Skip to content
Snippets Groups Projects
Commit 0975d578 authored by Rob Swindell's avatar Rob Swindell :speech_balloon:
Browse files

Fix 30-year-old bug (obvious password patterns) in chkpass()

Off-by-one bug caused the comparison of only the first 3 chars of the proposed password against "QWE", "ASD", and "!@#" rather than the 4 character pattern match as intended.

These lines should be removed anyway since this can be easily achieved via password.can (as intended), but I couldn't help myself but to fix this ancient bug.
parent d61a3589
No related branches found
No related tags found
1 merge request!463MRC mods by Codefenix (2024-10-20)
......@@ -761,9 +761,9 @@ bool sbbs_t::chkpass(char *passwd, user_t* user, bool unique)
&& (strstr(pass,cfg.sys_id) || strstr(cfg.sys_id,pass)))
|| (cfg.node_phone[0] && strstr(pass,cfg.node_phone))
|| (user->phone[0] && strstr(user->phone,pass))
|| !strncmp(pass,"QWER",3)
|| !strncmp(pass,"ASDF",3)
|| !strncmp(pass,"!@#$",3)
|| !strncmp(pass,"QWER",4)
|| !strncmp(pass,"ASDF",4)
|| !strncmp(pass,"!@#$",4)
)
{
bputs(text[PasswordObvious]);
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment