From 7917dc6585983ac62927642fc5c9d045fcd34c9d Mon Sep 17 00:00:00 2001 From: Bill Erickson Date: Tue, 8 Oct 2013 15:58:56 -0400 Subject: [PATCH] LP#1348731: have SIP gateway use a login nonce Since multiple SIP clients may use the same credentials, avoid the same-username race condition to authentication by applying a login nonce value. Signed-off-by: Bill Erickson Signed-off-by: Galen Charlton Signed-off-by: Mike Rylander --- Open-ILS/src/perlmods/lib/OpenILS/SIP.pm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm b/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm index 46c902a6e7..a98420029f 100644 --- a/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm +++ b/Open-ILS/src/perlmods/lib/OpenILS/SIP.pm @@ -223,9 +223,10 @@ sub login { my( $self, $username, $password ) = @_; syslog('LOG_DEBUG', "OILS: Logging in with username $username"); + my $nonce = rand($$); my $seed = $U->simplereq( 'open-ils.auth', - 'open-ils.auth.authenticate.init', $username ); + 'open-ils.auth.authenticate.init', $username, $nonce ); my $response = $U->simplereq( 'open-ils.auth', @@ -234,6 +235,7 @@ sub login { username => $username, password => md5_hex($seed . md5_hex($password)), type => 'opac', + nonce => $nonce } ); -- 2.43.2