webcit/auth.c

   1 /*
   2  * $Id$
   3  *
   4  * WebcitAuth; Handles authentication of users to a Citadel server.
   5  */
   6
   7 #include "webcit.h"
   8 #include "webserver.h"
   9 #include <ctype.h>
  10
  11 /*
  12  * Access level definitions.  This is initialized from a function rather than a
  13  * static array so that the strings may be localized.
  14  */
  15 char *axdefs[7];
  16
  17 void initialize_axdefs(void) {
  18         axdefs[0] = _("Deleted");       /* an erased user */
  19         axdefs[1] = _("New User");      /* a new user */
  20         axdefs[2] = _("Problem User");  /* a trouble maker */
  21         axdefs[3] = _("Local User");    /* user with normal privileges */
  22         axdefs[4] = _("Network User");  /* a user that may access network resources */
  23         axdefs[5] = _("Preferred User");/* a moderator */
  24         axdefs[6] = _("Aide");          /* chief */
  25 }
  26
  27
  28
  29
  30 /*
  31  * Display the login screen
  32  * mesg = the error message if last attempt failed.
  33  */
  34 void display_login(char *mesg)
  35 {
  36         char buf[SIZ];
  37
  38         output_headers(1, 1, 2, 0, 0, 0);
  39         wprintf("<div id=\"login_screen\">\n");
  40
  41         if (mesg != NULL) if (!IsEmptyStr(mesg)) {
  42                         stresc(buf, SIZ,  mesg, 0, 0);
  43                         svprintf(HKEY("MESG"), WCS_STRING, "%s", buf);
  44         }
  45
  46         svprintf(HKEY("LOGIN_INSTRUCTIONS"), WCS_STRING,
  47                 _("<ul>"
  48                 "<li><b>If you already have an account on %s</b>, "
  49                 "enter your user name and password and click &quot;Login.&quot; "
  50                 "<li><b>If you are a new user</b>, enter the name and password "
  51                 "you wish to use, "
  52                 "and click &quot;New User.&quot; "
  53                 "<li>Please log off properly when finished. "
  54                 "<li>You must use a browser that supports <i>frames</i> and "
  55                 "<i>cookies</i>. "
  56                 "<li>Also keep in mind that if your browser is "
  57                 "configured to block pop-up windows, you will not be able "
  58                 "to receive any instant messages.<br />"
  59                 "</ul>"),
  60                 serv_info.serv_humannode
  61         );
  62
  63         svput("USERNAME_BOX", WCS_STRING, _("User name:"));
  64         svput("PASSWORD_BOX", WCS_STRING, _("Password:"));
  65         svput("LANGUAGE_BOX", WCS_STRING, _("Language:"));
  66         svput("LOGIN_BUTTON", WCS_STRING, _("Login"));
  67         svput("NEWUSER_BUTTON", WCS_STRING, _("New User"));
  68         svput("EXIT_BUTTON", WCS_STRING, _("Exit"));
  69         svput("HELLO", WCS_SERVCMD, "MESG hello");
  70         svprintf(HKEY("BOXTITLE"), WCS_STRING, _("%s - powered by <a href=\"http://www.citadel.org\">Citadel</a>"),
  71                 serv_info.serv_humannode);
  72         svcallback("DO_LANGUAGE_BOX", offer_languages);
  73         if (serv_info.serv_newuser_disabled) {
  74                 svput("NEWUSER_BUTTON_PRE", WCS_STRING, "<div style=\"display:none;\">");
  75                 svput("NEWUSER_BUTTON_POST", WCS_STRING, "</div>");
  76         }
  77         else {
  78                 svput("NEWUSER_BUTTON_PRE", WCS_STRING, "");
  79                 svput("NEWUSER_BUTTON_POST", WCS_STRING, "");
  80         }
  81
  82         if (serv_info.serv_supports_openid) {
  83                 svprintf(HKEY("OFFER_OPENID_LOGIN"), WCS_STRING,
  84                         "<div align=center>"
  85                         "<a href=\"display_openid_login\">"
  86                         "<img src=\"static/openid-small.gif\" border=0 valign=middle>"
  87                         "%s</a>"
  88                         "</div>"
  89                         ,
  90                         "Log in using OpenID"
  91                 );
  92         }
  93         else {
  94                 svput("OFFER_OPENID_LOGIN", WCS_STRING, "");
  95         }
  96
  97         do_template("login");
  98
  99         wDumpContent(2);
 100 }
 101
 102
 103
 104
 105 /*
 106  * Display the openid-enabled login screen
 107  * mesg = the error message if last attempt failed.
 108  */
 109 void display_openid_login(char *mesg)
 110 {
 111         char buf[SIZ];
 112
 113         output_headers(1, 1, 2, 0, 0, 0);
 114         wprintf("<div id=\"login_screen\">\n");
 115
 116         if (mesg != NULL) if (!IsEmptyStr(mesg)) {
 117                         stresc(buf, SIZ,  mesg, 0, 0);
 118                         svprintf(HKEY("MESG"), WCS_STRING, "%s", buf);
 119         }
 120
 121         svprintf(HKEY("LOGIN_INSTRUCTIONS"), WCS_STRING,
 122                 _("<ul>"
 123                 "<li>Enter your OpenID URL and click &quot;Login&quot;."
 124                 "<li><a href=\"http://www.citadel.org/doku.php/documentation:openid\">"
 125                 "Click here to learn what OpenID is and how Citadel is using it.</a>"
 126                 "<li>Please log off properly when finished. "
 127                 "<li>You must use a browser that supports <i>frames</i> and "
 128                 "<i>cookies</i>. "
 129                 "<li>Also keep in mind that if your browser is "
 130                 "configured to block pop-up windows, you will not be able "
 131                 "to receive any instant messages.<br />"
 132                 "</ul>")
 133         );
 134
 135         svput("OPENID_BOX", WCS_STRING, _("OpenID URL:"));
 136         svput("LANGUAGE_BOX", WCS_STRING, _("Language:"));
 137         svput("LOGIN_BUTTON", WCS_STRING, _("Login"));
 138         svput("EXIT_BUTTON", WCS_STRING, _("Exit"));
 139         svput("HELLO", WCS_SERVCMD, "MESG hello");
 140         svprintf(HKEY("BOXTITLE"), WCS_STRING, _("%s - powered by <a href=\"http://www.citadel.org\">Citadel</a>"),
 141                 serv_info.serv_humannode);
 142         svcallback("DO_LANGUAGE_BOX", offer_languages);
 143
 144         svprintf(HKEY("OFFER_CONVENTIONAL_LOGIN"), WCS_STRING,
 145                 "<div align=center>"
 146                 "<a href=\"display_login\">"
 147                 "%s</a>"
 148                 "</div>"
 149                 ,
 150                 "Log in using a user name and password"
 151         );
 152
 153         do_template("openid_login");
 154         wDumpContent(2);
 155 }
 156
 157
 158 void display_openid_name_request(char *claimed_id, char *username) {
 159         char buf[SIZ];
 160
 161         output_headers(1, 1, 2, 0, 0, 0);
 162         wprintf("<div id=\"login_screen\">\n");
 163
 164         stresc(buf, sizeof buf, claimed_id, 0, 0);
 165         svprintf(HKEY("VERIFIED"), WCS_STRING, _("Your OpenID <tt>%s</tt> was successfully verified."),
 166                 claimed_id);
 167         svput("CLAIMED_ID", WCS_STRING, claimed_id);
 168
 169
 170         if (!IsEmptyStr(username)) {
 171                 stresc(buf, sizeof buf, username, 0, 0);
 172                 svprintf(HKEY("REASON"), WCS_STRING,
 173                         _("However, the user name '%s' conflicts with an existing user."), username);
 174         }
 175         else {
 176                 svput("REASON", WCS_STRING, "");
 177         }
 178
 179         svput("ACTION_REQUESTED", WCS_STRING, _("Please specify the user name you would like to use."));
 180
 181         svput("USERNAME_BOX", WCS_STRING, _("User name:"));
 182         svput("NEWUSER_BUTTON", WCS_STRING, _("New User"));
 183         svput("EXIT_BUTTON", WCS_STRING, _("Exit"));
 184
 185         svprintf(HKEY("BOXTITLE"), WCS_STRING, _("%s - powered by <a href=\"http://www.citadel.org\">Citadel</a>"),
 186                 serv_info.serv_humannode);
 187
 188         do_template("openid_manual_create");
 189         wDumpContent(2);
 190 }
 191
 192
 193
 194 /* Initialize the session
 195  *
 196  * This function needs to get called whenever the session changes from
 197  * not-logged-in to logged-in, either by an explicit login by the user or
 198  * by a timed-out session automatically re-establishing with a little help
 199  * from the browser cookie.  Either way, we need to load access controls and
 200  * preferences from the server.
 201  *
 202  * user                 the username
 203  * pass                 his password
 204  * serv_response        The parameters returned from a Citadel USER or NEWU command
 205  */
 206 void become_logged_in(char *user, char *pass, char *serv_response)
 207 {
 208         char buf[SIZ];
 209
 210         WC->logged_in = 1;
 211         extract_token(WC->wc_fullname, &serv_response[4], 0, '|', sizeof WC->wc_fullname);
 212         safestrncpy(WC->wc_username, user, sizeof WC->wc_username);
 213         safestrncpy(WC->wc_password, pass, sizeof WC->wc_password);
 214         WC->axlevel = extract_int(&serv_response[4], 1);
 215         if (WC->axlevel >= 6) {
 216                 WC->is_aide = 1;
 217         }
 218
 219         load_preferences();
 220
 221         serv_puts("CHEK");
 222         serv_getln(buf, sizeof buf);
 223         if (buf[0] == '2') {
 224                 WC->new_mail = extract_int(&buf[4], 0);
 225                 WC->need_regi = extract_int(&buf[4], 1);
 226                 WC->need_vali = extract_int(&buf[4], 2);
 227                 extract_token(WC->cs_inet_email, &buf[4], 3, '|', sizeof WC->cs_inet_email);
 228         }
 229
 230         get_preference("current_iconbar", buf, sizeof buf);
 231         WC->current_iconbar = atoi(buf);
 232
 233         get_preference("floordiv_expanded", WC->floordiv_expanded, sizeof WC->floordiv_expanded);
 234 }
 235
 236
 237 /*
 238  * Perform authentication using a user name and password
 239  */
 240 void do_login(void)
 241 {
 242         char buf[SIZ];
 243
 244         if (havebstr("language")) {
 245                 set_selected_language(bstr("language"));
 246                 go_selected_language();
 247         }
 248
 249         if (havebstr("exit_action")) {
 250                 do_logout();
 251                 return;
 252         }
 253         if (havebstr("login_action")) {
 254                 serv_printf("USER %s", bstr("name"));
 255                 serv_getln(buf, sizeof buf);
 256                 if (buf[0] == '3') {
 257                         serv_printf("PASS %s", bstr("pass"));
 258                         serv_getln(buf, sizeof buf);
 259                         if (buf[0] == '2') {
 260                                 become_logged_in(bstr("name"), bstr("pass"), buf);
 261                         } else {
 262                                 display_login(&buf[4]);
 263                                 return;
 264                         }
 265                 } else {
 266                         display_login(&buf[4]);
 267                         return;
 268                 }
 269         }
 270         if (havebstr("newuser_action")) {
 271                 if (!havebstr("pass")) {
 272                         display_login(_("Blank passwords are not allowed."));
 273                         return;
 274                 }
 275                 serv_printf("NEWU %s", bstr("name"));
 276                 serv_getln(buf, sizeof buf);
 277                 if (buf[0] == '2') {
 278                         become_logged_in(bstr("name"), bstr("pass"), buf);
 279                         serv_printf("SETP %s", bstr("pass"));
 280                         serv_getln(buf, sizeof buf);
 281                 } else {
 282                         display_login(&buf[4]);
 283                         return;
 284                 }
 285         }
 286         if (WC->logged_in) {
 287                 if (WC->need_regi) {
 288                         display_reg(1);
 289                 } else if (WC->need_vali) {
 290                         validate();
 291                 } else {
 292                         do_welcome();
 293                 }
 294         } else {
 295                 display_login(_("Your password was not accepted."));
 296         }
 297
 298 }
 299
 300 /*
 301  * Try to create an account manually after an OpenID was verified
 302  */
 303 void openid_manual_create(void)
 304 {
 305         if (havebstr("exit_action")) {
 306                 do_logout();
 307                 return;
 308         }
 309
 310         char buf[1024];
 311         if (havebstr("newuser_action")) {
 312                 serv_printf("OIDC %s", bstr("name"));
 313                 serv_getln(buf, sizeof buf);
 314                 if (buf[0] == '2') {
 315                         char gpass[1024] = "";
 316                         serv_puts("SETP GENERATE_RANDOM_PASSWORD");
 317                         serv_getln(gpass, sizeof gpass);
 318                         become_logged_in(bstr("name"), &gpass[4], buf);
 319                 }
 320         }
 321
 322         if (WC->logged_in) {
 323                 if (WC->need_regi) {
 324                         display_reg(1);
 325                 } else if (WC->need_vali) {
 326                         validate();
 327                 } else {
 328                         do_welcome();
 329                 }
 330         } else {
 331                 display_openid_name_request(bstr("openid_url"), bstr("name"));
 332         }
 333
 334 }
 335
 336
 337 /*
 338  * Perform authentication using OpenID
 339  * assemble the checkid_setup request and then redirect to the user's identity provider
 340  */
 341 void do_openid_login(void)
 342 {
 343         char buf[4096];
 344
 345         if (havebstr("language")) {
 346                 set_selected_language(bstr("language"));
 347                 go_selected_language();
 348         }
 349
 350         if (havebstr("exit_action")) {
 351                 do_logout();
 352                 return;
 353         }
 354         if (havebstr("login_action")) {
 355                 snprintf(buf, sizeof buf,
 356                         "OIDS %s|%s://%s/finalize_openid_login|%s://%s",
 357                         bstr("openid_url"),
 358                         (is_https ? "https" : "http"), WC->http_host,
 359                         (is_https ? "https" : "http"), WC->http_host
 360                 );
 361
 362                 serv_puts(buf);
 363                 serv_getln(buf, sizeof buf);
 364                 if (buf[0] == '2') {
 365                         lprintf(CTDL_DEBUG, "OpenID server contacted; redirecting to %s\n", &buf[4]);
 366                         http_redirect(&buf[4]);
 367                         return;
 368                 }
 369                 else {
 370                         display_openid_login(&buf[4]);
 371                         return;
 372                 }
 373         }
 374
 375         /* If we get to this point then something failed. */
 376         display_openid_login(_("Your password was not accepted."));
 377 }
 378
 379 /*
 380  * Complete the authentication using OpenID
 381  * This function handles the positive or negative assertion from the user's Identity Provider
 382  */
 383 void finalize_openid_login(void)
 384 {
 385         char buf[1024];
 386         struct wcsession *WCC = WC;
 387         int already_logged_in = (WCC->logged_in) ;
 388         int linecount = 0;
 389         char result[128] = "";
 390         char username[128] = "";
 391         char password[128] = "";
 392         char logged_in_response[1024] = "";
 393         char claimed_id[1024] = "";
 394
 395         if (havebstr("openid.mode")) {
 396                 if (!strcasecmp(bstr("openid.mode"), "id_res")) {
 397
 398                         serv_puts("OIDF");
 399                         serv_getln(buf, sizeof buf);
 400
 401                         if (buf[0] == '8') {
 402                                 urlcontent *u;
 403                                 void *U;
 404                                 long HKLen;
 405                                 char *HKey;
 406                                 HashPos *Cursor;
 407
 408                                 Cursor = GetNewHashPos ();
 409                                 while (GetNextHashPos(WCC->urlstrings, Cursor, &HKLen, &HKey, &U)) {
 410                                         u = (urlcontent*) U;
 411                                         if (!strncasecmp(u->url_key, "openid.", 7)) {
 412                                                 serv_printf("%s|%s", &u->url_key[7], u->url_data);
 413                                         }
 414                                 }
 415
 416                                 serv_puts("000");
 417
 418                                 linecount = 0;
 419                                 while (serv_getln(buf, sizeof buf), strcmp(buf, "000")) {
 420                                         if (linecount == 0) safestrncpy(result, buf, sizeof result);
 421                                         if (!strcasecmp(result, "authenticate")) {
 422                                                 if (linecount == 1) {
 423                                                         safestrncpy(username, buf, sizeof username);
 424                                                 }
 425                                                 else if (linecount == 2) {
 426                                                         safestrncpy(password, buf, sizeof password);
 427                                                 }
 428                                                 else if (linecount == 3) {
 429                                                         safestrncpy(logged_in_response, buf,
 430                                                                 sizeof logged_in_response);
 431                                                 }
 432                                         }
 433                                         else if (!strcasecmp(result, "verify_only")) {
 434                                                 if (linecount == 1) {
 435                                                         safestrncpy(claimed_id, buf, sizeof claimed_id);
 436                                                 }
 437                                                 if (linecount == 2) {
 438                                                         safestrncpy(username, buf, sizeof username);
 439                                                 }
 440                                         }
 441                                         ++linecount;
 442                                 }
 443                         }
 444                 }
 445         }
 446
 447         /* If we were already logged in, this was an attempt to associate an OpenID account */
 448         if (already_logged_in) {
 449                 display_openids();
 450                 return;
 451         }
 452
 453         /* If this operation logged us in, either by connecting with an existing account or by
 454          * auto-creating one using Simple Registration Extension, we're already on our way.
 455          */
 456         if (!strcasecmp(result, "authenticate")) {
 457                 become_logged_in(username, password, logged_in_response);
 458         }
 459
 460         /* The specified OpenID was verified but the desired user name was either not specified via SRI
 461          * or conflicts with an existing user.  Either way the user will need to specify a new name.
 462          */
 463
 464         else if (!strcasecmp(result, "verify_only")) {
 465                 display_openid_name_request(claimed_id, username);
 466         }
 467
 468         /* Did we manage to log in?  If so, continue with the normal flow... */
 469         if (WC->logged_in) {
 470                 if (WC->need_regi) {
 471                         display_reg(1);
 472                 } else {
 473                         do_welcome();
 474                 }
 475         } else {
 476                 display_openid_login(_("Your password was not accepted."));
 477         }
 478
 479 }
 480
 481
 482 /*
 483  * Display a welcome screen to the user.
 484  *
 485  * If this is the first time login, and the web based setup is enabled,
 486  * lead the user through the setup routines
 487  */
 488 void do_welcome(void)
 489 {
 490         char buf[SIZ];
 491 #ifdef XXX_NOT_FINISHED_YET_XXX
 492         FILE *fp;
 493         int i;
 494
 495         /**
 496          * See if we have to run the first-time setup wizard
 497          */
 498         if (WC->is_aide) {
 499                 if (!setup_wizard) {
 500                         int len;
 501                         sprintf(wizard_filename, "setupwiz.%s.%s",
 502                                 ctdlhost, ctdlport);
 503                         len = strlen(wizard_filename);
 504                         for (i=0; i<len; ++i) {
 505                                 if (    (wizard_filename[i]==' ')
 506                                         || (wizard_filename[i] == '/')
 507                                 ) {
 508                                         wizard_filename[i] = '_';
 509                                 }
 510                         }
 511
 512                         fp = fopen(wizard_filename, "r");
 513                         if (fp != NULL) {
 514                                 fgets(buf, sizeof buf, fp);
 515                                 buf[strlen(buf)-1] = 0;
 516                                 fclose(fp);
 517                                 if (atoi(buf) == serv_info.serv_rev_level) {
 518                                         setup_wizard = 1; /**< already run */
 519                                 }
 520                         }
 521                 }
 522
 523                 if (!setup_wizard) {
 524                         http_redirect("setup_wizard");
 525                 }
 526         }
 527 #endif
 528
 529         /*
 530          * Go to the user's preferred start page
 531          */
 532         get_preference("startpage", buf, sizeof buf);
 533         if (IsEmptyStr(buf)) {
 534                 safestrncpy(buf, "dotskip&room=_BASEROOM_", sizeof buf);
 535                 set_preference("startpage", buf, 1);
 536         }
 537         if (buf[0] == '/') {
 538                 strcpy(buf, &buf[1]);
 539         }
 540         http_redirect(buf);
 541 }
 542
 543
 544 /*
 545  * Disconnect from the Citadel server, and end this WebCit session
 546  */
 547 void end_webcit_session(void) {
 548         char buf[256];
 549
 550         if (WC->logged_in) {
 551                 sprintf(buf, "%d", WC->current_iconbar);
 552                 set_preference("current_iconbar", buf, 0);
 553                 set_preference("floordiv_expanded", WC->floordiv_expanded, 1);
 554         }
 555
 556         serv_puts("QUIT");
 557         WC->killthis = 1;
 558         /* close() of citadel socket will be done by do_housekeeping() */
 559 }
 560
 561 /*
 562  * execute the logout
 563  */
 564 void do_logout(void)
 565 {
 566         char buf[SIZ];
 567
 568         safestrncpy(WC->wc_username, "", sizeof WC->wc_username);
 569         safestrncpy(WC->wc_password, "", sizeof WC->wc_password);
 570         safestrncpy(WC->wc_roomname, "", sizeof WC->wc_roomname);
 571         safestrncpy(WC->wc_fullname, "", sizeof WC->wc_fullname);
 572
 573         /** Calling output_headers() this way causes the cookies to be un-set */
 574         output_headers(1, 1, 0, 1, 0, 0);
 575
 576         wprintf("<div id=\"logout_screen\">");
 577         wprintf("<div class=\"box\">");
 578         wprintf("<div class=\"boxlabel\">");
 579         wprintf(_("Log off"));
 580         wprintf("</div><div class=\"boxcontent\">");
 581         serv_puts("MESG goodbye");
 582         serv_getln(buf, sizeof buf);
 583
 584         if (WC->serv_sock >= 0) {
 585                 if (buf[0] == '1') {
 586                         fmout("CENTER");
 587                 } else {
 588                         wprintf("Goodbye\n");
 589                 }
 590         }
 591         else {
 592                 wprintf(_("This program was unable to connect or stay "
 593                         "connected to the Citadel server.  Please report "
 594                         "this problem to your system administrator.")
 595                 );
 596                 wprintf("<a href=\"http://www.citadel.org/doku.php/"
 597                         "faq:mastering_your_os:net#netstat\">%s</a>",
 598                         _("Read More..."));
 599         }
 600
 601         wprintf("<hr /><div class=\"buttons\"> "
 602                 "<span class=\"button_link\"><a href=\".\">");
 603         wprintf(_("Log in again"));
 604         wprintf("</a></span>&nbsp;&nbsp;&nbsp;<span class=\"button_link\">"
 605                 "<a href=\"javascript:window.close();\">");
 606         wprintf(_("Close window"));
 607         wprintf("</a></span></div></div></div></div>\n");
 608         wDumpContent(2);
 609         end_webcit_session();
 610 }
 611
 612
 613 /*
 614  * validate new users
 615  */
 616 void validate(void)
 617 {
 618         char cmd[SIZ];
 619         char user[SIZ];
 620         char buf[SIZ];
 621         int a;
 622
 623         output_headers(1, 1, 2, 0, 0, 0);
 624         wprintf("<div id=\"banner\">\n");
 625         wprintf("<h1>");
 626         wprintf(_("Validate new users"));
 627         wprintf("</h1>");
 628         wprintf("</div>\n");
 629
 630         wprintf("<div id=\"content\" class=\"service\">\n");
 631
 632         /* If the user just submitted a validation, process it... */
 633         safestrncpy(buf, bstr("user"), sizeof buf);
 634         if (!IsEmptyStr(buf)) {
 635                 if (havebstr("axlevel")) {
 636                         serv_printf("VALI %s|%s", buf, bstr("axlevel"));
 637                         serv_getln(buf, sizeof buf);
 638                         if (buf[0] != '2') {
 639                                 wprintf("<b>%s</b><br />\n", &buf[4]);
 640                         }
 641                 }
 642         }
 643
 644         /* Now see if any more users require validation. */
 645         serv_puts("GNUR");
 646         serv_getln(buf, sizeof buf);
 647         if (buf[0] == '2') {
 648                 wprintf("<b>");
 649                 wprintf(_("No users require validation at this time."));
 650                 wprintf("</b><br />\n");
 651                 wDumpContent(1);
 652                 return;
 653         }
 654         if (buf[0] != '3') {
 655                 wprintf("<b>%s</b><br />\n", &buf[4]);
 656                 wDumpContent(1);
 657                 return;
 658         }
 659
 660         wprintf("<div class=\"fix_scrollbar_bug\">"
 661                 "<table class=\"auth_validate\"><tr><td>\n");
 662         wprintf("<center>");
 663
 664         safestrncpy(user, &buf[4], sizeof user);
 665         serv_printf("GREG %s", user);
 666         serv_getln(cmd, sizeof cmd);
 667         if (cmd[0] == '1') {
 668                 a = 0;
 669                 do {
 670                         serv_getln(buf, sizeof buf);
 671                         ++a;
 672                         if (a == 1)
 673                                 wprintf("#%s<br /><H1>%s</H1>",
 674                                         buf, &cmd[4]);
 675                         if (a == 2) {
 676                                 char *pch;
 677                                 int haveChar = 0;
 678                                 int haveNum = 0;
 679                                 int haveOther = 0;
 680                                 int count = 0;
 681                                 pch = buf;
 682                                 while (!IsEmptyStr(pch))
 683                                 {
 684                                         if (isdigit(*pch))
 685                                                 haveNum = 1;
 686                                         else if (isalpha(*pch))
 687                                                 haveChar = 1;
 688                                         else
 689                                                 haveOther = 1;
 690                                         pch ++;
 691                                 }
 692                                 count = pch - buf;
 693                                 if (count > 7)
 694                                         count = 0;
 695                                 switch (count){
 696                                 case 0:
 697                                         pch = _("very weak");
 698                                         break;
 699                                 case 1:
 700                                         pch = _("weak");
 701                                         break;
 702                                 case 2:
 703                                         pch = _("ok");
 704                                         break;
 705                                 case 3:
 706                                 default:
 707                                         pch = _("strong");
 708                                 }
 709
 710                                 wprintf("PW: %s<br />\n", pch);
 711                         }
 712                         if (a == 3)
 713                                 wprintf("%s<br />\n", buf);
 714                         if (a == 4)
 715                                 wprintf("%s<br />\n", buf);
 716                         if (a == 5)
 717                                 wprintf("%s, ", buf);
 718                         if (a == 6)
 719                                 wprintf("%s ", buf);
 720                         if (a == 7)
 721                                 wprintf("%s<br />\n", buf);
 722                         if (a == 8)
 723                                 wprintf("%s<br />\n", buf);
 724                         if (a == 9)
 725                                 wprintf(_("Current access level: %d (%s)\n"),
 726                                         atoi(buf), axdefs[atoi(buf)]);
 727                 } while (strcmp(buf, "000"));
 728         } else {
 729                 wprintf("<H1>%s</H1>%s<br />\n", user, &cmd[4]);
 730         }
 731
 732         wprintf("<hr />");
 733         wprintf(_("Select access level for this user:"));
 734         wprintf("<br />\n");
 735         for (a = 0; a <= 6; ++a) {
 736                 wprintf("<a href=\"validate?nonce=%ld?user=", WC->nonce);
 737                 urlescputs(user);
 738                 wprintf("&axlevel=%d\">%s</A>&nbsp;&nbsp;&nbsp;\n",
 739                         a, axdefs[a]);
 740         }
 741         wprintf("<br />\n");
 742
 743         wprintf("</CENTER>\n");
 744         wprintf("</td></tr></table></div>\n");
 745         wDumpContent(1);
 746 }
 747
 748
 749
 750 /*
 751  * Display form for registration.
 752  *
 753  * (Set during_login to 1 if this registration is being performed during
 754  * new user login and will require chaining to the proper screen.)
 755  */
 756 void display_reg(int during_login)
 757 {
 758         long vcard_msgnum;
 759
 760         if (goto_config_room() != 0) {
 761                 if (during_login) do_welcome();
 762                 else display_main_menu();
 763                 return;
 764         }
 765
 766         vcard_msgnum = locate_user_vcard(WC->wc_fullname, -1);
 767         if (vcard_msgnum < 0L) {
 768                 if (during_login) do_welcome();
 769                 else display_main_menu();
 770                 return;
 771         }
 772
 773         if (during_login) {
 774                 do_edit_vcard(vcard_msgnum, "1", "do_welcome", USERCONFIGROOM);
 775         }
 776         else {
 777                 do_edit_vcard(vcard_msgnum, "1", "display_main_menu", USERCONFIGROOM);
 778         }
 779
 780 }
 781
 782
 783
 784
 785 /*
 786  * display form for changing your password
 787  */
 788 void display_changepw(void)
 789 {
 790         char buf[SIZ];
 791
 792         output_headers(1, 1, 1, 0, 0, 0);
 793
 794         svput("BOXTITLE", WCS_STRING, _("Change your password"));
 795         do_template("beginbox");
 796
 797         if (!IsEmptyStr(WC->ImportantMessage)) {
 798                 wprintf("<span class=\"errormsg\">"
 799                         "%s</span><br />\n", WC->ImportantMessage);
 800                 safestrncpy(WC->ImportantMessage, "", sizeof WC->ImportantMessage);
 801         }
 802
 803         serv_puts("MESG changepw");
 804         serv_getln(buf, sizeof buf);
 805         if (buf[0] == '1') {
 806                 fmout("CENTER");
 807         }
 808
 809         wprintf("<form name=\"changepwform\" action=\"changepw\" method=\"post\">\n");
 810         wprintf("<input type=\"hidden\" name=\"nonce\" value=\"%ld\">\n", WC->nonce);
 811         wprintf("<table class=\"altern\" ");
 812         wprintf("<tr class=\"even\"><td>");
 813         wprintf(_("Enter new password:"));
 814         wprintf("</td><td>");
 815         wprintf("<input type=\"password\" name=\"newpass1\" value=\"\" maxlength=\"20\"></td></tr>\n");
 816         wprintf("<tr class=\"odd\"><td>");
 817         wprintf(_("Enter it again to confirm:"));
 818         wprintf("</td><td>");
 819         wprintf("<input type=\"password\" name=\"newpass2\" value=\"\" maxlength=\"20\"></td></tr>\n");
 820         wprintf("</table>\n");
 821
 822         wprintf("<div class=\"buttons\">\n");
 823         wprintf("<input type=\"submit\" name=\"change_action\" value=\"%s\">", _("Change password"));
 824         wprintf("&nbsp;");
 825         wprintf("<input type=\"submit\" name=\"cancel_action\" value=\"%s\">\n", _("Cancel"));
 826         wprintf("</div>\n");
 827         wprintf("</form>\n");
 828
 829         do_template("endbox");
 830         wDumpContent(1);
 831 }
 832
 833 /*
 834  * change password
 835  * if passwords match, propagate it to citserver.
 836  */
 837 void changepw(void)
 838 {
 839         char buf[SIZ];
 840         char newpass1[32], newpass2[32];
 841
 842         if (!havebstr("change_action")) {
 843                 safestrncpy(WC->ImportantMessage,
 844                         _("Cancelled.  Password was not changed."),
 845                         sizeof WC->ImportantMessage);
 846                 display_main_menu();
 847                 return;
 848         }
 849
 850         safestrncpy(newpass1, bstr("newpass1"), sizeof newpass1);
 851         safestrncpy(newpass2, bstr("newpass2"), sizeof newpass2);
 852
 853         if (strcasecmp(newpass1, newpass2)) {
 854                 safestrncpy(WC->ImportantMessage,
 855                         _("They don't match.  Password was not changed."),
 856                         sizeof WC->ImportantMessage);
 857                 display_changepw();
 858                 return;
 859         }
 860
 861         if (IsEmptyStr(newpass1)) {
 862                 safestrncpy(WC->ImportantMessage,
 863                         _("Blank passwords are not allowed."),
 864                         sizeof WC->ImportantMessage);
 865                 display_changepw();
 866                 return;
 867         }
 868
 869         serv_printf("SETP %s", newpass1);
 870         serv_getln(buf, sizeof buf);
 871         sprintf(WC->ImportantMessage, "%s", &buf[4]);
 872         if (buf[0] == '2') {
 873                 safestrncpy(WC->wc_password, buf, sizeof WC->wc_password);
 874                 display_main_menu();
 875         }
 876         else {
 877                 display_changepw();
 878         }
 879 }
 880
 881
 882
 883 void InitModule_AUTH(void)
 884 {
 885         WebcitAddUrlHandler(HKEY("do_welcome"), do_welcome, 0);
 886         return ;
 887 }