X-Git-Url: http://git.indexdata.com/?a=blobdiff_plain;f=util%2Fpasswddb.c;h=0c57801c9d0b0fea4e61ad1e06532b8bde5933dc;hb=707cc9ebfa7f462ec58a31cfbad4c1a09fecfa00;hp=114da0666e8f0ab8973295f3eee9eae38451fc03;hpb=4478d785b7769691261005c98063b98a5a5971b3;p=idzebra-moved-to-github.git

diff --git a/util/passwddb.c b/util/passwddb.c
index 114da06..0c57801 100644
--- a/util/passwddb.c
+++ b/util/passwddb.c
@@ -1,5 +1,5 @@
-/* $Id: passwddb.c,v 1.14 2006-08-14 10:40:34 adam Exp $
-   Copyright (C) 1995-2006
+/* $Id: passwddb.c,v 1.18 2007-10-29 09:23:08 adam Exp $
+   Copyright (C) 1995-2007
    Index Data ApS
 
 This file is part of the Zebra server.
@@ -32,6 +32,7 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 #include <crypt.h>
 #endif
 
+#include <assert.h>
 #include <yaz/log.h>
 #include <yaz/xmalloc.h>
 
@@ -127,23 +128,31 @@ void passwd_db_show(Passwd_db db)
 int passwd_db_auth(Passwd_db db, const char *user, const char *pass)
 {
     struct passwd_entry *pe;
+
+    assert(db);
     for (pe = db->entries; pe; pe = pe->next)
 	if (user && !strcmp (user, pe->name))
 	    break;
     if (!pe)
 	return -1;
+    if (!pass)
+	return -2;
     if (pe->encrypt_flag)
     {
 #if HAVE_CRYPT_H
-	char salt[3];
 	const char *des_try;
+        assert(pe->des);
 	if (strlen (pe->des) < 3)
 	    return -3;
-	if (!pass)
-	    return -2;
-	memcpy (salt, pe->des, 2);
-	salt[2] = '\0';	
-	des_try = crypt (pass, salt);
+
+        if (pe->des[0] != '$') /* Not MD5? (assume DES) */
+        {
+            if (strlen(pass) > 8) /* maximum key length is 8 */
+                return -2;
+        }
+	des_try = crypt (pass, pe->des);
+
+        assert(des_try);
 	if (strcmp (des_try, pe->des))
 	    return -2;
 #else
@@ -152,6 +161,8 @@ int passwd_db_auth(Passwd_db db, const char *user, const char *pass)
     }
     else
     {
+        assert(pass);
+        assert(pe->des);
 	if (strcmp (pe->des, pass))
 	    return -2;
     }