starred/warmbly
1
0
Fork 0
mirror of https://github.com/warmbly/warmbly.git synced 2026-10-31 16:13:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: compare presented SMTP and IMAP passwords with crypto/subtle.ConstantTimeCompare when pool link enrollment adopts the workspace's existing Cloud mailbox

Browse Source
This commit is contained in:
Matthew Meszaros
2026-10-21 06:38:13 +02:00
parent f8fbca7cbb
commit ddecd1e65a
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/app/poollink/service.go
+3 -1
View File
@@ -5,6 +5,7 @@ import (
"context"
"crypto/rand"
"crypto/sha256"
"crypto/subtle"
"encoding/base64"
"encoding/hex"
"errors"
@@ -581,7 +582,8 @@ func sameSMTPIMAPCredentials(stored *repository.SMTPCredentials, got *models.Smt
}
same := func(host string, port int, user, password string, svc *models.Service) bool {
return strings.EqualFold(strings.TrimSpace(host), strings.TrimSpace(svc.Host)) && port == svc.Port &&
strings.TrimSpace(user) == strings.TrimSpace(svc.Username) && password == svc.Password
strings.TrimSpace(user) == strings.TrimSpace(svc.Username) &&
subtle.ConstantTimeCompare([]byte(password), []byte(svc.Password)) == 1
}
return same(stored.SMTPHost, stored.SMTPPort, stored.SMTPUser, stored.SMTPPassword, got.SMTP) &&
same(stored.IMAPHost, stored.IMAPPort, stored.IMAPUser, stored.IMAPPassword, got.IMAP)