From 3c9a8417442ea123f431a057821d35a34d7d8363 Mon Sep 17 00:00:00 2001
From: Simo Sorce <ssorce@redhat.com>
Date: Wed, 6 May 2009 18:12:26 -0400
Subject: Prevent accepting blank passwords

---
 server/responder/pam/pam_LOCAL_domain.c | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'server')

diff --git a/server/responder/pam/pam_LOCAL_domain.c b/server/responder/pam/pam_LOCAL_domain.c
index 1287c7d9b..614d640e6 100644
--- a/server/responder/pam/pam_LOCAL_domain.c
+++ b/server/responder/pam/pam_LOCAL_domain.c
@@ -230,6 +230,13 @@ static void do_pam_chauthtok(struct LOCAL_request *lreq)
                       lreq->error, ret, done);
     memset(pd->newauthtok, 0, pd->newauthtok_size);
 
+    if (strlen(newauthtok) == 0) {
+        /* TODO: should we allow null passwords via a config option ? */
+        DEBUG(1, ("Empty passwords are not allowed!"));
+        ret = EINVAL;
+        goto done;
+    }
+
     ret = s3crypt_gen_salt(lreq, &salt);
     NEQ_CHECK_OR_JUMP(ret, EOK, ("Salt generation failed.\n"),
                       lreq->error, ret, done);
-- 
cgit