Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms
- From
- Jan Viktorin <viktorin@rehivetech.com>
- Date
- Aug 1, 2015, 18:21 UTC
- Message-ID
- <20150801202156.57debcc3@jvn>
- In-Reply-To
- <20150801164959.GC488564@vauxhall.crustytoothpaste.net>
Hello Brian,
thanks for your note. I think, I will remove the check of list of mechanisms and put there a regex check.
On Sat, 1 Aug 2015 16:49:59 +0000 "brian m. carlson" <sandals@crustytoothpaste.net> wrote:
Show 12 quoted lines
> On Sat, Aug 01, 2015 at 01:33:37AM +0200, Jan Viktorin wrote:
> > + # Do not allow arbitrary strings.
> > + my ($filtered_auth) = "";
> > + foreach ("PLAIN", "LOGIN", "CRAM-MD5", "DIGEST-MD5") {
>
> On my system, GSSAPI is also available, and it does indeed work, as
> I'm not prompted for a password. (I have only PLAIN and GSSAPI
> available server-side, and AUTH is required.)
>
> It may be better to simply force the text to upper case, as that would
> allow us not to have to change Git if Authen::SASL::Perl implements
> new mechanisms.-- Jan Viktorin E-mail: Viktorin@RehiveTech.com System Architect Web: www.RehiveTech.com RehiveTech Phone: +420 606 201 868 Brno, Czech Republic