Fix for PAM error message display:

> and that the right fix is to make each of the subsequent calls be in
> this same pattern, not to try to emulate their nonsensical style.

Dominic J. Eidson

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 2063d02ab393386c75048c0f382df77b807f21d4..94d476d5ad73c6b937a16a38bcd915d50bc2c2f9 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -766,9 +766,9 @@ CheckPAMAuth(Port *port, char *user, char *password)
                return STATUS_ERROR;
        }
 
-       if (retval == PAM_SUCCESS)
-               retval = pam_set_item(pamh, PAM_USER, user);
-       else
+       retval = pam_set_item(pamh, PAM_USER, user);
+
+       if (retval != PAM_SUCCESS)
        {
                snprintf(PQerrormsg, PQERRORMSG_LENGTH,
                                 "CheckPAMAuth: pam_set_item(PAM_USER) failed: '%s'\n",
@@ -778,9 +778,10 @@ CheckPAMAuth(Port *port, char *user, char *password)
                pam_passwd = NULL;              /* Unset pam_passwd */
                return STATUS_ERROR;
        }
-       if (retval == PAM_SUCCESS)
-               retval = pam_set_item(pamh, PAM_CONV, &pam_passw_conv);
-       else
+
+       retval = pam_set_item(pamh, PAM_CONV, &pam_passw_conv);
+
+       if (retval != PAM_SUCCESS)
        {
                snprintf(PQerrormsg, PQERRORMSG_LENGTH,
                                 "CheckPAMAuth: pam_set_item(PAM_CONV) failed: '%s'\n",
@@ -790,9 +791,10 @@ CheckPAMAuth(Port *port, char *user, char *password)
                pam_passwd = NULL;              /* Unset pam_passwd */
                return STATUS_ERROR;
        }
-       if (retval == PAM_SUCCESS)
-               retval = pam_authenticate(pamh, 0);
-       else
+
+       retval = pam_authenticate(pamh, 0);
+
+       if (retval != PAM_SUCCESS)
        {
                snprintf(PQerrormsg, PQERRORMSG_LENGTH,
                                 "CheckPAMAuth: pam_authenticate failed: '%s'\n",
@@ -802,9 +804,10 @@ CheckPAMAuth(Port *port, char *user, char *password)
                pam_passwd = NULL;              /* Unset pam_passwd */
                return STATUS_ERROR;
        }
-       if (retval == PAM_SUCCESS)
-               retval = pam_acct_mgmt(pamh, 0);
-       else
+
+       retval = pam_acct_mgmt(pamh, 0);
+
+       if (retval != PAM_SUCCESS)
        {
                snprintf(PQerrormsg, PQERRORMSG_LENGTH,
                                 "CheckPAMAuth: pam_acct_mgmt failed: '%s'\n",
@@ -814,24 +817,21 @@ CheckPAMAuth(Port *port, char *user, char *password)
                pam_passwd = NULL;              /* Unset pam_passwd */
                return STATUS_ERROR;
        }
-       if (retval == PAM_SUCCESS)
-       {
-               retval = pam_end(pamh, retval);
-               if (retval != PAM_SUCCESS)
-               {
-                       snprintf(PQerrormsg, PQERRORMSG_LENGTH,
-                        "CheckPAMAuth: Failed to release PAM authenticator: '%s'\n",
-                                        pam_strerror(pamh, retval));
-                       fputs(PQerrormsg, stderr);
-                       pqdebug("%s", PQerrormsg);
-               }
 
-               pam_passwd = NULL;              /* Unset pam_passwd */
+       retval = pam_end(pamh, retval);
 
-               return (retval == PAM_SUCCESS ? STATUS_OK : STATUS_ERROR);
+       if (retval != PAM_SUCCESS)
+       {
+               snprintf(PQerrormsg, PQERRORMSG_LENGTH,
+                "CheckPAMAuth: Failed to release PAM authenticator: '%s'\n",
+                                pam_strerror(pamh, retval));
+               fputs(PQerrormsg, stderr);
+               pqdebug("%s", PQerrormsg);
        }
-       else
-               return STATUS_ERROR;
+
+       pam_passwd = NULL;              /* Unset pam_passwd */
+
+       return (retval == PAM_SUCCESS ? STATUS_OK : STATUS_ERROR);
 }
 #endif   /* USE_PAM */