| Subject: | Missing user exists check |
There used to be an error is the user was not in the mysql table, that
check seems to be missing. This is how I think it could be added (I
tested this), but you may have another idea of how to add that check.
I suggest adding this code to the authen_cred sub after the password
length check:
# Check that the user exists:
if ( !$class->user_exists( $r, $user ) ) {
my $message
= "${class}\tNo such user '$user', for auth realm $auth_name.";
$class->logger( $r, Apache2::Const::LOG_NOTICE, $message, $user,
LOG_TYPE_AUTH, $r->uri );
return;
}
########
Then add this subroutine to the code as well:
sub user_exists {
my ( $class, $r, $user ) = @_;
my %c = $class->_dbi_config_vars($r);
my $dbh = $class->_dbi_connect($r) || return;
my $sql_query = <<"SQL";
SELECT $c{'DBI_UserField'}
FROM $c{'DBI_UsersTable'}
WHERE $c{'DBI_UserField'} = ?
SQL
my $sth = $dbh->prepare_cached($sql_query);
$sth->execute($user);
my $num_rows = $sth->rows;
$sth->finish();
if ($sth->rows == 0) {
return(0);
} else {
return(1);
}
}