Thu Feb 23 19:09:49 UTC 2006  anarcat@koumbit.org
  * factor out how to get the right authentitcation scheme securely
diff -rN -u old-mysql_auth/mysql_auth.module new-mysql_auth/mysql_auth.module
--- old-mysql_auth/mysql_auth.module	2006-02-23 19:13:56.396221456 +0000
+++ new-mysql_auth/mysql_auth.module	2006-02-23 19:08:49.000000000 +0000
@@ -143,18 +143,13 @@
   if (variable_get('mysql_auth_pass_salt', 0)) {
     $salt = ', '. variable_get('mysql_auth_pass_col', 'pass');
   }
-  $scheme = variable_get('mysql_auth_pass_scheme', 'MD5');
-  /* security: allow only certain functions to be called */
-  if (!array_key_exists($scheme, array_keys(_mysql_auth_supported_schemes()))) {
-    $scheme = 'MD5';
-  }
   $res = db_fetch_array(db_query("SELECT %s AS name FROM %s WHERE %s = '%s' AND %s = %s('%s'%s)",
     variable_get('mysql_auth_user_col', 'name'),
     variable_get('mysql_auth_table', 'users'),
     variable_get('mysql_auth_user_col', 'name'),
     $username,
     variable_get('mysql_auth_pass_col', 'pass'),
-    variable_get('mysql_auth_pass_scheme', 'MD5'),
+    _mysql_auth_current_scheme(),
     $password,
     $salt
     ));
@@ -179,3 +174,17 @@
 function _mysql_auth_supported_schemes() {
   return array('MD5' => 'MD5() authentication', 'ENCRYPT' => 'builtin ENCRYPT() function', 'DES_ENCRYPT' => 'triple-DES encryption', 'SHA' => 'SHA1 encryption', 'PASSWORD' => 'MySQL password encryption', 'OLD_PASSWORD' => 'Older MySQL password encryption');
 }
+
+/**
+ * helper function to fetch safely the current scheme to encrypt passwords with
+ *
+ * this is to avoid giving the permission to admins to call an arbitrary SQL function
+ */
+function _mysql_auth_current_scheme() {
+  $scheme = variable_get('mysql_auth_pass_scheme', 'MD5');
+  /* security: allow only certain functions to be called */
+  if (!array_key_exists($scheme, _mysql_auth_supported_schemes())) {
+    $scheme = 'MD5';
+  }
+  return $scheme;
+}