security: fix improper PAM authorization handling (#6819)

ysf · unknwon · web-flow · commit 940a7da9d162 · 2022-03-08T20:02:01.000+08:00
Co-authored-by: Joe Chen &lt;jc@unknwon.io&gt;
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -22,6 +22,7 @@ All notable changes to Gogs are documented in this file.
 ### Fixed
 
 - _Security:_ Potential SSRF in repository migration. [#6754](https://github.com/gogs/gogs/issues/6754)
+- _Security:_ Improper PAM authorization handling. [#6810](https://github.com/gogs/gogs/issues/6810)
 - Unable to use LDAP authentication on ARM machines. [#6761](https://github.com/gogs/gogs/issues/6761)
 
 ### Removed
diff --git a/internal/auth/pam/pam.go b/internal/auth/pam/pam.go
@@ -25,6 +25,10 @@ func (c *Config) doAuth(login, password string) error {
 	if err != nil {
 		return err
 	}
-
-	return t.Authenticate(0)
+	
+	err = t.Authenticate(0)
+	if err != nil {
+		return err
+	}
+	return t.AcctMgmt(0)
 }

Original file line number	Diff line number	Diff line change
`@@ -25,6 +25,10 @@ func (c *Config) doAuth(login, password string) error {`
`25`	`25`	`if err != nil {`
`26`	`26`	`return err`
`27`	`27`	`}`
`28`		`-`
`29`		`- return t.Authenticate(0)`
	`28`	`+`
	`29`	`+ err = t.Authenticate(0)`
	`30`	`+ if err != nil {`
	`31`	`+ return err`
	`32`	`+ }`
	`33`	`+ return t.AcctMgmt(0)`
`30`	`34`	`}`