wrouesnel / vouch / 37319476592

51%

Build Type

push

github

Committed by wrouesnel

Commit Message

Bound the lockout threshold and let a PSO's threshold of 0 win

From CodeQL's go/incorrect-integer-conversion alert: the threshold read
from AD drives how many re-lock binds vouch makes, but nothing bounded
it. AD's maximum is 999; anything larger is now refused before the
account is touched.

While there: if a password settings object applied with a threshold of
0 (lockout disabled for that user), vouch fell through to the domain's
threshold. The PSO takes precedence, so that now returns
ErrLockoutNotConfigured. Checked on the Samba DC by setting
vouch-test-pso to 0: refused, account untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014EBFSg4NggxD8rZCRVtH1U

Coverage Stats

0 of 3 new or added lines in 1 file covered. (0.0%)

1 existing line in 1 file now uncovered.

1016 of 1997 relevant lines covered (50.88%)

8.2 hits per line