From ca7769d8b4ecc070320a727dbe307872523a0766 Mon Sep 17 00:00:00 2001 From: Adam Date: Sat, 3 Jul 2010 15:17:58 -0400 Subject: Fixed bug #1172: Encrypt the whole password given to nickserv and chanserv REGISTER This prevents us from truncating peoples passwords without telling them, which makes it so you can't identify with the same password you registered with if your password is really long. --- src/core/ns_register.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'src/core/ns_register.c') diff --git a/src/core/ns_register.c b/src/core/ns_register.c index 171315b60..9db168f9c 100644 --- a/src/core/ns_register.c +++ b/src/core/ns_register.c @@ -197,11 +197,9 @@ int do_register(User * u) } passcode[idx] = '\0'; nr = makerequest(u->nick); nr->passcode = sstrdup(passcode); - strscpy(nr->password, pass, PASSMAX); - memset(pass, 0, strlen(pass)); - /* We are paranoid about keeping a plain text pass in memory, yet we would write - * it to a database.. - Viper */ - enc_encrypt_in_place(nr->password, PASSMAX); + if (enc_encrypt(pass, strlen(pass), nr->password, PASSMAX - 1) < 0) { + alog("Failed to encrypt password for %s", nr->nick); + } if (email) { nr->email = sstrdup(email); } -- cgit