webcit/auth.c

   1 /*
   2  * auth.c
   3  *
   4  * This file contains code which relates to authentication of users to Citadel.
   5  *
   6  * $Id$
   7  */
   8
   9 #include <stdlib.h>
  10 #ifdef HAVE_UNISTD_H
  11 #include <unistd.h>
  12 #endif
  13 #include <stdio.h>
  14 #include <ctype.h>
  15 #include <string.h>
  16 #include <errno.h>
  17 #include "webcit.h"
  18 #include "child.h"
  19
  20 char *axdefs[] = {
  21         "Deleted",
  22         "New User",
  23         "Problem User",
  24         "Local User",
  25         "Network User",
  26         "Preferred User",
  27         "Aide"
  28         };
  29
  30 /*
  31  * Display the login screen
  32  */
  33 void display_login(char *mesg) {
  34         char buf[256];
  35
  36         printf("HTTP/1.0 200 OK\n");
  37         output_headers(1, "_top");
  38
  39         /* Da banner */
  40         wprintf("<CENTER><TABLE border=0 width=100%><TR><TD>\n");
  41         wprintf("<IMG SRC=\"/image&name=hello\">");
  42         wprintf("</TD><TD><CENTER>\n");
  43
  44         if (mesg != NULL) {
  45                 wprintf("<font size=+1><b>%s</b></font>", mesg);
  46                 }
  47         else {
  48                 serv_puts("MESG hello");
  49                 serv_gets(buf);
  50                 if (buf[0]=='1') fmout(NULL);
  51                 }
  52
  53         wprintf("</CENTER></TD></TR></TABLE></CENTER>\n");
  54         wprintf("<HR>\n");
  55
  56         /* Da login box */
  57         wprintf("<CENTER><FORM ACTION=\"/login\" METHOD=\"POST\">\n");
  58         wprintf("<TABLE border><TR>\n");
  59         wprintf("<TD>User Name:</TD>\n");
  60         wprintf("<TD><INPUT TYPE=\"text\" NAME=\"name\" MAXLENGTH=\"25\">\n");
  61         wprintf("</TD></TR><TR>\n");
  62         wprintf("<TD>Password:</TD>\n");
  63         wprintf("<TD><INPUT TYPE=\"password\" NAME=\"pass\" MAXLENGTH=\"20\"></TD>\n");
  64         wprintf("</TR></TABLE>\n");
  65         wprintf("<INPUT type=\"submit\" NAME=\"action\" VALUE=\"Login\">\n");
  66         wprintf("<INPUT type=\"submit\" NAME=\"action\" VALUE=\"New User\">\n");
  67         wprintf("<INPUT type=\"submit\" NAME=\"action\" VALUE=\"Exit\">\n");
  68
  69         wprintf("<BR><INPUT TYPE=\"checkbox\" NAME=\"noframes\">");
  70         wprintf("<FONT SIZE=-1>&nbsp;Check here to disable frames</FONT>\n");
  71         wprintf("</FORM></CENTER>\n");
  72
  73         /* Da instructions */
  74         wprintf("<LI><EM>If you already have an account on %s,",
  75                 serv_info.serv_humannode);
  76         wprintf("</EM> enter your user name\n");
  77         wprintf("and password and click \"<TT>Login</TT>.\"<BR>\n");
  78         wprintf("<LI><EM>If you are a new user,</EM>\n");
  79         wprintf("enter the name and password you wish to use, and click\n");
  80         wprintf("\"New User.\"<BR><LI>");
  81         wprintf("<EM>Please log off properly when finished.</EM>");
  82         wprintf("<LI>You must use a browser that supports <i>cookies</i>.<BR>\n");
  83         wprintf("<LI>Your browser is: ");
  84         escputs(browser);
  85         wprintf("</EM></UL>\n");
  86
  87         wDumpContent(1);
  88         }
  89
  90
  91
  92
  93 /*
  94  * This function needs to get called whenever a PASS or NEWU succeeds.
  95  */
  96 void become_logged_in(char *user, char *pass, char *serv_response) {
  97         logged_in = 1;
  98         extract(wc_username, &serv_response[4], 0);
  99         strcpy(wc_password, pass);
 100         axlevel = extract_int(&serv_response[4], 1);
 101         if (axlevel >=6) is_aide = 1;
 102         }
 103
 104
 105 void do_login(void) {
 106         char buf[256];
 107         int need_regi = 0;
 108
 109
 110         if (!strcasecmp(bstr("noframes"), "on"))
 111                 noframes = 1;
 112         else
 113                 noframes = 0;
 114
 115         if (!strcasecmp(bstr("action"), "Exit")) {
 116                 do_logout();
 117                 }
 118
 119         if (!strcasecmp(bstr("action"), "Login")) {
 120                 serv_printf("USER %s", bstr("name"));
 121                 serv_gets(buf);
 122                 if (buf[0]=='3') {
 123                         serv_printf("PASS %s", bstr("pass"));
 124                         serv_gets(buf);
 125                         if (buf[0]=='2') {
 126                                 become_logged_in(bstr("name"),
 127                                         bstr("pass"), buf);
 128                                 }
 129                         else {
 130                                 display_login(&buf[4]);
 131                                 return;
 132                                 }
 133                         }
 134                 else {
 135                         display_login(&buf[4]);
 136                         return;
 137                         }
 138                 }
 139
 140         if (!strcasecmp(bstr("action"), "New User")) {
 141                 serv_printf("NEWU %s", bstr("name"));
 142                 serv_gets(buf);
 143                 if (buf[0]=='2') {
 144                         become_logged_in(bstr("name"), bstr("pass"), buf);
 145                         serv_printf("SETP %s", bstr("pass"));
 146                         serv_gets(buf);
 147                         }
 148                 else {
 149                         display_login(&buf[4]);
 150                         return;
 151                         }
 152                 }
 153
 154         if (logged_in) {
 155                 serv_puts("CHEK");
 156                 serv_gets(buf);
 157                 if (buf[0]=='2') {
 158                         need_regi = extract_int(&buf[4], 1);
 159                         /* FIX also check for new mail etc. here */
 160                         }
 161                 if (need_regi) {
 162                         display_reg(1);
 163                         }
 164                 else {
 165                         do_welcome();
 166                         }
 167                 }
 168         else {
 169                 display_login("Your password was not accepted.");
 170                 }
 171
 172         }
 173
 174 void do_welcome(void) {
 175
 176         if (noframes) {
 177                 printf("HTTP/1.0 200 OK\n");
 178                 output_headers(1, "_top");
 179                 wprintf("<CENTER><H1>");
 180                 escputs(wc_username);
 181                 wprintf("</H1>\n");
 182                 /* FIX add user stats here */
 183                 wDumpContent(1);
 184                 }
 185
 186         else {
 187                 output_static("frameset.html");
 188                 }
 189         }
 190
 191
 192 void do_logout(void) {
 193         char buf[256];
 194
 195         strcpy(wc_username, "");
 196         strcpy(wc_password, "");
 197         strcpy(wc_roomname, "");
 198
 199         printf("HTTP/1.0 200 OK\n");
 200         output_headers(2, "_top");      /* note "2" causes cookies to be unset */
 201
 202         wprintf("<CENTER>");
 203         serv_puts("MESG goodbye");
 204         serv_gets(buf);
 205
 206         if (buf[0]=='1') fmout(NULL);
 207         else wprintf("Goodbye\n");
 208
 209         wprintf("<HR><A HREF=\"/\">Log in again</A></CENTER>\n");
 210         wDumpContent(2);
 211         serv_puts("QUIT");
 212         exit(0);
 213         }
 214
 215
 216
 217
 218
 219 /*
 220  * validate new users
 221  */
 222 void validate(void) {
 223         char cmd[256];
 224         char user[256];
 225         char buf[256];
 226         int a;
 227
 228         printf("HTTP/1.0 200 OK\n");
 229         output_headers(1, "bottom");
 230
 231         strcpy(buf,bstr("user"));
 232         if (strlen(buf)>0) if (strlen(bstr("axlevel"))>0) {
 233                 serv_printf("VALI %s|%s",buf,bstr("axlevel"));
 234                 serv_gets(buf);
 235                 if (buf[0]!='2') {
 236                         wprintf("<EM>%s</EM><BR>\n", &buf[4]);
 237                         }
 238                 }
 239
 240         serv_puts("GNUR");
 241         serv_gets(buf);
 242
 243         if (buf[0]!='3') {
 244                 wprintf("<EM>%s</EM><BR>\n", &buf[4]);
 245                 wDumpContent(1);
 246                 return;
 247                 }
 248
 249         strcpy(user,&buf[4]);
 250         serv_printf("GREG %s",user);
 251         serv_gets(cmd);
 252         if (cmd[0]=='1') {
 253                 a = 0;
 254                 do {
 255                         serv_gets(buf);
 256                         ++a;
 257                         if (a==1) wprintf("User #%s<BR><H1>%s</H1>",
 258                                 buf,&cmd[4]);
 259                         if (a==2) wprintf("PW: %s<BR>\n",buf);
 260                         if (a==3) wprintf("%s<BR>\n",buf);
 261                         if (a==4) wprintf("%s<BR>\n",buf);
 262                         if (a==5) wprintf("%s, ",buf);
 263                         if (a==6) wprintf("%s ",buf);
 264                         if (a==7) wprintf("%s<BR>\n",buf);
 265                         if (a==8) wprintf("%s<BR>\n",buf);
 266                         if (a==9) wprintf("Current access level: %d (%s)\n",
 267                                 atoi(buf),axdefs[atoi(buf)]);
 268                         } while(strcmp(buf,"000"));
 269                 }
 270         else {
 271                 wprintf("<H1>%s</H1>%s<BR>\n",user,&cmd[4]);
 272                 }
 273
 274         wprintf("<CENTER><TABLE border><CAPTION>Select access level:");
 275         wprintf("</CAPTION><TR>");
 276         for (a=0; a<=6; ++a) {
 277                 wprintf(
 278                 "<TD><A HREF=\"/validate&user=%s&axlevel=%d\">%s</A></TD>\n",
 279                         urlesc(user), a, axdefs[a]);
 280                 }
 281         wprintf("</TR></TABLE><CENTER><BR>\n");
 282         wDumpContent(1);
 283         }
 284
 285
 286
 287
 288
 289
 290 /*
 291  * Display form for registration.
 292  * (Set during_login to 1 if this registration is being performed during
 293  * new user login and will require chaining to the proper screen.)
 294  */
 295 void display_reg(int during_login) {
 296         char buf[256];
 297         int a;
 298
 299         printf("HTTP/1.0 200 OK\n");
 300         output_headers(1, "bottom");
 301
 302         wprintf("<TABLE WIDTH=100% BORDER=0 BGCOLOR=007700><TR><TD>");
 303         wprintf("<FONT SIZE=+1 COLOR=\"FFFFFF\"");
 304         wprintf("<B>Enter registration info</B>\n");
 305         wprintf("</FONT></TD></TR></TABLE>\n");
 306
 307         wprintf("<CENTER>");
 308         serv_puts("MESG register");
 309         serv_gets(buf);
 310         if (buf[0]=='1') fmout(NULL);
 311
 312         wprintf("<FORM ACTION=\"/register\" METHOD=\"POST\">\n");
 313         wprintf("<INPUT TYPE=\"hidden\" NAME=\"during_login\" VALUE=\"%d\">\n", during_login);
 314
 315         serv_puts("GREG _SELF_");
 316         serv_gets(buf);
 317         if (buf[0]!='1') {
 318                 wprintf("<EM>%s</EM><BR>\n",&buf[4]);
 319                 }
 320         else {
 321
 322                 wprintf("<H1>%s</H1><TABLE border>\n",&buf[4]);
 323                 a = 0;
 324                 while (serv_gets(buf), strcmp(buf,"000")) {
 325                         ++a;
 326                         wprintf("<TR><TD>");
 327                         switch(a) {
 328                                 case 3: wprintf("Real Name:</TD><TD><INPUT TYPE=\"text\" NAME=\"realname\" VALUE=\"%s\" MAXLENGTH=\"29\"><BR>\n",buf);
 329                                         break;
 330                                 case 4: wprintf("Street Address:</TD><TD><INPUT TYPE=\"text\" NAME=\"address\" VALUE=\"%s\" MAXLENGTH=\"24\"><BR>\n",buf);
 331                                         break;
 332                                 case 5: wprintf("City/town:</TD><TD><INPUT TYPE=\"text\" NAME=\"city\" VALUE=\"%s\" MAXLENGTH=\"14\"><BR>\n",buf);
 333                                         break;
 334                                 case 6: wprintf("State/province:</TD><TD><INPUT TYPE=\"text\" NAME=\"state\" VALUE=\"%s\" MAXLENGTH=\"2\"><BR>\n",buf);
 335                                         break;
 336                                 case 7: wprintf("ZIP code:</TD><TD><INPUT TYPE=\"text\" NAME=\"zip\" VALUE=\"%s\" MAXLENGTH=\"10\"><BR>\n",buf);
 337                                         break;
 338                                 case 8: wprintf("Telephone:</TD><TD><INPUT TYPE=\"text\" NAME=\"phone\" VALUE=\"%s\" MAXLENGTH=\"14\"><BR>\n",buf);
 339                                         break;
 340                                 case 9: wprintf("E-Mail:</TD><TD><INPUT TYPE=\"text\" NAME=\"email\" VALUE=\"%s\" MAXLENGTH=\"31\"><BR>\n",buf);
 341                                         break;
 342                                 }
 343                         wprintf("</TD></TR>\n");
 344                         }
 345                 wprintf("</TABLE><P>");
 346                 }
 347         wprintf("<INPUT type=\"submit\" NAME=\"action\" VALUE=\"Register\">\n");
 348         wprintf("<INPUT type=\"submit\" NAME=\"action\" VALUE=\"Cancel\">\n");
 349         wprintf("</CENTER>\n");
 350         wDumpContent(1);
 351         }
 352
 353 /*
 354  * register
 355  */
 356 void register_user(void) {
 357         char buf[256];
 358
 359         if (strcmp(bstr("action"),"Register")) {
 360                 display_error("Cancelled.  Registration was not saved.");
 361                 return;
 362                 }
 363
 364         serv_puts("REGI");
 365         serv_gets(buf);
 366         if (buf[0]!='4') {
 367                 display_error(&buf[4]);
 368                 }
 369
 370         serv_puts(bstr("realname"));
 371         serv_puts(bstr("address"));
 372         serv_puts(bstr("city"));
 373         serv_puts(bstr("state"));
 374         serv_puts(bstr("zip"));
 375         serv_puts(bstr("phone"));
 376         serv_puts(bstr("email"));
 377         serv_puts("000");
 378
 379         if (atoi(bstr("during_login"))) {
 380                 do_welcome();
 381                 }
 382         else {
 383                 display_error("Registration information has been saved.");
 384                 }
 385         }
 386
 387
 388
 389
 390
 391 /*
 392  * display form for changing your password
 393  */
 394 void display_changepw(void) {
 395         char buf[256];
 396
 397         printf("HTTP/1.0 200 OK\n");
 398         output_headers(1, "bottom");
 399
 400         wprintf("<TABLE WIDTH=100% BORDER=0 BGCOLOR=770000><TR><TD>");
 401         wprintf("<FONT SIZE=+1 COLOR=\"FFFFFF\"");
 402         wprintf("<B>Change your password</B>\n");
 403         wprintf("</FONT></TD></TR></TABLE>\n");
 404
 405         wprintf("<CENTER>");
 406         serv_puts("MESG changepw");
 407         serv_gets(buf);
 408         if (buf[0]=='1') fmout(NULL);
 409
 410         wprintf("<FORM ACTION=\"changepw\" METHOD=\"POST\">\n");
 411         wprintf("<CENTER><TABLE border><TR><TD>Enter new password:</TD>\n");
 412         wprintf("<TD><INPUT TYPE=\"password\" NAME=\"newpass1\" VALUE=\"\" MAXLENGTH=\"20\"></TD></TR>\n");
 413         wprintf("<TR><TD>Enter it again to confirm:</TD>\n");
 414         wprintf("<TD><INPUT TYPE=\"password\" NAME=\"newpass2\" VALUE=\"\" MAXLENGTH=\"20\"></TD></TR>\n");
 415         wprintf("</TABLE>\n");
 416         wprintf("<INPUT type=\"submit\" NAME=\"action\" VALUE=\"Change\">\n");
 417         wprintf("<INPUT type=\"submit\" NAME=\"action\" VALUE=\"Cancel\">\n");
 418         wprintf("</CENTER>\n");
 419         wDumpContent(1);
 420         }
 421
 422 /*
 423  * change password
 424  */
 425 void changepw(void) {
 426         char buf[256];
 427         char newpass1[32], newpass2[32];
 428
 429         if (strcmp(bstr("action"),"Change")) {
 430                 display_error("Cancelled.  Password was not changed.");
 431                 return;
 432                 }
 433
 434         strcpy(newpass1, bstr("newpass1"));
 435         strcpy(newpass2, bstr("newpass2"));
 436
 437         if (strcasecmp(newpass1, newpass2)) {
 438                 display_error("They don't match.  Password was not changed.");
 439                 return;
 440                 }
 441
 442         serv_printf("SETP %s", newpass1);
 443         serv_gets(buf);
 444         if (buf[0]=='2') display_success(&buf[4]);
 445         else display_error(&buf[4]);
 446         }