#9 0.70: Four columns in PAM auth broken (change attached)

[James Bellinger]

In pam_pgsql.c, pam_sm_acct_mgmt(pam_handle_t pamh, int flags, int argc, const char *argv), in the event that there are four columns,

                        if (PQnfields(res)>=4) {
                            char *nulltok_db = PQgetvalue(res, 0, 3);
                            rc = PAM_PERM_DENIED;
                        }

needs to be

                        if (PQnfields(res)>=4) {
                            char *nulltok_db = PQgetvalue(res, 0, 3);
                            if (!strcmp(nulltok_db, "t")) { rc = PAM_PERM_DENIED; }
                        }

The existence of four columns should not be sufficient to deny permission.

[William Grzybowski]

Well, sort of.

The query for account should return 3 columns, the first column tell us if the password is expired (account suspended), the second one if a new password should be asked and the third one if the password itself if NULL or BLANK.

But i agree with you, this code is not right, there is no point to get the four column value.