src/httprpc.cpp
static bool multiUserAuthorized(std::string strUserPass)
{
    if (strUserPass.find(':') == std::string::npos) {
        return false;
    }
    std::string strUser = strUserPass.substr(0, strUserPass.find(':'));
    std::string strPass = strUserPass.substr(strUserPass.find(':') + 1);

    for (const std::string& strRPCAuth : gArgs.GetArgs("-rpcauth")) {
        //Search for multi-user login/pass "rpcauth" from config
        std::vector<std::string> vFields;
        boost::split(vFields, strRPCAuth, boost::is_any_of(":$"));
        if (vFields.size() != 3) {
            //Incorrect formatting in config file
            continue;
        }

        std::string strName = vFields[0];
        if (!TimingResistantEqual(strName, strUser)) {
            continue;
        }

        std::string strSalt = vFields[1];
        std::string strHash = vFields[2];

        static const unsigned int KEY_SIZE = 32;
        unsigned char out[KEY_SIZE];

        CHMAC_SHA256(reinterpret_cast<const unsigned char*>(strSalt.data()), strSalt.size()).Write(reinterpret_cast<const unsigned char*>(strPass.data()), strPass.size()).Finalize(out);
        std::vector<unsigned char> hexvec(out, out+KEY_SIZE);
        std::string strHashFromPass = HexStr(hexvec);

        if (TimingResistantEqual(strHashFromPass, strHash)) {
            return true;
        }
    }
    return false;
}
//This function checks username and password against -rpcauth
//entries from config file.
This function checks username and password against -rpcauth
entries from config file.
This function checks username and password against - rpcauth entries from config file .
static bool multiUserAuthorized(std::string strUserPass)
{
    if (strUserPass.find(':') == std::string::npos) {
        return false;
    }
    std::string strUser = strUserPass.substr(0, strUserPass.find(':'));
    std::string strPass = strUserPass.substr(strUserPass.find(':') + 1);
    for (const std::string& strRPCAuth : gArgs.GetArgs("-rpcauth")) {
        std::vector<std::string> vFields;
        boost::split(vFields, strRPCAuth, boost::is_any_of(":$"));
        if (vFields.size() != 3) {
            continue;
        }
        std::string strName = vFields[0];
        if (!TimingResistantEqual(strName, strUser)) {
            continue;
        }
        std::string strSalt = vFields[1];
        std::string strHash = vFields[2];
        static const unsigned int KEY_SIZE = 32;
        unsigned char out[KEY_SIZE];
        CHMAC_SHA256(reinterpret_cast<const unsigned char*>(strSalt.data()), strSalt.size()).Write(reinterpret_cast<const unsigned char*>(strPass.data()), strPass.size()).Finalize(out);
        std::vector<unsigned char> hexvec(out, out+KEY_SIZE);
        std::string strHashFromPass = HexStr(hexvec);
        if (TimingResistantEqual(strHashFromPass, strHash)) {
            return true;
        }
    }
    return false;
}
static bool multiUserAuthorized ( std :: string strUserPass ) { if ( strUserPass . find ( ' ' ) == std :: string :: npos ) { return false ; } std :: string strUser = strUserPass . substr ( 0 , strUserPass . find ( ' ' ) ) ; std :: string strPass = strUserPass . substr ( strUserPass . find ( ' ' ) + 1 ) ; for ( const std :: string & strRPCAuth : gArgs . GetArgs ( " " ) ) { std :: vector < std :: string > vFields ; boost :: split ( vFields , strRPCAuth , boost :: is_any_of ( " " ) ) ; if ( vFields . size ( ) != 3 ) { continue ; } std :: string strName = vFields [ 0 ] ; if ( ! TimingResistantEqual ( strName , strUser ) ) { continue ; } std :: string strSalt = vFields [ 1 ] ; std :: string strHash = vFields [ 2 ] ; static const unsigned int KEY_SIZE = 32 ; unsigned char out [ KEY_SIZE ] ; CHMAC_SHA256 ( reinterpret_cast < const unsigned char * > ( strSalt . data ( ) ) , strSalt . size ( ) ) . Write ( reinterpret_cast < const unsigned char * > ( strPass . data ( ) ) , strPass . size ( ) ) . Finalize ( out ) ; std :: vector < unsigned char > hexvec ( out , out + KEY_SIZE ) ; std :: string strHashFromPass = HexStr ( hexvec ) ; if ( TimingResistantEqual ( strHashFromPass , strHash ) ) { return true ; } } return false ; }
This function checks username and password against -rpcauth
entries from config file.
This function checks username and password against - rpcauth entries from config file .
//Search for multi-user login/pass "rpcauth" from config //Incorrect formatting in config file