X-Git-Url: http://www.dolda2000.com/gitweb/?a=blobdiff_plain;f=src%2Fhtextauth.c;h=c12e1a47398e3f509d64469f3003186d8f4ed899;hb=HEAD;hp=27217e01e1bbf0dc41b8ac4f8d1287c3366b46e5;hpb=baaabaf72db3a414319824ced4ff99292801a06a;p=ashd.git diff --git a/src/htextauth.c b/src/htextauth.c index 27217e0..c12e1a4 100644 --- a/src/htextauth.c +++ b/src/htextauth.c @@ -82,6 +82,38 @@ static void reqauth(struct hthead *req, int fd) buffree(buf); } +static void authinval(struct hthead *req, int fd, char *msg) +{ + struct charbuf buf; + FILE *out; + char *rn; + + rn = realm; + if(rn == NULL) + rn = "auth"; + bufinit(buf); + bufcatstr(buf, "\r\n"); + bufcatstr(buf, "\r\n"); + bufcatstr(buf, "\r\n"); + bufcatstr(buf, "\r\n"); + bprintf(&buf, "Invalid authentication\r\n"); + bufcatstr(buf, "\r\n"); + bufcatstr(buf, "\r\n"); + bprintf(&buf, "

Invalid authentication

\r\n"); + bprintf(&buf, "

%s

\r\n", htmlquote(msg)); + bufcatstr(buf, "\r\n"); + bufcatstr(buf, "\r\n"); + out = fdopen(dup(fd), "w"); + fprintf(out, "HTTP/1.1 401 Invalid authentication\n"); + fprintf(out, "WWW-Authenticate: Basic realm=\"%s\"\n", rn); + fprintf(out, "Content-Type: text/html\n"); + fprintf(out, "Content-Length: %zi\n", buf.d); + fprintf(out, "\n"); + fwrite(buf.b, 1, buf.d, out); + fclose(out); + buffree(buf); +} + static void cleancache(int complete) { struct cache *c, *n; @@ -147,11 +179,11 @@ static void serve(struct hthead *req, int fd) size_t declen; now = time(NULL); + dec = NULL; if(reqssl && (((raw = getheader(req, "X-Ash-Protocol")) == NULL) || strcmp(raw, "https"))) { simpleerror(fd, 403, "Forbidden", "The requested resource must be requested over HTTPS."); goto out; } - dec = NULL; if(((raw = getheader(req, "Authorization")) == NULL) || strncasecmp(raw, "basic ", 6)) { reqauth(req, fd); goto out; @@ -162,6 +194,12 @@ static void serve(struct hthead *req, int fd) } memset(raw, 0, strlen(raw)); headrmheader(req, "Authorization"); + for(p = dec; *p; p++) { + if(*p < 32) { + simpleerror(fd, 400, "Invalid request", "The authentication data is invalid."); + goto out; + } + } if((p = strchr(dec, ':')) == NULL) { simpleerror(fd, 400, "Invalid request", "The authentication data is invalid."); goto out; @@ -198,10 +236,6 @@ static int auth(struct hthead *req, int fd, char *user, char *pass) FILE *out; rv = 0; - if(strchr(user, '\n') || strchr(pass, '\n')) { - simpleerror(fd, 401, "Invalid authentication", "The supplied credentials are invalid."); - return(0); - } msg = "The supplied credentials are invalid."; pipe(pfd); pipe(efd); @@ -251,10 +285,12 @@ static int auth(struct hthead *req, int fd, char *user, char *pass) buffree(ebuf); return(0); } + if(WCOREDUMP(status)) + flog(LOG_WARNING, "htextauth: authenticator process dumped core"); if(WIFEXITED(status) && (WEXITSTATUS(status) == 0)) rv = 1; else - simpleerror(fd, 401, "Invalid authentication", msg); + authinval(req, fd, msg); buffree(ebuf); return(rv); }