Changeset 3183c21 for storage_text.c

Timestamp:

2008-09-06T22:59:32Z (16 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

15d1469

Parents:

0a4f6f4

Message:

Completely reviewed all uses of irc->password, irc_setpass() and
USTATUS_IDENTIFIED after another account overwriting vulnerability was
found by Tero Marttila.

File:

• storage_text.c (modified) (4 diffs)

storage_text.c

@@ -44 +44 @@
 }
 
-static storage_status_t text_load ( const char *my_nick, const char* password, irc_t *irc )
+static storage_status_t text_load( irc_t *irc, const char* password )
 {
         char s[512];
@@ -54 +54 @@
         account_t *acc, *acc_lookup[9];
         
-        if( irc->status & USTATUS_IDENTIFIED )
-                return( 1 );
-        
-        g_snprintf( s, 511, "%s%s%s", global.conf->configdir, my_nick, ".accounts" );
+        g_snprintf( s, 511, "%s%s%s", global.conf->configdir, irc->nick, ".accounts" );
         fp = fopen( s, "r" );
         if( !fp ) return STORAGE_NO_SUCH_USER;
@@ -68 +65 @@
                 return STORAGE_INVALID_PASSWORD;
         }
-        
-        /* Do this now. If the user runs with AuthMode = Registered, the
-           account command will not work otherwise. */
-        irc->status |= USTATUS_IDENTIFIED;
         
         while( fscanf( fp, "%511[^\n]s", s ) > 0 )
@@ -101 +94 @@
         }
         
-        g_snprintf( s, 511, "%s%s%s", global.conf->configdir, my_nick, ".nicks" );
+        g_snprintf( s, 511, "%s%s%s", global.conf->configdir, irc->nick, ".nicks" );
         fp = fopen( s, "r" );
         if( !fp ) return STORAGE_NO_SUCH_USER;