From 3938f49ec1ef176966d43fece3a3fc3a5abbb4fc Mon Sep 17 00:00:00 2001
From: bwarsaw
Date: Thu, 16 Aug 2001 06:35:04 +0000
Subject: MakeCookie(): If the secret isn't a string, raise MMBadUserError.

__checkone(): Likewise, if the secret isn't a string, return 0
    (i.e. no the user isn't authenticated).
---
 Mailman/SecurityManager.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Mailman/SecurityManager.py b/Mailman/SecurityManager.py
index f2fe8f04e..f1d34bca9 100644
--- a/Mailman/SecurityManager.py
+++ b/Mailman/SecurityManager.py
@@ -208,7 +208,7 @@ class SecurityManager:
 
     def MakeCookie(self, authcontext, user=None):
         key, secret = self.AuthContextInfo(authcontext, user)
-        if key is None or secret is None:
+        if key is None or secret is None or not isinstance(secret, StringType):
             raise Errors.MMBadUserError
         # Timestamp
         issued = int(time.time())
@@ -283,7 +283,7 @@ class SecurityManager:
         # Do the guts of the cookie check, for one authcontext/user
         # combination.
         key, secret = self.AuthContextInfo(authcontext, user)
-        if not c.has_key(key):
+        if not c.has_key(key) or not isinstance(secret, StringType):
             return 0
         # Undo the encoding we performed in MakeCookie() above
         try:
-- 
cgit v1.3.1