From cdebfd3892af178dfeaddc5c0ddd284753905ba0 Mon Sep 17 00:00:00 2001 From: Sergei Golubchik Date: Wed, 2 Jun 2010 17:53:12 +0200 Subject: handle a case when a user connects with a password to a passwordless account --- sql/sql_acl.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'sql/sql_acl.cc') diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc index 55e31b18e7f..db20782037e 100644 --- a/sql/sql_acl.cc +++ b/sql/sql_acl.cc @@ -8217,7 +8217,8 @@ static int native_password_authenticate(MYSQL_PLUGIN_VIO *vio, info->password_used = 1; if (pkt_len == SCRAMBLE_LENGTH) - return check_scramble(pkt, thd->scramble, mpvio->acl_user->salt) ? + return info->auth_string[0] == 0 || + check_scramble(pkt, thd->scramble, mpvio->acl_user->salt) ? CR_ERROR : CR_OK; inc_host_errors(&mpvio->thd->net.vio->remote.sin_addr); @@ -8268,7 +8269,8 @@ static int old_password_authenticate(MYSQL_PLUGIN_VIO *vio, info->password_used = 1; if (pkt_len == SCRAMBLE_LENGTH_323) - return check_scramble_323(pkt, thd->scramble, + return info->auth_string[0] == 0 || + check_scramble_323(pkt, thd->scramble, (ulong *)mpvio->acl_user->salt) ? CR_ERROR : CR_OK; inc_host_errors(&mpvio->thd->net.vio->remote.sin_addr); -- cgit v1.2.1