Bug #2646

APOP attempted when not supported

Details

Submitted	2004-10-29 17:14 UTC
From	osdave at nospam_davepar dot com
Assigned	damian
Status	Closed
Package	Net_POP3
PHP Version	4.3.5
OS	linux
Roadmaps	(Not assigned)

Comments

[2004-10-29 17:14 UTC] osdave at nospam_davepar dot com

Description:
------------
My server doesn't report any auth methods in the capabilities, so the POP package attempts to use APOP, which it also doesn't support.

S:+OK Hello there.
C: CAPA
S:+OK Here's what I can do:
S:TOP
S:USER
S:LOGIN-DELAY 10
S:PIPELINING
S:UIDL
S:IMPLEMENTATION Courier Mail Server

S:.

POP package tries to use APOP at this point, but the timestamp isn't set. It then returns "Not In NET_POP3_STATE_AUTHORISATION State1"

I made a fix for _getBestAuthMethod:

if( isset($this->_capability['sasl']) ){
$serverMethods=$this->_capability['sasl'];
}else{
$serverMethods=array('USER');
// Check for timestamp before attempting APOP
if ($this->_timestamp != null)
{
$serverMethods[] = 'APOP';
}
}

[2004-10-29 17:28 UTC] osdave at nospam_davepar dot com

I found another related problem. The logic in _cmdAuthenticate is not falling back to USER correctly when APOP fails. It's checking for a false return code from _cmdApop, but that function now returns a PEAR error when it fails.