Handle client PASS messages that contain spaces and/or a leading colon.HEADmaster

1. The password is a freeform string that might contain spaces anywhere, so use the raw string rather than the space-separated tokens.
2. If there is a leading colon then always strip it:
   a) Some clients always send one.
   b) Some clients send one if the password contains a space or has a leading colon itself.
   c) Clients that don't send one if the password contains a leading colon won't work unless the user uses two leading colons.

1 files changed, 21 insertions, 1 deletions

diff --git a/message.c b/message.c
index 695b196..6175fca 100644
--- a/message.c
+++ b/message.c
@@ -900,7 +900,27 @@ int processclientmessage(SSL *server_ssl, char *str, struct client *clients, int
 
   // PASS received?  User is trying to log in, check their password.
   if (strncasecmp(tokens[0], "PASS", strlen(tokens[0])) == 0) {
-    if (checkpassword(tokens[1], settings)) {
+
+  // 1. The password is a freeform string that might contain spaces anywhere, so use the raw string rather than the space-separated tokens
+  // 2. If there is a leading colon then always strip it:
+  //    a) Some clients always send one
+  //    b) Some clients send one if the password contains a space or has a leading colon itself
+  //    c) Clients that don't send one if the password contains a leading colon won't work unless the user uses two leading colons
+
+  char passcopy[MAXDATASIZE];
+
+  // If the message is too short to contain a password, just pretend it's a blank string and it'll fail later...
+  if (counter > 1 && strlen(str) >= 6) {
+    // ...otherwise, use everything after "PASS "
+    strcpy(passcopy, str + 5);
+  } else {
+    strcpy(passcopy, "");
+  }
+
+  // Always strip the leading colon (see 2. above)
+  stripprefix(passcopy, 1);
+
+    if (checkpassword(passcopy, settings)) {
       debugprint(DEBUG_FULL, "Password accepted!  Setting client %s with fd %d to authenticated.\n", clients[clientindex].remoteip, sourcefd);
       // Find the client in the clients array and set them as authenticated
       for (int i = 0; i < MAXCLIENTS; i++) {