From 7676330a5ceaba2feb795c5e61ffa6488e01e3a0 Mon Sep 17 00:00:00 2001 From: Michal Fox Date: Fri, 25 Sep 2026 10:05:55 +0200 Subject: [PATCH] fix #8053: auth: accept "0" as password for pam and pve realms Both plugins rejected the password with a plain boolean check, and in Perl the string "0" is false. So a user whose password is "0" could never log in, getting a generic authentication failure. Only reject undefined or empty passwords. Signed-off-by: Michal Fox --- src/PVE/Auth/PAM.pm | 2 +- src/PVE/Auth/PVE.pm | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/PVE/Auth/PAM.pm b/src/PVE/Auth/PAM.pm index 8586da5..11750c5 100644 --- a/src/PVE/Auth/PAM.pm +++ b/src/PVE/Auth/PAM.pm @@ -25,7 +25,7 @@ sub authenticate_user { my ($class, $config, $realm, $username, $password) = @_; # user (www-data) need to be able to read /etc/passwd /etc/shadow - die "no password\n" if !$password; + die "no password\n" if !defined($password) || $password eq ''; # PAM modules may temporarily override $SIG{CHLD}, causing SIGCHLDs from # RESTEnvironment workers to be lost. Running the PAM interaction in a fork diff --git a/src/PVE/Auth/PVE.pm b/src/PVE/Auth/PVE.pm index ab439a8..ca0fae7 100644 --- a/src/PVE/Auth/PVE.pm +++ b/src/PVE/Auth/PVE.pm @@ -73,7 +73,7 @@ sub options { sub authenticate_user { my ($class, $config, $realm, $username, $password) = @_; - die "no password\n" if !$password; + die "no password\n" if !defined($password) || $password eq ''; my $shadow_cfg = cfs_read_file($shadowconfigfile);