totp-cgi icon indicating copy to clipboard operation
totp-cgi copied to clipboard

Username comparison in freeradius totpcgi-handler.pl

Open Selelvian opened this issue 7 years ago • 0 comments

On line 174, there is: ($mesg->entry(0)->get_value($$config{'userAttribute'}) == $RAD_REQUEST{'User-Name'})

I think this should be ($mesg->entry(0)->get_value($$config{'userAttribute'}) eq $RAD_REQUEST{'User-Name'})

Because otherwise it is doing a conversion to a numeric type, and comparing that, which for most usernames will not make sense.

I only discovered this because I had a username of nancy, which was converting to NaN, for which equality breaks, and would not let them log in.

Selelvian avatar Mar 23 '17 00:03 Selelvian