From: Matteo Nastasi Date: Wed, 7 Oct 2026 07:23:08 +0000 (+0200) Subject: stop sending the alarm password back on a failed admin check X-Git-Url: https://mop.ddnsfree.com/gitweb/?a=commitdiff_plain;h=90e6e2717e92bc5cfd2badea23be2ec02224b8be;p=brisk.git stop sending the alarm password back on a failed admin check When the userauth command of the control channel got a wrong hash, the reply carried the hash received and the string it should have been made from: G_alarm_passwd, the ip and the session of the admin, in clear, to whoever had reached the channel. G_alarm_passwd is also the password of admin.php and the key of the mail verification hashes. The reply is now a bare "authentication failed". The failure goes to the daemon log instead, with the name and the ip of the admin and without the session, which is a credential too. The hashes are compared with hash_equals rather than !=, which stops at the first differing byte. Checked by calling direct_command() on a Sac_a_push built without its constructor and a fake app: the right hash still answers 200, a wrong one 404 with nothing of the secret in the reply, where the previous code returned it whole. Co-Authored-By: Claude Opus 5.5 (1M context) --- diff --git a/web/Obj/sac-a-push.phh b/web/Obj/sac-a-push.phh index acf95a3..09d5fc1 100644 --- a/web/Obj/sac-a-push.phh +++ b/web/Obj/sac-a-push.phh @@ -1473,8 +1473,17 @@ class Sac_a_push { if (($user->flags & USER_FLAG_TY_ADMIN) == 0x00) return cmd_return(403, 'permission denied'); - if (md5($G_alarm_passwd.$user->ip.$user->sess) != $cmd['private']) - return cmd_return(404, 'authentication failed ['.$cmd['private'].']['.$G_alarm_passwd.$user->ip.$user->sess.']'); + /* The reply goes back to whoever reached the control channel: + it must not carry G_alarm_passwd, which is also the password + of admin.php and the key of the mail verification hashes. + The failure goes to the log instead, without the session, + which is a credential too. hash_equals: a != stops at the + first differing byte. */ + if (!hash_equals(md5($G_alarm_passwd.$user->ip.$user->sess), (string)$cmd['private'])) { + fprintf(STDERR, "DIRECT: userauth failed for admin [%s] from [%s]\n", + $user->name, $user->ip); + return cmd_return(404, 'authentication failed'); + } return cmd_return(200, 'success'); }