starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-52267 (published 2023-12-31T00:15Z)

ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/hongliuliao/ehttp
commit_details: repo_url: https://github.com/hongliuliao/ehttp
author: harleyliao
author_date: 2023-10-08 06:54:01+00:00
msg: fix log overflow & epoll_context use after free bug
repository: repo_url: https://github.com/hongliuliao/ehttp
repo_name: hongliuliao/ehttp
description: simple http server base on epoll
repo_language: C++
owner: hongliuliao
file_changes: filename: Makefile
change_type: ModificationType.MODIFY
diff: @@ -5,8 +5,8 @@ CXXFLAGS += -g -Wall
 LDFLAGS += -pthread
 
 ifdef ACOV
-	CXXFLAGS += -fprofile-arcs -ftest-coverage
-	LDFLAGS += -lgcov --coverage
+	CXXFLAGS += -fprofile-arcs -ftest-coverage -fsanitize=address
+	LDFLAGS += -lgcov --coverage -fsanitize=address
 endif
 
 MULTIPART_PARSER_INC_PATH=-I deps/multipart-parser-c/

programming_language: Shell
filename: epoll_socket.cpp
change_type: ModificationType.MODIFY
diff: @@ -228,11 +228,6 @@ int EpollSocket::handle_accept_event(int &epollfd, epoll_event &event, EpollSock
 void read_func(void *data) {
     TaskData *td = (TaskData *) data;
     td->es->handle_readable_event(td->event);
-
-    EpollContext *hc = (EpollContext *) td->event.data.ptr;
-    if (hc != NULL) {
-        hc->_ctx_status = CONTEXT_READ_OVER;
-    }
     delete td;
 }
 
@@ -248,6 +243,9 @@ int EpollSocket::handle_readable_event(epoll_event &event) {
     if (ret == READ_CLOSE) {
         return close_and_release(event);
     }
+    if (epoll_context != NULL) {
+        epoll_context->_ctx_status = CONTEXT_READ_OVER;
+    }
 
     if (ret == READ_CONTINUE) {
         event.events = EPOLLIN | EPOLLONESHOT;

programming_language: C++
filename: sim_parser.cpp
change_type: ModificationType.MODIFY
diff: @@ -577,7 +577,7 @@ int Request::parse_request(const char *read_buffer, int read_size) {
         LOG_INFO("TOO BIG REQUEST WE WILL REFUSE IT! MAX_REQ_SIZE:%d", MAX_REQ_SIZE);
         return -1;
     }
-    LOG_DEBUG("read from client: size:%d, content:%s", read_size, read_buffer);
+    LOG_DEBUG("read from client: size:%d, content:%.4096s", read_size, read_buffer);
     ssize_t nparsed = http_parser_execute(&_parser, &_settings, read_buffer, read_size);
     if (nparsed != read_size) {
         std::string err_msg = "unkonw";

programming_language: C++
filename: poc.py
change_type: ModificationType.ADD
diff: @@ -0,0 +1,9 @@
+#!/usr/bin/env python3
+
+import socket
+
+sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+sock.connect(("localhost", 8080))
+sock.send(b"GET"*5000+b" /hello"*5000+b" HTTP/1.1\r\nHost:localhost:8080\r\n\r\n")
+response = sock.recv(4096)
+sock.close()

programming_language: Lua
CVE-2021-41147 (published 2021-10-15T14:15Z)

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Enalean/tuleap
commit_details: repo_url: https://github.com/Enalean/tuleap
author: Thomas Gerbet
author_date: 2020-07-20 10:11:59+02:00
msg: request #15131: SQL injection in the planning edition panel

Change-Id: Ifa9971534640010198196f34544f97eb8c7cc9c9
repository: repo_url: https://github.com/Enalean/tuleap
repo_name: Enalean/tuleap
description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. With a single web-based solution, project managers, developers & quality managers can easily build, deploy software projects.
repo_language: PHP
owner: Enalean
file_changes: filename: ColumnMappingFieldValueDao.class.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 <?php
 /**
- * Copyright (c) Enalean, 2012. All Rights Reserved.
+ * Copyright (c) Enalean, 2012-Present. All Rights Reserved.
  *
  * This file is a part of Tuleap.
  *
@@ -35,6 +35,8 @@ class Cardwall_OnTop_ColumnMappingFieldValueDao extends DataAccessObject
     {
         $cardwall_tracker_id = $this->da->escapeInt($cardwall_tracker_id);
         $tracker_id          = $this->da->escapeInt($tracker_id);
+        $value_id            = $this->da->escapeInt($value_id);
+        $column_id           = $this->da->escapeInt($column_id);
         if ($field_id === null) {
             $field_id = " NULL ";
         } else {

programming_language: PHP
CVE-2023-0564 (published 2023-01-29T01:15Z)

Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.\n\n

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-521
cwe_name: Weak Password Requirements
description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
extended_description: Authentication mechanisms often rely on a memorized secret (also known as a password) to provide an assertion of identity for a user of a system. It is therefore important that this password be of sufficient complexity and impractical for an adversary to guess. The specific requirements around how complex a password needs to be depends on the type of system being protected. Selecting the correct password requirements and enforcing them through implementation are critical to the overall success of the authentication mechanism.
         

Fix information:
repo_url: https://github.com/froxlor/froxlor
commit_details: repo_url: https://github.com/froxlor/froxlor
author: Michael Kaufmann
author_date: 2023-01-28 11:40:07+01:00
msg: enforce password requirements set in settings for directory-protection

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
repository: repo_url: https://github.com/froxlor/froxlor
repo_name: froxlor/Froxlor
description: The server administration software for your needs - The official Froxlor development Git repository
repo_language: PHP
owner: froxlor
file_changes: filename: DirProtections.php
change_type: ModificationType.MODIFY
diff: @@ -87,7 +87,8 @@ class DirProtections extends ApiCommand implements ResourceEntity
 		$path = FileDir::makeCorrectDir($customer['documentroot'] . '/' . $path);
 		$username = Validate::validate($username, 'username', '/^[a-zA-Z0-9][a-zA-Z0-9\-_]+\$?$/', '', [], true);
 		$authname = Validate::validate($authname, 'directory_authname', '/^[a-zA-Z0-9][a-zA-Z0-9\-_ ]+\$?$/', '', [], true);
-		Validate::validate($password, 'password', '', '', [], true);
+		$password = Validate::validate($password, 'password', '', '', [], true);
+		$password = Crypt::validatePassword($password, true);
 
 		// check for duplicate usernames for the path
 		$username_path_check_stmt = Database::prepare("
@@ -244,7 +245,8 @@ class DirProtections extends ApiCommand implements ResourceEntity
 
 		// validation
 		$authname = Validate::validate($authname, 'directory_authname', '/^[a-zA-Z0-9][a-zA-Z0-9\-_ ]+\$?$/', '', [], true);
-		Validate::validate($password, 'password', '', '', [], true);
+		$password = Validate::validate($password, 'password', '', '', [], true);
+		$password = Crypt::validatePassword($password, true);
 
 		$upd_query = "";
 		$upd_params = [

programming_language: PHP
CVE-2014-2829 (published 2014-04-11T01:55Z)

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/esl/MongooseIM
commit_details: repo_url: https://github.com/esl/MongooseIM
author: Michał Piotrowski
author_date: 2014-04-09 15:05:37+02:00
msg: Merge pull request #167 from esl/zlib_cwe400_fix

Add zlib inflated data size limit
repository: repo_url: https://github.com/esl/MongooseIM
repo_name: esl/MongooseIM
description: MongooseIM is Erlang Solutions' robust, scalable and efficient XMPP server, aimed at large installations. Specifically designed for enterprise purposes, it is fault-tolerant and can utilise the resources of multiple clustered machines.
repo_language: Erlang
owner: esl
CVE-2022-0128 (published 2022-01-06T17:15Z)

vim is vulnerable to Out-of-bounds Read

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Bram Moolenaar
author_date: 2022-01-05 16:50:40+00:00
msg: patch 8.2.4009: reading one byte beyond the end of the line

Problem:    Reading one byte beyond the end of the line.
Solution:   Check for NUL byte first.
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: ex_docmd.c
change_type: ModificationType.MODIFY
diff: @@ -3632,7 +3632,8 @@ find_ex_command(
 	}
 
 	// Check for "++nr" and "--nr".
-	if (p == eap->cmd && p[0] == p[1] && (*p == '+' || *p == '-'))
+	if (p == eap->cmd && p[0] != NUL && p[0] == p[1]
+						   && (*p == '+' || *p == '-'))
 	{
 	    eap->cmdidx = *p == '+' ? CMD_increment : CMD_decrement;
 	    return eap->cmd + 2;

programming_language: Shell
filename: test_vim9_func.vim
change_type: ModificationType.MODIFY
diff: @@ -3537,6 +3537,17 @@ def Test_numbered_function_reference()
   unlet g:mydict
 enddef
 
+def Test_go_beyond_end_of_cmd()
+  # this was reading the byte after the end of the line
+  var lines =<< trim END
+    def F()
+      cal
+    enddef
+    defcompile
+  END
+  CheckScriptFailure(lines, 'E476:')
+enddef
+
 if has('python3')
   def Test_python3_heredoc()
     py3 << trim EOF

programming_language: Python
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4009,
 /**/
     4008,
 /**/

programming_language: Ruby
filename: vim9compile.c
change_type: ModificationType.MODIFY
diff: @@ -2781,7 +2781,8 @@ compile_def_function(
 	cmd = ea.cmd;
 	if ((*cmd != '$' || starts_with_colon)
 		&& (starts_with_colon || !(*cmd == '\''
-		       || (cmd[0] == cmd[1] && (*cmd == '+' || *cmd == '-')))))
+		       || (cmd[0] != NUL && cmd[0] == cmd[1]
+					    && (*cmd == '+' || *cmd == '-')))))
 	{
 	    ea.cmd = skip_range(ea.cmd, TRUE, NULL);
 	    if (ea.cmd > cmd)

programming_language: C
CVE-2020-27985 (published 2020-11-23T14:15Z)

Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home/<user>/SecurityOnion/setup/so-setup.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-306
cwe_name: Missing Authentication for Critical Function
description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Security-Onion-Solutions/securityonion
commit_details: repo_url: https://github.com/Security-Onion-Solutions/securityonion
author: William Wernert
author_date: 2020-11-17 15:36:25-05:00
msg: [feat] Remove so-setup permission from sudoers file after iso setup

Closes #1701
repository: repo_url: https://github.com/Security-Onion-Solutions/securityonion
repo_name: Security-Onion-Solutions/securityonion
description: Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
repo_language: Shell
owner: Security-Onion-Solutions
file_changes: filename: soup
change_type: ModificationType.MODIFY
diff: @@ -191,6 +191,7 @@ pillar_changes() {
     [[ "$INSTALLEDVERSION" =~ rc.1 ]] && rc1_to_rc2
     [[ "$INSTALLEDVERSION" =~ rc.2 ]] && rc2_to_rc3
     [[ "$INSTALLEDVERSION" =~ rc.3 ]] && rc3_to_2.3.0
+	[[ "$INSTALLEDVERSION" =~ 2.3.2 ]] && up_2.3.2_to_2.3.10
 
 }
 
@@ -292,6 +293,12 @@ unmount_update() {
   umount /tmp/soagupdate
 }
 
+up_2.3.2_to_2.3.10() {
+	if grep -q "so-setup" /etc/sudoers; then
+		echo "[ INFO ] There is an entry for so-setup in the sudoers file, this can be safely deleted using \"visudo\"."
+	fi
+}
+
 update_centos_repo() {
   # Update the files in the repo
   echo "Syncing new updates to /nsm/repo"

programming_language: Shell
filename: so-functions
change_type: ModificationType.MODIFY
diff: @@ -1019,6 +1019,10 @@ install_cleanup() {
 	# If Mysql is running stop it
 	/usr/sbin/so-mysql-stop
 
+	if [[ $install_type == 'iso' ]]; then
+		info "Removing so-setup permission entry from sudoers file"
+		sed -i '/so-setup/d' /etc/sudoers
+	fi
 }
 
 import_registry_docker() {

programming_language: Shell
CVE-2024-33438 (published 2024-04-29T18:15Z)

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/cubecart/v6
commit_details: repo_url: https://github.com/cubecart/v6
author: Al Brookbanks
author_date: 2024-04-24 13:01:48+01:00
msg: #3570 - .phar to illegal filenames list
repository: repo_url: https://github.com/cubecart/v6
repo_name: cubecart/v6
description: CubeCart Version 6
repo_language: PHP
owner: cubecart
file_changes: filename: filemanager.class.php
change_type: ModificationType.MODIFY
diff: @@ -779,7 +779,7 @@ class FileManager
 
     public function filenameIsIllegal($file_name)
     {
-        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phtml|\.php[3-6])$/i', $file_name)) {
+        if (preg_match('/(\.sh\.inc\.ini|\.htaccess|\.php|\.phar|\.phtml|\.php[3-6])$/i', $file_name)) {
             return true;
         } elseif (preg_match('/\.php\./i', $file_name)) {
             return true;

programming_language: PHP
CVE-2022-0144 (published 2022-01-11T07:15Z)

shelljs is vulnerable to Improper Privilege Management

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/shelljs/shelljs
commit_details: repo_url: https://github.com/shelljs/shelljs
author: Nate Fischer
author_date: 2022-01-06 21:14:23-08:00
msg: fix(exec): lockdown file permissions (#1060)

This locks down file permissions used by the internal implementation of
`shell.exec()`.

Issue #1058
Tested manually using the documented scenarios
repository: repo_url: https://github.com/shelljs/shelljs
repo_name: shelljs/shelljs
description: :shell: Portable Unix shell commands for Node.js
repo_language: JavaScript
owner: shelljs
file_changes: filename: exec.js
change_type: ModificationType.MODIFY
diff: @@ -48,7 +48,24 @@ function execSync(cmd, opts, pipe) {
     stderrFile: stderrFile,
   };
 
-  fs.writeFileSync(paramsFile, JSON.stringify(paramsToSerialize), 'utf8');
+  // Create the files and ensure these are locked down (for read and write) to
+  // the current user. The main concerns here are:
+  //
+  // * If we execute a command which prints sensitive output, then
+  //   stdoutFile/stderrFile must not be readable by other users.
+  // * paramsFile must not be readable by other users, or else they can read it
+  //   to figure out the path for stdoutFile/stderrFile and create these first
+  //   (locked down to their own access), which will crash exec() when it tries
+  //   to write to the files.
+  function writeFileLockedDown(filePath, data) {
+    fs.writeFileSync(filePath, data, {
+      encoding: 'utf8',
+      mode: parseInt('600', 8),
+    });
+  }
+  writeFileLockedDown(stdoutFile, '');
+  writeFileLockedDown(stderrFile, '');
+  writeFileLockedDown(paramsFile, JSON.stringify(paramsToSerialize));
 
   var execArgs = [
     path.join(__dirname, 'exec-child.js'),
@@ -91,6 +108,7 @@ function execSync(cmd, opts, pipe) {
   }
 
   // No biggie if we can't erase the files now -- they're in a temp dir anyway
+  // and we locked down permissions (see the note above).
   try { common.unlinkSync(paramsFile); } catch (e) {}
   try { common.unlinkSync(stderrFile); } catch (e) {}
   try { common.unlinkSync(stdoutFile); } catch (e) {}

programming_language: JavaScript
CVE-2018-1000041 (published 2018-02-09T23:29Z)

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/ImageMagick/librsvg
commit_details: repo_url: https://github.com/ImageMagick/librsvg
author: Dirk Lemstra
author_date: 2017-11-27 21:18:43+01:00
msg: Fixed possible credentials leaking reported by Alex Birsan.
repository: repo_url: https://github.com/ImageMagick/librsvg
repo_name: ImageMagick/rsvg
description: librsvg for the Windows build of ImageMagick
repo_language: C
owner: ImageMagick
file_changes: filename: rsvg-io.c
change_type: ModificationType.MODIFY
diff: @@ -130,7 +130,7 @@ _rsvg_io_get_file_path (const gchar * filename,
 {
     gchar *absolute_filename;
 
-    if (g_file_test (filename, G_FILE_TEST_EXISTS) || g_path_is_absolute (filename)) {
+    if (g_path_is_absolute (filename)) {
         absolute_filename = g_strdup (filename);
     } else {
         gchar *tmpcdir;

programming_language: C
repo_url: https://github.com/GNOME/librsvg
commit_details: repo_url: https://github.com/GNOME/librsvg
author: Federico Mena Quintero
author_date: 2017-12-04 18:55:28-06:00
msg: Merge branch 'no-xrefs-in-paint-servers'
repository: repo_url: https://github.com/GNOME/librsvg
repo_name: GNOME/librsvg
description: Read-only mirror of https://gitlab.gnome.org/GNOME/librsvg
repo_language: Rust
owner: GNOME
CVE-2015-10083 (published 2023-02-21T15:15Z)

A vulnerability has been found in harrystech Dynosaur-Rails and classified as critical. Affected by this vulnerability is the function basic_auth of the file app/controllers/application_controller.rb. The manipulation leads to improper authentication. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 04b223813f0e336aab50bff140d0f5889c31dbec. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221503.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/harrystech/dynosaur-rails
commit_details: repo_url: https://github.com/harrystech/dynosaur-rails
author: Andy O'Neill
author_date: 2015-09-15 14:02:06-04:00
msg: Fix basic auth bypass vulnerability

Serious vulnerability discovered, please update to latest code.
repository: repo_url: https://github.com/harrystech/dynosaur-rails
repo_name: harrystech/dynosaur-rails
description: [Deprecated] Web interface for https://github.com/harrystech/dynosaur
repo_language: Ruby
owner: harrystech
file_changes: filename: application_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -15,16 +15,14 @@ class ApplicationController < ActionController::Base
       expected_password = ENV.fetch("DYNOSAUR_PASSWORD", DEFAULT_PASSWORD)
       if username != expected_username
         puts "Failed username"
-        return false
+        return request_http_basic_authentication
       end
       if expected_password == password
-        @passed_auth=true
         return true
       else
         begin
           bcyrpt_password = BCrypt::Password.new(expected_password)
           if bcyrpt_password == password
-            @passed_auth=true
             return true
           else
             puts "Failed password"
@@ -35,8 +33,7 @@ class ApplicationController < ActionController::Base
 
       end
       puts "ERROR: Failed basic auth"
-      request_http_basic_authentication
-      return false
+      return request_http_basic_authentication
     end
   end
 

programming_language: Ruby