An ubus RPC daemon for Liminix
Find a file
Fabian Bläse 3df62bcebd session: deny access if password login is disabled
The special characters '!' and '*' in /etc/shadow are
used to disable password login for a specific account.

The character 'x' has no special meaning, but should not
be interpreted as an empty password.

However, rpcd did treat these special characters like no
password was set, which allows access even though the account
is disabled.

By removing the additional checks for these characters, the
encrypted password string is passed to crypt, which returns NULL
if the salt has an invalid format and therefore access is denied.

Fixes: FS#2634

Signed-off-by: Fabian Bläse <fabian@blaese.de>
2020-03-17 19:33:35 +01:00
include/rpcd plugin: store pointer to exec timeout value in the ops structure 2018-11-28 12:10:40 +01:00
CMakeLists.txt Fix possible linker errors by using CMake find_library macro 2019-06-05 13:10:50 +02:00
exec.c exec: always call finish_cb to allow plugin to free up memory 2019-10-29 09:24:46 +01:00
file.c file: extend exec acl checks to commands with arguments 2019-12-11 09:13:05 +01:00
iwinfo.c iwinfo: add current hw and ht mode to info call 2020-01-05 19:56:34 +01:00
main.c main: exec_self: make clang analyzer happy 2019-10-29 09:26:24 +01:00
plugin.c plugin: avoid truncating numeric values 2019-11-10 21:26:51 +01:00
session.c session: deny access if password login is disabled 2020-03-17 19:33:35 +01:00
sys.c sys: fix symbol redeclaration 2019-09-04 15:51:39 +02:00
uci.c uci: free configs list memory on return 2019-10-29 09:25:17 +01:00
unauthenticated.json session: setup a persistent NULL section and implement login procedure 2013-09-10 19:56:36 +02:00