From c6a3d4bafc70dc9bd99b9da37c4b12a5324d4e0f Mon Sep 17 00:00:00 2001 From: brain Date: Mon, 8 Dec 2008 01:56:28 +0000 Subject: Fix silly oversight discovered by tra26 (thanks!) where the core tries to handle hash providers other than plaintext by direct string comparison, allowing someone to oper up by specifying the md5 sum of an md5 password, etc! git-svn-id: http://svn.inspircd.org/repository/trunk/inspircd@10870 e03df62e-2008-0410-955e-edbf42e46eb7 --- src/command_parse.cpp | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/command_parse.cpp b/src/command_parse.cpp index eeb4b3e9f..36b3d712c 100644 --- a/src/command_parse.cpp +++ b/src/command_parse.cpp @@ -30,11 +30,21 @@ int InspIRCd::PassCompare(Extensible* ex, const std::string &data, const std::st { int MOD_RESULT = 0; FOREACH_RESULT_I(this,I_OnPassCompare,OnPassCompare(ex, data, input, hashtype)) + + /* Module matched */ if (MOD_RESULT == 1) return 0; + + /* Module explicitly didnt match */ if (MOD_RESULT == -1) return 1; - return data != input; // this seems back to front, but returns 0 if they *match*, 1 else + + /* We dont handle any hash types except for plaintext - Thanks tra26 */ + if (hashtype != "" && hashtype != "plaintext") + /* See below. 1 because they dont match */ + return 1; + + return (data != input); // this seems back to front, but returns 0 if they *match*, 1 else } /* LoopCall is used to call a command classes handler repeatedly based on the contents of a comma seperated list. -- cgit v1.2.3