X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=cgi-auth-flexible.git;a=blobdiff_plain;f=cgi-auth-flexible.pm;h=7542b21afeba6eea6e80f6f90b222fb44c3e4b74;hp=954b0218c17b10357e0ab927c708378024cbc279;hb=5cdffac4f5d68ed78abe24d045f02cc33ea07ee5;hpb=103380f163dd8ee94d530e7469b71eba811fd761 diff --git a/cgi-auth-flexible.pm b/cgi-auth-flexible.pm index 954b021..7542b21 100644 --- a/cgi-auth-flexible.pm +++ b/cgi-auth-flexible.pm @@ -17,8 +17,6 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -die "need to fix js hijacking"; - use strict; use warnings FATAL => 'all'; @@ -33,8 +31,6 @@ BEGIN { @ISA = qw(Exporter); @EXPORT = qw(); %EXPORT_TAGS = ( ); # eg: TAG => [ qw!name1 name2! ], - - @EXPORT_OK = qw(); } our @EXPORT_OK; @@ -79,10 +75,11 @@ sub has_a_param ($$) { sub get_params ($) { my ($r) = @_; - my %p; my $c = $r->{Cgi}; - foreach my $name ($c->param()) { - $p{$name} = [ $c->param($name) ]; + my $vars = $c->Vars(); + my %p; + foreach my $name (keys %$vars) { + $p{$name} = [ split "\0", $vars->{$name} ]; } return \%p; } @@ -181,8 +178,9 @@ sub gen_plain_login_link ($$) { sub gen_srcdump_link_html ($$$$) { my ($c,$r,$anchor,$specval) = @_; my %params = ($r->{S}{srcdump_param_name} => [ $specval ]); - return ''. - $anchor.""; + return ''.$anchor.""; } sub gen_plain_licence_link_html ($$) { my ($c,$r) = @_; @@ -282,8 +280,9 @@ sub srcdump_novcs ($$$$$) { sub srcdump_byvcs ($$$$$$) { my ($c, $v, $dumpdir, $dir, $outfn, $vcs) = @_; #print STDERR "BYVCS GIT $dir\n"; - return srcdump_dir_cpio($c,$v,$dumpdir,$dir,$outfn,$vcs, - $v->{S}{"srcdump_vcsscript_$vcs"}); + my $script = $v->{S}{"srcdump_vcsscript"}{$vcs}; + die "no script for vcs $vcs" unless defined $script; + return srcdump_dir_cpio($c,$v,$dumpdir,$dir,$outfn,$vcs,$script); } sub srcdump_file ($$$$) { @@ -354,6 +353,7 @@ sub srcdump_dirscan_prepare ($$) { }; my %dirsdone; foreach my $item ($v->_ch('srcdump_listitems')) { + next unless defined $item; if ($item eq '.' && $v->{S}{srcdump_filter_cwd}) { my @bad = grep { !m#^/# } values %INC; die "filtering . from srcdump items and \@INC but already". @@ -418,14 +418,14 @@ sub new_verifier { my $verifier = { S => { dir => undef, - assocdb_dbh => undef, # must have AutoCommit=0, RaiseError=1 - assocdb_path => 'caf-assocs.db', + db_dbh => undef, # must have AutoCommit=0, RaiseError=1 + db_path => 'caf.db', keys_path => 'caf-keys', srcdump_path => 'caf-srcdump', - assocdb_dsn => undef, - assocdb_user => '', - assocdb_password => '', - assocdb_table => 'caf_assocs', + db_dsn => undef, + db_user => '', + db_password => '', + db_prefix => 'caf', random_source => '/dev/urandom', secretbits => 128, # bits hash_algorithm => "SHA-256", @@ -447,14 +447,13 @@ sub new_verifier { get_path_info => sub { $_[0]->path_info() }, get_cookie => sub { $_[0]->cookie($_[1]->{S}{cookie_name}) }, get_method => sub { $_[0]->request_method() }, - check_https => sub { !!$_[0]->https() }, + is_https => sub { !!$_[0]->https() }, get_url => sub { $_[0]->url(); }, is_login => sub { defined $_[1]->_rp('password_param_name') }, login_ok => \&login_ok_password, username_password_error => sub { die }, is_logout => sub { $_[1]->has_a_param('logout_param_names') }, is_loggedout => sub { $_[1]->has_a_param('loggedout_param_names') }, - is_page => sub { return 1 }, handle_divert => sub { return 0 }, do_redirect => \&do_redirect_cgi, # this hook is allowed to throw cookie_path => "/", @@ -478,16 +477,12 @@ sub new_verifier { $_[2] =~ m#^/etc/|^/usr/(?!local/)(?!lib/cgi)#; }, srcdump_process_item => \&srcdump_process_item, - srcdump_vcs_dirs => [qw(.git .hg .bzr .svn CVS)], - srcdump_vcsscript_git => " + srcdump_vcs_dirs => [qw(.git .hg .bzr .svn)], + srcdump_vcsscript => {git => " git ls-files -z git ls-files -z --others --exclude-from=.gitignore find .git -print0 - ", - srcdump_vcsscript_hg => "false hg", - srcdump_vcsscript_bzr => "false bzr", - srcdump_vcsscript_svn => "false svn", - srcdump_vcsscript_cvs => "false cvs", + "}, srcdump_byvcs => \&srcdump_byvcs, srcdump_novcs => \&srcdump_novcs, srcdump_excludes => [qw(*~ *.bak *.tmp), '#*#'], @@ -500,9 +495,22 @@ sub new_verifier { }; my ($k,$v); while (($k,$v,@_) = @_) { - die "unknown setting $k" unless exists $verifier->{S}{$k}; + die "unknown setting $k" unless + $k =~ m/^promise_/ or + exists $verifier->{S}{$k}; $verifier->{S}{$k} = $v; } + $verifier->{S}{db_setup_stmts} //= + ["CREATE TABLE $verifier->{S}{db_prefix}_assocs (". + " assochash VARCHAR PRIMARY KEY,". + " username VARCHAR NOT NULL,". + " last INTEGER NOT NULL". + ")" + , + "CREATE INDEX $verifier->{S}{db_prefix}_assocs_timeout_index". + " ON $verifier->{S}{db_prefix}_assocs". + " (last)" + ]; bless $verifier, $class; $verifier->_dbopen(); $verifier->_ch('srcdump_prepare'); @@ -525,17 +533,17 @@ sub _dbopen ($) { my $dbh = $v->{Dbh}; return $dbh if $dbh; - $dbh = $v->{S}{assocdb_dbh}; + $dbh = $v->{S}{db_dbh}; if ($dbh) { die if $dbh->{AutoCommit}; die unless $dbh->{RaiseError}; } else { - $v->{S}{assocdb_dsn} ||= "dbi:SQLite:dbname=".$v->_get_path('assocdb'); - my $dsn = $v->{S}{assocdb_dsn}; + $v->{S}{db_dsn} ||= "dbi:SQLite:dbname=".$v->_get_path('db'); + my $dsn = $v->{S}{db_dsn}; my $u = umask 077; - $dbh = DBI->connect($dsn, $v->{S}{assocdb_user}, - $v->{S}{assocdb_password}, { + $dbh = DBI->connect($dsn, $v->{S}{db_user}, + $v->{S}{db_password}, { AutoCommit => 0, RaiseError => 1, ShowErrorStatement => 1, @@ -545,14 +553,9 @@ sub _dbopen ($) { } $v->{Dbh} = $dbh; - $v->_db_setup_do("CREATE TABLE $v->{S}{assocdb_table} (". - " assochash VARCHAR PRIMARY KEY,". - " username VARCHAR NOT NULL,". - " last INTEGER NOT NULL". - ")"); - $v->_db_setup_do("CREATE INDEX $v->{S}{assocdb_table}_timeout_index". - " ON $v->{S}{assocdb_table}". - " (last)"); + foreach my $stmt (@{ $v->{S}{db_setup_stmts} }) { + $v->_db_setup_do($stmt); + } return $dbh; } @@ -653,12 +656,14 @@ sub construct_cookie ($$$) { my ($r, $cooks) = @_; return undef unless $cooks; my $c = $r->{Cgi}; -my @ca = (-name => $r->{S}{cookie_name}, - -value => $cooks, - -path => $r->{S}{cookie_path}, - -domain => $r->_ch('get_cookie_domain'), - -expires => '+'.$r->{S}{login_timeout}.'s', - -secure => $r->{S}{encrypted_only}); + my @ca = ( + -name => $r->{S}{cookie_name}, + -value => $cooks, + -path => $r->{S}{cookie_path}, + -domain => $r->_ch('get_cookie_domain'), + -expires => '+'.$r->{S}{login_timeout}.'s', + -secure => $r->{S}{encrypted_only} + ); my $cookie = $c->cookie(@ca); #print STDERR "CC $r $c $cooks $cookie (@ca).\n"; return $cookie; @@ -666,9 +671,9 @@ my @ca = (-name => $r->{S}{cookie_name}, # pages/param-sets are # n normal non-mutating page -# r retrieval of information for JS, non-mutating +# r retrieval of information for JS etc., non-mutating # m mutating page -# u update of information by JS, mutating +# u update of information by JS etc., mutating # i login # o logout # O "you have just logged out" page load @@ -782,16 +787,16 @@ sub _check_divert_core ($) { die if $srcdump =~ m/\W/; return ({ Kind => 'SRCDUMP-'.uc $srcdump, Message => undef, - CookieSecret => undef, + _CookieRaw => undef, Params => { } }); } my $cooks = $r->_ch('get_cookie'); - if ($r->{S}{encrypted_only} && !$r->_ch('check_https')) { + if ($r->{S}{encrypted_only} && !$r->_ch('is_https')) { return ({ Kind => 'REDIRECT-HTTPS', Message => $r->_gt("Redirecting to secure server..."), - CookieSecret => undef, + _CookieRaw => undef, Params => { } }); } @@ -813,7 +818,7 @@ sub _check_divert_core ($) { $r->_db_revoke($parmh); return ({ Kind => 'REDIRECT-LOGGEDOUT', Message => $r->_gt("Logging out..."), - CookieSecret => '', + _CookieRaw => '', Params => { } }); } if ($r->_ch('is_loggedout')) { @@ -822,7 +827,7 @@ sub _check_divert_core ($) { die if $parmt; return ({ Kind => 'SMALLPAGE-LOGGEDOUT', Message => $r->_gt("You have been logged out."), - CookieSecret => '', + _CookieRaw => '', Params => { } }); } if ($r->_ch('is_login')) { @@ -833,15 +838,15 @@ sub _check_divert_core ($) { Message => $r->_gt("You do not seem to have cookies". " enabled. You must enable cookies". " as we use them for login."), - CookieSecret => $r->_fresh_secret(), - Params => $r->chain_params() }) + _CookieRaw => $r->_fresh_secret(), + Params => $r->_chain_params() }) } if (!$cookt || $cookt eq 'n' || $cookh ne $parmh) { $r->_db_revoke($cookh); return ({ Kind => 'LOGIN-STALE', Message => $r->_gt("Stale session;". " you need to log in again."), - CookieSecret => $r->_fresh_secret(), + _CookieRaw => $r->_fresh_secret(), Params => { } }) } die unless $parmt eq 't' || $parmt eq 'y'; @@ -851,14 +856,14 @@ sub _check_divert_core ($) { if !$login_errormessage; return ({ Kind => 'LOGIN-BAD', Message => $login_errormessage, - CookieSecret => $cooks, - Params => $r->chain_params() }) + _CookieRaw => $cooks, + Params => $r->_chain_params() }) } $r->_db_record_login_ok($parmh,$username); return ({ Kind => 'REDIRECT-LOGGEDIN', Message => $r->_gt("Logging in..."), - CookieSecret => $cooks, - Params => $r->chain_params() }); + _CookieRaw => $cooks, + Params => $r->_chain_params() }); } if ($cookt eq 't') { $cookt = ''; @@ -877,13 +882,13 @@ sub _check_divert_core ($) { if ($meth eq 'GET') { return ({ Kind => 'LOGIN-INCOMINGLINK', Message => $r->_gt("You need to log in."), - CookieSecret => $news, - Params => $r->chain_params() }); + _CookieRaw => $news, + Params => $r->_chain_params() }); } else { $r->_db_revoke($parmh); return ({ Kind => 'LOGIN-FRESH', Message => $r->_gt("You need to log in."), - CookieSecret => $news, + _CookieRaw => $news, Params => { } }); } } @@ -892,7 +897,7 @@ sub _check_divert_core ($) { if ($meth ne 'POST') { return ({ Kind => 'MAINPAGEONLY', Message => $r->_gt('Entering via cross-site link.'), - CookieSecret => $cooks, + _CookieRaw => $cooks, Params => { } }); # NB caller must then ignore params & path! # if this is too hard they can spit out a small form @@ -905,13 +910,21 @@ sub _check_divert_core ($) { die unless $parmt eq 'y'; die unless $cookh eq $parmh; } + $r->{ParmT} = $parmt; $r->{AssocSecret} = $cooks; $r->{UserOK} = $cooku; #print STDERR "C-D-C OK\n"; return undef; } -sub chain_params ($) { +sub _chain_params ($) { +# =item C<< $authreq->_chain_params() >> +# +# Returns a hash of the "relevant" parameters to this request, in a form +# used by C. This is all of the query parameters +# which are not related to CGI::Auth::Flexible. The PATH_INFO from the +# request is returned as the parameter C<< '' >>. + my ($r) = @_; my %p = %{ $r->_ch('get_params') }; foreach my $pncn (keys %{ $r->{S} }) { @@ -950,12 +963,12 @@ sub _identify ($$) { my $dbh = $r->{Dbh}; - $dbh->do("DELETE FROM $r->{S}{assocdb_table}". + $dbh->do("DELETE FROM $r->{S}{db_prefix}_assocs". " WHERE last < ?", {}, time - $r->{S}{login_timeout}); my $row = $dbh->selectrow_arrayref("SELECT username, last". - " FROM $r->{S}{assocdb_table}". + " FROM $r->{S}{db_prefix}_assocs". " WHERE assochash = ?", {}, $h); if (defined $row) { #print STDERR "_identify h=$h s=$s YES @$row\n"; @@ -996,7 +1009,7 @@ sub _db_revoke ($$) { my $dbh = $r->{Dbh}; - $dbh->do("DELETE FROM $r->{S}{assocdb_table}". + $dbh->do("DELETE FROM $r->{S}{db_prefix}_assocs". " WHERE assochash = ?", {}, $h); } @@ -1004,7 +1017,7 @@ sub _db_record_login_ok ($$$) { my ($r,$h,$user) = @_; $r->_db_revoke($h); my $dbh = $r->{Dbh}; - $dbh->do("INSERT INTO $r->{S}{assocdb_table}". + $dbh->do("INSERT INTO $r->{S}{db_prefix}_assocs". " (assochash, username, last) VALUES (?,?,?)", {}, $h, $user, time); } @@ -1017,6 +1030,15 @@ sub check_divert ($) { my $dbh = $r->{Dbh}; $r->{Divert} = $r->_db_transaction(sub { $r->_check_divert_core(); }); $dbh->commit(); + + my $cookraw = $r->{_CookieRaw}; + $r->{CookieSecret} = $$cookraw; + if ($cookraw) { + $r->{Params}{$r->{S}{assoc_param_name}} = [ + $r->hash($cookraw) + ]; + } + $r->_debug(Data::Dumper->Dump([$r->{Divert}],[qw(divert)])); return $r->{Divert}; } @@ -1034,12 +1056,16 @@ sub get_username ($) { return $r->{UserOK}; } -sub url_with_query_params ($$) { - my ($r, $params) = @_; +sub url_with_query_params ($$;$) { + my ($r, $params, $nonpagetype) = @_; #print STDERR "PARAMS ",Dumper($params); my $uri = URI->new($r->_ch('get_url')); $uri->path($uri->path() . $params->{''}[0]) if $params->{''}; - $uri->query_form(flatten_params($params)); + my @flatparams = flatten_params($params); + if (defined $nonpagetype && $r->need_add_hidden('GET',$nonpagetype)) { + push @flatparams, $r->{S}{assoc_param_name}, $r->secret_hidden_val(); + } + $uri->query_form(@flatparams); return $uri->as_string(); } @@ -1071,7 +1097,7 @@ sub check_ok ($) { } if ($kind =~ m/^REDIRECT-/) { - # for redirects, we honour stored NextParams and SetCookie, + # for redirects, we honour stored Params and Cookie, # as we would for non-divert if ($kind eq 'REDIRECT-LOGGEDOUT') { $params->{$r->{S}{loggedout_param_names}[0]} = [ 1 ]; @@ -1092,10 +1118,6 @@ sub check_ok ($) { return 0; } - if (defined $cookiesecret) { - $params->{$r->{S}{assoc_param_name}} = [ $r->hash($cookiesecret) ]; - } - my ($title, @body); if ($kind =~ m/^LOGIN-/) { $title = $r->_gt('Login'); @@ -1279,11 +1301,39 @@ sub check_mutate ($) { $r->_must_be_post(); } -sub mutate_ok ($) { - my ($r) = @_; +our %_resource_get_needs_secret_hidden = + (map { $_ => 0 } qw(PAGE FRAME IFRAME SRCDUMP STYLESHEET FAVICON ROBOTS), + map { $_ => 1 } qw(IMAGE SCRIPT AJAX-XML AJAX-JSON AJAX-OTHER)); + +sub update_get_need_add_hidden ($$;$) { + my ($r, $reqtype, $value, $force) = @_; + my $hash = ref $r + ? ($r->{GetNeedsSecretHidden} ||= { }) + : \%_resource_get_needs_secret_hidden; + return if !$force && + (exists $_resource_get_needs_secret_hidden{$reqtype} || + exists $hash->{$reqtype}); + $hash->{$reqtype} = $value; +} + +sub need_add_hidden ($$) { + my ($r, $method, $reqtype) = @_; + return 1 if $method ne 'GET'; + if (ref $r) { + my $ent = $r->{GetNeedsSecretHidden}{$reqtype}; + return $ent if defined $ent; + } + my $ent = $_resource_get_needs_secret_hidden{$reqtype}; + return $ent if defined $ent; + die "unsupported nonpage GET type $reqtype"; +} + +sub check_nonpage ($$) { + my ($r, $reqtype) = @_; $r->_assert_checked(); - die if $r->{Divert}; - return $r->_is_post(); + return unless $r->resource_get_needs_secret_hidden($reqtype); + return if $r->{ParmT}; + die "missing hidden secret parameter on nonpage request $reqtype"; } #---------- output ----------