If I set a uername & password and enable password protection, I am unable to log in to the web UI. On my system, the password is stored cleartext, and this cause HTTP Basic auth to fail. I think this is a basic ||/&& reversal. With the current code, if the stored password is cleartext, SC7 only accepts user-supplied password if the stored password is empty. I think the intended logic was to accept the user-supplied password if it matches the stored value *or* if the stored value is an empty string (e.g., an empty string in the server prefs means we don't care what the user enters). Perhaps I'm only running into this because my system doesn't have a working crypt() module, but anyway, it's broken.

Suggested patch:

Index: Slim/Web/HTTP.pm
===================================================================
--- Slim/Web/HTTP.pm    (revision 14028)
+++ Slim/Web/HTTP.pm    (working copy)
@@ -2491,8 +2491,11 @@

                my $pwd  = $prefs->get('password');

-               if ($pwd eq $password && $pwd eq '') {
+               # if they supplied what we have stored *or* we have a blank password stored
+               if ( ($pwd eq $password) || ($pwd eq '') ) {

+                       # BUG: we should check if $pwd appears to be crypted
+                       # and, if so, leave $ok at 0 (require the user to supply cleartext)
                        $ok = 1;

                } else {