Mercurial > notdcc

comparison cgi-bin/chgpasswd.in @ 0:c7f6b056b673

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
First import of vendor version
author Peter Gervai <grin@grin.hu>
date Tue, 10 Mar 2009 13:49:58 +0100
parents
children
comparison
equal deleted inserted replaced
-1:000000000000 0:c7f6b056b673
1 #! @PERL@ -wT
2
3 # Change a DCC end-user's password
4
5 # Copyright (c) 2008 by Rhyolite Software, LLC
6 #
7 # This agreement is not applicable to any entity which sells anti-spam
8 # solutions to others or provides an anti-spam solution as part of a
9 # security solution sold to other entities, or to a private network
10 # which employs the DCC or uses data provided by operation of the DCC
11 # but does not provide corresponding data to other users.
12 #
13 # Permission to use, copy, modify, and distribute this software without
14 # changes for any purpose with or without fee is hereby granted, provided
15 # that the above copyright notice and this permission notice appear in all
16 # copies and any distributed versions or copies are either unchanged
17 # or not called anything similar to "DCC" or "Distributed Checksum
18 # Clearinghouse".
19 #
20 # Parties not eligible to receive a license under this agreement can
21 # obtain a commercial license to use DCC by contacting Rhyolite Software
22 # at sales@rhyolite.com.
23 #
24 # A commercial license would be for Distributed Checksum and Reputation
25 # Clearinghouse software. That software includes additional features. This
26 # free license for Distributed ChecksumClearinghouse Software does not in any
27 # way grant permision to use Distributed Checksum and Reputation Clearinghouse
28 # software
29 #
30 # THE SOFTWARE IS PROVIDED "AS IS" AND RHYOLITE SOFTWARE, LLC DISCLAIMS ALL
31 # WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
32 # OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL RHYOLITE SOFTWARE, LLC
33 # BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
34 # OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
35 # WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
36 # ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
37 # SOFTWARE.
38 # Rhyolite Software DCC 1.3.103-1.19 $Revision$
39 # @configure_input@
40
41 # This file must protected with equivalents to the httpd.conf lines
42 # in the README file.
43
44 use strict 'subs';
45 use 5.004;
46 use Fcntl qw(:DEFAULT :flock);
47
48
49 sub emsg {
50 my($msg) = html_str_encode(@_);
51
52 $msg =~ s/^\s+//;
53 $msg =~ s/\s+$//;
54 $msg =~ s/\n/<BR>\n/g;
55
56 return "<P class=warn>$msg";
57 }
58
59
60 my($preq, $passwd1, $passwd2, @file, %dict,
61 $locked, $result_msg, $restart_url);
62
63 # get DCC parameters
64 local($DCCM_USERDIRS,
65 $hostname,
66 $user,
67 $whiteclnt_lock,
68 $edit_url, $passwd_url,
69 $url_ques, $url_suffix,
70 $form_hidden);
71 do('@cgibin@/common') || die("could not get DCC configuration: $!\n");
72
73 read_whiteclnt(\@file, \%dict);
74
75
76 $webusers="@prefix@/$DCCM_USERDIRS/webusers";
77 $webusers_lock="$webusers.lock";
78
79 $passwd1 = $query{passwd1} ? $query{passwd1} : "";
80 $passwd2 = $query{passwd2} ? $query{passwd2} : "";
81 if ($hostname eq "www.rhyolite.com"
82 && $ENV{AuthName} && $ENV{AuthName} eq "DCC-demo-cgi"
83 && $user eq "cgi-demo"
84 && $passwd1 && $passwd2 && $passwd1 eq $passwd2) {
85 $passwd1 = "cgi-demo";
86 $passwd2 = "cgi-demo";
87 }
88
89 $preq="The password must be 4 or more characters.";
90 $locked = ($whiteclnt_lock =~ /\blocked/) ? " disabled" : "";
91 if ($locked) {
92 $result_msg = emsg("$whiteclnt locked; password not changed");
93 } elsif (!$passwd1) {
94 if ($locked) {
95 $result_msg = emsg("$whiteclnt locked");
96 } else {
97 $result_msg = html_str_encode($preq);
98 }
99 } elsif (length($passwd1) < 4) {
100 $result_msg = emsg("$preq");
101
102 } elsif ($passwd1 ne $passwd2) {
103 $result_msg = emsg("The two copies of the password differ.");
104 } elsif ($passwd1 !~ /^([^'"`]+)$/) {
105 $result_msg = emsg("Quotes are not allowed in passwords.");
106 } else {
107 $passwd1 = $1; # quite Perl taint warnings
108
109 # use a separate lock file in case htpasswd does some locking of its own
110 if (!sysopen(LOCKFH, "$webusers_lock", O_WRONLY | O_CREAT)) {
111 $result_msg = emsg("open($webusers_lock): $!");
112 } elsif (!flock(LOCKFH, LOCK_EX | LOCK_NB)) {
113 $result_msg = emsg("$webusers_lock busy: $!\nTry again");
114 close(LOCKFH);
115 } else {
116 $locked = " disabled";
117 open(CMD, "@HTPASSWD@ -b $webusers '$user' '$passwd1' 2>&1 |");
118 if (!read(CMD, $result_msg, 1000)) {
119 $result_msg = emsg("read(htpasswd): $!");
120 # put the error message into the Apache error log
121 print STDERR "DCC cgi chgpasswd $result_msg\n";
122 $result_msg = emsg($result_msg);
123 close(CMD);
124 close(LOCKFH);
125 } else {
126 close(LOCKFH);
127 if (!close(CMD)) {
128 $result_msg = ($! ? "$result_msg\nclose(htpasswd): $!"
129 : "$result_msg\nhtpasswd exit status $?");
130 # put the error message into the Apache error log
131 print STDERR "DCC cgi chgpasswd $result_msg\n";
132 $result_msg = emsg($result_msg);
133 } else {
134 $restart_url = ($query{goback} && $query{goback} ne $passwd_url
135 ? "$query{goback}$url_suffix"
136 : $edit_url);
137 $restart_url .= $url_ques;
138 }
139 }
140 }
141 }
142
143 html_head("Change DCC Password for $user", $restart_url);
144
145 print "<H3>Change DCC Password for <EM>$user</EM></H3>\n<P>\n";
146
147 common_buttons();
148 print <<EOF;
149 </TABLE>
150
151 <P>
152 <FORM action="$ENV{SCRIPT_NAME}" name=form method=POST>
153 <TABLE border=0 cellspacing=1 cellpadding=1>
154 <TR><TD align=right><LABEL for=passwd1>Password</LABEL>
155 <TD><INPUT$locked id=passwd1 type=password name=passwd1 maxlength=12 value="$passwd1">
156 <TR><TD align=right><LABEL for=passwd2>Confirm</LABEL>
157 <TD><INPUT$locked id=passwd2 type=password name=passwd2 maxlength=12 value="$passwd2">
158 <TR><TD><INPUT type=submit $locked value="Change">$form_hidden
159 </TABLE>
160 </FORM>
161
162 <P>
163 $result_msg
164
165 EOF
166 html_footer();
167 print "</BODY>\n</HTML>\n";