# [PATCH 3/5] git-cvsserver: take care of empty passwords

3 messages from 2010-07-06 to 2010-07-06. Participants: Áshin László, Ævar Arnfjörð Bjarmason.
Thread: https://gitlist.dev/t/24304

## Áshin László, 2010-07-06 17:37

Subject: [PATCH 3/5] git-cvsserver: take care of empty passwords
Message-ID: <AANLkTinpjbOStczVo7NaPlxqyAh_32kLy0kWKc_AsLiI@mail.gmail.com>
URL: https://gitlist.dev/e/AANLkTinpjbOStczVo7NaPlxqyAh_32kLy0kWKc_AsLiI%40mail.gmail.com
In-Reply-To: <3594077658746039911@unknownmsgid>

```
Do not try to descramble them.
---
 git-cvsserver.perl |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/git-cvsserver.perl b/git-cvsserver.perl
index 10dcc65..e842d77 100755
--- a/git-cvsserver.perl
+++ b/git-cvsserver.perl
@@ -241,11 +241,15 @@ if ($state->{method} eq 'pserver') {
            exit 1;
        }

+        if (length($password) > 0) {
+            $password = descramble($password);
+        }
+
        my $auth_ok;
        open my $passwd, "<", $authdb or die $!;
        while (<$passwd>) {
            if (m{^\Q$user\E:(.*)}) {
-                if (crypt($user, descramble($password)) eq $1) {
+                if (crypt($user, $password) eq $1) {
                    $auth_ok = 1;
                }
            };
--
1.7.0.4

```

## Ævar Arnfjörð Bjarmason, 2010-07-06 18:05

Subject: Re: [PATCH 3/5] git-cvsserver: take care of empty passwords
Message-ID: <AANLkTilSvEf6DIM_JZql8pTnSCrnFQ2tAOGuqownVl4e@mail.gmail.com>
URL: https://gitlist.dev/e/AANLkTilSvEf6DIM_JZql8pTnSCrnFQ2tAOGuqownVl4e%40mail.gmail.com
In-Reply-To: <AANLkTinpjbOStczVo7NaPlxqyAh_32kLy0kWKc_AsLiI@mail.gmail.com>

```
On Tue, Jul 6, 2010 at 17:37, Áshin László <ashinlaszlo@gmail.com> wrote:
> Do not try to descramble them.

This commit message isn't very revealing. What does this do exactly?
Is the behavior with empty passwords changed now? Does git-cvsserver
no longer support empty passwords? Is the on-disk format in the authdb
just different? (I.e. "" instead of "A" or something). Or something
else?

```

## Áshin László, 2010-07-06 18:21

Subject: Re: [PATCH 3/5] git-cvsserver: take care of empty passwords
Message-ID: <AANLkTinkg-i3KczWliWymP1FWYx0_YeoLGLHq2h2jLa-@mail.gmail.com>
URL: https://gitlist.dev/e/AANLkTinkg-i3KczWliWymP1FWYx0_YeoLGLHq2h2jLa-%40mail.gmail.com
In-Reply-To: <AANLkTilSvEf6DIM_JZql8pTnSCrnFQ2tAOGuqownVl4e@mail.gmail.com>

```
descramble() dies if it is called with empty string as an argument.
This patch only fixes this.

The test case written to check empty passwords only checks the case
when the user is not in the authdb, so the old code doesn't even call
descramble().

On Tue, Jul 6, 2010 at 20:05, Ævar Arnfjörð Bjarmason <avarab@gmail.com> wrote:
> On Tue, Jul 6, 2010 at 17:37, Áshin László <ashinlaszlo@gmail.com> wrote:
>> Do not try to descramble them.
>
> This commit message isn't very revealing. What does this do exactly?
> Is the behavior with empty passwords changed now? Does git-cvsserver
> no longer support empty passwords? Is the on-disk format in the authdb
> just different? (I.e. "" instead of "A" or something). Or something
> else?
>

```