- $status =~ s/:.*//; # remove verification hmac, it's just noise here.
- my $e = "<tr><td>$hosts</td>
- <td>$status</td>
+ if ($status =~ /^confirmed:/) {
+ my $data = join(':', 'password-is-confirmed', 'sudo', $data{'uid'}, $uuid, $hosts, $crypted);
+ my $hmac = hmac_sha1_hex( $data, $hmac_key);
+ if ($status eq "confirmed:$hmac") {
+ $status = 'confirmed';
+ } else {
+ $status = 'INVALID';
+ }
+ }
+ my $e = "<tr><td>".CGI::escapeHTML($hosts)."</td>
+ <td>".CGI::escapeHTML($status)."</td>