mirror of
https://github.com/go-gitea/gitea
synced 2024-11-14 14:14:25 +00:00
3e5c844a77
Backport #19040 The PAM module has previously only checked the results of the authentication module. However, in normal PAM practice most users will expect account module authorization to also be checked. Without doing this check in almost every configuration expired accounts and accounts with expired passwords will still be able to login. This is likely to represent a significant gotcha in most configurations and cause most users configurations to be potentially insecure. Therefore we should add in the account authorization check. ## ⚠️ **BREAKING** ⚠️ Users of the PAM module who rely on account modules not being checked will need to change their PAM configuration. However, as it is likely that the vast majority of users of PAM will be expecting account authorization to be checked in addition to authentication we should make this breaking change to make the default behaviour correct for the majority. --- I suggest we backport this despite the BREAKING nature because of the surprising nature of this. Thanks to @ysf for bringing this to our attention. Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: ysf <34326+ysf@users.noreply.github.com>
47 lines
1023 B
Go
47 lines
1023 B
Go
// Copyright 2014 The Gogs Authors. All rights reserved.
|
|
// Use of this source code is governed by a MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
//go:build pam
|
|
// +build pam
|
|
|
|
package pam
|
|
|
|
import (
|
|
"errors"
|
|
|
|
"github.com/msteinert/pam"
|
|
)
|
|
|
|
// Supported is true when built with PAM
|
|
var Supported = true
|
|
|
|
// Auth pam auth service
|
|
func Auth(serviceName, userName, passwd string) (string, error) {
|
|
t, err := pam.StartFunc(serviceName, userName, func(s pam.Style, msg string) (string, error) {
|
|
switch s {
|
|
case pam.PromptEchoOff:
|
|
return passwd, nil
|
|
case pam.PromptEchoOn, pam.ErrorMsg, pam.TextInfo:
|
|
return "", nil
|
|
}
|
|
return "", errors.New("Unrecognized PAM message style")
|
|
})
|
|
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
if err = t.Authenticate(0); err != nil {
|
|
return "", err
|
|
}
|
|
|
|
if err = t.AcctMgmt(0); err != nil {
|
|
return "", err
|
|
}
|
|
|
|
// PAM login names might suffer transformations in the PAM stack.
|
|
// We should take whatever the PAM stack returns for it.
|
|
return t.GetItem(pam.User)
|
|
}
|