Add "forceExternalAuth" config option to Murmur

Without this option (or when it's set to false), Murmur's default
authentication will kick in when your external authenticator plugin
crashes and basically allow *anyone* to login and register.

When it's enabled, Murmur will instead return a temporary login
failure to the client.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/murmur/ServerDB.cpp b/src/murmur/ServerDB.cpp
index 819dc459d..67720d3ae 100644
--- a/src/murmur/ServerDB.cpp
+++ b/src/murmur/ServerDB.cpp
@@ -843,7 +843,7 @@ QMap<int, QString> Server::getRegistration(int id) {
 /// @return UserID of authenticated user, -1 for authentication failures, -2 for unknown user (fallthrough),
 ///         -3 for authentication failures where the data could (temporarily) not be verified.
 int Server::authenticate(QString &name, const QString &pw, int sessionId, const QStringList &emails, const QString &certhash, bool bStrongCert, const QList<QSslCertificate> &certs) {
-	int res = -2;
+	int res = bForceExternalAuth ? -3 : -2;
 
 	emit authenticateSig(res, name, sessionId, certs, certhash, bStrongCert, pw);