Fix for bug allowing accounts in LDAP to authenticate to unactivated accounts

diff --git a/ChangeLog b/ChangeLog
index 4027da47667ef50d64a2958057854023d6d28429..89b69bdf1d3b4b54cf8f0dcc5089f2afa5a07c4e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,14 @@
 /***********************************************************************
 X3 ChangeLog
 
+2009-11-21  Matthew Beeching  <jobe@mdbnet.co.uk>
+
+       * src/x3ldap.c: Fix for bug allowing accounts in LDAP to
+       authenticate to unactivated accounts.
+
+       * src/nickserv.c: Fix for bug allowing accounts in LDAP to
+       authenticate to unactivated accounts.
+
 2009-11-16  Matthew Beeching  <jobe@mdbnet.co.uk>
 
        * src/proto-p10.c: Added support for MARK SSLCLIFP.

diff --git a/src/nickserv.c b/src/nickserv.c
index 604d12ef5fcefcb197e9b4db69706536afa100c3..68d472564892b125976e54e006d214b7094f2c3d 100644 (file)
--- a/src/nickserv.c
+++ b/src/nickserv.c
@@ -1104,7 +1104,7 @@ nickserv_register(struct userNode *user, struct userNode *settee, const char *ha
 #ifdef WITH_LDAP
     if(nickserv_conf.ldap_enable && nickserv_conf.ldap_admin_dn) {
         int rc;
-        rc = ldap_do_add(handle, crypted, NULL);
+        rc = ldap_do_add(handle, (no_auth ? NULL : crypted), NULL);
         if(LDAP_SUCCESS != rc && LDAP_ALREADY_EXISTS != rc ) {
            if(user)
              send_message(user, nickserv, "NSMSG_LDAP_FAIL", ldap_err2string(rc));

diff --git a/src/x3ldap.c b/src/x3ldap.c
index 72f61bcc99b4ffd091981a78aaf3e8e7015406f5..7950cf99e0fb10e5598c189f75d310e792ee90e0 100644 (file)
--- a/src/x3ldap.c
+++ b/src/x3ldap.c
@@ -346,15 +346,19 @@ LDAPMod **make_mods_add(const char *account, const char *password, const char *e
     static char *account_vals[] = { NULL, NULL };
     static char *password_vals[] = { NULL, NULL };
     static char *email_vals[] = { NULL, NULL };
-    int num_mods = 3;
+    int num_mods = 2;
     int i;
+    int mod = 0;
     /* TODO: take this from nickserv_conf.ldap_add_objects */
     LDAPMod **mods;
     static char **object_vals;
     object_vals = make_object_vals();
 
     account_vals[0] = (char *) account;
-    password_vals[0] = (char *) password;
+    if (password != NULL) {
+      password_vals[0] = (char *) password;
+      num_mods++;
+    }
     email_vals[0] = (char *) email;
 
     if(!(nickserv_conf.ldap_field_account && *nickserv_conf.ldap_field_account))
@@ -370,26 +374,30 @@ LDAPMod **make_mods_add(const char *account, const char *password, const char *e
       memset(mods[i], 0, sizeof(LDAPMod));
     }
 
-    mods[0]->mod_op = LDAP_MOD_ADD;
-    mods[0]->mod_type = strdup("objectclass");
-    mods[0]->mod_values = object_vals;
+    mods[mod]->mod_op = LDAP_MOD_ADD;
+    mods[mod]->mod_type = strdup("objectclass");
+    mods[mod]->mod_values = object_vals;
+    mod++;
 
-    mods[1]->mod_op = LDAP_MOD_ADD;
-    mods[1]->mod_type = strdup(nickserv_conf.ldap_field_account);
-    mods[1]->mod_values = account_vals;
+    mods[mod]->mod_op = LDAP_MOD_ADD;
+    mods[mod]->mod_type = strdup(nickserv_conf.ldap_field_account);
+    mods[mod]->mod_values = account_vals;
+    mod++;
 
-    mods[2]->mod_op = LDAP_MOD_ADD;
-    mods[2]->mod_type = strdup(nickserv_conf.ldap_field_password);
-    mods[2]->mod_values = password_vals;
+    if (password != NULL) {
+      mods[mod]->mod_op = LDAP_MOD_ADD;
+      mods[mod]->mod_type = strdup(nickserv_conf.ldap_field_password);
+      mods[mod]->mod_values = password_vals;
+      mod++;
+    }
 
     if(nickserv_conf.ldap_field_email && *nickserv_conf.ldap_field_email && email && *email) {
-        mods[3]->mod_op = LDAP_MOD_ADD;
-        mods[3]->mod_type = strdup(nickserv_conf.ldap_field_email);
-        mods[3]->mod_values = email_vals;
-        mods[4] = NULL;
+      mods[mod]->mod_op = LDAP_MOD_ADD;
+      mods[mod]->mod_type = strdup(nickserv_conf.ldap_field_email);
+      mods[mod]->mod_values = email_vals;
+      mod++;
     }
-    else
-       mods[3] = NULL;
+    mods[mod] = NULL;
     *num_mods_ret = num_mods;
     return mods;
 }
@@ -406,10 +414,11 @@ int ldap_do_add(const char *account, const char *crypted, const char *email)
        log_module(MAIN_LOG, LOG_ERROR, "failed to bind as admin");
        return rc;
     }
-    
-    passbuf = make_password(crypted);
+
+    if (crypted != NULL)
+      passbuf = make_password(crypted);
     snprintf(newdn, MAXLEN-1, nickserv_conf.ldap_dn_fmt, account);
-    mods = make_mods_add(account, passbuf, email, &num_mods);
+    mods = make_mods_add(account, (crypted != NULL ? passbuf : crypted), email, &num_mods);
     if(!mods) {
        log_module(MAIN_LOG, LOG_ERROR, "Error building mods for ldap_add");
        return LDAP_OTHER;
@@ -425,7 +434,8 @@ int ldap_do_add(const char *account, const char *crypted, const char *email)
        free(mods[i]);
     }
     free(mods);
-    free(passbuf);
+    if (crypted != NULL)
+      free(passbuf);
     return rc;
 }