From 3e19583b296539edc42a90b714e1ed15e55c28f9 Mon Sep 17 00:00:00 2001
From: Nick Couchman <vnick@apache.org>
Date: Fri, 18 Sep 2020 22:23:03 -0400
Subject: [PATCH] GUACAMOLE-221: Switch VNC credentials to NULL when parameter
 is not passed

---
 src/protocols/vnc/auth.c     | 24 +++++++++---------------
 src/protocols/vnc/settings.c |  6 ++++--
 2 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/src/protocols/vnc/auth.c b/src/protocols/vnc/auth.c
index b5a74b15..c26e4d2e 100644
--- a/src/protocols/vnc/auth.c
+++ b/src/protocols/vnc/auth.c
@@ -27,6 +27,7 @@
 #include <guacamole/client.h>
 #include <guacamole/protocol.h>
 #include <guacamole/socket.h>
+#include <guacamole/string.h>
 #include <rfb/rfbclient.h>
 #include <rfb/rfbproto.h>
 
@@ -41,10 +42,10 @@ char* guac_vnc_get_password(rfbClient* client) {
     /* If the client does not support the "required" instruction, just return
         the configuration data. */
     if (!guac_client_owner_supports_required(gc))
-        return ((guac_vnc_client*) gc->data)->settings->password;
+        return guac_strdup(settings->password);
     
     /* If password isn't around, prompt for it. */
-    if (settings->password == NULL || strcmp(settings->password, "") == 0) {
+    if (settings->password == NULL) {
         
         guac_argv_register(GUAC_VNC_ARGV_PASSWORD, guac_vnc_argv_callback, NULL, 0);
         
@@ -58,7 +59,7 @@ char* guac_vnc_get_password(rfbClient* client) {
 
     }
     
-    return settings->password;
+    return guac_strdup(settings->password);
     
 }
 
@@ -78,14 +79,14 @@ rfbCredential* guac_vnc_get_credentials(rfbClient* client, int credentialType) {
             char* params[3] = {NULL};
             int i = 0;
 
-            /* Check if username is null or empty. */
+            /* Check if username is not provided. */
             if (settings->username == NULL) {
                 guac_argv_register(GUAC_VNC_ARGV_USERNAME, guac_vnc_argv_callback, NULL, 0);
                 params[i] = GUAC_VNC_ARGV_USERNAME;
                 i++;
             }
 
-            /* Check if password is null or empty. */
+            /* Check if password is not provided. */
             if (settings->password == NULL) {
                 guac_argv_register(GUAC_VNC_ARGV_PASSWORD, guac_vnc_argv_callback, NULL, 0);
                 params[i] = GUAC_VNC_ARGV_PASSWORD;
@@ -94,23 +95,16 @@ rfbCredential* guac_vnc_get_credentials(rfbClient* client, int credentialType) {
 
             params[i] = NULL;
 
-            /* If we have empty parameters, request them. */
+            /* If we have empty parameters, request them and await response. */
             if (i > 0) {
-
-                /* Send required parameters to owner. */
                 guac_client_owner_send_required(gc, (const char**) params);
-
-                /* Wait for the parameters to be returned. */
                 guac_argv_await((const char**) params);
-
-                return creds;
-
             }
         }
         
         /* Copy the values and return the credential set. */
-        creds->userCredential.username = strdup(settings->username);
-        creds->userCredential.password = strdup(settings->password);
+        creds->userCredential.username = guac_strdup(settings->username);
+        creds->userCredential.password = guac_strdup(settings->password);
         return creds;
         
     }
diff --git a/src/protocols/vnc/settings.c b/src/protocols/vnc/settings.c
index 86207c47..c6f36464 100644
--- a/src/protocols/vnc/settings.c
+++ b/src/protocols/vnc/settings.c
@@ -393,11 +393,11 @@ guac_vnc_settings* guac_vnc_parse_args(guac_user* user,
 
     settings->username =
         guac_user_parse_args_string(user, GUAC_VNC_CLIENT_ARGS, argv,
-                IDX_USERNAME, ""); /* NOTE: freed by libvncclient */
+                IDX_USERNAME, NULL);
     
     settings->password =
         guac_user_parse_args_string(user, GUAC_VNC_CLIENT_ARGS, argv,
-                IDX_PASSWORD, ""); /* NOTE: freed by libvncclient */
+                IDX_PASSWORD, NULL);
     
     /* Remote cursor */
     if (strcmp(argv[IDX_CURSOR], "remote") == 0) {
@@ -625,8 +625,10 @@ void guac_vnc_settings_free(guac_vnc_settings* settings) {
     free(settings->clipboard_encoding);
     free(settings->encodings);
     free(settings->hostname);
+    free(settings->password);
     free(settings->recording_name);
     free(settings->recording_path);
+    free(settings->username);
 
 #ifdef ENABLE_VNC_REPEATER
     /* Free VNC repeater settings */