thematdev/simple-discuss
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fixed redis_auth.c logic + filling user_sid field

Browse Source 
redis_auth.c was unable to receive session_id as long as
user <-> session should be both ways
This commit is contained in:
thematdev 2023-07-05 15:47:31 +03:00
parent 8d3718c9ae
commit 6cafa0aff9
Signed by: thematdev
GPG Key ID: D12878639B090D90
3 changed files with 41 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
src/new_client.c
View File

@ -3,10 +3,10 @@
#include "config.h"
#include "utils.h"
#define UUID_SIZE 36
#define UUID_SIZE 37
/* TODO: place cookie normally */
void
char *
validate_credentials()
{
char username[RA_USER_MAX_LENGTH + 1], password[RA_PASSWORD_MAX_LENGTH + 1];
@ -16,45 +16,38 @@ validate_credentials()
err = cgiFormString("username", username, RA_USER_MAX_LENGTH + 1);
if (err == cgiFormTruncated) {
fprintf(cgiOut, "Username too long(max %d chars)\n", RA_USER_MAX_LENGTH);
return;
return "Username too long\n";
}
if (err == cgiFormNotFound) {
fprintf(cgiOut, "Username not provided\n");
return;
return "Username not provided\n";
}
err = cgiFormString("password", password, RA_PASSWORD_MAX_LENGTH + 1);
if (err == cgiFormTruncated) {
fprintf(cgiOut, "Password too long(max %d+1(NUL) bytes)\n", RA_PASSWORD_MAX_LENGTH);
return;
return "Password too long\n";
}
if (err == cgiFormNotFound) {
fprintf(cgiOut, "Password not provided\n");
return;
return "Password not provided\n";
}
if (!is_valid_username(username)) {
fprintf(cgiOut, "Username must be [A-Za-z0-9_]\n");
return;
return "Username must be [A-Za-z0-9_]\n";
}
if (!is_valid_password(password)) {
fprintf(cgiOut, "Password must be a sequence of bytes in range 32-255\n");
return;
return "Password must be a sequence of bytes in range 32-255\n";
}
auth = authenticate(username, password, session_id);
if (auth < 0) {
fprintf(cgiOut, "Some error occured, contact system administrator\n");
return;
return "Some error occured, contact system administrator\n";
}
if (auth) {
cgiHeaderCookieSet(SESSION_COOKIE_NAME, session_id, RA_SESSION_EXPIRE, "/", HOSTNAME, 0);
fprintf(cgiOut, "You've successfully logged in as %s\n", username);
return "You've successfully logged in!\n";
} else {
fprintf(cgiOut, "Failed to log in, check credentials\n");
return "Failed to log in, check credentials\n";
}
}
@ -73,6 +66,14 @@ print_login_form()
int
cgiMain()
{
char *message;
if (cgiFormSubmitClicked("login") == cgiFormSuccess) {
message = validate_credentials();
} else {
message = "";
}
cgiHeaderContentType("text/html");
fprintf(cgiOut, "<html>\n");
@ -83,9 +84,7 @@ cgiMain()
fprintf(cgiOut, "<body>\n");
if (cgiFormSubmitClicked("login") == cgiFormSuccess) {
validate_credentials();
}
fputs(message, cgiOut);
print_login_form();

8
src/redis_auth.c
View File

@ -7,7 +7,7 @@
#include <errno.h>
#include <tomcrypt.h>
#define UUID_SIZE 36
#define UUID_SIZE 37
#define SHA512_DIGEST_SIZE 64
#define FAIL_AUTH() do { \
@ -40,7 +40,7 @@ user_by_session_id(const char *session_id, char *username)
goto defer;
}
reply = redisCommand(ctx, "GET session:%s", session_id);
reply = redisCommand(ctx, "GET username:%s", session_id);
if (reply->type != REDIS_REPLY_STRING) {
strcpy(username, "");
} else {
@ -115,10 +115,14 @@ authenticate(const char *username, const char *password, char *session_id)
sid_reply = redisCommand(ctx, "SET session:%s %s", username, session_id);
freeReplyObject(sid_reply);
sid_reply = redisCommand(ctx, "SET username:%s %s", session_id, username);
freeReplyObject(sid_reply);
} else {
strcpy(session_id, sid_reply->str);
}
sid_reply = redisCommand(ctx, "EXPIRE session:%s %d", username, RA_SESSION_EXPIRE);
freeReplyObject(sid_reply);
sid_reply = redisCommand(ctx, "EXPIRE username:%s %d", session_id, RA_SESSION_EXPIRE);
retval = 1;
}

16
src/view_comments.c
View File

@ -5,11 +5,16 @@
#include "driver.h"
#include "drivers/unix_fs/unix_fs_driver.h"
#include "config.h"
#include "auth.h"
#include <stdlib.h>
#include <time.h>
#include <stdio.h>
#define UUID_SIZE 37
char authorized_user_sid[RA_USER_MAX_LENGTH + 1], session_id[UUID_SIZE];
int
page_by_id(int id)
{
@ -196,7 +201,11 @@ handle_submitted_comment()
time(&header.creation_time);
header.reply_id = rid;
header.text_length = strlen(sanitized_text);
header.user_sid = "web/anonymous";
if (strcmp(authorized_user_sid, "")) {
header.user_sid = authorized_user_sid;
} else {
header.user_sid = "web/anonymous";
}
header.user_displayname = displayname;
if (driver.leave_comment(&driver_data, &header, sanitized_text) < 0) {
@ -214,6 +223,11 @@ defer:
int
cgiMain()
{
if (cgiCookieString(SESSION_COOKIE_NAME, session_id, UUID_SIZE) == cgiFormSuccess) {
user_by_session_id(session_id, authorized_user_sid);
} else {
authorized_user_sid[0] = '\0';
}
cgiHeaderContentType("text/html");
fprintf(cgiOut, "<html>\n");