X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fuserdir-ldap-cgi.git;a=blobdiff_plain;f=login.cgi;h=71536040f0df7e44a7fedb4327ae9379792157fa;hp=60358a686228270d4abdfa181cfce1576447c25f;hb=HEAD;hpb=b62107bcdbc4fb5311f981999d838de38243e46f diff --git a/login.cgi b/login.cgi index 60358a6..7153604 100755 --- a/login.cgi +++ b/login.cgi @@ -1,7 +1,9 @@ #!/usr/bin/perl -# $Id: login.cgi,v 1.6 2000/05/06 06:10:05 tausq Exp $ +# $Id: login.cgi,v 1.10 2006/12/22 08:58:50 rmurray Exp $ # (c) 1999 Randolph Chung. Licensed under the GPL. +# (c) 2006 Ryan Murray. Licensed under the GPL. +# Copyright (c) 2008, 2011, 2015 Peter Palfrader use lib '.'; use strict; @@ -9,24 +11,20 @@ use strict; use CGI; use Util; use URI::Escape; -use Crypt::Blowfish; -use Net::LDAP qw(:all); +use Net::LDAP qw(LDAP_SUCCESS LDAP_PROTOCOL_ERROR); my %config = &Util::ReadConfigFile; my $query = new CGI; my $proto = ($ENV{HTTPS} ? "https" : "http"); -if (!($query->param('username')) || !($query->param('password'))) { - print "Location: $proto://$ENV{SERVER_NAME}/$config{webloginurl}\n\n"; +if ($proto eq "http" || !($query->param('username')) || !($query->param('password'))) { + print "Location: https://$ENV{SERVER_NAME}/$config{webloginhtml}\n\n"; exit; } -my $key = &Util::CreateKey($config{blowfishkeylen}); # human-readable version of the key -my $hrkey = unpack("H".($config{blowfishkeylen}*2), $key); -my $cipher = new Crypt::Blowfish $key; - my $ldap = Net::LDAP->new($config{ldaphost}) || &Util::HTMLError($!); +&Util::UpgradeConnection($ldap) unless $config{usessl} eq 'False'; my $username = $query->param('username'); my $password = $query->param('password'); @@ -46,7 +44,7 @@ if ($mesg->code == LDAP_SUCCESS) { my $oldpassword = $entries->{$dn}->{userpassword}->[0]; if ($oldpassword !~ /^{crypt}\$1\$/) { # Update their password to md5 - open (LOG, ">$config{weblogfile}"); + open (LOG, ">>$config{weblogfile}"); print LOG scalar(localtime); print LOG ": Updating MD5 password for $dn\n"; close LOG; @@ -55,20 +53,19 @@ if ($mesg->code == LDAP_SUCCESS) { } ## END HACK HACK HACK - my $cryptid = &Util::SavePasswordToFile($username, $password, $cipher); + my $authtoken = &Util::SavePasswordToFile($username, $password); if ($query->param('update')) { - my $url = "$proto://$ENV{SERVER_NAME}/$config{webupdateurl}?id=$username&authtoken=$cryptid,$hrkey&editdn="; - $url .= uri_escape("uid=$username,$config{basedn}", "\x00-\x40\x7f-\xff"); + my $url = "$proto://$ENV{SERVER_NAME}/$config{webupdateurl}?id=$username;authtoken=$authtoken"; print "Location: $url\n\n"; } else { - my $url = "$proto://$ENV{SERVER_NAME}/$config{websearchurl}?id=$username&authtoken=$cryptid,$hrkey"; + my $url = "$proto://$ENV{SERVER_NAME}/$config{websearchurl}?id=$username;authtoken=$authtoken"; print "Location: $url\n\n"; } $ldap->unbind; } else { - print "Content-type: text/html\n\n"; + print "Content-type: text/html; charset=utf-8\n\n"; print "

Not authenticated

\n"; }