[hackers] [ubase] [PATCH 2/2] pw_check: Allow empty password in shadow(5)

[Michael Forney]

---
 libutil/passwd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/libutil/passwd.c b/libutil/passwd.c
index c1233a1..3171fd5 100644
--- a/libutil/passwd.c
+++ b/libutil/passwd.c
@@ -23,12 +23,6 @@ pw_check(const struct passwd *pw, const char *pass)
        struct spwd *spw;
 
        p = pw->pw_passwd;
-       if (p[0] == '\0') {
-               if (pass[0] == '\0')
-                       return 1;
-               weprintf("incorrect password\n");
-               return 0;
-       }
        if (p[0] == 'x' && p[1] == '\0') {
                errno = 0;
                spw = getspnam(pw->pw_name);
@@ -45,6 +39,12 @@ pw_check(const struct passwd *pw, const char *pass)
                weprintf("denied\n");
                return -1;
        }
+       if (p[0] == '\0') {
+               if (pass[0] == '\0')
+                       return 1;
+               weprintf("incorrect password\n");
+               return 0;
+       }
 
        cryptpass = crypt(pass, p);
        if (!cryptpass) {
-- 
2.20.1