Home » Networking » Net_POP3 » Bug #2175

[2004-08-20 12:15 UTC] kmizuno9999 at yahoo dot co dot jp

Description:
------------
The login() method which uses DIGEST-MD5 regardless of server response returns true.
This situation is caused when the client sends invalid user or password.
The version number is 1.3.2

When mailserver returned "ERR" response, the method should return "false".

in _authDigest_MD5()
------------------------------------------------------------ if ( PEAR::isError($error = $this->_send( $auth_str ) ) ) {
return $error;
}

/**** here ****/
if ( PEAR::isError( $challenge = $this->_recvLn() ) ) { <-- it doesn't check server response.
/**** here ****/
return $challenge;
}

/*
* We don't use the protocol's third step because POP3 doesn't allow
* subsequent authentication, so we just silently ignore it.
*/

if ( PEAR::isError( $challenge = $this->_send("\r\n") ) ) {
return $challenge ;
}

/**** here ****/
if ( PEAR::isError( $challenge = $this->_recvLn() ) ) { <-- it doesn't check server response.
/**** here ****/
return $challenge;
}

return true;
------------------------------------------------------------