Subject: Bug in authentication in nnrpd
To: rsalz@uunet.uu.net
Date: Thu, 1 Jun 1995 23:38:31 +0200 (MET DST)
X-Mailer: ELM [version 2.4 PL20]
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Content-Length: 1702      

Hello Rich,

I have the following entry in nnrp.access:

pilhuhn.de:R P:::*,!pilhuhn.foo

So I'm neither allowed to read nor to post to pilhuhn.foo

But:

pilhuhn!213> !!
telnet snert nntp
Trying 193.141.89.2... Connected to snert.pilhuhn.de.
Escape character is '^]'.
200 snert InterNetNews NNRP server INN 1.4 22-Dec-93 ready (posting
ok).
group pilhuhn.foo
411 No such group
post
340 Ok
Newsgroups: pilhuhn.foo
From: hwr@pilhuhn.de
Subject: Test

gaga
.
240 Article posted


So the article gets successfully posted to pilhuhn.foo even if it
shouldn't. 

The following diff cures this (I don't know if this is the best place
to do, but it works ..):

*** post.c,1    Fri Jan 29 17:51:50 1993
--- post.c      Thu Jun  1 23:36:12 1995
***************
*** 549,554 ****
--- 549,555 ----
      register GROUPENTRY       *gp;
      register BOOL     approved;
      struct _DDHANDLE  *h;
+     char      *grplist[2];
      BOOL              IsNewgroup;
      BOOL              FoundOne;
  
***************
*** 596,601 ****
--- 597,609 ----
                    "The newsgroup \"%s\" has been renamed to \"%s\".\n",
                    p, gp->Alias);
            break;
+       }
+       if (PERMspecified) {
+         grplist[0] = p;
+         grplist[1] = NULL;
+         if (!PERMmatch(PERMdefault, PERMlist, grplist)) {
+             sprintf(Error,"%s: %s\r\n", NNTP_NOSUCHGROUP,p);
+         }
        }
      } while ((p = strtok((char *)NULL, NGSEPS)) != NULL);
      DISPOSE(groups);

- Heiko

-- 
Heiko W.Rupp        Gerwigstr.5        D-76131  Karlsruhe    +49 721 9661521
Two signs from a Majorcan shop entrance:
                - English well talking.
                - Here speeching American.