Subject: x2gobroker authservice fails to handle passwords with spaces in them

From: Jason Alavaliant <[email-masked]>
Date: Thu, 18 Dec 2014 15:09:16 +1300

Package: x2gobroker-authservice
Version: 0.0.2.3
Tags: patch

Some of my users were getting authentication failed errors trying to 
login via our x2go broker setup (configured with http backend),     
further investigation revealed that the common factor was that they all 
had spaces in their passwords.

Digging through the code I found that the socket connection used by the 
x2gobroker authservice used spaces to separate the fields when passing 
user data to be validated which meant any password with a space was 
effectively truncated by the code when it was send to the authservice.   
     The two attached patches contain my proposed fix of changing the 
separation character to be \r instead which seems to fix the problem 
fine in my testing.

Thanks
Jason

--- old/x2gobroker/sbin/x2gobroker-authservice	2014-12-18 14:29:04.604215427 +1300
+++ new/x2gobroker/sbin/x2gobroker-authservice	2014-12-18 14:29:37.429187984 +1300
@@ -58,7 +58,7 @@
         self._buf = data
         for req in reqs.split('\n'):
             try:
-                user, passwd, service = req.split()
+                user, passwd, service = req.split('\r')
             except:
                 self.send('bad\n')
             else:
--- old/x2gobroker/authservice.py	2014-12-18 14:28:32.079251766 +1300
+++ new/x2gobroker/authservice.py	2014-12-18 14:28:56.087963130 +1300
@@ -34,7 +34,7 @@
     s.connect(x2gobroker.defaults.X2GOBROKER_AUTHSERVICE_SOCKET)
     # FIXME: somehow logging output disappears after we have connected to the socket file...
     logger_broker.debug('sending username={username}, password=<hidden>, service={service} to authentication service'.format(username=username, service=service))
-    s.send('{username} {password} {service}\n'.format(username=username, password=password, service=service))
+    s.send('{username}\r{password}\r{service}\n'.format(username=username, password=password, service=service))
     result = s.recv(1024)
     s.close()
     if result.startswith('ok'):