From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55008) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wn4AJ-0005wW-V7 for qemu-devel@nongnu.org; Wed, 21 May 2014 06:54:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Wn4AD-0005dr-JW for qemu-devel@nongnu.org; Wed, 21 May 2014 06:54:31 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37176) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wn4AD-0005dj-9p for qemu-devel@nongnu.org; Wed, 21 May 2014 06:54:25 -0400 From: Gerd Hoffmann Date: Wed, 21 May 2014 12:54:21 +0200 Message-Id: <1400669661-18353-1-git-send-email-kraxel@redhat.com> Subject: [Qemu-devel] [PATCH] vnc: refuse to set a password with VNC_AUTH_NONE List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Anthony Liguori Current code silently changes the authentication settings in case you try to set a password without password authentication turned on. This is bad. Return an error instead. If we want allow changing auth settings at runtime this should be done explicitly using a separate monitor command, not as side effect of set_passwd. Signed-off-by: Gerd Hoffmann --- ui/vnc.c | 34 ++++++---------------------------- 1 file changed, 6 insertions(+), 28 deletions(-) diff --git a/ui/vnc.c b/ui/vnc.c index 2d7def9..64aa2fa 100644 --- a/ui/vnc.c +++ b/ui/vnc.c @@ -2976,26 +2976,6 @@ static void vnc_display_close(DisplayState *ds) #endif } -static int vnc_display_disable_login(DisplayState *ds) -{ - VncDisplay *vs = vnc_display; - - if (!vs) { - return -1; - } - - if (vs->password) { - g_free(vs->password); - } - - vs->password = NULL; - if (vs->auth == VNC_AUTH_NONE) { - vs->auth = VNC_AUTH_VNC; - } - - return 0; -} - int vnc_display_password(DisplayState *ds, const char *password) { VncDisplay *vs = vnc_display; @@ -3003,20 +2983,18 @@ int vnc_display_password(DisplayState *ds, const char *password) if (!vs) { return -EINVAL; } - - if (!password) { - /* This is not the intention of this interface but err on the side - of being safe */ - return vnc_display_disable_login(ds); + if (vs->auth == VNC_AUTH_NONE) { + error_printf_unless_qmp("If you want use passwords please enable " + "password auth using '-vnc ${dpy},password'."); + return -EINVAL; } if (vs->password) { g_free(vs->password); vs->password = NULL; } - vs->password = g_strdup(password); - if (vs->auth == VNC_AUTH_NONE) { - vs->auth = VNC_AUTH_VNC; + if (password) { + vs->password = g_strdup(password); } return 0; -- 1.8.3.1