From 2fe210eb69ba7caf78864fe3664cb3c52a887c74 Mon Sep 17 00:00:00 2001 From: Luke Bratch Date: Tue, 8 Sep 2026 21:15:59 +0100 Subject: Handle client PASS messages that contain spaces and/or a leading colon. 1. The password is a freeform string that might contain spaces anywhere, so use the raw string rather than the space-separated tokens. 2. If there is a leading colon then always strip it: a) Some clients always send one. b) Some clients send one if the password contains a space or has a leading colon itself. c) Clients that don't send one if the password contains a leading colon won't work unless the user uses two leading colons. --- message.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) (limited to 'message.c') diff --git a/message.c b/message.c index 695b196..6175fca 100644 --- a/message.c +++ b/message.c @@ -900,7 +900,27 @@ int processclientmessage(SSL *server_ssl, char *str, struct client *clients, int // PASS received? User is trying to log in, check their password. if (strncasecmp(tokens[0], "PASS", strlen(tokens[0])) == 0) { - if (checkpassword(tokens[1], settings)) { + + // 1. The password is a freeform string that might contain spaces anywhere, so use the raw string rather than the space-separated tokens + // 2. If there is a leading colon then always strip it: + // a) Some clients always send one + // b) Some clients send one if the password contains a space or has a leading colon itself + // c) Clients that don't send one if the password contains a leading colon won't work unless the user uses two leading colons + + char passcopy[MAXDATASIZE]; + + // If the message is too short to contain a password, just pretend it's a blank string and it'll fail later... + if (counter > 1 && strlen(str) >= 6) { + // ...otherwise, use everything after "PASS " + strcpy(passcopy, str + 5); + } else { + strcpy(passcopy, ""); + } + + // Always strip the leading colon (see 2. above) + stripprefix(passcopy, 1); + + if (checkpassword(passcopy, settings)) { debugprint(DEBUG_FULL, "Password accepted! Setting client %s with fd %d to authenticated.\n", clients[clientindex].remoteip, sourcefd); // Find the client in the clients array and set them as authenticated for (int i = 0; i < MAXCLIENTS; i++) { -- cgit v1.3