close $reportfh or die $!;
srcdump_install($c,$v, $dumpdir, 'licence', 'text/plain');
$!=0;
- my @cmd = (qw(tar -zvvcf), "$dumpdir/source.tmp",
+ my @cmd = (qw(sh -ec), 'exec >&2 "$@"', qw(x),
+ qw(tar -zvvcf), "$dumpdir/source.tmp",
"-C", $dumpdir, qw( --), @srcfiles);
my $r = system(@cmd);
if ($r) {
Params => { } });
}
- my $cooks = $r->_ch('get_cookie');
+ my $cooksraw = $r->_ch('get_cookie');
+ my $cooks = $r->_unblind($cooksraw);
if ($r->{S}{encrypted_only} && !$r->_ch('is_https')) {
return ({ Kind => 'REDIRECT-HTTPS',
}
my $meth = $r->_ch('get_method');
- my $parmh = $r->_rp('assoc_param_name');
+ my $parmhraw = $r->_rp('assoc_param_name');
+ my $parmh = $r->_unblind($parmhraw);
my $cookh = defined $cooks ? $r->hash($cooks) : undef;
my ($cookt,$cooku) = $r->_identify($cookh, $cooks);
return ({ Kind => 'REDIRECT-LOGGEDOUT',
Message => $r->_gt("Logging out..."),
_CookieRaw => '',
- Params => { } });
+ Params => {
+ $r->{S}{loggedout_param_names}[0] => [ 1 ],
+ } });
}
if ($r->_ch('is_loggedout')) {
die unless $meth eq 'GET';
" enabled. You must enable cookies".
" as we use them for login."),
_CookieRaw => $r->_fresh_secret(),
- Params => $r->_chain_params() })
+ Params => $r->chain_params() })
}
if (!$cookt || $cookt eq 'n' || $cookh ne $parmh) {
$r->_db_revoke($cookh);
return ({ Kind => 'LOGIN-BAD',
Message => $login_errormessage,
_CookieRaw => $cooks,
- Params => $r->_chain_params() })
+ Params => $r->chain_params() })
}
$r->_db_record_login_ok($parmh,$username);
return ({ Kind => 'REDIRECT-LOGGEDIN',
Message => $r->_gt("Logging in..."),
_CookieRaw => $cooks,
- Params => $r->_chain_params() });
+ Params => $r->chain_params() });
}
if ($cookt eq 't') {
$cookt = '';
return ({ Kind => 'LOGIN-INCOMINGLINK',
Message => $r->_gt("You need to log in."),
_CookieRaw => $news,
- Params => $r->_chain_params() });
+ Params => $r->chain_params() });
} else {
$r->_db_revoke($parmh);
return ({ Kind => 'LOGIN-FRESH',
die unless $cookh eq $parmh;
}
$r->{ParmT} = $parmt;
- $r->{AssocSecret} = $cooks;
+ $r->{AssocRaw} = $cooks;
$r->{UserOK} = $cooku;
#print STDERR "C-D-C OK\n";
return undef;
}
-sub _chain_params ($) {
-# =item C<< $authreq->_chain_params() >>
-#
-# Returns a hash of the "relevant" parameters to this request, in a form
-# used by C<url_with_query_params>. This is all of the query parameters
-# which are not related to CGI::Auth::Flexible. The PATH_INFO from the
-# request is returned as the parameter C<< '' >>.
-
+sub chain_params ($) {
my ($r) = @_;
my %p = %{ $r->_ch('get_params') };
foreach my $pncn (keys %{ $r->{S} }) {
$r->{Divert} = $r->_db_transaction(sub { $r->_check_divert_core(); });
$dbh->commit();
- my $cookraw = $r->{_CookieRaw};
- $r->{CookieSecret} = $$cookraw;
+ my $divert = $r->{Divert};
+ my $cookraw = $divert->{_CookieRaw};
+ $divert->{CookieSecret} = $r->_blind($cookraw);
+ if ($cookraw) {
+ $divert->{Params}{$r->{S}{assoc_param_name}} = [
+ $r->_blind($r->hash($cookraw))
+ ];
+ }
- $r->_debug(Data::Dumper->Dump([$r->{Divert}],[qw(divert)]));
- return $r->{Divert};
+ $r->_debug(Data::Dumper->Dump([$divert],[qw(divert)]));
+ return $divert;
}
sub get_divert ($) {
# for redirects, we honour stored Params and Cookie,
# as we would for non-divert
if ($kind eq 'REDIRECT-LOGGEDOUT') {
- $params->{$r->{S}{loggedout_param_names}[0]} = [ 1 ];
- } elsif ($kind eq 'REDIRECT-LOGOUT') {
- $params->{$r->{S}{logout_param_names}[0]} = [ 1 ];
} elsif ($kind =~ m/REDIRECT-(?:LOGGEDIN|HTTPS)/) {
} else {
die;
return 0;
}
- if (defined $cookiesecret) {
- $params->{$r->{S}{assoc_param_name}} = [ $r->hash($cookiesecret) ];
- }
-
my ($title, @body);
if ($kind =~ m/^LOGIN-/) {
$title = $r->_gt('Login');
return $out;
}
+sub _blind_len ($$) {
+ my ($r, $str) = @_;
+ return length($str =~ y/0-9a-f//cdr);
+}
+
+sub _blind_combine ($$$) {
+ my ($r, $in, $mask) = @_;
+ my @mask = split //, $mask;
+ $in =~ s{[0-9a-f]}{
+ my $m = shift @mask;
+ sprintf "%x", hex($m) ^ hex($&);
+ }ge;
+ return $in;
+}
+
+sub _blind ($$) {
+ my ($r, $in) = @_;
+ return $in unless $in;
+ my $l = $r->_blind_len($in);
+ my $mask = $r->_random(($l+1)>>1);
+ $mask = substr $mask, 0, $l;
+ my $blound = $r->_blind_combine($in, $mask);
+ return "$blound.$mask";
+}
+
+sub _unblind ($$) {
+ my ($r, $in) = @_;
+ return $in unless $in;
+ my ($blound,$mask) = ($in =~ m#^(.*)\.([0-9a-f]+)$#) or die "$in ?";
+ my $l = $r->_blind_len($blound);
+ $l == length($mask) or die "$in ?";
+ return $r->_blind_combine($blound, $mask);
+}
+
sub _random_key ($) {
my ($r) = @_;
#print STDERR "_random_key\n";
sub secret_cookie_val ($) {
my ($r) = @_;
$r->_assert_checked();
- return defined $r->{AssocSecret} ? $r->{AssocSecret} : '';
+ return defined $r->{AssocRaw} ? $r->_blind($r->{AssocRaw}) : '';
}
sub secret_hidden_val ($) {
my ($r) = @_;
$r->_assert_checked();
- return defined $r->{AssocSecret} ? $r->hash($r->{AssocSecret}) : '';
+ return defined $r->{AssocRaw} ? $r->_blind($r->hash($r->{AssocRaw})) : '';
}
sub secret_hidden_html ($) {