modules/saslserv/main: authxid_can_login: check for freeze early

Freezing an account should prevent a login attempt entirely, rather
than allowing the mechanism to succeed first, only for the login
itself to then fail.

diff --git a/modules/saslserv/main.c b/modules/saslserv/main.c
index 87c3b17c7d8a9b3576a8dd439302f4cb774d9672..1d886c2dfc6169e82a1b90d6adb7edbf33ad4f54 100644 (file)
--- a/modules/saslserv/main.c
+++ b/modules/saslserv/main.c
@@ -282,12 +282,6 @@ sasl_user_can_login(struct sasl_session *const restrict p)
        else if (! (target_mu = myuser_find_uid(p->authzeid)))
                return NULL;
 
-       if (metadata_find(source_mu, "private:freeze:freezer"))
-       {
-               (void) logcommand(p->si, CMDLOG_LOGIN, "failed LOGIN to \2%s\2 (frozen)", entity(source_mu)->name);
-               return NULL;
-       }
-
        if (target_mu != source_mu)
        {
                if (! sasl_may_impersonate(source_mu, target_mu))
@@ -296,13 +290,6 @@ sasl_user_can_login(struct sasl_session *const restrict p)
                                                               entity(source_mu)->name, entity(target_mu)->name);
                        return NULL;
                }
-
-               if (metadata_find(target_mu, "private:freeze:freezer"))
-               {
-                       (void) logcommand(p->si, CMDLOG_LOGIN, "failed LOGIN to \2%s\2 (frozen)",
-                                                              entity(target_mu)->name);
-                       return NULL;
-               }
        }
 
        if (! (target_mu->flags & MU_LOGINNOLIMIT)
@@ -992,6 +979,11 @@ sasl_authxid_can_login(struct sasl_session *const restrict p, const char *const
                (void) slog(LG_DEBUG, "%s: myuser_find_by_nick: does not exist", MOWGLI_FUNC_NAME);
                return false;
        }
+       if (metadata_find(mu, "private:freeze:freezer"))
+       {
+               (void) logcommand(p->si, CMDLOG_LOGIN, "failed LOGIN to \2%s\2 (frozen)", entity(mu)->name);
+               return false;
+       }
 
        if (muo)
                *muo = mu;