From cdeca37ec3fe0a0978b949f80b916f408568daa7 Mon Sep 17 00:00:00 2001 From: Ed Kellett Date: Thu, 2 Jan 2020 15:49:15 +0000 Subject: [PATCH] sasl_usercloak: make the magic string more specific Require '/account' at the end of the spoof, rather than 'account' anywhere. --- extensions/sasl_usercloak.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/extensions/sasl_usercloak.c b/extensions/sasl_usercloak.c index 26e4f52f..bce1c722 100644 --- a/extensions/sasl_usercloak.c +++ b/extensions/sasl_usercloak.c @@ -46,10 +46,12 @@ check_new_user(void *vdata) if (EmptyString(source_p->user->suser)) return; - char *accountpart = strstr(source_p->orighost, "account"); - if (!accountpart) + char *accountpart = strstr(source_p->orighost, "/account"); + if (!accountpart || accountpart[8] != '\0') return; + accountpart += 1; + char buf[HOSTLEN]; memset(buf, 0, sizeof(buf)); char *dst = buf;