ejabberdsql2prosody: Don't print password of imported accounts (thanks azerttyu)

[prosody.git] / util / sasl / plain.lua

diff --git a/util/sasl/plain.lua b/util/sasl/plain.lua
index 5c7ff68a770426ff01cead1c091963499ebcaf07..ae5c777a77423f466ecd5977f696e0f9bec7e313 100644 (file)
--- a/util/sasl/plain.lua
+++ b/util/sasl/plain.lua
@@ -17,25 +17,26 @@ local log = require "util.logger".init("sasl");
 
 module "plain"
 
---=========================
---SASL PLAIN according to RFC 4616
+-- ================================
+-- SASL PLAIN according to RFC 4616
 local function plain(self, message)
-       local response = message
-       local authorization = s_match(response, "([^%z]+)")
-       local authentication = s_match(response, "%z([^%z]+)%z")
-       local password = s_match(response, "%z[^%z]+%z([^%z]+)")
+       if not message then
+               return "failure", "malformed-request";
+       end
+
+       local authorization, authentication, password = s_match(message, "^([^%z]*)%z([^%z]+)%z([^%z]+)");
 
-       if authentication == nil or password == nil then
+       if not authorization then
                return "failure", "malformed-request";
        end
-       
+
        -- SASLprep password and authentication
        authentication = saslprep(authentication);
        password = saslprep(password);
-       
+
        if (not password) or (password == "") or (not authentication) or (authentication == "") then
                log("debug", "Username or password violates SASLprep.");
-               return "failure", "malformed-request";
+               return "failure", "malformed-request", "Invalid username or password.";
        end
 
        local correct, state = false, false;
@@ -55,7 +56,7 @@ local function plain(self, message)
        if correct then
                return "success";
        else
-               return "failure", "not-authorized";
+               return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent.";
        end
 end
 
@@ -63,4 +64,4 @@ function init(registerMechanism)
        registerMechanism("PLAIN", {"plain", "plain_test"}, plain);
 end
 
-return _M;
\ No newline at end of file
+return _M;