root/trunk/freewrt/package/busybox/patches/310-passwd_access.patch

busybox-1.4.2/networking/httpd.c

@@ -1404 +1404 @@
-                        if (ENABLE_FEATURE_HTTPD_AUTH_MD5) {
-                                char *cipher;
-                                char *pp;
+                                char *ppnew = NULL;
+                                struct passwd * pwd = NULL;
-
-                                if (strncmp(p, request, u-request) != 0) {
-                                        /* user uncompared */
@@ -1410 +1412 @@
-                                        continue;
-                                }
-                                pp = strchr(p, ':');
+                                if(pp && pp[1] == '$' && pp[2] == 'p' &&
+                                                         pp[3] == '$' && pp[4] &&
+                                                         (pwd = getpwnam(&pp[4])) != NULL) {
+                                        if(pwd->pw_passwd && pwd->pw_passwd[0] == '!') {
+                                                prev = NULL;
+                                                continue;
+                                        }
+                                        ppnew = malloc(5 + strlen(pwd->pw_passwd));
+                                        ppnew[0] = ':';
+                                        strcpy(ppnew + 1, pwd->pw_passwd);
+                                        pp = ppnew;
+                                }
-                                if (pp && pp[1] == '$' && pp[2] == '1' &&
-                                                pp[3] == '$' && pp[4]) {
-                                        pp++;
@@ -1418 +1432 @@
-                                                goto set_remoteuser_var;   /* Ok */
-                                        /* unauthorized */
-                                        continue;
+                                }
+                                if (ppnew) {
+                                        free(ppnew);
+                                        ppnew = NULL;
-                                }
-                        }
-