# HG changeset patch
# User Goffi <goffi@goffi.org>
# Date 1402408792 -7200
# Node ID de039f008333e5ca64e1696b1118da7978e27c82
# Parent  34ce41e014c46e24b6f7022962437de925721024
server side: added config only option empty_password_allowed_warning_dangerous_list, which allow to connect with a profile with empty password. /!\ MUST not be used if Libervia is accessible from outside, this option is mainly useful for developpers.

diff -r 34ce41e014c4 -r de039f008333 src/server/server.py
--- a/src/server/server.py	Tue Jun 10 15:38:47 2014 +0200
+++ b/src/server/server.py	Tue Jun 10 15:59:52 2014 +0200
@@ -631,9 +631,10 @@
             raise Exception('No profile_key allowed')
 
         profile_check = self.sat_host.bridge.getProfileName(login_)
-        if not profile_check or profile_check != login_ or not password_:
+        if ((not profile_check or profile_check != login_) or
+            (not password_ and profile_check not in self.sat_host.empty_password_allowed_warning_dangerous_list)):
+            return "PROFILE AUTH ERROR"
             # profiles with empty passwords are restricted to local frontends
-            return "PROFILE AUTH ERROR"
 
         if login_ in self.profiles_waiting:
             return "ALREADY WAITING"
@@ -1015,7 +1016,7 @@
                            ['passphrase', 'k', '', _(u"Passphrase for the SàT profile named '%s'") % C.SERVICE_PROFILE, str],
                            ['data_dir', 'd', DATA_DIR_DEFAULT, _(u'Data directory for Libervia'), coerceDataDir],
                           ] # options which are in sat.conf and on command line, see https://twistedmatrix.com/documents/current/api/twisted.python.usage.Options.html
-    OPT_PARAMETERS_CFG = [] # Options which are in sat.conf only
+    OPT_PARAMETERS_CFG = [['empty_password_allowed_warning_dangerous_list', None, '', None]] # Options which are in sat.conf only
 
     def __init__(self, *args, **kwargs):
         self.initialised = defer.Deferred()