#! /usr/bin/perl # ### Variables # Password file with full system path . $file = '/www/business/istug/.htpasswd'; $url ='http://istug.fast.net.uk/cgi-bin/control.cgi'; ### End of Variables # Create form and exit on GET &make_form unless ($ENV{'REQUEST_METHOD'} eq "POST"); # Get POST input read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'}); # Split the name-value pairs @pairs = split(/&/, $buffer); foreach $pair (@pairs) { ($name, $value) = split(/=/, $pair); $value =~ tr/+/ /; $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; $name =~ tr/+/ /; $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg; $FORM{$name} = $value; } if ($FORM{user}) { $user = $FORM{user}; } else { &error("Error", "Username missing from form."); } $pwd = $FORM{old}; $command = $FORM{command}; unless (($command eq 'remove') ||($FORM{new} && $FORM{new} eq $FORM{new2})) { &error("Password Mismatch", "New password mismatch or missing."); } # Get existing passwords if (-e $file) { open (IN, $file) or &error("Error", "Can't open password file: $!"); flock(IN,2); seek(IN,0,0); while () { chomp; ($name, $value, $tail) = split(/:/, $_, 3); $hash{$name} = $value; $tail{$name} = $tail; # maintain any additional fields } close IN; } # Salt for crypt @range = ('0'..'9','a'..'z','A'..'Z','.','/'); srand ( time() ^ ($$ + ($$ << 15)) ); $salt = $range[rand(int($#range)+1)] . $range[rand(int($#range)+1)]; # Check for valid password or existing user $pass = $hash{$user} if $hash{$user}; $cpwd = crypt($pwd, $pass); $admin = $hash{admin} && crypt($pwd, $hash{admin}) eq $hash{admin}; if (($command ne 'new') && ($admin || $pass && $cpwd eq $pass)) { if ($command eq 'remove') { delete($hash{$user}); delete($tail{$user}); $msg = "User $user was removed from password file.
Click HERE to return."; } elsif (!$pass) { $msg = "WARNING! 'Change Password' checked for non-existing user?\n" . "

Creating new user $user.\n" . "

If this was an error, go back and 'Remove User'
Click HERE to return."; } else { $msg = "Password has been updated for $user.
Click HERE to return."; } } elsif ($FORM{command} eq 'new') { if ($pass) { &error("Sorry", "User $user is already assigned.
Click HERE to return."); }elsif ($admin) { $msg = "Password has been assigned for new user $user.
Click HERE to return."; } else { &begin_html("Sorry"); print "Have you entered the admin password correctly ?.
Click HERE to return."; &end_html; exit; } } else { &error("Password Error", "Invalid user or password or forgot to check 'New User'.
Click HERE to return."); } # Assign new password to user and write to file $hash{$user} = crypt($FORM{new}, $salt) if $command ne 'remove'; if (open(OUT, ">$file")) { flock(OUT,2); seek(OUT,0,0); foreach $name (sort keys %hash) { print OUT "$name:$hash{$name}"; print OUT ":$tail{$name}" if $tail{$name}; print OUT "\n"; } } else { &error("Error","Can't update password file: $!"); } # Print Return HTML &begin_html("Thank You"); print "$msg\n"; &end_html; ### Subroutines #subroutine begin_html(title) sub begin_html { local ($title) = @_; print "Content-type: text/html\n\n"; print "$title\n"; print <

User Administration

END } #subroutine end_html sub end_html { # Add footer links here print "

\n"; } #subroutine make_form sub make_form { &begin_html("User Administration"); print <
  User and Password Control Form
 
Request:

Change Password
New User
Remove User
 
Username for modification/creation:
Admin Password:
New Password:
Confirm New Password:

 

  

NEW_FORM print '

'; open (USERS, "$file"); print ''; print ''; print ''; print ''; print '
  CURRENT USERS ON SYSTEM
'; while () { ($username,$password) = split (/:/); print "$username"; print '
'; } close USERS; print '
'; &end_html; exit; } sub error { local($title,$msg) = @_; &begin_html($title); print "

$msg\n"; print "

Please check your name and re-enter passwords.
Click HERE to return.\n"; &end_html; exit; }