From 9eb98cb3f9139afaaaf84b789b70abd1d0890932 Mon Sep 17 00:00:00 2001 From: Timo Sirainen Date: Sat, 1 May 2004 22:09:34 +0300 Subject: [PATCH] Don't advertise AUTH=PLAIN unless transport is secure --HG-- branch : HEAD --- src/imap-login/client-authenticate.c | 15 +++++++++++---- src/pop3-login/client-authenticate.c | 16 ++++++++++++---- 2 files changed, 23 insertions(+), 8 deletions(-) diff --git a/src/imap-login/client-authenticate.c b/src/imap-login/client-authenticate.c index f01f7ef48c..b9033f0dcd 100644 --- a/src/imap-login/client-authenticate.c +++ b/src/imap-login/client-authenticate.c @@ -34,10 +34,17 @@ const char *client_authenticate_get_capabilities(int secured) str = t_str_new(128); for (i = 0; i < AUTH_MECH_COUNT; i++) { - if ((auth_mechs & auth_mech_desc[i].mech) && - auth_mech_desc[i].name != NULL && - (secured || !auth_mech_desc[i].plaintext || - !disable_plaintext_auth)) { + if ((auth_mechs & auth_mech_desc[i].mech) == 0) + continue; /* not available */ + + /* a) transport is secured + b) auth mechanism isn't plaintext + c) we allow insecure authentication + - but don't advertise AUTH=PLAIN, as RFC 2595 requires + */ + if (secured || !auth_mech_desc[i].plaintext || + (!disable_plaintext_auth && + auth_mech_desc[i].mech != AUTH_MECH_PLAIN)) { str_append_c(str, ' '); str_append(str, "AUTH="); str_append(str, auth_mech_desc[i].name); diff --git a/src/pop3-login/client-authenticate.c b/src/pop3-login/client-authenticate.c index 6f5203ea69..7001a56e27 100644 --- a/src/pop3-login/client-authenticate.c +++ b/src/pop3-login/client-authenticate.c @@ -34,10 +34,18 @@ int cmd_capa(struct pop3_client *client, const char *args __attr_unused__) str_append(str, "SASL"); for (i = 0; i < AUTH_MECH_COUNT; i++) { - if ((auth_mechs & auth_mech_desc[i].mech) && - auth_mech_desc[i].name != NULL && - (client->secured || !auth_mech_desc[i].plaintext || - !disable_plaintext_auth)) { + if ((auth_mechs & auth_mech_desc[i].mech) == 0) + continue; /* not available */ + + /* a) transport is secured + b) auth mechanism isn't plaintext + c) we allow insecure authentication + - but don't advertise AUTH=PLAIN, + as RFC 2595 requires + */ + if (client->secured || !auth_mech_desc[i].plaintext || + (!disable_plaintext_auth && + auth_mech_desc[i].mech != AUTH_MECH_PLAIN)) { str_append_c(str, ' '); str_append(str, auth_mech_desc[i].name); } -- 2.47.3