TigerVNC/tigervnc — pull request #65 by michalsrb (2014-11-10 16:12:01+00:00)
Title: Add support for view only passwords in VncAuth.

The SConnection class already has ability to restrict access with accessRights variable. It doesn't seem to be used anywhere however.

I added SSecurity::getAccessRights() method that returns access rights the client is authorized to. SConnection calls this method when the client authentication is done and sets the returned value as its new accessRights. Default implementation of SSecurity::getAccessRights() returns SConnection::AccessDefault, so nothing changes for SSecurity subclasses that don't override it.

Secondly I updated vncpasswd to ask for optional second password and store it behind the main one. This is same behavior and same format of passwd file as tightvnc uses.

Lastly I made SSecurityVncAuth (and its helper classes) load both passwords and test client response against both of them. If the client entered the view only password, he is accepted, but with access restricted to SConnection::AccessView. If there is no second password in the passwd file, only the main one is checked.

Other subclasses of SSecurity could reimplement getAccessRights() for their own purposes.