* NEWS, src/login.c: Also check if the authentication token of the

	user has to be updated in case the user was already authenticated.

diff --git a/ChangeLog b/ChangeLog
index 0098d65c297f3091e425645ab940e46af1ec27ea..e2c1d6fcb3f463e7bb53d8c86a38fde69d0936ed 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2009-04-19  Nicolas François  <nicolas.francois@centraliens.net>
+
+       * NEWS, src/login.c: Also check if the authentication token of the
+       user has to be updated in case the user was already authenticated.
+
 2009-04-19  Nicolas François  <nicolas.francois@centraliens.net>
 
        * src/login.c: fflg is already restricted to root. Move

diff --git a/NEWS b/NEWS
index 39aa7f0c58a90ce06fc13aa3edad82f2198699f8..49525c5474f6c84895651675fb0183da7334a12c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ shadow-4.1.3.1 -> shadow-4.1.3.2                                        UNRELEASED
 - login
   * Do not trust the current utmp entry's ut_line to set PAM_TTY. This could
     lead to DOS attacks.
+  * (PAM) Even if the user was already authenticated (-f flag), ask the
+    user to update his authentication token if needed.
 
 shadow-4.1.3 -> shadow-4.1.3.1                                         2009-04-15
 

diff --git a/src/login.c b/src/login.c
index 4d60bc3d7235c1193ead2a74e7ae50d7d9a68f80..30f6aab25837ae0f81ede4d0d6ab95f1a8967b69 100644 (file)
--- a/src/login.c
+++ b/src/login.c
@@ -811,17 +811,14 @@ int main (int argc, char **argv)
 
                /* We don't get here unless they were authenticated above */
                alarm (0);
-               retcode = pam_acct_mgmt (pamh, 0);
-
-               if (retcode == PAM_NEW_AUTHTOK_REQD) {
-                       retcode = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
-               }
+       }
 
-               PAM_FAIL_CHECK;
-       } else (fflg) {
-               retcode = pam_acct_mgmt (pamh, 0);
-               PAM_FAIL_CHECK;
+       /* Check the account validity */
+       retcode = pam_acct_mgmt (pamh, 0);
+       if (retcode == PAM_NEW_AUTHTOK_REQD) {
+               retcode = pam_chauthtok (pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
        }
+       PAM_FAIL_CHECK;
 
        /* Grab the user information out of the password file for future usage
           First get the username that we are actually using, though.