Matisse,
Here's the patch mentioned in this thread. I'd really like to see this
issue get resolved. It's against 1.19. If it doesn't go in let me know
and I'll try to make it against 2.02.
Also shouldn't the Makefile.PL include DBI as a prereq?
Thanks,
William
--- /tmp/AuthCookieDBI.pm Mon Jul 26 10:04:09 2004
+++ AuthCookieDBI.pm Fri Dec 12 17:02:38 2003
@@ -463,16 +463,16 @@
my $auth_name = $r->auth_name;
# Username goes in credential_0
- my $user = $credentials[ 0 ];
- unless ( $user =~ /^.+$/ ) {
+ my $user = $credentials[ 0 ] || '';
+ unless ( $user && $user =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookieDBI: no username supplied for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
# Password goes in credential_1
- my $password = $credentials[ 1 ];
- unless ( $password =~ /^.+$/ ) {
+ my $password = $credentials[ 1 ] || '';
+ unless ( $password && $password =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookieDBI: no password supplied for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
# get the configuration information.
@@ -483,7 +483,7 @@
$c{ DBI_user }, $c{ DBI_password } );
unless ( defined $dbh ) {
$r->log_reason( "Apache::AuthCookieDBI: couldn't connect to $c{ DBI_DSN } for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
my $sth = $dbh->prepare( <<"EOS" );
SELECT $c{ DBI_passwordfield }
@@ -494,26 +494,26 @@
my( $crypted_password ) = $sth->fetchrow_array;
unless ( defined $crypted_password ) {
$r->log_reason( "Apache::AuthCookieDBI: couldn't select password from $c{ DBI_DSN }, $c{ DBI_userstable }, $c{ DBI_userfield } for user $user for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
# now return unless the passwords match.
if ( lc $c{ DBI_crypttype } eq 'none' ) {
unless ( $password eq $crypted_password ) {
$r->log_reason( "Apache::AuthCookieDBI: plaintext passwords didn't match for user $user for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
} elsif ( lc $c{ DBI_crypttype } eq 'crypt' ) {
my $salt = substr $crypted_password, 0, 2;
unless ( crypt( $password, $salt ) eq $crypted_password ) {
$r->log_reason( "Apache::AuthCookieDBI: crypted passwords didn't match for user $user for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
} elsif ( lc $c{ DBI_crypttype } eq 'md5' ) {
# NOTE: This may not be good enough. *** DEBUG ***
unless ( md5_hex( $password ) eq $crypted_password ) {
$r->log_reason( "Apache::AuthCookieDBI: MD5 passwords didn't match for user $user for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
}
@@ -548,7 +548,7 @@
my $secret_key = $SECRET_KEYS{ $auth_name };
unless ( defined $secret_key ) {
$r->log_reason( "Apache::AuthCookieDBI: didn't have the secret key for auth realm $auth_name", $r->uri );
- return 'bad';
+ return;
}
my $hash = md5_hex( join ':', $secret_key, md5_hex(
join ':', $public_part, $secret_key
@@ -646,6 +646,7 @@
}
# decode the user
my $user = _percent_decode $enc_user;
+ $issue_time ||= '';
unless ( $issue_time =~ /^\d{4}-\d{2}-\d{2}-\d{2}-\d{2}-\d{2}$/ ) {
$r->log_reason( "Apache::AuthCookieDBI: bad issue time $issue_time recovered from ticket for user $user for auth_realm $auth_name", $r->uri );
return undef;
