ejabberdsql2prosody: Don't print password of imported accounts (thanks azerttyu)

[prosody.git] / util / sasl / digest-md5.lua

diff --git a/util/sasl/digest-md5.lua b/util/sasl/digest-md5.lua
index f8e0e393fdabd9e1474e4a7aaa3de445eb1f5126..5b8f5c8a6ab4f6b28a73caee6f0981a79fb94964 100644 (file)
--- a/util/sasl/digest-md5.lua
+++ b/util/sasl/digest-md5.lua
@@ -28,10 +28,6 @@ module "digest-md5"
 
 --=========================
 --SASL DIGEST-MD5 according to RFC 2831
-local function digest_response()
-       
-       return response, A1, A2
-end
 
 local function digest(self, message)
        --TODO complete support for authzid
@@ -170,13 +166,14 @@ local function digest(self, message)
 
                --TODO maybe realm support
                self.username = response["username"];
+               local Y, state;
                if self.profile.plain then
                        local password, state = self.profile.plain(response["username"], self.realm)
                        if state == nil then return "failure", "not-authorized"
                        elseif state == false then return "failure", "account-disabled" end
                        Y = md5(response["username"]..":"..response["realm"]..":"..password);
                elseif self.profile["digest-md5"] then
-                       local Y, state = self.profile["digest-md5"](response["username"], self.realm, response["realm"], response["charset"])
+                       Y, state = self.profile["digest-md5"](response["username"], self.realm, response["realm"], response["charset"])
                        if state == nil then return "failure", "not-authorized"
                        elseif state == false then return "failure", "account-disabled" end
                elseif self.profile["digest-md5-test"] then
@@ -215,7 +212,8 @@ local function digest(self, message)
                        KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2
                        local rspauth = md5(KD, true);
                        self.authenticated = true;
-                       return "success", serialize({rspauth = rspauth});
+                       --TODO: considering sending the rspauth in a success node for saving one roundtrip; allowed according to http://tools.ietf.org/html/draft-saintandre-rfc3920bis-09#section-7.3.6
+                       return "challenge", serialize({rspauth = rspauth});
                else
                        return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated."
                end