totp-cgi
totp-cgi copied to clipboard
Username comparison in freeradius totpcgi-handler.pl
On line 174, there is: ($mesg->entry(0)->get_value($$config{'userAttribute'}) == $RAD_REQUEST{'User-Name'})
I think this should be ($mesg->entry(0)->get_value($$config{'userAttribute'}) eq $RAD_REQUEST{'User-Name'})
Because otherwise it is doing a conversion to a numeric type, and comparing that, which for most usernames will not make sense.
I only discovered this because I had a username of nancy, which was converting to NaN, for which equality breaks, and would not let them log in.