otp_state_put(): reset locked flag on successful PUT. We were

        seeing a second PUT if (state_parse() failed, did a put(), returned
        -1 to otp_pw_valid() with locked flag set, and then otp_pw_valid()
        would try to PUT again before returning).

diff --git a/src/modules/rlm_otp/otp_state.c b/src/modules/rlm_otp/otp_state.c
index 335c0ab..4dc6ae5 100644 (file)
--- a/src/modules/rlm_otp/otp_state.c
+++ b/src/modules/rlm_otp/otp_state.c
@@ -139,6 +139,9 @@ otp_state_put(const char *username, otp_user_state_t *user_state,
     goto putfd;
   }
 
+  /* reset locked flag on successful PUT, to avoid further PUT's by caller */
+  user_state->locked = 0;
+
 putfd:
   otp_state_putfd(user_state->fdp, 0, log_prefix);
   return rc;