Updating cmd_euid() to use the CtdlForEachMessage() API fixes the security check...

[citadel.git] / citadel / msgbase.c

diff --git a/citadel/msgbase.c b/citadel/msgbase.c
index 5e10471eb4024dc8d65127887aa1015b9ee90203..7f337d3ab0c3b04e98aaa7f9e2d2fdf85edc9031 100644 (file)
--- a/citadel/msgbase.c
+++ b/citadel/msgbase.c
@@ -654,7 +654,6 @@ int CtdlForEachMessage(int mode, long ref, char *search_string,
        
                CC->cached_msglist = msglist;
                CC->cached_num_msgs = num_msgs;
-               syslog(LOG_DEBUG, "\033[34m RELOAD \033[0m\n");
        }
 
        /*
@@ -1560,10 +1559,21 @@ int check_cached_msglist(long msgnum) {
        if (CC->cached_num_msgs == 0) return om_access_denied;          /* nothing to check */
 
 
-       /* FIXME FIXME SLOW SEARCH DO NOT LET THIS GO INTO PRODUCTION */
-       int i;
-       for (i=0; i < CC->cached_num_msgs ; ++i) {
-               if (CC->cached_msglist[i] == msgnum) return om_ok;
+       /* Do a binary search within the cached_msglist for the requested msgnum */
+       int min = 0;
+       int max = (CC->cached_num_msgs - 1);
+
+       while (max >= min) {
+               int middle = min + (max-min) / 2 ;
+               if (msgnum == CC->cached_msglist[middle]) {
+                       return om_ok;
+               }
+               if (msgnum > CC->cached_msglist[middle]) {
+                       min = middle + 1;
+               }
+               else {
+                       max = middle - 1;
+               }
        }
 
        return om_access_denied;
@@ -1621,13 +1631,25 @@ int CtdlOutputMsg(long msg_num,         /* message number (local) to fetch */
        }
 
        r = check_cached_msglist(msg_num);
-       if (r == om_ok) {
-               syslog(LOG_DEBUG, "\033[32m PASS \033[0m\n");
-       }
-       else {
-               syslog(LOG_DEBUG, "\033[31m FAIL \033[0m\n");
+       if (r != om_ok) {
+               syslog(LOG_DEBUG, "\033[31m SECURITY CHECK FAIL \033[0m\n");
+/*
+ * FIXME enable this section when the security check yields no false positives
+ *
+               if (do_proto) {
+                       if (r == om_access_denied) {
+                               cprintf("%d Message %ld was not found in this room.\n",
+                                       ERROR + MESSAGE_NOT_FOUND,
+                                       msg_num
+                               );
+                       }
+                       else {
+                               cprintf("%d An unknown error has occurred.\n", ERROR);
+                       }
+               return(r);
+               }
+*/
        }
-       /* FIXME after testing, this is where we deny access */
 
        /*
         * Fetch the message from disk.  If we're in HEADERS_FAST mode,