* refuse empty passvoids against host auth

[citadel.git] / citadel / user_ops.c

diff --git a/citadel/user_ops.c b/citadel/user_ops.c
index 10fcb3f47d1fc605cf9e07674734e8354679bc52..7f84fa21eadb893c5bbd51cfe5bc6b8533616702 100644 (file)
--- a/citadel/user_ops.c
+++ b/citadel/user_ops.c
@@ -625,6 +625,11 @@ static int validpw(uid_t uid, const char *pass)
 {
        char buf[256];
 
+       if (IsEmptyStr(pass)) {
+               lprintf(CTDL_DEBUG, "refusing to check empty password for uid=%d using chkpwd...\n", uid);
+               return 0;
+       }
+
        lprintf(CTDL_DEBUG, "Validating password for uid=%d using chkpwd...\n", uid);
 
        begin_critical_section(S_CHKPWD);