upstream/icinga2
1
0
Fork 0
mirror of https://github.com/Icinga/icinga2.git synced 2026-05-28 04:12:13 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

API: Ensure that empty passwords w/ client_cn are properly checked

Browse source 
fixes #11482
This commit is contained in:
Michael Friedrich 2016-04-04 16:38:47 +02:00
parent 3715f307a1
commit d2f5008557
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
lib/remote/httpserverconnection.cpp
View file

@ -144,12 +144,16 @@ void HttpServerConnection::ProcessMessageAsync(HttpRequest& request)
ApiUser::Ptr user;
/* client_cn matched. */
if (m_ApiUser)
user = m_ApiUser;
else {
user = ApiUser::GetByName(username);
if (user && user->GetPassword() != password)
/* Deny authentication if 1) given password is empty 2) configured password does not match. */
if (password.IsEmpty())
user.reset();
else if (user && user->GetPassword() != password)
user.reset();
}