Re: [squid-users] squid_radius_auth accepts any credentials!

tis 2007-06-05 klockan 08:53 +0100 skrev Neil A. Hillard:

> I'll post here and let everyone know whether it's OK now. I'll compare
> the sources but can you summarise what needed resolving?

It was a year ago so memory is a little dim, but looking at the diffs
the specific change is these two:

    }
+
+ if (auth->id != request_id) {
+ /* Duplicate response of an earlier query, ignore */
+ return -1;
+ }
+
     /* Verify the reply digest */

[...]

     if (memcmp(reply_digest, calc_digest, AUTH_VECTOR_LEN) != 0) {
        fprintf(stderr, "Warning: Received invalid reply digest from server\n");
+ return -1;
     }

Regards
Henrik