From: Stephan Bosch <stephan.bosch@open-xchange.com>
Date: Sun, 5 Mar 2023 15:31:47 +0000 (+0100)
Subject: auth: mech-otp - Set lock flag in otp_try_lock()
X-Git-Tag: 2.4.2~326
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a1107e3b1e0ca84b90201f910422560269af9d5a;p=thirdparty%2Fdovecot%2Fcore.git

auth: mech-otp - Set lock flag in otp_try_lock()
---

diff --git a/src/auth/mech-otp.c b/src/auth/mech-otp.c
index 6034f80344..cc4b37c0dc 100644
--- a/src/auth/mech-otp.c
+++ b/src/auth/mech-otp.c
@@ -56,6 +56,7 @@ static bool otp_try_lock(struct otp_auth_request *request)
 
 	hash_table_insert(otp_lock_table, auth_request->fields.user,
 			  auth_request);
+	request->lock = TRUE;
 	return TRUE;
 }
 
@@ -96,8 +97,7 @@ otp_send_challenge(struct otp_auth_request *request,
 		return;
 	}
 
-	request->lock = otp_try_lock(request);
-	if (!request->lock) {
+	if (!otp_try_lock(request)) {
 		e_error(auth_request->mech_event,
 			"user is locked, race attack?");
 		auth_request_fail(auth_request);