[PATCH access-control] fix #8053: auth: accept "0" as password for pam and pve realms

[PATCH access-control] fix #8053: auth: accept "0" as password for pam and pve realms

[Michal Fox]

Both plugins rejected the password with a plain boolean check, and in
Perl the string "0" is false. So a user whose password is "0" could
never log in, getting a generic authentication failure.

Only reject undefined or empty passwords.

Signed-off-by: Michal Fox <me@dualfroz.com>
---
 src/PVE/Auth/PAM.pm | 2 +-
 src/PVE/Auth/PVE.pm | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/PVE/Auth/PAM.pm b/src/PVE/Auth/PAM.pm
index 8586da5..11750c5 100755
--- a/src/PVE/Auth/PAM.pm
+++ b/src/PVE/Auth/PAM.pm
@@ -25,7 +25,7 @@ sub authenticate_user {
     my ($class, $config, $realm, $username, $password) = @_;
 
     # user (www-data) need to be able to read /etc/passwd /etc/shadow
-    die "no password\n" if !$password;
+    die "no password\n" if !defined($password) || $password eq '';
 
     # PAM modules may temporarily override $SIG{CHLD}, causing SIGCHLDs from
     # RESTEnvironment workers to be lost. Running the PAM interaction in a fork
diff --git a/src/PVE/Auth/PVE.pm b/src/PVE/Auth/PVE.pm
index ab439a8..ca0fae7 100755
--- a/src/PVE/Auth/PVE.pm
+++ b/src/PVE/Auth/PVE.pm
@@ -73,7 +73,7 @@ sub options {
 sub authenticate_user {
     my ($class, $config, $realm, $username, $password) = @_;
 
-    die "no password\n" if !$password;
+    die "no password\n" if !defined($password) || $password eq '';
 
     my $shadow_cfg = cfs_read_file($shadowconfigfile);
 
-- 
2.43.0