[vchkpw] vpopmail 5.4.16 released (finally)

[Tom Collins]

5.4.16 - released 7-May-06
http://vpopmail.sf.net/

Release Notes:

More fixes to 5.4.14/5.4.15, hopefully leading to a useable, stable  
release

incorporating vpopmaild from the 5.5 branch.

There is an important security fix in this release, related to cleartext
passwords.  If cleartext passwords are enabled, and an account doesn't
have a cleartext password set, it is possible to authenticate with
SMTP AUTH and/or APOP methods using a blank password.

Once anonymous CVS is updated (after May 8), this link should show the
changes made to vchkpw.c:

http://cvs.sourceforge.net/viewcvs.py/vpopmail/vpopmail/vchkpw.c? 
r1=1.11.2.4r2=1.11.2.5diff_format=u


ChangeLog

Michael Krieger
- vpalias: Properly handle some empty search results.

Ken Jones
- vpalias: wasn't allocating enough memory for alias name in
  valias_select_names (missing one byte for NULL).

Jianbin Xiao
- vmysql: reconnect to server if connection was dropped.

Rick Widmer
- vpgsql: fix queries to allow domains starting with digits.

John Simpson
- vpgsql: fix compile errors introduced in 5.4.14.
- vdominfo: undo change from 5.4.14 that displayed alias domains
  incorrectly.

Toshihiko Kyoda
- vdelivermail: check for over quota when creating temp mail file.

Tom Collins
- vpalias: Fix double-free in code ported from 5.5 branch.
- valias: exit non-zero on error, send all errors to stderr.
- vchkpw: make sure we have cleartext pass before checking SMTP_AUTH
  or APOP logins.
- Remove vactivedir code since it's just a client for a non-existent
  server.

[vchkpw] problem overriding qmailadmin limits at authentication?

[Michael Krieger]

Interesting problem..qmailadmin-limits is my default that has disable_imap set for the domain. Naturally that should make new accounts have that limit.Sadly though, I want some people to use imap. So I clear the flags (-x) with vmoduser, but the disable_imap still holds true, rejecting the login.I don't recall it working that way before. Is this something new?-M

Re: [vchkpw] problem overriding qmailadmin limits at authentication?

[Tom Collins]

On May 7, 2006, at 8:17 PM, Michael Krieger wrote:

Interesting problem.

.qmailadmin-limits is my default that has disable_imap set for the 
domain.  Naturally that should make new accounts have that limit.


Sadly though, I want some people to use imap.  So I clear the flags 
(-x) with vmoduser, but the disable_imap still holds true, rejecting 
the login.


I don't recall it working that way before.  Is this something new?


The limits file applies to every user in the domain -- it's not a 
template used when creating new accounts.


If you want some people to use imap, you have to use the -o flag (user 
is not subject to domain limits).


--
Tom Collins  -  [EMAIL PROTECTED]
QmailAdmin: http://qmailadmin.sf.net/  Vpopmail: http://vpopmail.sf.net/