Bug in Auth-Type = System and empty password?

Dear Round Cornered Friends --

It appears that there's a bug where a user has no password
and Auth-Type = System.  The comments in the code say
it should fail the login; but the code lets them in.

In radiusd.c line 201 we return 0 when we should return -1.
        /*
         * Forbid logins on passwordless accounts
         */
        if (encrypted_pass[0] == 0)
                return 0;

My version:

"@(#) $Id: auth.c,v 1.47.2.2 2002/05/30 14:06:41 gray Exp $";


Many thanks for a greatly useful piece of software.

All best,
Jonathan.
-- 
____________________________________________________________________
Imagination  25 Store Street South Crescent London WC1E 7BL England |
             Tel +44 20 7323 3300    Fax +44 20 7323 5801           |
             _______________________________________________________|