Changeset 3183c21 for storage_xml.c

Timestamp:

2008-09-06T22:59:32Z (16 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

15d1469

Parents:

0a4f6f4

Message:

Completely reviewed all uses of irc->password, irc_setpass() and
USTATUS_IDENTIFIED after another account overwriting vulnerability was
found by Tero Marttila.

File:

• storage_xml.c (modified) (5 diffs)

storage_xml.c

@@ -259 +259 @@
 }
 
-static storage_status_t xml_load_real( const char *my_nick, const char *password, irc_t *irc, xml_pass_st action )
+static storage_status_t xml_load_real( irc_t *irc, const char *my_nick, const char *password, xml_pass_st action )
 {
         GMarkupParseContext *ctx;
@@ -266 +266 @@
         GError *gerr = NULL;
         int fd, st;
-        
-        if( irc && irc->status & USTATUS_IDENTIFIED )
-                return( 1 );
         
         xd = g_new0( struct xml_parsedata, 1 );
@@ -321 +318 @@
                 return STORAGE_OK;
         
-        irc->status |= USTATUS_IDENTIFIED;
-        
         return STORAGE_OK;
 }
 
-static storage_status_t xml_load( const char *my_nick, const char *password, irc_t *irc )
-{
-        return xml_load_real( my_nick, password, irc, XML_PASS_UNKNOWN );
+static storage_status_t xml_load( irc_t *irc, const char *password )
+{
+        return xml_load_real( irc, irc->nick, password, XML_PASS_UNKNOWN );
 }
 
@@ -335 +330 @@
         /* This is a little bit risky because we have to pass NULL for the
            irc_t argument. This *should* be fine, if I didn't miss anything... */
-        return xml_load_real( my_nick, password, NULL, XML_PASS_CHECK_ONLY );
+        return xml_load_real( NULL, my_nick, password, XML_PASS_CHECK_ONLY );
 }
 
@@ -370 +365 @@
         md5_byte_t pass_md5[21];
         md5_state_t md5_state;
-        
-        if( irc->password == NULL )
-        {
-                irc_usermsg( irc, "Please register yourself if you want to save your settings." );
-                return STORAGE_OTHER_ERROR;
-        }
         
         path2 = g_strdup( irc->nick );