Changeset 105 in openpam

Timestamp:

Apr 6, 2002, 9:23:26 PM (19 years ago)

Author:

Dag-Erling Smørgrav

Message:

If PAM_OLDAUTHTOK is set, we're asked for PAM_AUTHTOK, and we have
to prompt the user, prompt her twice and compare the responses.

Sponsored by: DARPA, NAI Labs

File:

• trunk/lib/pam_get_authtok.c (modified) (7 diffs)

trunk/lib/pam_get_authtok.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_get_authtok.c#14 $
+ * $P4: //depot/projects/openpam/lib/pam_get_authtok.c#15 $
  */
 
@@ -46 +46 @@
 const char authtok_prompt[] = "Password:";
 const char oldauthtok_prompt[] = "Old Password:";
+const char newauthtok_prompt[] = "New Password:";
 
 /*
@@ -59 +60 @@
         const char *prompt)
 {
+        const void *oldauthtok;
         const char *default_prompt;
-        char *resp;
-        int pitem, r, style;
+        char *resp, *resp2;
+        int pitem, r, style, twice;
 
         if (pamh == NULL || authtok == NULL)
@@ -67 +69 @@
 
         *authtok = NULL;
+        twice = 0;
         switch (item) {
         case PAM_AUTHTOK:
                 pitem = PAM_AUTHTOK_PROMPT;
                 default_prompt = authtok_prompt;
+                r = pam_get_item(pamh, PAM_OLDAUTHTOK, &oldauthtok);
+                if (r == PAM_SUCCESS && oldauthtok != NULL) {
+                        default_prompt = newauthtok_prompt;
+                        twice = 1;
+                }
                 break;
         case PAM_OLDAUTHTOK:
                 pitem = PAM_OLDAUTHTOK_PROMPT;
                 default_prompt = oldauthtok_prompt;
+                twice = 0;
                 break;
         default:
@@ -98 +107 @@
         if (r != PAM_SUCCESS)
                 return (r);
+        if (twice) {
+                r = pam_prompt(pamh, style, &resp2, "Retype %s", prompt);
+                if (r != PAM_SUCCESS) {
+                        free(resp);
+                        return (r);
+                }
+                if (strcmp(resp, resp2) != 0) {
+                        free(resp);
+                        resp = NULL;
+                }
+                free(resp2);
+        }
+        if (resp == NULL)
+                return (PAM_TRY_AGAIN);
         r = pam_set_item(pamh, pitem, resp);
         free(resp);
@@ -112 +135 @@
  *      =pam_set_item
  *      !PAM_SYMBOL_ERR
+ *      PAM_TRY_AGAIN
  */
 
@@ -134 +158 @@
  * default prompt will be used.
  *
+ * If =item is set to =PAM_AUTHTOK and there is a non-null =PAM_OLDAUTHTOK
+ * item, =pam_get_authtok will ask the user to confirm the new token by
+ * retyping it.  If there is a mismatch, =pam_get_authtok will return
+ * =PAM_TRY_AGAIN.
+ *
  * >pam_get_item
  * >pam_get_user