Mercurial > lxmppd-hg-xmllex / changeset
changeset
Return error when the given realm value does not match the sent realm value. Prevents impersonation of an account on one virtual host, but a user with the same username on another host.
Mon, 08 Dec 2008 03:23:37 +0500
- author
- Waqas Hussain <waqas20@gmail.com>
- date
- Mon, 08 Dec 2008 03:23:37 +0500
- changeset 602
- a977227aa9e6
- parent 601
- 6cb908ef01c8
- child 603
- 423fd24fff54
Return error when the given realm value does not match the sent realm value. Prevents impersonation of an account on one virtual host, but a user with the same username on another host.
| util/sasl.lua | file | annotate | diff | comparison | revisions |
--- a/util/sasl.lua Mon Dec 08 03:19:11 2008 +0500 +++ b/util/sasl.lua Mon Dec 08 03:23:37 2008 +0500 @@ -176,7 +176,11 @@ if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end if not response["qop"] then response["qop"] = "auth" end - if response["realm"] == nil then response["realm"] = "" end + if response["realm"] == nil then + response["realm"] = "" + elseif response["realm"] ~= self.realm then + return "failure", "not-authorized", "Incorrect realm value"; + end local decoder; if response["charset"] == nil then
