Authenticate(): When sha hex digesting the response, save the results

in a temporary variable and check that variable against the secret
(this is so that subsequent checks have the raw password).

1 files changed, 4 insertions, 2 deletions

diff --git a/Mailman/SecurityManager.py b/Mailman/SecurityManager.py
index 7104f75a7..5745ef7a3 100644
--- a/Mailman/SecurityManager.py
+++ b/Mailman/SecurityManager.py
@@ -141,10 +141,12 @@ class SecurityManager:
                 # response being passed in is plain text, so we need to
                 # digestify it first.
                 if ac in (mm_cfg.AuthListAdmin, mm_cfg.AuthListModerator):
-                    response = sha.new(response).hexdigest()
+                    chkresponse = sha.new(response).hexdigest()
+                else:
+                    chkresponse = response
 
                 key, secret = self.AuthContextInfo(ac, user)
-                if secret is not None and response == secret:
+                if secret is not None and chkresponse == secret:
                     return ac
         return mm_cfg.UnAuthorized