From: Jan Viktorin <viktorin@rehivetech.com>
Date: Sat, 01 Aug 2015 18:21:56 GMT
Subject: Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms
Message-ID: <20150801202156.57debcc3@jvn>
In-Reply-To: <20150801164959.GC488564@vauxhall.crustytoothpaste.net>

Hello Brian,

thanks for your note. I think, I will remove the check
of list of mechanisms and put there a regex check.

On Sat, 1 Aug 2015 16:49:59 +0000
"brian m. carlson" <sandals@crustytoothpaste.net> wrote:

> On Sat, Aug 01, 2015 at 01:33:37AM +0200, Jan Viktorin wrote:
> > +	# Do not allow arbitrary strings.
> > +	my ($filtered_auth) = "";
> > +	foreach ("PLAIN", "LOGIN", "CRAM-MD5", "DIGEST-MD5") {
> 
> On my system, GSSAPI is also available, and it does indeed work, as
> I'm not prompted for a password.  (I have only PLAIN and GSSAPI
> available server-side, and AUTH is required.)
> 
> It may be better to simply force the text to upper case, as that would
> allow us not to have to change Git if Authen::SASL::Perl implements
> new mechanisms.

-- 
  Jan Viktorin                E-mail: Viktorin@RehiveTech.com
  System Architect            Web:    www.RehiveTech.com
  RehiveTech                  Phone: +420 606 201 868
  Brno, Czech Republic