On 2002-03-25 at 22:58 -0700, Dan Egli wrote:
> server_condition = "${if crypteq{$2} \
> {${lookup mysql{SELECT passwd \
> FROM users \
> WHERE AuthMail = "Y" and
> userID='${local_part:$1}'}}}{1}{0}}"
On a separate note ... since the base64 encoded strings separate the
parameters with NULLs, someone talking to your server can supply fairly
arbitrary data for authentication. The question is, how much is
stripped off by ${local_part: ?
What happens if someone with an account not authorised for mail supplies
$1 as something like:
BadUser' or AuthMail = 'N
? Perhaps there's no way to escape something similar past ${local_part:
but then who knows? SQL is complex, I suck at it.
Hrm: SELECT passwd FROM users WHERE \
AuthMail = "Y" and userID = 'BadUser' or AuthMail = 'N'
userID='${quote_mysql:${local_part:$1}}'
Always quote external data if you're going to be putting it into a
construct which something else then needs to parse out again. Always.
--
Legislation needs a better reason than that lawyers like it,
and that America does it. -- Lawrence Lessig
