From 4b5470eedfb4e6515b391cd961f38ddff2a7c015 Mon Sep 17 00:00:00 2001
From: bwarsaw
Date: Thu, 31 May 2001 21:17:47 +0000
Subject: Authenticate(): When sha hex digesting the response, save the results
 in a temporary variable and check that variable against the secret (this is
 so that subsequent checks have the raw password).

---
 Mailman/SecurityManager.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Mailman/SecurityManager.py b/Mailman/SecurityManager.py
index 7104f75a7..5745ef7a3 100644
--- a/Mailman/SecurityManager.py
+++ b/Mailman/SecurityManager.py
@@ -141,10 +141,12 @@ class SecurityManager:
                 # response being passed in is plain text, so we need to
                 # digestify it first.
                 if ac in (mm_cfg.AuthListAdmin, mm_cfg.AuthListModerator):
-                    response = sha.new(response).hexdigest()
+                    chkresponse = sha.new(response).hexdigest()
+                else:
+                    chkresponse = response
 
                 key, secret = self.AuthContextInfo(ac, user)
-                if secret is not None and response == secret:
+                if secret is not None and chkresponse == secret:
                     return ac
         return mm_cfg.UnAuthorized
 
-- 
cgit v1.3.1