Re: [vchkpw] Bug (feature) in MySQL select

2002-10-15 Thread Ken Jones

I'm pretty sure that all the vpopmail functions validate 
user names as well as domain names.

Please see the two functions:
is_domain_valid ( char *domainname )
is_username_valid( char *username)

The both return error codes if not valid.
[root@newdevel bin]# ./vadduser "kbo @ken.com" test
user invalid kbo
Error: Illegal username

In pop conversations:
telnet localhost 110
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
+OK <[EMAIL PROTECTED]>
user postmaster  NOTE: extra space at the end of postmaster
+OK
pass foober
user invalid postmaster
-ERR authorization failed

When you say you received a mesage for with a space after
the user name. Could you be more specific in how it was 
received and all the programs that handled the email?

Ken Jones


On Tuesday 15 October 2002 03:29 pm, tonix (Antonio Nati) wrote:
> I've received a message for "user @mydomain.it", and vpopmail routine
> validating addresses has let this wrong address pass.
>
> I've found that when you make a
>  SELECT * FROM VPOPMAIL WHERE pw_name = "user "
> it's exactly like
>  SELECT * FROM VPOPMAIL WHERE pw_name = "user
>
> This is a MySQL feature.
>
> All select should be modified to use "like binary" instead of "=" in their
> string comparison.
>  I.e.
>  SELECT * FROM VPOPMAIL WHERE pw_name LIKE BINARY "user "
>  does return 0 lines.
>
> Tonino
>
>
>
> 
>  Inter@zioniInterazioni di Antonio Nati
> http://www.interazioni.it  [EMAIL PROTECTED]
> 





[vchkpw] Bug (feature) in MySQL select

2002-10-15 Thread tonix (Antonio Nati)


I've received a message for "user @mydomain.it", and vpopmail routine 
validating addresses has let this wrong address pass.

I've found that when you make a
 SELECT * FROM VPOPMAIL WHERE pw_name = "user "
it's exactly like
 SELECT * FROM VPOPMAIL WHERE pw_name = "user"

This is a MySQL feature.

All select should be modified to use "like binary" instead of "=" in their 
string comparison.
 I.e.
 SELECT * FROM VPOPMAIL WHERE pw_name LIKE BINARY "user "
 does return 0 lines.

Tonino




 Inter@zioniInterazioni di Antonio Nati
http://www.interazioni.it  [EMAIL PROTECTED]