Differences From Artifact [5bb8ce2dae]:

• File src/xfer.c — part of check-in [95f5520a09] at 2009-09-14 14:08:35 on branch trunk — Construct event records for tickets correctly even when the ticket change artifacts arrive out of order. (user: drh size: 37361)

To Artifact [d0ba2feaa9]:

• File src/xfer.c — part of check-in [bbb8ae7ebf] at 2009-09-15 18:44:51 on branch trunk — Make it harder to misconfigure the user accounts in a way that might give people greater access than intended. (user: drh size: 37432)

385
386
387
388
389
390
391

392
393
394
395
396
397
398

void check_login(Blob *pLogin, Blob *pNonce, Blob *pSig){
  Stmt q;
  int rc = -1;

  db_prepare(&q,
     "SELECT pw, cap, uid FROM user"
     " WHERE login=%B"

     "   AND length(pw)>0",
     pLogin
  );
  if( db_step(&q)==SQLITE_ROW ){
    Blob pw, combined, hash;
    blob_zero(&pw);
    db_ephemeral_blob(&q, 0, &pw);

>

385
386
387
388
389
390
391
392
393
394
395
396
397
398
399

void check_login(Blob *pLogin, Blob *pNonce, Blob *pSig){
  Stmt q;
  int rc = -1;

  db_prepare(&q,
     "SELECT pw, cap, uid FROM user"
     " WHERE login=%B"
     "   AND login NOT IN ('anonymous','nobody','developer','reader')"
     "   AND length(pw)>0",
     pLogin
  );
  if( db_step(&q)==SQLITE_ROW ){
    Blob pw, combined, hash;
    blob_zero(&pw);
    db_ephemeral_blob(&q, 0, &pw);