2c12a2c32a
So far seteuid could change uid to any existing account, given sufficient permissions of the caller. This is kind of bad since it disallows admins to refuse login to disabled or locked out accounts. Add check for the account's UF_ACCOUNTDISABLE or UF_LOCKOUT flags and don't let the user in, if one of the flags is set. Signed-off-by: Corinna Vinschen <corinna@vinschen.de>
THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Cygwin documentation is available on the net at https://cygwin.com You might especially be interested in https://cygwin.com/faq/faq.html#faq.programming.building-cygwin