5 ms·
If I am understanding this correctly: Any existing but disabled account (an account with no shadow hash) will be upgraded to an account with a shadowhash. Norm
by teilo 9y ago
If I am understanding this correctly:
Any existing but disabled account (an account with no shadow hash) will be upgraded to an account with a shadowhash. Normally this is fine, because it is an in-memory upgrade that allows the authentication code to run.
And then, because of a brain-dead if check, whatever password the user attempted to use is saved as the shadowhash for that account, permanently enabling the account with the password that was being tried. In this case, that means a blank password.
This allows a subsequent authentication with that same password to succeed. This accounts for the initial need to repeat the login multiple times.
- joveian 9y agoI don't think it is intended to be an in-memory upgrade but rather move the hash on disk into shadow with a new hash method. The only way to change the hash method is to create a new hash from the provided password after verifying that it matches the previous hash. The if statement seems designed to make sure that the password matches the currently stored password before doing anything, so the question is why does it not do that. Either the function returns that it does match for some reason or the return value is tested incorrectly. Currently the article doesn't say but maybe at some point the author will track that down :). Then the question is why it happened, which would be easier to speculate on knowing what precisely is wrong.