webcit/auth.c

   1 /*
   2  * $Id$
   3  *
   4  * WebcitAuth; Handles authentication of users to a Citadel server.
   5  */
   6
   7 #include "webcit.h"
   8
   9 /*
  10  * user states
  11  * the plain text states of a user. filled in at \ function TODO initialize_ax_defs()
  12  * due to NLS
  13  */
  14 char *axdefs[7];
  15
  16 void initialize_axdefs(void) {
  17         axdefs[0] = _("Deleted");       /*!0: an erased user */
  18         axdefs[1] = _("New User");      /*!1: a new user */
  19         axdefs[2] = _("Problem User");  /*!2: a trouble maker */
  20         axdefs[3] = _("Local User");    /*!3: user with normal privileges */
  21         axdefs[4] = _("Network User");  /*!4: a user that may access network resources */
  22         axdefs[5] = _("Preferred User");/*!5: a moderator */
  23         axdefs[6] = _("Aide");          /*!6: chief */
  24 }
  25
  26
  27
  28
  29 /*
  30  * Display the login screen
  31  * mesg = the error message if last attempt failed.
  32  */
  33 void display_login(char *mesg)
  34 {
  35         char buf[SIZ];
  36
  37         output_headers(1, 1, 2, 0, 0, 0);
  38         wprintf("<div id=\"login_screen\">\n");
  39
  40         if (mesg != NULL) if (!IsEmptyStr(mesg)) {
  41                         stresc(buf, SIZ,  mesg, 0, 0);
  42                         svprintf(HKEY("MESG"), WCS_STRING, "%s", buf);
  43         }
  44
  45         svprintf(HKEY("LOGIN_INSTRUCTIONS"), WCS_STRING,
  46                 _("<ul>"
  47                 "<li><b>If you already have an account on %s</b>, "
  48                 "enter your user name and password and click &quot;Login.&quot; "
  49                 "<li><b>If you are a new user</b>, enter the name and password "
  50                 "you wish to use, "
  51                 "and click &quot;New User.&quot; "
  52                 "<li>Please log off properly when finished. "
  53                 "<li>You must use a browser that supports <i>frames</i> and "
  54                 "<i>cookies</i>. "
  55                 "<li>Also keep in mind that if your browser is "
  56                 "configured to block pop-up windows, you will not be able "
  57                 "to receive any instant messages.<br />"
  58                 "</ul>"),
  59                 serv_info.serv_humannode
  60         );
  61
  62         svput("USERNAME_BOX", WCS_STRING, _("User name:"));
  63         svput("PASSWORD_BOX", WCS_STRING, _("Password:"));
  64         svput("LANGUAGE_BOX", WCS_STRING, _("Language:"));
  65         svput("LOGIN_BUTTON", WCS_STRING, _("Login"));
  66         svput("NEWUSER_BUTTON", WCS_STRING, _("New User"));
  67         svput("EXIT_BUTTON", WCS_STRING, _("Exit"));
  68         svput("HELLO", WCS_SERVCMD, "MESG hello");
  69         svprintf(HKEY("BOXTITLE"), WCS_STRING, _("%s - powered by <a href=\"http://www.citadel.org\">Citadel</a>"),
  70                 serv_info.serv_humannode);
  71         svcallback("DO_LANGUAGE_BOX", offer_languages);
  72         if (serv_info.serv_newuser_disabled) {
  73                 svput("NEWUSER_BUTTON_PRE", WCS_STRING, "<div style=\"display:none;\">");
  74                 svput("NEWUSER_BUTTON_POST", WCS_STRING, "</div>");
  75         }
  76         else {
  77                 svput("NEWUSER_BUTTON_PRE", WCS_STRING, "");
  78                 svput("NEWUSER_BUTTON_POST", WCS_STRING, "");
  79         }
  80
  81 #ifdef TECH_PREVIEW
  82                 svprintf(HKEY("OFFER_OPENID_LOGIN"), WCS_STRING, "<a href=\"display_openid_login\">%s</a>",
  83                         "Click here to login with OpenID"       // FIXME localize when ready
  84                 );
  85 #else
  86                 svput("OFFER_OPENID_LOGIN", WCS_STRING, "");
  87 #endif
  88
  89         do_template("login");
  90
  91         wDumpContent(2);
  92 }
  93
  94
  95
  96
  97 /*
  98  * Display the openid-enabled login screen
  99  * mesg = the error message if last attempt failed.
 100  */
 101 void display_openid_login(char *mesg)
 102 {
 103         char buf[SIZ];
 104
 105         output_headers(1, 1, 2, 0, 0, 0);
 106         wprintf("<div id=\"login_screen\">\n");
 107
 108         if (mesg != NULL) if (!IsEmptyStr(mesg)) {
 109                         stresc(buf, SIZ,  mesg, 0, 0);
 110                         svprintf(HKEY("MESG"), WCS_STRING, "%s", buf);
 111         }
 112
 113         svprintf(HKEY("LOGIN_INSTRUCTIONS"), WCS_STRING,
 114                 _("<ul>"
 115                 "<li>Enter your OpenID URL and click &quot;Login&quot;."
 116                 "<li>Please log off properly when finished. "
 117                 "<li>You must use a browser that supports <i>frames</i> and "
 118                 "<i>cookies</i>. "
 119                 "<li>Also keep in mind that if your browser is "
 120                 "configured to block pop-up windows, you will not be able "
 121                 "to receive any instant messages.<br />"
 122                 "</ul>")
 123         );
 124
 125         svput("OPENID_BOX", WCS_STRING, _("OpenID URL:"));
 126         svput("LANGUAGE_BOX", WCS_STRING, _("Language:"));
 127         svput("LOGIN_BUTTON", WCS_STRING, _("Login"));
 128         svput("EXIT_BUTTON", WCS_STRING, _("Exit"));
 129         svput("HELLO", WCS_SERVCMD, "MESG hello");
 130         svprintf(HKEY("BOXTITLE"), WCS_STRING, _("%s - powered by <a href=\"http://www.citadel.org\">Citadel</a>"),
 131                 serv_info.serv_humannode);
 132         svcallback("DO_LANGUAGE_BOX", offer_languages);
 133
 134         do_template("openid_login");
 135         wDumpContent(2);
 136 }
 137
 138
 139
 140
 141 /* Initialize the session
 142  *
 143  * This function needs to get called whenever the session changes from
 144  * not-logged-in to logged-in, either by an explicit login by the user or
 145  * by a timed-out session automatically re-establishing with a little help
 146  * from the browser cookie.  Either way, we need to load access controls and
 147  * preferences from the server.
 148  *
 149  * user                 the username
 150  * pass                 his password
 151  * serv_response        The parameters returned from a Citadel USER or NEWU command
 152  */
 153 void become_logged_in(char *user, char *pass, char *serv_response)
 154 {
 155         char buf[SIZ];
 156
 157         WC->logged_in = 1;
 158         extract_token(WC->wc_fullname, &serv_response[4], 0, '|', sizeof WC->wc_fullname);
 159         safestrncpy(WC->wc_username, user, sizeof WC->wc_username);
 160         safestrncpy(WC->wc_password, pass, sizeof WC->wc_password);
 161         WC->axlevel = extract_int(&serv_response[4], 1);
 162         if (WC->axlevel >= 6) {
 163                 WC->is_aide = 1;
 164         }
 165
 166         load_preferences();
 167
 168         serv_puts("CHEK");
 169         serv_getln(buf, sizeof buf);
 170         if (buf[0] == '2') {
 171                 WC->new_mail = extract_int(&buf[4], 0);
 172                 WC->need_regi = extract_int(&buf[4], 1);
 173                 WC->need_vali = extract_int(&buf[4], 2);
 174                 extract_token(WC->cs_inet_email, &buf[4], 3, '|', sizeof WC->cs_inet_email);
 175         }
 176
 177         get_preference("current_iconbar", buf, sizeof buf);
 178         WC->current_iconbar = atoi(buf);
 179
 180         get_preference("floordiv_expanded", WC->floordiv_expanded, sizeof WC->floordiv_expanded);
 181 }
 182
 183
 184 /*
 185  * Login Checks
 186  * the logic to detect invalid passwords not to get on citservers nerves
 187  */
 188 void do_login(void)
 189 {
 190         char buf[SIZ];
 191
 192         if (havebstr("language")) {
 193                 set_selected_language(bstr("language"));
 194                 go_selected_language();
 195         }
 196
 197         if (havebstr("exit_action")) {
 198                 do_logout();
 199                 return;
 200         }
 201         if (havebstr("login_action")) {
 202                 serv_printf("USER %s", bstr("name"));
 203                 serv_getln(buf, sizeof buf);
 204                 if (buf[0] == '3') {
 205                         serv_printf("PASS %s", bstr("pass"));
 206                         serv_getln(buf, sizeof buf);
 207                         if (buf[0] == '2') {
 208                                 become_logged_in(bstr("name"),
 209                                                  bstr("pass"), buf);
 210                         } else {
 211                                 display_login(&buf[4]);
 212                                 return;
 213                         }
 214                 } else {
 215                         display_login(&buf[4]);
 216                         return;
 217                 }
 218         }
 219         if (havebstr("newuser_action")) {
 220                 if (!havebstr("pass")) {
 221                         display_login(_("Blank passwords are not allowed."));
 222                         return;
 223                 }
 224                 serv_printf("NEWU %s", bstr("name"));
 225                 serv_getln(buf, sizeof buf);
 226                 if (buf[0] == '2') {
 227                         become_logged_in(bstr("name"), bstr("pass"), buf);
 228                         serv_printf("SETP %s", bstr("pass"));
 229                         serv_getln(buf, sizeof buf);
 230                 } else {
 231                         display_login(&buf[4]);
 232                         return;
 233                 }
 234         }
 235         if (WC->logged_in) {
 236                 if (WC->need_regi) {
 237                         display_reg(1);
 238                 } else {
 239                         do_welcome();
 240                 }
 241         } else {
 242                 display_login(_("Your password was not accepted."));
 243         }
 244
 245 }
 246
 247 /*
 248  * display the user a welcome screen.
 249  *
 250  * if this is the first time login, and the web based setup is enabled,
 251  * lead the user through the setup routines
 252  */
 253 void do_welcome(void)
 254 {
 255         char buf[SIZ];
 256 #ifdef XXX_NOT_FINISHED_YET_XXX
 257         FILE *fp;
 258         int i;
 259
 260         /**
 261          * See if we have to run the first-time setup wizard
 262          */
 263         if (WC->is_aide) {
 264                 if (!setup_wizard) {
 265                         int len;
 266                         sprintf(wizard_filename, "setupwiz.%s.%s",
 267                                 ctdlhost, ctdlport);
 268                         len = strlen(wizard_filename);
 269                         for (i=0; i<len; ++i) {
 270                                 if (    (wizard_filename[i]==' ')
 271                                         || (wizard_filename[i] == '/')
 272                                 ) {
 273                                         wizard_filename[i] = '_';
 274                                 }
 275                         }
 276
 277                         fp = fopen(wizard_filename, "r");
 278                         if (fp != NULL) {
 279                                 fgets(buf, sizeof buf, fp);
 280                                 buf[strlen(buf)-1] = 0;
 281                                 fclose(fp);
 282                                 if (atoi(buf) == serv_info.serv_rev_level) {
 283                                         setup_wizard = 1; /**< already run */
 284                                 }
 285                         }
 286                 }
 287
 288                 if (!setup_wizard) {
 289                         http_redirect("setup_wizard");
 290                 }
 291         }
 292 #endif
 293
 294         /*
 295          * Go to the user's preferred start page
 296          */
 297         get_preference("startpage", buf, sizeof buf);
 298         if (IsEmptyStr(buf)) {
 299                 safestrncpy(buf, "dotskip&room=_BASEROOM_", sizeof buf);
 300                 set_preference("startpage", buf, 1);
 301         }
 302         if (buf[0] == '/') {
 303                 strcpy(buf, &buf[1]);
 304         }
 305         http_redirect(buf);
 306 }
 307
 308
 309 /*
 310  * Disconnect from the Citadel server, and end this WebCit session
 311  */
 312 void end_webcit_session(void) {
 313         char buf[256];
 314
 315         if (WC->logged_in) {
 316                 sprintf(buf, "%d", WC->current_iconbar);
 317                 set_preference("current_iconbar", buf, 0);
 318                 set_preference("floordiv_expanded", WC->floordiv_expanded, 1);
 319         }
 320
 321         serv_puts("QUIT");
 322         WC->killthis = 1;
 323         /* close() of citadel socket will be done by do_housekeeping() */
 324 }
 325
 326 /*
 327  * execute the logout
 328  */
 329 void do_logout(void)
 330 {
 331         char buf[SIZ];
 332
 333         safestrncpy(WC->wc_username, "", sizeof WC->wc_username);
 334         safestrncpy(WC->wc_password, "", sizeof WC->wc_password);
 335         safestrncpy(WC->wc_roomname, "", sizeof WC->wc_roomname);
 336         safestrncpy(WC->wc_fullname, "", sizeof WC->wc_fullname);
 337
 338         /** Calling output_headers() this way causes the cookies to be un-set */
 339         output_headers(1, 1, 0, 1, 0, 0);
 340
 341         wprintf("<div id=\"logout_screen\">");
 342         wprintf("<div class=\"box\">");
 343         wprintf("<div class=\"boxlabel\">");
 344         wprintf(_("Log off"));
 345         wprintf("</div><div class=\"boxcontent\">");
 346         serv_puts("MESG goodbye");
 347         serv_getln(buf, sizeof buf);
 348
 349         if (WC->serv_sock >= 0) {
 350                 if (buf[0] == '1') {
 351                         fmout("CENTER");
 352                 } else {
 353                         wprintf("Goodbye\n");
 354                 }
 355         }
 356         else {
 357                 wprintf(_("This program was unable to connect or stay "
 358                         "connected to the Citadel server.  Please report "
 359                         "this problem to your system administrator.")
 360                 );
 361                 wprintf("<a href=\"http://www.citadel.org/doku.php/"
 362                         "faq:mastering_your_os:net#netstat\">%s</a>",
 363                         _("Read More..."));
 364         }
 365
 366         wprintf("<hr /><div class=\"buttons\"> "
 367                 "<span class=\"button_link\"><a href=\".\">");
 368         wprintf(_("Log in again"));
 369         wprintf("</a></span>&nbsp;&nbsp;&nbsp;<span class=\"button_link\">"
 370                 "<a href=\"javascript:window.close();\">");
 371         wprintf(_("Close window"));
 372         wprintf("</a></span></div></div></div></div>\n");
 373         wDumpContent(2);
 374         end_webcit_session();
 375 }
 376
 377
 378 /*
 379  * validate new users
 380  */
 381 void validate(void)
 382 {
 383         char cmd[SIZ];
 384         char user[SIZ];
 385         char buf[SIZ];
 386         int a;
 387
 388         output_headers(1, 1, 2, 0, 0, 0);
 389         wprintf("<div id=\"banner\">\n");
 390         wprintf("<h1>");
 391         wprintf(_("Validate new users"));
 392         wprintf("</h1>");
 393         wprintf("</div>\n");
 394
 395         wprintf("<div id=\"content\" class=\"service\">\n");
 396
 397         /* If the user just submitted a validation, process it... */
 398         safestrncpy(buf, bstr("user"), sizeof buf);
 399         if (!IsEmptyStr(buf)) {
 400                 if (havebstr("axlevel")) {
 401                         serv_printf("VALI %s|%s", buf, bstr("axlevel"));
 402                         serv_getln(buf, sizeof buf);
 403                         if (buf[0] != '2') {
 404                                 wprintf("<b>%s</b><br />\n", &buf[4]);
 405                         }
 406                 }
 407         }
 408
 409         /* Now see if any more users require validation. */
 410         serv_puts("GNUR");
 411         serv_getln(buf, sizeof buf);
 412         if (buf[0] == '2') {
 413                 wprintf("<b>");
 414                 wprintf(_("No users require validation at this time."));
 415                 wprintf("</b><br />\n");
 416                 wDumpContent(1);
 417                 return;
 418         }
 419         if (buf[0] != '3') {
 420                 wprintf("<b>%s</b><br />\n", &buf[4]);
 421                 wDumpContent(1);
 422                 return;
 423         }
 424
 425         wprintf("<div class=\"fix_scrollbar_bug\">"
 426                 "<table class=\"auth_validate\"><tr><td>\n");
 427         wprintf("<center>");
 428
 429         safestrncpy(user, &buf[4], sizeof user);
 430         serv_printf("GREG %s", user);
 431         serv_getln(cmd, sizeof cmd);
 432         if (cmd[0] == '1') {
 433                 a = 0;
 434                 do {
 435                         serv_getln(buf, sizeof buf);
 436                         ++a;
 437                         if (a == 1)
 438                                 wprintf("#%s<br /><H1>%s</H1>",
 439                                         buf, &cmd[4]);
 440                         if (a == 2)
 441                                 wprintf("PW: %s<br />\n", buf);
 442                         if (a == 3)
 443                                 wprintf("%s<br />\n", buf);
 444                         if (a == 4)
 445                                 wprintf("%s<br />\n", buf);
 446                         if (a == 5)
 447                                 wprintf("%s, ", buf);
 448                         if (a == 6)
 449                                 wprintf("%s ", buf);
 450                         if (a == 7)
 451                                 wprintf("%s<br />\n", buf);
 452                         if (a == 8)
 453                                 wprintf("%s<br />\n", buf);
 454                         if (a == 9)
 455                                 wprintf(_("Current access level: %d (%s)\n"),
 456                                         atoi(buf), axdefs[atoi(buf)]);
 457                 } while (strcmp(buf, "000"));
 458         } else {
 459                 wprintf("<H1>%s</H1>%s<br />\n", user, &cmd[4]);
 460         }
 461
 462         wprintf("<hr />");
 463         wprintf(_("Select access level for this user:"));
 464         wprintf("<br />\n");
 465         for (a = 0; a <= 6; ++a) {
 466                 wprintf("<a href=\"validate?nonce=%ld?user=", WC->nonce);
 467                 urlescputs(user);
 468                 wprintf("&axlevel=%d\">%s</A>&nbsp;&nbsp;&nbsp;\n",
 469                         a, axdefs[a]);
 470         }
 471         wprintf("<br />\n");
 472
 473         wprintf("</CENTER>\n");
 474         wprintf("</td></tr></table></div>\n");
 475         wDumpContent(1);
 476 }
 477
 478
 479
 480 /*
 481  * Display form for registration.
 482  *
 483  * (Set during_login to 1 if this registration is being performed during
 484  * new user login and will require chaining to the proper screen.)
 485  */
 486 void display_reg(int during_login)
 487 {
 488         long vcard_msgnum;
 489
 490         if (goto_config_room() != 0) {
 491                 if (during_login) do_welcome();
 492                 else display_main_menu();
 493                 return;
 494         }
 495
 496         vcard_msgnum = locate_user_vcard(WC->wc_fullname, -1);
 497         if (vcard_msgnum < 0L) {
 498                 if (during_login) do_welcome();
 499                 else display_main_menu();
 500                 return;
 501         }
 502
 503         if (during_login) {
 504                 do_edit_vcard(vcard_msgnum, "1", "do_welcome", USERCONFIGROOM);
 505         }
 506         else {
 507                 do_edit_vcard(vcard_msgnum, "1", "display_main_menu", USERCONFIGROOM);
 508         }
 509
 510 }
 511
 512
 513
 514
 515 /*
 516  * display form for changing your password
 517  */
 518 void display_changepw(void)
 519 {
 520         char buf[SIZ];
 521
 522         output_headers(1, 1, 1, 0, 0, 0);
 523
 524         svput("BOXTITLE", WCS_STRING, _("Change your password"));
 525         do_template("beginbox");
 526
 527         if (!IsEmptyStr(WC->ImportantMessage)) {
 528                 wprintf("<span class=\"errormsg\">"
 529                         "%s</span><br />\n", WC->ImportantMessage);
 530                 safestrncpy(WC->ImportantMessage, "", sizeof WC->ImportantMessage);
 531         }
 532
 533         serv_puts("MESG changepw");
 534         serv_getln(buf, sizeof buf);
 535         if (buf[0] == '1') {
 536                 fmout("CENTER");
 537         }
 538
 539         wprintf("<form name=\"changepwform\" action=\"changepw\" method=\"post\">\n");
 540         wprintf("<input type=\"hidden\" name=\"nonce\" value=\"%ld\">\n", WC->nonce);
 541         wprintf("<table class=\"altern\" ");
 542         wprintf("<tr class=\"even\"><td>");
 543         wprintf(_("Enter new password:"));
 544         wprintf("</td><td>");
 545         wprintf("<input type=\"password\" name=\"newpass1\" value=\"\" maxlength=\"20\"></td></tr>\n");
 546         wprintf("<tr class=\"odd\"><td>");
 547         wprintf(_("Enter it again to confirm:"));
 548         wprintf("</td><td>");
 549         wprintf("<input type=\"password\" name=\"newpass2\" value=\"\" maxlength=\"20\"></td></tr>\n");
 550         wprintf("</table>\n");
 551
 552         wprintf("<div class=\"buttons\">\n");
 553         wprintf("<input type=\"submit\" name=\"change_action\" value=\"%s\">", _("Change password"));
 554         wprintf("&nbsp;");
 555         wprintf("<input type=\"submit\" name=\"cancel_action\" value=\"%s\">\n", _("Cancel"));
 556         wprintf("</div>\n");
 557         wprintf("</form>\n");
 558
 559         do_template("endbox");
 560         wDumpContent(1);
 561 }
 562
 563 /*
 564  * change password
 565  * if passwords match, propagate it to citserver.
 566  */
 567 void changepw(void)
 568 {
 569         char buf[SIZ];
 570         char newpass1[32], newpass2[32];
 571
 572         if (!havebstr("change_action")) {
 573                 safestrncpy(WC->ImportantMessage,
 574                         _("Cancelled.  Password was not changed."),
 575                         sizeof WC->ImportantMessage);
 576                 display_main_menu();
 577                 return;
 578         }
 579
 580         safestrncpy(newpass1, bstr("newpass1"), sizeof newpass1);
 581         safestrncpy(newpass2, bstr("newpass2"), sizeof newpass2);
 582
 583         if (strcasecmp(newpass1, newpass2)) {
 584                 safestrncpy(WC->ImportantMessage,
 585                         _("They don't match.  Password was not changed."),
 586                         sizeof WC->ImportantMessage);
 587                 display_changepw();
 588                 return;
 589         }
 590
 591         if (IsEmptyStr(newpass1)) {
 592                 safestrncpy(WC->ImportantMessage,
 593                         _("Blank passwords are not allowed."),
 594                         sizeof WC->ImportantMessage);
 595                 display_changepw();
 596                 return;
 597         }
 598
 599         serv_printf("SETP %s", newpass1);
 600         serv_getln(buf, sizeof buf);
 601         sprintf(WC->ImportantMessage, "%s", &buf[4]);
 602         if (buf[0] == '2') {
 603                 safestrncpy(WC->wc_password, buf, sizeof WC->wc_password);
 604                 display_main_menu();
 605         }
 606         else {
 607                 display_changepw();
 608         }
 609 }
 610
 611
 612
 613 void InitModule_AUTH(void)
 614 {
 615         WebcitAddUrlHandler(HKEY("do_welcome"), do_welcome, 0);
 616         return ;
 617 }