Merge security fix from vendor branch (revision 1.1.1.14).

1 files changed, 19 insertions, 4 deletions

diff --git a/contrib/cvs/src/server.c b/contrib/cvs/src/server.c
index 62bff8f..ddc3488 100644
--- a/contrib/cvs/src/server.c
+++ b/contrib/cvs/src/server.c
@@ -5237,10 +5237,11 @@ error ENOMEM Virtual memory exhausted.\n");
 
 
 #if defined (HAVE_KERBEROS) || defined (AUTH_SERVER_SUPPORT) || defined (HAVE_GSSAPI)
-static void switch_to_user PROTO((const char *));
+static void switch_to_user PROTO((const char *, const char *));
 
 static void
-switch_to_user (username)
+switch_to_user (cvs_username, username)
+    const char *cvs_username; /* Only used for error messages. */
     const char *username;
 {
     struct passwd *pw;
@@ -5257,6 +5258,20 @@ error 0 %s: no such user\n", username);
 	error_exit ();
     }
 
+    if (pw->pw_uid == 0)
+    {
+#ifdef HAVE_SYSLOG_H
+	    /* FIXME: Can the IP address of the connecting client be retrieved
+	     * and printed here?
+	     */
+	    syslog (LOG_DAEMON | LOG_ALERT,
+		    "attempt to root from account: %s", cvs_username
+		   );
+#endif
+        printf("error 0: root not allowed\n");
+        error_exit ();
+    }
+
 #if HAVE_INITGROUPS
     if (initgroups (pw->pw_name, pw->pw_gid) < 0
 #  ifdef EPERM
@@ -5834,7 +5849,7 @@ pserver_authenticate_connection ()
     strcpy (Pserver_Repos, repository);
 
     /* Switch to run as this user. */
-    switch_to_user (host_user);
+    switch_to_user (username, host_user);
     free (host_user);
     free (tmp);
     free (repository);
@@ -6027,7 +6042,7 @@ gserver_authenticate_connection ()
 	    error (1, errno, "fwrite failed");
     }
 
-    switch_to_user (buf);
+    switch_to_user ("GSSAPI", buf);
 
     printf ("I LOVE YOU\n");
     fflush (stdout);