|
0
|
1 #! @PERL@ -wT |
|
|
2 |
|
|
3 # Change a DCC end-user's password |
|
|
4 |
|
|
5 # Copyright (c) 2008 by Rhyolite Software, LLC |
|
|
6 # |
|
|
7 # This agreement is not applicable to any entity which sells anti-spam |
|
|
8 # solutions to others or provides an anti-spam solution as part of a |
|
|
9 # security solution sold to other entities, or to a private network |
|
|
10 # which employs the DCC or uses data provided by operation of the DCC |
|
|
11 # but does not provide corresponding data to other users. |
|
|
12 # |
|
|
13 # Permission to use, copy, modify, and distribute this software without |
|
|
14 # changes for any purpose with or without fee is hereby granted, provided |
|
|
15 # that the above copyright notice and this permission notice appear in all |
|
|
16 # copies and any distributed versions or copies are either unchanged |
|
|
17 # or not called anything similar to "DCC" or "Distributed Checksum |
|
|
18 # Clearinghouse". |
|
|
19 # |
|
|
20 # Parties not eligible to receive a license under this agreement can |
|
|
21 # obtain a commercial license to use DCC by contacting Rhyolite Software |
|
|
22 # at sales@rhyolite.com. |
|
|
23 # |
|
|
24 # A commercial license would be for Distributed Checksum and Reputation |
|
|
25 # Clearinghouse software. That software includes additional features. This |
|
|
26 # free license for Distributed ChecksumClearinghouse Software does not in any |
|
|
27 # way grant permision to use Distributed Checksum and Reputation Clearinghouse |
|
|
28 # software |
|
|
29 # |
|
|
30 # THE SOFTWARE IS PROVIDED "AS IS" AND RHYOLITE SOFTWARE, LLC DISCLAIMS ALL |
|
|
31 # WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES |
|
|
32 # OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL RHYOLITE SOFTWARE, LLC |
|
|
33 # BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES |
|
|
34 # OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, |
|
|
35 # WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, |
|
|
36 # ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS |
|
|
37 # SOFTWARE. |
|
|
38 # Rhyolite Software DCC 1.3.103-1.19 $Revision$ |
|
|
39 # @configure_input@ |
|
|
40 |
|
|
41 # This file must protected with equivalents to the httpd.conf lines |
|
|
42 # in the README file. |
|
|
43 |
|
|
44 use strict 'subs'; |
|
|
45 use 5.004; |
|
|
46 use Fcntl qw(:DEFAULT :flock); |
|
|
47 |
|
|
48 |
|
|
49 sub emsg { |
|
|
50 my($msg) = html_str_encode(@_); |
|
|
51 |
|
|
52 $msg =~ s/^\s+//; |
|
|
53 $msg =~ s/\s+$//; |
|
|
54 $msg =~ s/\n/<BR>\n/g; |
|
|
55 |
|
|
56 return "<P class=warn>$msg"; |
|
|
57 } |
|
|
58 |
|
|
59 |
|
|
60 my($preq, $passwd1, $passwd2, @file, %dict, |
|
|
61 $locked, $result_msg, $restart_url); |
|
|
62 |
|
|
63 # get DCC parameters |
|
|
64 local($DCCM_USERDIRS, |
|
|
65 $hostname, |
|
|
66 $user, |
|
|
67 $whiteclnt_lock, |
|
|
68 $edit_url, $passwd_url, |
|
|
69 $url_ques, $url_suffix, |
|
|
70 $form_hidden); |
|
|
71 do('@cgibin@/common') || die("could not get DCC configuration: $!\n"); |
|
|
72 |
|
|
73 read_whiteclnt(\@file, \%dict); |
|
|
74 |
|
|
75 |
|
|
76 $webusers="@prefix@/$DCCM_USERDIRS/webusers"; |
|
|
77 $webusers_lock="$webusers.lock"; |
|
|
78 |
|
|
79 $passwd1 = $query{passwd1} ? $query{passwd1} : ""; |
|
|
80 $passwd2 = $query{passwd2} ? $query{passwd2} : ""; |
|
|
81 if ($hostname eq "www.rhyolite.com" |
|
|
82 && $ENV{AuthName} && $ENV{AuthName} eq "DCC-demo-cgi" |
|
|
83 && $user eq "cgi-demo" |
|
|
84 && $passwd1 && $passwd2 && $passwd1 eq $passwd2) { |
|
|
85 $passwd1 = "cgi-demo"; |
|
|
86 $passwd2 = "cgi-demo"; |
|
|
87 } |
|
|
88 |
|
|
89 $preq="The password must be 4 or more characters."; |
|
|
90 $locked = ($whiteclnt_lock =~ /\blocked/) ? " disabled" : ""; |
|
|
91 if ($locked) { |
|
|
92 $result_msg = emsg("$whiteclnt locked; password not changed"); |
|
|
93 } elsif (!$passwd1) { |
|
|
94 if ($locked) { |
|
|
95 $result_msg = emsg("$whiteclnt locked"); |
|
|
96 } else { |
|
|
97 $result_msg = html_str_encode($preq); |
|
|
98 } |
|
|
99 } elsif (length($passwd1) < 4) { |
|
|
100 $result_msg = emsg("$preq"); |
|
|
101 |
|
|
102 } elsif ($passwd1 ne $passwd2) { |
|
|
103 $result_msg = emsg("The two copies of the password differ."); |
|
|
104 } elsif ($passwd1 !~ /^([^'"`]+)$/) { |
|
|
105 $result_msg = emsg("Quotes are not allowed in passwords."); |
|
|
106 } else { |
|
|
107 $passwd1 = $1; # quite Perl taint warnings |
|
|
108 |
|
|
109 # use a separate lock file in case htpasswd does some locking of its own |
|
|
110 if (!sysopen(LOCKFH, "$webusers_lock", O_WRONLY | O_CREAT)) { |
|
|
111 $result_msg = emsg("open($webusers_lock): $!"); |
|
|
112 } elsif (!flock(LOCKFH, LOCK_EX | LOCK_NB)) { |
|
|
113 $result_msg = emsg("$webusers_lock busy: $!\nTry again"); |
|
|
114 close(LOCKFH); |
|
|
115 } else { |
|
|
116 $locked = " disabled"; |
|
|
117 open(CMD, "@HTPASSWD@ -b $webusers '$user' '$passwd1' 2>&1 |"); |
|
|
118 if (!read(CMD, $result_msg, 1000)) { |
|
|
119 $result_msg = emsg("read(htpasswd): $!"); |
|
|
120 # put the error message into the Apache error log |
|
|
121 print STDERR "DCC cgi chgpasswd $result_msg\n"; |
|
|
122 $result_msg = emsg($result_msg); |
|
|
123 close(CMD); |
|
|
124 close(LOCKFH); |
|
|
125 } else { |
|
|
126 close(LOCKFH); |
|
|
127 if (!close(CMD)) { |
|
|
128 $result_msg = ($! ? "$result_msg\nclose(htpasswd): $!" |
|
|
129 : "$result_msg\nhtpasswd exit status $?"); |
|
|
130 # put the error message into the Apache error log |
|
|
131 print STDERR "DCC cgi chgpasswd $result_msg\n"; |
|
|
132 $result_msg = emsg($result_msg); |
|
|
133 } else { |
|
|
134 $restart_url = ($query{goback} && $query{goback} ne $passwd_url |
|
|
135 ? "$query{goback}$url_suffix" |
|
|
136 : $edit_url); |
|
|
137 $restart_url .= $url_ques; |
|
|
138 } |
|
|
139 } |
|
|
140 } |
|
|
141 } |
|
|
142 |
|
|
143 html_head("Change DCC Password for $user", $restart_url); |
|
|
144 |
|
|
145 print "<H3>Change DCC Password for <EM>$user</EM></H3>\n<P>\n"; |
|
|
146 |
|
|
147 common_buttons(); |
|
|
148 print <<EOF; |
|
|
149 </TABLE> |
|
|
150 |
|
|
151 <P> |
|
|
152 <FORM action="$ENV{SCRIPT_NAME}" name=form method=POST> |
|
|
153 <TABLE border=0 cellspacing=1 cellpadding=1> |
|
|
154 <TR><TD align=right><LABEL for=passwd1>Password</LABEL> |
|
|
155 <TD><INPUT$locked id=passwd1 type=password name=passwd1 maxlength=12 value="$passwd1"> |
|
|
156 <TR><TD align=right><LABEL for=passwd2>Confirm</LABEL> |
|
|
157 <TD><INPUT$locked id=passwd2 type=password name=passwd2 maxlength=12 value="$passwd2"> |
|
|
158 <TR><TD><INPUT type=submit $locked value="Change">$form_hidden |
|
|
159 </TABLE> |
|
|
160 </FORM> |
|
|
161 |
|
|
162 <P> |
|
|
163 $result_msg |
|
|
164 |
|
|
165 EOF |
|
|
166 html_footer(); |
|
|
167 print "</BODY>\n</HTML>\n"; |
