blinding: Move another setting of Params into check_divert

[cgi-auth-flexible.git] / cgi-auth-flexible.pm

diff --git a/cgi-auth-flexible.pm b/cgi-auth-flexible.pm
index 284a23dcee5a9bd1c179dac330d9461bfd0dd38b..8eeea922f0ebd7e5b03347b2b1f44cb8f6d091c5 100644 (file)
--- a/cgi-auth-flexible.pm
+++ b/cgi-auth-flexible.pm
@@ -353,6 +353,7 @@ sub srcdump_dirscan_prepare ($$) {
     };
     my %dirsdone;
     foreach my $item ($v->_ch('srcdump_listitems')) {
+       next unless defined $item;
        if ($item eq '.' && $v->{S}{srcdump_filter_cwd}) {
            my @bad = grep { !m#^/# } values %INC;
            die "filtering . from srcdump items and \@INC but already".
@@ -477,11 +478,11 @@ sub new_verifier {
            },
            srcdump_process_item => \&srcdump_process_item,
            srcdump_vcs_dirs => [qw(.git .hg .bzr .svn)],
-           srcdump_vcsscript => [git => "
+           srcdump_vcsscript => {git => "
                  git ls-files -z
                  git ls-files -z --others --exclude-from=.gitignore
                  find .git -print0
-                            "],
+                            "},
            srcdump_byvcs => \&srcdump_byvcs,
            srcdump_novcs => \&srcdump_novcs,
            srcdump_excludes => [qw(*~ *.bak *.tmp), '#*#'],
@@ -500,14 +501,14 @@ sub new_verifier {
        $verifier->{S}{$k} = $v;
     }
     $verifier->{S}{db_setup_stmts} //=
-       ["CREATE TABLE $v->{S}{db_prefix}_assocs (".
+       ["CREATE TABLE $verifier->{S}{db_prefix}_assocs (".
         " assochash VARCHAR PRIMARY KEY,".
         " username VARCHAR NOT NULL,".
         " last INTEGER NOT NULL".
         ")"
         ,
-        "CREATE INDEX $v->{S}{db_prefix}_assocs_timeout_index".
-        " ON $v->{S}{db_prefix}_assocs".
+        "CREATE INDEX $verifier->{S}{db_prefix}_assocs_timeout_index".
+        " ON $verifier->{S}{db_prefix}_assocs".
         " (last)"
        ];
     bless $verifier, $class;
@@ -786,7 +787,7 @@ sub _check_divert_core ($) {
        die if $srcdump =~ m/\W/;
        return ({ Kind => 'SRCDUMP-'.uc $srcdump,
                  Message => undef,
-                 CookieSecret => undef,
+                 _CookieRaw => undef,
                  Params => { } });
     }
 
@@ -795,7 +796,7 @@ sub _check_divert_core ($) {
     if ($r->{S}{encrypted_only} && !$r->_ch('is_https')) {
         return ({ Kind => 'REDIRECT-HTTPS',
                   Message => $r->_gt("Redirecting to secure server..."),
-                  CookieSecret => undef,
+                  _CookieRaw => undef,
                   Params => { } });
     }
 
@@ -817,8 +818,10 @@ sub _check_divert_core ($) {
        $r->_db_revoke($parmh);
        return ({ Kind => 'REDIRECT-LOGGEDOUT',
                  Message => $r->_gt("Logging out..."),
-                 CookieSecret => '',
-                 Params => { } });
+                 _CookieRaw => '',
+                 Params => {
+                     $r->{S}{loggedout_param_names}[0] => [ 1 ],
+                 } });
     }
     if ($r->_ch('is_loggedout')) {
        die unless $meth eq 'GET';
@@ -826,7 +829,7 @@ sub _check_divert_core ($) {
        die if $parmt;
        return ({ Kind => 'SMALLPAGE-LOGGEDOUT',
                  Message => $r->_gt("You have been logged out."),
-                 CookieSecret => '',
+                 _CookieRaw => '',
                  Params => { } });
     }
     if ($r->_ch('is_login')) {
@@ -837,7 +840,7 @@ sub _check_divert_core ($) {
                       Message => $r->_gt("You do not seem to have cookies".
                                          " enabled.  You must enable cookies".
                                          " as we use them for login."),
-                      CookieSecret => $r->_fresh_secret(),
+                      _CookieRaw => $r->_fresh_secret(),
                       Params => $r->_chain_params() })
         }
         if (!$cookt || $cookt eq 'n' || $cookh ne $parmh) {
@@ -845,7 +848,7 @@ sub _check_divert_core ($) {
             return ({ Kind => 'LOGIN-STALE',
                       Message => $r->_gt("Stale session;".
                                          " you need to log in again."),
-                      CookieSecret => $r->_fresh_secret(),
+                      _CookieRaw => $r->_fresh_secret(),
                       Params => { } })
         }
        die unless $parmt eq 't' || $parmt eq 'y';
@@ -855,13 +858,13 @@ sub _check_divert_core ($) {
                 if !$login_errormessage;
             return ({ Kind => 'LOGIN-BAD',
                       Message => $login_errormessage,
-                      CookieSecret => $cooks,
+                      _CookieRaw => $cooks,
                       Params => $r->_chain_params() })
         }
        $r->_db_record_login_ok($parmh,$username);
        return ({ Kind => 'REDIRECT-LOGGEDIN',
                  Message => $r->_gt("Logging in..."),
-                 CookieSecret => $cooks,
+                 _CookieRaw => $cooks,
                  Params => $r->_chain_params() });
     }
     if ($cookt eq 't') {
@@ -881,13 +884,13 @@ sub _check_divert_core ($) {
        if ($meth eq 'GET') {
            return ({ Kind => 'LOGIN-INCOMINGLINK',
                      Message => $r->_gt("You need to log in."),
-                     CookieSecret => $news,
+                     _CookieRaw => $news,
                      Params => $r->_chain_params() });
        } else {
            $r->_db_revoke($parmh);
            return ({ Kind => 'LOGIN-FRESH',
                       Message => $r->_gt("You need to log in."),
-                      CookieSecret => $news,
+                      _CookieRaw => $news,
                       Params => { } });
        }
     }
@@ -896,7 +899,7 @@ sub _check_divert_core ($) {
        if ($meth ne 'POST') {
            return ({ Kind => 'MAINPAGEONLY',
                      Message => $r->_gt('Entering via cross-site link.'),
-                     CookieSecret => $cooks,
+                     _CookieRaw => $cooks,
                      Params => { } });
            # NB caller must then ignore params & path!
            # if this is too hard they can spit out a small form
@@ -1029,6 +1032,15 @@ sub check_divert ($) {
     my $dbh = $r->{Dbh};
     $r->{Divert} = $r->_db_transaction(sub { $r->_check_divert_core(); });
     $dbh->commit();
+
+    my $cookraw = $r->{_CookieRaw};
+    $r->{CookieSecret} = $$cookraw;
+    if ($cookraw) {
+       $r->{Params}{$r->{S}{assoc_param_name}} = [
+           $r->hash($cookraw)
+           ];
+    }
+
     $r->_debug(Data::Dumper->Dump([$r->{Divert}],[qw(divert)]));
     return $r->{Divert};
 }
@@ -1090,7 +1102,6 @@ sub check_ok ($) {
        # for redirects, we honour stored Params and Cookie,
        # as we would for non-divert
        if ($kind eq 'REDIRECT-LOGGEDOUT') {
-           $params->{$r->{S}{loggedout_param_names}[0]} = [ 1 ];
        } elsif ($kind eq 'REDIRECT-LOGOUT') {
            $params->{$r->{S}{logout_param_names}[0]} = [ 1 ];
        } elsif ($kind =~ m/REDIRECT-(?:LOGGEDIN|HTTPS)/) {
@@ -1108,10 +1119,6 @@ sub check_ok ($) {
        return 0;
     }
 
-    if (defined $cookiesecret) {
-        $params->{$r->{S}{assoc_param_name}} = [ $r->hash($cookiesecret) ];
-    }
-
     my ($title, @body);
     if ($kind =~ m/^LOGIN-/) {
        $title = $r->_gt('Login');