Avii/Radicale
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(auth): prevent login variable overwrite during failed cache cleanup

Browse Source 
In the failed login cache cleanup loop, the tuple unpacking was using
`login` as the local variable name, silently overwriting the current
user's login with the one retrieved from the expired cache entry.

This caused subsequent backend authentication (e.g. IMAP) to be
attempted with the wrong username, resulting in spurious auth failures
for legitimate users whenever an expired failed-cache entry happened
to be present at the same time.

Rename the loop variable to `login_expired` to avoid shadowing the
outer `login` variable, and fix the associated debug log to reference
`login_expired` instead of the previously incorrect `login_cache`.

Fixes: intermittent authentication failures when _cache_failed contains
expired entries from previous failed login attempts by other users.

Signed-off-by: webmaster <webmaster@jbsky.fr>
This commit is contained in:
webmaster
2026-04-10 11:39:45 +02:00
parent 5388f79bd8
commit e22d5b438f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
radicale/auth/__init__.py
View File

@@ -275,8 +275,8 @@ class BaseAuth:
logger.debug("Login failed cache cleanup start (entries: %d)", cache_failed_cleanup_entries)
if cache_failed_cleanup_entries > 0:
for digest in cache_failed_cleanup:
(login, age_failed) = cache_failed_cleanup[digest]
logger.debug("Login failed cache entry for user+password expired: '%s' (age: %d > %d sec)", login_cache, age_failed, self._cache_failed_logins_expiry)
(login_expired, age_failed) = cache_failed_cleanup[digest]
logger.debug("Login failed cache entry for user+password expired: '%s' (age: %d > %d sec)", login_expired, age_failed, self._cache_failed_logins_expiry)
del self._cache_failed[digest]
self._lock.release()
logger.debug("Login failed cache investigation finished")