threads / patch / 24304

patch, 5 partsgit-cvsserver: take care of empty passwords

Subject: [PATCH 3/5] git-cvsserver: take care of empty passwords

## tl;dr

3 messages between Jul 6, 2010 and Jul 6, 2010. Diffs are folded; open one to read it.

replies: 2people: 2as markdown or json

Áshin László· Jul 6, 2010, 17:37 UTC · lore

Do not try to descramble them.
---
 git-cvsserver.perl |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

Show changes to git-cvsserver.perl +5 −2

diff --git a/git-cvsserver.perl b/git-cvsserver.perl
index 10dcc65..e842d77 100755
--- a/git-cvsserver.perl
+++ b/git-cvsserver.perl
@@ -241,11 +241,15 @@ if ($state->{method} eq 'pserver') {
            exit 1;
        }

+        if (length($password) > 0) {
+            $password = descramble($password);
+        }
+
        my $auth_ok;
        open my $passwd, "<", $authdb or die $!;
        while (<$passwd>) {
            if (m{^\Q$user\E:(.*)}) {
-                if (crypt($user, descramble($password)) eq $1) {
+                if (crypt($user, $password) eq $1) {
                    $auth_ok = 1;
                }
            };
--
1.7.0.4

Ævar Arnfjörð Bjarmason· Jul 6, 2010, 18:05 UTC · re: Áshin László · lore

Re: [PATCH 3/5] git-cvsserver: take care of empty passwords

On Tue, Jul 6, 2010 at 17:37, Áshin László <ashinlaszlo@gmail.com> wrote:

> Do not try to descramble them.

This commit message isn't very revealing. What does this do exactly? Is the behavior with empty passwords changed now? Does git-cvsserver no longer support empty passwords? Is the on-disk format in the authdb just different? (I.e. "" instead of "A" or something). Or something else?

Áshin László· Jul 6, 2010, 18:21 UTC · re: Ævar Arnfjörð Bjarmason · lore

Re: [PATCH 3/5] git-cvsserver: take care of empty passwords

descramble() dies if it is called with empty string as an argument. This patch only fixes this.

The test case written to check empty passwords only checks the case when the user is not in the authdb, so the old code doesn't even call descramble().

On Tue, Jul 6, 2010 at 20:05, Ævar Arnfjörð Bjarmason <avarab@gmail.com> wrote:

Show 9 quoted lines

> On Tue, Jul 6, 2010 at 17:37, Áshin László <ashinlaszlo@gmail.com> wrote:
>> Do not try to descramble them.
>
> This commit message isn't very revealing. What does this do exactly?
> Is the behavior with empty passwords changed now? Does git-cvsserver
> no longer support empty passwords? Is the on-disk format in the authdb
> just different? (I.e. "" instead of "A" or something). Or something
> else?
>