webcit/auth.c

   1 /*
   2  * $Id$
   3  *
   4  * WebcitAuth; Handles authentication of users to a Citadel server.
   5  */
   6
   7 #include "webcit.h"
   8
   9 /*
  10  * user states
  11  * the plain text states of a user. filled in at \ function TODO initialize_ax_defs()
  12  * due to NLS
  13  */
  14 char *axdefs[7];
  15
  16 void initialize_axdefs(void) {
  17         axdefs[0] = _("Deleted");       /*!0: an erased user */
  18         axdefs[1] = _("New User");      /*!1: a new user */
  19         axdefs[2] = _("Problem User");  /*!2: a trouble maker */
  20         axdefs[3] = _("Local User");    /*!3: user with normal privileges */
  21         axdefs[4] = _("Network User");  /*!4: a user that may access network resources */
  22         axdefs[5] = _("Preferred User");/*!5: a moderator */
  23         axdefs[6] = _("Aide");          /*!6: chief */
  24 }
  25
  26
  27
  28
  29 /*
  30  * Display the login screen
  31  * mesg = the error message if last attempt failed.
  32  */
  33 void display_login(char *mesg)
  34 {
  35         char buf[SIZ];
  36
  37         output_headers(1, 1, 2, 0, 0, 0);
  38         wprintf("<div id=\"login_screen\">\n");
  39
  40         if (mesg != NULL) if (!IsEmptyStr(mesg)) {
  41                         stresc(buf, SIZ,  mesg, 0, 0);
  42                         svprintf("mesg", WCS_STRING, "%s", buf);
  43         }
  44
  45         svprintf("LOGIN_INSTRUCTIONS", WCS_STRING,
  46                 _("<ul>"
  47                 "<li><b>If you already have an account on %s</b>, "
  48                 "enter your user name and password and click &quot;Login.&quot; "
  49                 "<li><b>If you are a new user</b>, enter the name and password "
  50                 "you wish to use, "
  51                 "and click &quot;New User.&quot; "
  52                 "<li>Please log off properly when finished. "
  53                 "<li>You must use a browser that supports <i>frames</i> and "
  54                 "<i>cookies</i>. "
  55                 "<li>Also keep in mind that if your browser is "
  56                 "configured to block pop-up windows, you will not be able "
  57                 "to receive any instant messages.<br />"
  58                 "</ul>"),
  59                 serv_info.serv_humannode
  60         );
  61
  62         svprintf("USERNAME_BOX", WCS_STRING, "%s", _("User name:"));
  63         svprintf("PASSWORD_BOX", WCS_STRING, "%s", _("Password:"));
  64         svprintf("LANGUAGE_BOX", WCS_STRING, "%s", _("Language:"));
  65         svprintf("LOGIN_BUTTON", WCS_STRING, "%s", _("Login"));
  66         svprintf("NEWUSER_BUTTON", WCS_STRING, "%s", _("New User"));
  67         svprintf("EXIT_BUTTON", WCS_STRING, "%s", _("Exit"));
  68         svprintf("hello", WCS_SERVCMD, "MESG hello");
  69         svprintf("BOXTITLE", WCS_STRING, _("%s - powered by <a href=\"http://www.citadel.org\">Citadel</a>"),
  70                 serv_info.serv_humannode);
  71         svcallback("DO_LANGUAGE_BOX", offer_languages);
  72         if (serv_info.serv_newuser_disabled) {
  73                 svprintf("NEWUSER_BUTTON_PRE", WCS_STRING, "<div style=\"display:none;\">");
  74                 svprintf("NEWUSER_BUTTON_POST", WCS_STRING, "</div>");
  75         }
  76         else {
  77                 svprintf("NEWUSER_BUTTON_PRE", WCS_STRING, "");
  78                 svprintf("NEWUSER_BUTTON_POST", WCS_STRING, "");
  79         }
  80
  81         do_template("login");
  82
  83         wDumpContent(2);
  84 }
  85
  86
  87
  88
  89 /* Initialize the session
  90  *
  91  * This function needs to get called whenever the session changes from
  92  * not-logged-in to logged-in, either by an explicit login by the user or
  93  * by a timed-out session automatically re-establishing with a little help
  94  * from the browser cookie.  Either way, we need to load access controls and
  95  * preferences from the server.
  96  *
  97  * user                 the username
  98  * pass                 his password
  99  * serv_response        The parameters returned from a Citadel USER or NEWU command
 100  */
 101 void become_logged_in(char *user, char *pass, char *serv_response)
 102 {
 103         char buf[SIZ];
 104
 105         WC->logged_in = 1;
 106         extract_token(WC->wc_fullname, &serv_response[4], 0, '|', sizeof WC->wc_fullname);
 107         safestrncpy(WC->wc_username, user, sizeof WC->wc_username);
 108         safestrncpy(WC->wc_password, pass, sizeof WC->wc_password);
 109         WC->axlevel = extract_int(&serv_response[4], 1);
 110         if (WC->axlevel >= 6) {
 111                 WC->is_aide = 1;
 112         }
 113
 114         load_preferences();
 115
 116         serv_puts("CHEK");
 117         serv_getln(buf, sizeof buf);
 118         if (buf[0] == '2') {
 119                 WC->new_mail = extract_int(&buf[4], 0);
 120                 WC->need_regi = extract_int(&buf[4], 1);
 121                 WC->need_vali = extract_int(&buf[4], 2);
 122                 extract_token(WC->cs_inet_email, &buf[4], 3, '|', sizeof WC->cs_inet_email);
 123         }
 124
 125         get_preference("current_iconbar", buf, sizeof buf);
 126         WC->current_iconbar = atoi(buf);
 127
 128         get_preference("floordiv_expanded", WC->floordiv_expanded, sizeof WC->floordiv_expanded);
 129 }
 130
 131
 132 /*
 133  * Login Checks
 134  * the logic to detect invalid passwords not to get on citservers nerves
 135  */
 136 void do_login(void)
 137 {
 138         char buf[SIZ];
 139
 140         if (havebstr("language")) {
 141                 set_selected_language(bstr("language"));
 142                 go_selected_language();
 143         }
 144
 145         if (havebstr("exit_action")) {
 146                 do_logout();
 147                 return;
 148         }
 149         if (havebstr("login_action")) {
 150                 serv_printf("USER %s", bstr("name"));
 151                 serv_getln(buf, sizeof buf);
 152                 if (buf[0] == '3') {
 153                         serv_printf("PASS %s", bstr("pass"));
 154                         serv_getln(buf, sizeof buf);
 155                         if (buf[0] == '2') {
 156                                 become_logged_in(bstr("name"),
 157                                                  bstr("pass"), buf);
 158                         } else {
 159                                 display_login(&buf[4]);
 160                                 return;
 161                         }
 162                 } else {
 163                         display_login(&buf[4]);
 164                         return;
 165                 }
 166         }
 167         if (havebstr("newuser_action")) {
 168                 if (!havebstr("pass")) {
 169                         display_login(_("Blank passwords are not allowed."));
 170                         return;
 171                 }
 172                 serv_printf("NEWU %s", bstr("name"));
 173                 serv_getln(buf, sizeof buf);
 174                 if (buf[0] == '2') {
 175                         become_logged_in(bstr("name"), bstr("pass"), buf);
 176                         serv_printf("SETP %s", bstr("pass"));
 177                         serv_getln(buf, sizeof buf);
 178                 } else {
 179                         display_login(&buf[4]);
 180                         return;
 181                 }
 182         }
 183         if (WC->logged_in) {
 184                 if (WC->need_regi) {
 185                         display_reg(1);
 186                 } else {
 187                         do_welcome();
 188                 }
 189         } else {
 190                 display_login(_("Your password was not accepted."));
 191         }
 192
 193 }
 194
 195 /*
 196  * display the user a welcome screen.
 197  *
 198  * if this is the first time login, and the web based setup is enabled,
 199  * lead the user through the setup routines
 200  */
 201 void do_welcome(void)
 202 {
 203         char buf[SIZ];
 204 #ifdef XXX_NOT_FINISHED_YET_XXX
 205         FILE *fp;
 206         int i;
 207
 208         /**
 209          * See if we have to run the first-time setup wizard
 210          */
 211         if (WC->is_aide) {
 212                 if (!setup_wizard) {
 213                         int len;
 214                         sprintf(wizard_filename, "setupwiz.%s.%s",
 215                                 ctdlhost, ctdlport);
 216                         len = strlen(wizard_filename);
 217                         for (i=0; i<len; ++i) {
 218                                 if (    (wizard_filename[i]==' ')
 219                                         || (wizard_filename[i] == '/')
 220                                 ) {
 221                                         wizard_filename[i] = '_';
 222                                 }
 223                         }
 224
 225                         fp = fopen(wizard_filename, "r");
 226                         if (fp != NULL) {
 227                                 fgets(buf, sizeof buf, fp);
 228                                 buf[strlen(buf)-1] = 0;
 229                                 fclose(fp);
 230                                 if (atoi(buf) == serv_info.serv_rev_level) {
 231                                         setup_wizard = 1; /**< already run */
 232                                 }
 233                         }
 234                 }
 235
 236                 if (!setup_wizard) {
 237                         http_redirect("setup_wizard");
 238                 }
 239         }
 240 #endif
 241
 242         /*
 243          * Go to the user's preferred start page
 244          */
 245         get_preference("startpage", buf, sizeof buf);
 246         if (IsEmptyStr(buf)) {
 247                 safestrncpy(buf, "dotskip&room=_BASEROOM_", sizeof buf);
 248                 set_preference("startpage", buf, 1);
 249         }
 250         if (buf[0] == '/') {
 251                 strcpy(buf, &buf[1]);
 252         }
 253         http_redirect(buf);
 254 }
 255
 256
 257 /*
 258  * Disconnect from the Citadel server, and end this WebCit session
 259  */
 260 void end_webcit_session(void) {
 261         char buf[256];
 262
 263         if (WC->logged_in) {
 264                 sprintf(buf, "%d", WC->current_iconbar);
 265                 set_preference("current_iconbar", buf, 0);
 266                 set_preference("floordiv_expanded", WC->floordiv_expanded, 1);
 267         }
 268
 269         serv_puts("QUIT");
 270         WC->killthis = 1;
 271         /* close() of citadel socket will be done by do_housekeeping() */
 272 }
 273
 274 /*
 275  * execute the logout
 276  */
 277 void do_logout(void)
 278 {
 279         char buf[SIZ];
 280
 281         safestrncpy(WC->wc_username, "", sizeof WC->wc_username);
 282         safestrncpy(WC->wc_password, "", sizeof WC->wc_password);
 283         safestrncpy(WC->wc_roomname, "", sizeof WC->wc_roomname);
 284         safestrncpy(WC->wc_fullname, "", sizeof WC->wc_fullname);
 285
 286         /** Calling output_headers() this way causes the cookies to be un-set */
 287         output_headers(1, 1, 0, 1, 0, 0);
 288
 289         wprintf("<div id=\"logout_screen\">");
 290         wprintf("<div class=\"box\">");
 291         wprintf("<div class=\"boxlabel\">");
 292         wprintf(_("Log off"));
 293         wprintf("</div><div class=\"boxcontent\">");
 294         serv_puts("MESG goodbye");
 295         serv_getln(buf, sizeof buf);
 296
 297         if (WC->serv_sock >= 0) {
 298                 if (buf[0] == '1') {
 299                         fmout("CENTER");
 300                 } else {
 301                         wprintf("Goodbye\n");
 302                 }
 303         }
 304         else {
 305                 wprintf(_("This program was unable to connect or stay "
 306                         "connected to the Citadel server.  Please report "
 307                         "this problem to your system administrator.")
 308                 );
 309                 wprintf("<a href=\"http://www.citadel.org/doku.php/"
 310                         "faq:mastering_your_os:net#netstat\">%s</a>",
 311                         _("Read More..."));
 312         }
 313
 314         wprintf("<hr /><div class=\"buttons\"> "
 315                 "<span class=\"button_link\"><a href=\".\">");
 316         wprintf(_("Log in again"));
 317         wprintf("</a></span>&nbsp;&nbsp;&nbsp;<span class=\"button_link\">"
 318                 "<a href=\"javascript:window.close();\">");
 319         wprintf(_("Close window"));
 320         wprintf("</a></span></div></div></div></div>\n");
 321         wDumpContent(2);
 322         end_webcit_session();
 323 }
 324
 325
 326 /*
 327  * validate new users
 328  */
 329 void validate(void)
 330 {
 331         char cmd[SIZ];
 332         char user[SIZ];
 333         char buf[SIZ];
 334         int a;
 335
 336         output_headers(1, 1, 2, 0, 0, 0);
 337         wprintf("<div id=\"banner\">\n");
 338         wprintf("<h1>");
 339         wprintf(_("Validate new users"));
 340         wprintf("</h1>");
 341         wprintf("</div>\n");
 342
 343         wprintf("<div id=\"content\" class=\"service\">\n");
 344
 345         /* If the user just submitted a validation, process it... */
 346         safestrncpy(buf, bstr("user"), sizeof buf);
 347         if (!IsEmptyStr(buf)) {
 348                 if (havebstr("axlevel")) {
 349                         serv_printf("VALI %s|%s", buf, bstr("axlevel"));
 350                         serv_getln(buf, sizeof buf);
 351                         if (buf[0] != '2') {
 352                                 wprintf("<b>%s</b><br />\n", &buf[4]);
 353                         }
 354                 }
 355         }
 356
 357         /* Now see if any more users require validation. */
 358         serv_puts("GNUR");
 359         serv_getln(buf, sizeof buf);
 360         if (buf[0] == '2') {
 361                 wprintf("<b>");
 362                 wprintf(_("No users require validation at this time."));
 363                 wprintf("</b><br />\n");
 364                 wDumpContent(1);
 365                 return;
 366         }
 367         if (buf[0] != '3') {
 368                 wprintf("<b>%s</b><br />\n", &buf[4]);
 369                 wDumpContent(1);
 370                 return;
 371         }
 372
 373         wprintf("<div class=\"fix_scrollbar_bug\">"
 374                 "<table class=\"auth_validate\"><tr><td>\n");
 375         wprintf("<center>");
 376
 377         safestrncpy(user, &buf[4], sizeof user);
 378         serv_printf("GREG %s", user);
 379         serv_getln(cmd, sizeof cmd);
 380         if (cmd[0] == '1') {
 381                 a = 0;
 382                 do {
 383                         serv_getln(buf, sizeof buf);
 384                         ++a;
 385                         if (a == 1)
 386                                 wprintf("#%s<br /><H1>%s</H1>",
 387                                         buf, &cmd[4]);
 388                         if (a == 2)
 389                                 wprintf("PW: %s<br />\n", buf);
 390                         if (a == 3)
 391                                 wprintf("%s<br />\n", buf);
 392                         if (a == 4)
 393                                 wprintf("%s<br />\n", buf);
 394                         if (a == 5)
 395                                 wprintf("%s, ", buf);
 396                         if (a == 6)
 397                                 wprintf("%s ", buf);
 398                         if (a == 7)
 399                                 wprintf("%s<br />\n", buf);
 400                         if (a == 8)
 401                                 wprintf("%s<br />\n", buf);
 402                         if (a == 9)
 403                                 wprintf(_("Current access level: %d (%s)\n"),
 404                                         atoi(buf), axdefs[atoi(buf)]);
 405                 } while (strcmp(buf, "000"));
 406         } else {
 407                 wprintf("<H1>%s</H1>%s<br />\n", user, &cmd[4]);
 408         }
 409
 410         wprintf("<hr />");
 411         wprintf(_("Select access level for this user:"));
 412         wprintf("<br />\n");
 413         for (a = 0; a <= 6; ++a) {
 414                 wprintf("<a href=\"validate?nonce=%ld?user=", WC->nonce);
 415                 urlescputs(user);
 416                 wprintf("&axlevel=%d\">%s</A>&nbsp;&nbsp;&nbsp;\n",
 417                         a, axdefs[a]);
 418         }
 419         wprintf("<br />\n");
 420
 421         wprintf("</CENTER>\n");
 422         wprintf("</td></tr></table></div>\n");
 423         wDumpContent(1);
 424 }
 425
 426
 427
 428 /*
 429  * Display form for registration.
 430  *
 431  * (Set during_login to 1 if this registration is being performed during
 432  * new user login and will require chaining to the proper screen.)
 433  */
 434 void display_reg(int during_login)
 435 {
 436         long vcard_msgnum;
 437
 438         if (goto_config_room() != 0) {
 439                 if (during_login) do_welcome();
 440                 else display_main_menu();
 441                 return;
 442         }
 443
 444         vcard_msgnum = locate_user_vcard(WC->wc_fullname, -1);
 445         if (vcard_msgnum < 0L) {
 446                 if (during_login) do_welcome();
 447                 else display_main_menu();
 448                 return;
 449         }
 450
 451         if (during_login) {
 452                 do_edit_vcard(vcard_msgnum, "1", "do_welcome", USERCONFIGROOM);
 453         }
 454         else {
 455                 do_edit_vcard(vcard_msgnum, "1", "display_main_menu", USERCONFIGROOM);
 456         }
 457
 458 }
 459
 460
 461
 462
 463 /*
 464  * display form for changing your password
 465  */
 466 void display_changepw(void)
 467 {
 468         char buf[SIZ];
 469
 470         output_headers(1, 1, 1, 0, 0, 0);
 471
 472         svprintf("BOXTITLE", WCS_STRING, _("Change your password"));
 473         do_template("beginbox");
 474
 475         if (!IsEmptyStr(WC->ImportantMessage)) {
 476                 wprintf("<span class=\"errormsg\">"
 477                         "%s</span><br />\n", WC->ImportantMessage);
 478                 safestrncpy(WC->ImportantMessage, "", sizeof WC->ImportantMessage);
 479         }
 480
 481         serv_puts("MESG changepw");
 482         serv_getln(buf, sizeof buf);
 483         if (buf[0] == '1') {
 484                 fmout("CENTER");
 485         }
 486
 487         wprintf("<form name=\"changepwform\" action=\"changepw\" method=\"post\">\n");
 488         wprintf("<input type=\"hidden\" name=\"nonce\" value=\"%ld\">\n", WC->nonce);
 489         wprintf("<table class=\"altern\" ");
 490         wprintf("<tr class=\"even\"><td>");
 491         wprintf(_("Enter new password:"));
 492         wprintf("</td><td>");
 493         wprintf("<input type=\"password\" name=\"newpass1\" value=\"\" maxlength=\"20\"></td></tr>\n");
 494         wprintf("<tr class=\"odd\"><td>");
 495         wprintf(_("Enter it again to confirm:"));
 496         wprintf("</td><td>");
 497         wprintf("<input type=\"password\" name=\"newpass2\" value=\"\" maxlength=\"20\"></td></tr>\n");
 498         wprintf("</table>\n");
 499
 500         wprintf("<div class=\"buttons\">\n");
 501         wprintf("<input type=\"submit\" name=\"change_action\" value=\"%s\">", _("Change password"));
 502         wprintf("&nbsp;");
 503         wprintf("<input type=\"submit\" name=\"cancel_action\" value=\"%s\">\n", _("Cancel"));
 504         wprintf("</div>\n");
 505         wprintf("</form>\n");
 506
 507         do_template("endbox");
 508         wDumpContent(1);
 509 }
 510
 511 /*
 512  * change password
 513  * if passwords match, propagate it to citserver.
 514  */
 515 void changepw(void)
 516 {
 517         char buf[SIZ];
 518         char newpass1[32], newpass2[32];
 519
 520         if (!havebstr("change_action")) {
 521                 safestrncpy(WC->ImportantMessage,
 522                         _("Cancelled.  Password was not changed."),
 523                         sizeof WC->ImportantMessage);
 524                 display_main_menu();
 525                 return;
 526         }
 527
 528         safestrncpy(newpass1, bstr("newpass1"), sizeof newpass1);
 529         safestrncpy(newpass2, bstr("newpass2"), sizeof newpass2);
 530
 531         if (strcasecmp(newpass1, newpass2)) {
 532                 safestrncpy(WC->ImportantMessage,
 533                         _("They don't match.  Password was not changed."),
 534                         sizeof WC->ImportantMessage);
 535                 display_changepw();
 536                 return;
 537         }
 538
 539         if (IsEmptyStr(newpass1)) {
 540                 safestrncpy(WC->ImportantMessage,
 541                         _("Blank passwords are not allowed."),
 542                         sizeof WC->ImportantMessage);
 543                 display_changepw();
 544                 return;
 545         }
 546
 547         serv_printf("SETP %s", newpass1);
 548         serv_getln(buf, sizeof buf);
 549         sprintf(WC->ImportantMessage, "%s", &buf[4]);
 550         if (buf[0] == '2') {
 551                 safestrncpy(WC->wc_password, buf, sizeof WC->wc_password);
 552                 display_main_menu();
 553         }
 554         else {
 555                 display_changepw();
 556         }
 557 }
 558
 559
 560
 561 void InitModule_AUTH(void)
 562 {
 563         WebcitAddUrlHandler(HKEY("do_welcome"), do_welcome, 0);
 564         return ;
 565 }