use password_ok() instead of calling crypt()

diff --git a/source/cgi.c b/source/cgi.c
index 2008f9a8d36581c0e272536c9d6004488a651a18..6468c92917e82c8f917daf2655c25e9c1bd2e8b2 100644 (file)
--- a/source/cgi.c
+++ b/source/cgi.c
@@ -459,8 +459,6 @@ handle a http authentication line
 static int cgi_handle_authorization(char *line)
 {
        char *p, *user, *pass;
-       struct passwd *pwd;
-       int ret=0;
 
        if (strncasecmp(line,"Basic ", 6)) {
                cgi_setup_error("401 Bad Authorization", "", 
@@ -478,20 +476,13 @@ static int cgi_handle_authorization(char *line)
        pass = p+1;
 
        /* currently only allow connections as root */
-       if (strcasecmp(user,"root")) {
+       if (strcmp(user,"root")) {
                cgi_setup_error("401 Bad Authorization", "", 
                                "incorrect username/password");
        }
-       
-       pwd = getpwnam(user);
-
-       if (!strcmp((char *)crypt(pass, pwd->pw_passwd),pwd->pw_passwd)) {
-               ret = 1;
-       }
 
-       memset(pass, 0, strlen(pass));
 
-       return ret;
+       return password_ok(user, pass, strlen(pass), NULL);
 }
 
 

diff --git a/source/web/cgi.c b/source/web/cgi.c
index 2008f9a8d36581c0e272536c9d6004488a651a18..6468c92917e82c8f917daf2655c25e9c1bd2e8b2 100644 (file)
--- a/source/web/cgi.c
+++ b/source/web/cgi.c
@@ -459,8 +459,6 @@ handle a http authentication line
 static int cgi_handle_authorization(char *line)
 {
        char *p, *user, *pass;
-       struct passwd *pwd;
-       int ret=0;
 
        if (strncasecmp(line,"Basic ", 6)) {
                cgi_setup_error("401 Bad Authorization", "", 
@@ -478,20 +476,13 @@ static int cgi_handle_authorization(char *line)
        pass = p+1;
 
        /* currently only allow connections as root */
-       if (strcasecmp(user,"root")) {
+       if (strcmp(user,"root")) {
                cgi_setup_error("401 Bad Authorization", "", 
                                "incorrect username/password");
        }
-       
-       pwd = getpwnam(user);
-
-       if (!strcmp((char *)crypt(pass, pwd->pw_passwd),pwd->pw_passwd)) {
-               ret = 1;
-       }
 
-       memset(pass, 0, strlen(pass));
 
-       return ret;
+       return password_ok(user, pass, strlen(pass), NULL);
 }