.2.beta1~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=548193b7d6c19a14eff810202cd334f364b75e36;p=thirdparty%2Fdovecot%2Fcore.git

auth: Don't keep username duplicated in userdb_reply string.
This fixes bugs where userdb_reply is accessed via auth_stream_*() functions
that remove/replace existing fields, which may have ended up
removing/replacing the username.
---

diff --git a/src/auth/auth-master-connection.c b/src/auth/auth-master-connection.c
index 4b9e3fb770..4b94cad733 100644
--- a/src/auth/auth-master-connection.c
+++ b/src/auth/auth-master-connection.c
@@ -276,6 +276,8 @@ user_callback(enum userdb_result result,
 		break;
 	case USERDB_RESULT_OK:
 		str_printfa(str, "USER\t%u\t", auth_request->id);
+		str_append_tabescaped(str, auth_request->user);
+		str_append_c(str, '\t');
 		str_append(str, auth_stream_reply_export(reply));
 		break;
 	}
diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c
index a05eda04a9..7dd7c7037e 100644
--- a/src/auth/auth-request-handler.c
+++ b/src/auth/auth-request-handler.c
@@ -661,8 +661,6 @@ static void userdb_callback(enum userdb_result result,
 		auth_stream_reply_add(reply, NULL, dec2str(request->id));
 		break;
 	case USERDB_RESULT_OK:
-		auth_stream_reply_add(reply, "USER", NULL);
-		auth_stream_reply_add(reply, NULL, dec2str(request->id));
 		if (request->master_user != NULL &&
 		    auth_stream_reply_find(request->userdb_reply,
 					   "master_user") == NULL) {
@@ -680,6 +678,9 @@ static void userdb_callback(enum userdb_result result,
 					      "anonymous", NULL);
 		}
 
+		auth_stream_reply_add(reply, "USER", NULL);
+		auth_stream_reply_add(reply, NULL, dec2str(request->id));
+		auth_stream_reply_add(reply, NULL, request->user);
 		auth_stream_reply_import(reply,
 			auth_stream_reply_export(request->userdb_reply));
 
diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index 1bc5a494ba..2579e16279 100644
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -438,22 +438,6 @@ static void auth_request_save_cache(struct auth_request *request,
 			  result == PASSDB_RESULT_OK);
 }
 
-static void auth_request_userdb_reply_update_user(struct auth_request *request)
-{
-	const char *str, *p;
-
-	str = t_strdup(auth_stream_reply_export(request->userdb_reply));
-
-	/* reset the reply and add the new username */
-	auth_stream_reply_reset(request->userdb_reply);
-	auth_stream_reply_add(request->userdb_reply, NULL, request->user);
-
-	/* add the rest */
-	p = strchr(str, '\t');
-	if (p != NULL)
-		auth_stream_reply_import(request->userdb_reply, p + 1);
-}
-
 static bool auth_request_master_lookup_finish(struct auth_request *request)
 {
 	struct auth_passdb *passdb;
@@ -468,8 +452,6 @@ static bool auth_request_master_lookup_finish(struct auth_request *request)
 	request->master_user = request->user;
 	request->user = request->requested_login_user;
 	request->requested_login_user = NULL;
-	if (request->userdb_reply != NULL)
-		auth_request_userdb_reply_update_user(request);
 
 	request->skip_password_check = TRUE;
 	request->passdb_password = NULL;
@@ -1261,8 +1243,6 @@ auth_request_try_update_username(struct auth_request *request,
 				       "username changed %s -> %s",
 				       request->user, new_value);
 		request->user = p_strdup(request->pool, new_value);
-		if (request->userdb_reply != NULL)
-			auth_request_userdb_reply_update_user(request);
 	}
 	return TRUE;
 }
@@ -1367,8 +1347,6 @@ void auth_request_init_userdb_reply(struct auth_request *request)
 	struct userdb_module *module = request->userdb->userdb;
 
 	request->userdb_reply = auth_stream_reply_init(request->pool);
-	auth_stream_reply_add(request->userdb_reply, NULL, request->user);
-
 	userdb_template_export(module->default_fields_tmpl, request);
 }