Online registration now sends email. The confirmation URL doesn't

[disorder] / server / dcgi.c

diff --git a/server/dcgi.c b/server/dcgi.c
index 08203f8052f16a37fd46ac298a55eb52d53fe58d..d8783305c1563b754e3387780abe2e897d99872c 100644 (file)
--- a/server/dcgi.c
+++ b/server/dcgi.c
@@ -54,6 +54,9 @@
 #include "trackname.h"
 #include "charset.h"
 #include "dcgi.h"
+#include "url.h"
+#include "mime.h"
+#include "sendmail.h"
 
 char *login_cookie;
 
@@ -103,21 +106,28 @@ static const char *front_url(void) {
 
 static void header_cookie(struct sink *output) {
   struct dynstr d[1];
-  char *s;
+  struct url u;
 
+  memset(&u, 0, sizeof u);
+  dynstr_init(d);
+  parse_url(config->url, &u);
   if(login_cookie) {
-    dynstr_init(d);
-    for(s = login_cookie; *s; ++s) {
-      if(*s == '"')
-       dynstr_append(d, '\\');
-      dynstr_append(d, *s);
-    }
-    dynstr_terminate(d);
-    byte_xasprintf(&s, "disorder=\"%s\"", d->vec); /* TODO domain, path, expiry */
-    cgi_header(output, "Set-Cookie", s);
-  } else
+    dynstr_append_string(d, "disorder=");
+    dynstr_append_string(d, quote822(login_cookie, 0));
+  } else {
     /* Force browser to discard cookie */
-    cgi_header(output, "Set-Cookie", "disorder=none;Max-Age=0");
+    dynstr_append_string(d, "disorder=none;Max-Age=0");
+  }
+  if(u.path) {
+    /* The default domain matches the request host, so we need not override
+     * that.  But the default path only goes up to the rightmost /, which would
+     * cause the browser to expose the cookie to other CGI programs on the same
+     * web server. */
+    dynstr_append_string(d, ";Path=");
+    dynstr_append_string(d, quote822(u.path, 0));
+  }
+  dynstr_terminate(d);
+  cgi_header(output, "Set-Cookie", d->vec);
 }
 
 static void redirect(struct sink *output) {
@@ -488,7 +498,8 @@ static void act_logout(cgi_sink *output,
 static void act_register(cgi_sink *output,
                         dcgi_state *ds) {
   const char *username, *password, *email;
-  char *confirm;
+  char *confirm, *content_type;
+  const char *text, *encoding, *charset;
 
   username = cgi_get("username");
   password = cgi_get("password");
@@ -521,6 +532,18 @@ static void act_register(cgi_sink *output,
     expand_template(ds, output, "login");
     return;
   }
+  /* Send the user a mail */
+  /* TODO templatize this */
+  byte_xasprintf((char **)&text,
+                "Welcome to DisOrder.  To active your login, please visit this URL:\n"
+                "\n"
+                "  %s?confirm=%s\n", config->url, confirm);
+  if(!(text = mime_encode_text(text, &charset, &encoding)))
+    fatal(0, "cannot encode email");
+  byte_xasprintf(&content_type, "text/plain;charset=%s",
+                quote822(charset, 0));
+  sendmail("", config->mail_sender, email, "Welcome to DisOrder",
+          encoding, content_type, text); /* TODO error checking  */
   /* We'll go back to the login page with a suitable message */
   cgi_set_option("registered", "registeredok");
   expand_template(ds, output, "login");