auth: The first userdb's default_fields may have been used wrongly if passdb set...

When a passdb sets a userdb_ prefixed field, the userdb reply was
initialized with the first userdb's default_fields filled. However, if
the user wasn't found from the first userdb, the default_fields were still
left there.

diff --git a/src/auth/auth-request-fields.c b/src/auth/auth-request-fields.c
index 77e995af2bcf9a57ef8010538cd4332a60b6bdda..c40b55560d7981f3d5dccdac93932afece8d7651 100644 (file)
--- a/src/auth/auth-request-fields.c
+++ b/src/auth/auth-request-fields.c
@@ -283,7 +283,7 @@ bool auth_request_import(struct auth_request *request,
                auth_fields_add(fields->extra_fields, key, value, 0);
        else if (str_begins(key, "userdb_", &key)) {
                if (fields->userdb_reply == NULL)
-                       auth_request_init_userdb_reply(request, FALSE);
+                       auth_request_init_userdb_reply(request);
                auth_fields_add(fields->userdb_reply, key, value, 0);
        } else
                return FALSE;
@@ -506,19 +506,9 @@ void auth_request_set_password_verified(struct auth_request *request)
        request->fields.skip_password_check = TRUE;
 }
 
-void auth_request_init_userdb_reply(struct auth_request *request,
-                                   bool add_default_fields)
+void auth_request_init_userdb_reply(struct auth_request *request)
 {
-       const char *error;
-
        request->fields.userdb_reply = auth_fields_init(request->pool);
-       if (add_default_fields) {
-               if (userdb_template_export(request->userdb->default_fields_tmpl,
-                                          request, &error) < 0) {
-                       e_error(authdb_event(request),
-                               "Failed to expand default_fields: %s", error);
-               }
-       }
 }
 
 void auth_request_set_delayed_credentials(struct auth_request *request,

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index 4fe96bdd80127ff4791b6ebcc7160ee82f97b086..3ba55988af08ed0e1e76282dd81dbd7a46fbfb54 100644 (file)
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -1458,7 +1458,7 @@ auth_request_lookup_user_cache(struct auth_request *request, const char *key,
           Don't add userdb's default_fields, because the entire userdb part of
           the result comes from the cache. */
        if (request->fields.userdb_reply == NULL)
-               auth_request_init_userdb_reply(request, FALSE);
+               auth_request_init_userdb_reply(request);
        auth_request_userdb_import(request, value);
        return TRUE;
 }
@@ -1607,19 +1607,17 @@ void auth_request_lookup_user(struct auth_request *request,
        request->userdb_lookup = TRUE;
        request->userdb_cache_result = AUTH_REQUEST_CACHE_NONE;
        if (request->fields.userdb_reply == NULL)
-               auth_request_init_userdb_reply(request, TRUE);
-       else {
-               /* we still want to set default_fields. these override any
-                  existing fields set by previous userdbs (because if that is
-                  unwanted, ":protected" can be used). */
-               if (userdb_template_export(userdb->default_fields_tmpl,
-                                          request, &error) < 0) {
-                       e_error(authdb_event(request),
-                               "Failed to expand default_fields: %s", error);
-                       auth_request_userdb_callback(
-                               USERDB_RESULT_INTERNAL_FAILURE, request);
-                       return;
-               }
+               auth_request_init_userdb_reply(request);
+       /* we still want to set default_fields. these override any
+          existing fields set by previous userdbs (because if that is
+          unwanted, ":protected" can be used). */
+       if (userdb_template_export(userdb->default_fields_tmpl,
+                                  request, &error) < 0) {
+               e_error(authdb_event(request),
+                       "Failed to expand default_fields: %s", error);
+               auth_request_userdb_callback(
+                       USERDB_RESULT_INTERNAL_FAILURE, request);
+               return;
        }
 
        auth_request_userdb_lookup_begin(request);
@@ -1878,7 +1876,7 @@ void auth_request_set_field(struct auth_request *request,
                /* for prefetch userdb */
                request->userdb_prefetch_set = TRUE;
                if (request->fields.userdb_reply == NULL)
-                       auth_request_init_userdb_reply(request, TRUE);
+                       auth_request_init_userdb_reply(request);
                if (strcmp(name, "userdb_userdb_import") == 0) {
                        /* we can't put the whole userdb_userdb_import
                           value to extra_cache_fields or it doesn't work

diff --git a/src/auth/auth-request.h b/src/auth/auth-request.h
index 9fab59cadabf900c011463c3013f4d061122e558..9cb7d8440b94fac975ce38e421d5d871d7fd51bf 100644 (file)
--- a/src/auth/auth-request.h
+++ b/src/auth/auth-request.h
@@ -320,8 +320,7 @@ void auth_request_set_fields(struct auth_request *request,
                             const char *const *fields,
                             const char *default_scheme) ATTR_NULL(3);
 
-void auth_request_init_userdb_reply(struct auth_request *request,
-                                   bool add_default_fields);
+void auth_request_init_userdb_reply(struct auth_request *request);
 void auth_request_set_userdb_field(struct auth_request *request,
                                   const char *name, const char *value);
 void auth_request_set_userdb_field_values(struct auth_request *request,

diff --git a/src/auth/auth-worker-server.c b/src/auth/auth-worker-server.c
index a1079bf4963fa351004823cd2f38b034eca45133..ff0c6fff81808b978f789a7708cca54ba74e2ac7 100644 (file)
--- a/src/auth/auth-worker-server.c
+++ b/src/auth/auth-worker-server.c
@@ -13,6 +13,7 @@
 #include "process-title.h"
 #include "master-service.h"
 #include "auth-request.h"
+#include "userdb-template.h"
 #include "auth-worker-server.h"
 
 
@@ -568,6 +569,7 @@ auth_worker_handle_user(struct auth_worker_command *cmd,
        /* lookup user */
        struct auth_request *auth_request;
        unsigned int userdb_id;
+       const char *error;
 
        /* <userdb id> [<args>] */
        if (str_to_uint(args[0], &userdb_id) < 0) {
@@ -589,9 +591,18 @@ auth_worker_handle_user(struct auth_worker_command *cmd,
                return FALSE;
        }
 
-       if (auth_request->fields.userdb_reply == NULL)
-               auth_request_init_userdb_reply(auth_request, TRUE);
        auth_request_userdb_lookup_begin(auth_request);
+       if (auth_request->fields.userdb_reply == NULL)
+               auth_request_init_userdb_reply(auth_request);
+       if (userdb_template_export(auth_request->userdb->default_fields_tmpl,
+                                  auth_request, &error) < 0) {
+               e_error(authdb_event(auth_request),
+                       "Failed to expand default_fields: %s", error);
+               lookup_user_callback(USERDB_RESULT_INTERNAL_FAILURE,
+                                    auth_request);
+               return TRUE;
+       }
+
        auth_request->userdb->userdb->iface->
                lookup(auth_request, lookup_user_callback);
        return TRUE;