[Pkg-shadow-commits] r1384 - in upstream/trunk: . src

[nekral-guest at alioth.debian.org]

Author: nekral-guest
Date: 2007-11-17 21:03:33 +0000 (Sat, 17 Nov 2007)
New Revision: 1384

Modified:
   upstream/trunk/ChangeLog
   upstream/trunk/src/newgrp.c
Log:
* src/newgrp.c: Do not give an indication that the group has no
  password.
* src/newgrp.c: Do not only bail on syslog if the password is not
  valid. Also give an indication to the user on stderr.


Modified: upstream/trunk/ChangeLog
===================================================================
--- upstream/trunk/ChangeLog	2007-11-17 20:41:49 UTC (rev 1383)
+++ upstream/trunk/ChangeLog	2007-11-17 21:03:33 UTC (rev 1384)
@@ -1,5 +1,12 @@
 2007-11-17  Nicolas François  <nicolas.francois at centraliens.net>
 
+	* src/newgrp.c: Do not give an indication that the group has no
+	password.
+	* src/newgrp.c: Do not only bail on syslog if the password is not
+	valid. Also give an indication to the user on stderr.
+
+2007-11-17  Nicolas François  <nicolas.francois at centraliens.net>
+
 	Fixes from Openwall patch shadow-4.0.4.1-owl-chage-drop-priv.diff:
 	* src/chage.c: Remove cleanup(). pw_lock is never called. Replace
 	cleanup(2) by spw_unlock and remove the calls to cleanup(1).

Modified: upstream/trunk/src/newgrp.c
===================================================================
--- upstream/trunk/src/newgrp.c	2007-11-17 20:41:49 UTC (rev 1383)
+++ upstream/trunk/src/newgrp.c	2007-11-17 21:03:33 UTC (rev 1384)
@@ -377,16 +377,6 @@
 	 * of the tests above.
 	 */
 	if (getuid () != 0 && needspasswd) {
-		if (grp->gr_passwd[0] == '\0') {
-			/*
-			 * there is no password, print out "No password."
-			 * and give up
-			 */
-			sleep (1);
-			fputs (_("No password.\n"), stderr);
-			goto failure;
-		}
-
 		/*
 		 * get the password from her, and set the salt for
 		 * the decryption from the group file.
@@ -402,11 +392,13 @@
 		cpasswd = pw_encrypt (cp, grp->gr_passwd);
 		strzero (cp);
 
-		if (strcmp (cpasswd, grp->gr_passwd) != 0) {
+		if (grp->gr_passwd[0] == '\0' ||
+		    strcmp (cpasswd, grp->gr_passwd) != 0) {
 			SYSLOG ((LOG_INFO,
 				 "Invalid password for group `%s' from `%s'",
 				 group, name));
 			sleep (1);
+			fputs (_("Invalid password."), stderr);
 			goto failure;
 		}
 	}