diff options
| -rw-r--r-- | message.c | 22 |
1 files changed, 21 insertions, 1 deletions
@@ -900,7 +900,27 @@ int processclientmessage(SSL *server_ssl, char *str, struct client *clients, int // PASS received? User is trying to log in, check their password. if (strncasecmp(tokens[0], "PASS", strlen(tokens[0])) == 0) { - if (checkpassword(tokens[1], settings)) { + + // 1. The password is a freeform string that might contain spaces anywhere, so use the raw string rather than the space-separated tokens + // 2. If there is a leading colon then always strip it: + // a) Some clients always send one + // b) Some clients send one if the password contains a space or has a leading colon itself + // c) Clients that don't send one if the password contains a leading colon won't work unless the user uses two leading colons + + char passcopy[MAXDATASIZE]; + + // If the message is too short to contain a password, just pretend it's a blank string and it'll fail later... + if (counter > 1 && strlen(str) >= 6) { + // ...otherwise, use everything after "PASS " + strcpy(passcopy, str + 5); + } else { + strcpy(passcopy, ""); + } + + // Always strip the leading colon (see 2. above) + stripprefix(passcopy, 1); + + if (checkpassword(passcopy, settings)) { debugprint(DEBUG_FULL, "Password accepted! Setting client %s with fd %d to authenticated.\n", clients[clientindex].remoteip, sourcefd); // Find the client in the clients array and set them as authenticated for (int i = 0; i < MAXCLIENTS; i++) { |