From 00aceaf624d8e5da2a8f3df161d52599aae2ac41 Mon Sep 17 00:00:00 2001
From: Steven Barth <steven@midlink.org>
Date: Sat, 28 Jun 2008 16:03:54 +0000
Subject: * libs/web: Switched from HTTP-Basic-Auth to Session-Auth * Updated
 Makefiles for better testing environment integration * Fixed libs/sgi-luci

---
 libs/web/luasrc/dispatcher.lua | 77 ++++++++++++++++++++++--------------------
 libs/web/luasrc/http.lua       | 15 ++++----
 libs/web/luasrc/i18n.lua       |  4 +--
 libs/web/luasrc/sauth.lua      | 11 +++---
 4 files changed, 57 insertions(+), 50 deletions(-)

(limited to 'libs/web')

diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua
index 5bf3fc1d6..989eb4402 100644
--- a/libs/web/luasrc/dispatcher.lua
+++ b/libs/web/luasrc/dispatcher.lua
@@ -43,18 +43,6 @@ function build_url(...)
 	return luci.http.getenv("SCRIPT_NAME") .. "/" .. table.concat(arg, "/")
 end
 
--- Prints an error message or renders the "error401" template if available
-function error401(message)
-	message = message or "Unauthorized"
-
-	require("luci.template")
-	if not luci.util.copcall(luci.template.render, "error401") then
-		luci.http.prepare_content("text/plain")
-		luci.http.write(message)
-	end
-	return false
-end
-
 -- Sends a 404 error code and renders the "error404" template if available
 function error404(message)
 	luci.http.status(404, "Not Found")
@@ -80,6 +68,25 @@ function error500(message)
 	return false
 end
 
+-- Renders an authorization form
+function sysauth(default)
+	local user = luci.http.formvalue("username")
+	local pass = luci.http.formvalue("password")
+	
+	if user and luci.sys.user.checkpasswd(user, pass) then
+		local sid = luci.sys.uniqueid(16)
+		luci.http.header("Set-Cookie", "sysauth=" .. sid)
+		luci.sauth.write(sid, user)
+		return true
+	else
+		require("luci.i18n")
+		require("luci.template")
+		context.path = {}
+		luci.template.render("sysauth", {duser=default, fuser=user})
+		return false
+	end
+end
+
 -- Creates a request object for dispatching
 function httpdispatch(request)
 	luci.http.context.request = request
@@ -119,34 +126,9 @@ function dispatch(request)
 		end
 	end
 
-	if track.sysauth then
-		local accs = track.sysauth
-		accs = (type(accs) == "string") and {accs} or accs
-		
-		--[[
-		local function sysauth(user, password)
-			return (luci.util.contains(accs, user)
-				and luci.sys.user.checkpasswd(user, password)) 
-		end
-		
-		if not luci.http.basic_auth(sysauth) then
-			error401()
-			return
-		end
-		]]--
-	end
-
 	if track.i18n then
 		require("luci.i18n").loadc(track.i18n)
 	end
-
-	if track.setgroup then
-		luci.sys.process.setgroup(track.setgroup)
-	end
-
-	if track.setuser then
-		luci.sys.process.setuser(track.setuser)
-	end
 	
 	-- Init template engine
 	local tpl = require("luci.template")
@@ -159,6 +141,27 @@ function dispatch(request)
 	viewns.resource    = luci.config.main.resourcebase
 	viewns.REQUEST_URI = luci.http.getenv("SCRIPT_NAME") .. (luci.http.getenv("PATH_INFO") or "")
 	
+	if track.sysauth then
+		require("luci.sauth")
+		local def  = (type(track.sysauth) == "string") and track.sysauth
+		local accs = def and {track.sysauth} or track.sysauth
+		local user = luci.sauth.read(luci.http.getcookie("sysauth"))
+		
+		
+		if not luci.util.contains(accs, user) then
+			if not sysauth(def) then
+				return
+			end
+		end
+	end
+
+	if track.setgroup then
+		luci.sys.process.setgroup(track.setgroup)
+	end
+
+	if track.setuser then
+		luci.sys.process.setuser(track.setuser)
+	end
 
 	if c and type(c.target) == "function" then
 		context.dispatched = c
diff --git a/libs/web/luasrc/http.lua b/libs/web/luasrc/http.lua
index 37050e478..f37d67343 100644
--- a/libs/web/luasrc/http.lua
+++ b/libs/web/luasrc/http.lua
@@ -51,13 +51,13 @@ function Request.__init__(self, env, sourcein, sinkerr)
 	self.parsed_input = false
 end
 
-function Request.formvalue(self, name, default)
+function Request.formvalue(self, name)
 	if not self.parsed_input then
 		self:_parse_input()
 	end
 	
 	if name then
-		return self.message.params[name] and tostring(self.message.params[name]) or default
+		return self.message.params[name]
 	else
 		return self.message.params
 	end
@@ -84,7 +84,7 @@ end
 function Request.getcookie(self, name)
   local c = string.gsub(";" .. (self:getenv("HTTP_COOKIE") or "") .. ";", "%s*;%s*", ";")
   local p = ";" .. name .. "=(.-);"
-  local i, j, value = cookies:find(p)
+  local i, j, value = c:find(p)
   return value and urldecode(value)
 end
 
@@ -130,6 +130,10 @@ function formvaluetable(...)
 	return context.request:formvaluetable(...)
 end
 
+function getcookie(...)
+	return context.request:getcookie(...)
+end
+
 function getvalue(...)
 	return context.request:getvalue(...)
 end
@@ -147,9 +151,6 @@ function setfilehandler(...)
 end
 
 function header(key, value)
-	if not context.status then
-		status()
-	end
 	if not context.headers then
 		context.headers = {}
 	end
@@ -187,7 +188,7 @@ function write(content)
 end
 
 function redirect(url)
-	header("Status", "302 Found")
+	status(302, "Found")
 	header("Location", url)
 	close()
 end
diff --git a/libs/web/luasrc/i18n.lua b/libs/web/luasrc/i18n.lua
index 35ad0965d..2c2bb2e1a 100644
--- a/libs/web/luasrc/i18n.lua
+++ b/libs/web/luasrc/i18n.lua
@@ -71,10 +71,10 @@ function setlanguage(lang)
 end
 
 -- Returns the i18n-value defined by "key" or if there is no such: "default"
-function translate(key, default)
+function translate(key, def)
 	return (table[context.lang] and table[context.lang][key])
 		or (table[default] and table[default][key])
-		or default
+		or def
 end
 
 -- Translate shourtcut with sprintf/string.format inclusion
diff --git a/libs/web/luasrc/sauth.lua b/libs/web/luasrc/sauth.lua
index 724e22d20..d838f84f6 100644
--- a/libs/web/luasrc/sauth.lua
+++ b/libs/web/luasrc/sauth.lua
@@ -19,7 +19,7 @@ require("luci.config")
 
 luci.config.sauth = luci.config.sauth or {}
 sessionpath = luci.config.sauth.sessionpath
-sessiontime = luci.config.sauth.sessiontime
+sessiontime = tonumber(luci.config.sauth.sessiontime)
 
 
 function clean()
@@ -30,7 +30,7 @@ function clean()
 		return nil
 	end
 	
-	for i, file in files do
+	for i, file in pairs(files) do
 		local fname = sessionpath .. "/" .. file
 		local stat = luci.fs.stat(fname)
 		if stat and stat.type == "regular" and stat.atime + sessiontime < now then
@@ -41,11 +41,14 @@ end
 
 function prepare()
 	luci.fs.mkdir(sessionpath)
-	luci.fs.chmod(sessionpath, "a-rwx,u+rw")
+	luci.fs.chmod(sessionpath, "a-rwx,u+rwx")
 end
 
 function read(id)
-	cleansessions()
+	if not id then
+		return
+	end
+	clean()
 	return luci.fs.readfile(sessionpath .. "/" .. id)
 end
 
-- 
cgit v1.2.3