summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--www/commission/index.php133
1 files changed, 83 insertions, 50 deletions
diff --git a/www/commission/index.php b/www/commission/index.php
index 3e87e7a..ef8b68d 100644
--- a/www/commission/index.php
+++ b/www/commission/index.php
@@ -27,7 +27,7 @@ openlog("Commission:", LOG_PID | LOG_PERROR, LOG_LOCAL0);
// uid number must be 1000 or larger.
function chk_username($userid) {
- $cmd = "/usr/bin/id -u " . $userid . " 2>/dev/null";
+ $cmd = "/usr/bin/id -u \"" . $userid . "\" 2>/dev/null";
syslog(LOG_ALERT, "/usr/bin/id cmd: $cmd");
$handle = popen($cmd, 'r');
$result = trim(fread($handle, 4192));
@@ -59,16 +59,22 @@ if($_SERVER["REQUEST_METHOD"] == "POST"){
goto err_exit;
}
- $save_password = trim($_POST["save_password"]);
+ $save_password = $_POST["save_password"];
syslog(LOG_ALERT, "Enter post: save_password = $save_password");
+ $username = trim($_POST["username"]);
+ $userlen = strlen($username);
// Validate username
- if(strlen(trim($_POST["username"])) == 0){
+ // Be generous on the character length of the username
+ // in case it is some kind of character encoding scheme.
+ // useradd should catch it if the length is a little off.
+ if($userlen == 0) {
$username_err = "Please enter a username.";
+ } elseif ($userlen > 80) {
+ $username_err = "mLinux username must not exceed 32 characters";
} else {
- $username = trim($_POST["username"]);
syslog(LOG_ALERT, "Enter username check: $username");
$id = chk_username($username);
syslog(LOG_ALERT, "after username check: chk_username $id");
@@ -77,26 +83,45 @@ if($_SERVER["REQUEST_METHOD"] == "POST"){
}
}
- // Validate password
- if(strlen(trim($_POST["password"])) == 0){
+ // Validate password. Password length is not set in
+ // Linux. It depends on how much memory we have.
+ // To avoid unknown issues, reject if > 4096
+ $tmpfile = tempnam("/var/volatile/tmp","commission");
+ $password = $_POST["password"];
+ $passlen = strlen($password);
+ $save_passwordlen = strlen($save_password);
+ syslog(LOG_ALERT, "passlen: $passlen, save_password len: $save_passwordlen");
+ syslog(LOG_ALERT, "password: $password, save_password: $save_password");
+ if ($passlen == 0) {
$password_err = "Please enter a password.";
$mismatch = 0;
+ } elseif ($passlen > 4096) {
+ $password_err = "Too long. Limit password length to 4096 characters";
+ $password = "";
+
} else {
- $password = trim($_POST["password"]);
- if (strlen($save_password) == 0) {
+ if ($save_passwordlen === 0) {
$mismatch = 0;
- $cmd = "echo '" . $password . "' | /usr/bin/pwscore 2>&1";
- $handle = popen($cmd, 'r');
- $result = trim(fread($handle,4192));
- if (pclose($handle) === 0) {
- $pwdscore = "Password score: " . $result;
+ $cmd = "/usr/bin/pwscore >$tmpfile 2>&1";
+ $handle = popen($cmd, 'w');
+ fwrite($handle,$password);
+ $status = pclose($handle);
+
+ $result2 = file_get_contents($tmpfile);
+ if (strlen($result2) > 0)
+ syslog(LOG_ALERT, "read pwscore log: status: $status result: $result2");
+ else
+ syslog(LOG_ALERT, "pwscore has no results!");
+
+ if ($status === 0) {
+ $pwdscore = "Password score: " . $result2;
$save_password = $password;
$password = "";
$conftxt = "Re-Enter";
} else {
$conftxt = "Re-Enter";
- $password_err = $result .
- ". Confirm password if you really want this." .
+ $password_err = $result2 .
+ " Confirm password if you really want this." .
" Click reset to start again";
$save_password = $password;
$password = "";
@@ -106,19 +131,24 @@ if($_SERVER["REQUEST_METHOD"] == "POST"){
}
}
- if ((strlen($password) != 0) && ($password === $save_password) && (strlen($username) != 0)) {
- syslog(LOG_ALERT, "Have password: $password username: $password");
+ if (($passlen != 0) && ($password === $save_password))
+ $mismatch = 0;
+
+ if (($mismatch === 0) && ($passlen > 0) && ($save_passwordlen > 0)) {
+ syslog(LOG_ALERT, "Have password: $password username: $username");
if((strlen($username_err) == 0) && (strlen($password_err) == 0) && (strlen($confirm_password_err) == 0)){
// Create user in sudo group
- $cmd = "/usr/sbin/useradd -U -m -G sudo,dialout,disk -s /bin/bash " . $username . " 2>&1";
+ $cmd = "/usr/sbin/useradd -U -m -G sudo,dialout,disk -s /bin/bash -- \"" . $username . "\" 2>&1";
syslog(LOG_ALERT, "useradd cmd: $cmd");
$handle = popen($cmd, 'r');
$username_err = trim(fread($handle, 4192));
$status = pclose($handle);
syslog(LOG_ALERT, "useradd: status: $status result: $result");
$uid = chk_username($username);
- $cmd = "/usr/bin/id " . $username . " 2>/dev/null";
- if (! ($uid > 999)) {
+ if ($uid === -1) {
+ syslog(LOG_ALERT, "useradd: $status");
+ goto err_exit;
+ } elseif (! ($uid > 999)) {
syslog(LOG_ALERT, "useradd: system user-id cannot be chosen: $username uid: $uid");
$username_err = "useradd: system user-id cannot be chosen: $username uid: $uid";
$username = "";
@@ -126,29 +156,38 @@ if($_SERVER["REQUEST_METHOD"] == "POST"){
$password = "";
goto err_exit;
} // Must have uid > 999
- $tmpfile = tempnam("/var/volatile/tmp","commission");
- $cmd = "/usr/bin/passwd " . $username . " 2>&1 >$tmpfile";
+ $cmd = "/usr/bin/passwd \"" . $username . "\" 2>&1 >$tmpfile";
$handle = popen($cmd, 'w');
$pwdtxt = $password . "\n" . $password;
fwrite($handle, $pwdtxt);
$status = pclose($handle);
syslog(LOG_ALERT, "set passwd: status: $status result: $result");
- $cmd = "/bin/cat $tmpfile";
- $handle = popen($cmd, 'r');
- $result2 = trim(fread($handle, 4192));
- $status2 = pclose($handle);
- if (($result2 != 0) || (strlen($result2) > 0))
- syslog(LOG_ALERT, "read passwd log: status: $status2 result: $result2");
+ $result2 = file_get_contents($tmpfile);
+ if (strlen($result2) > 0) {
+ syslog(LOG_ALERT, "passwd log: status: $status2 result: $result2");
+ }
+
+ $cmd = "/sbin/mts-ubpasswd -up >$tmpfile 2>&1";
+ $handle = popen($cmd, 'w');
+ fwrite($handle,$password);
+ $status = pclose($handle);
+
+ $result3 = file_get_contents($tmpfile);
- $cmd = "/sbin/mts-ubpasswd -u " . $password;
- $handle = popen($cmd, 'r');
- $result3 = trim(fread($handle, 4192));
- $status3 = pclose($handle);
- if ($status != 0)
- syslog(LOG_ALERT, "mts-ubpasswd: status: $status result: $result");
- else
+ // Delete the password entry log
+ $handle = fopen($tmpfile, 'w');
+ ftruncate($handle,0);
+ fclose($handle);
+
+ if (strlen($result2) > 0)
+ syslog(LOG_ALERT, "read mts-ubpasswd log: result: $result2");
+
+ if ($status != 0) {
+ syslog(LOG_ALERT, "mts-ubpasswd failed: status: $status");
+ syslog(LOG_ALERT, "mts-ubpasswd failed: result: $result3");
+ } else // Dont print if successful or password is in the log.
syslog(LOG_ALERT, "mts-ubpasswd: set u-boot password");
if ($status == 0) {
@@ -156,25 +195,19 @@ if($_SERVER["REQUEST_METHOD"] == "POST"){
$password_err = $result2;
$username_err = $result;
// Disable commissioning
- $cmd = "echo 'ENABLED=\"no\"' >/run/mt-commission 2>&1";
+ $data = 'ENABLED=\"no\"';
+ file_put_contents("/run/mt-commission",$data);
+
+ // shut off web server
+ $cmd = "/usr/sbin/start-stop-daemon -S -p /var/run/commissionoff.pid -b -a /bin/bash -- -c " .
+ "/usr/libexec/commission/off.sh";
+ syslog(LOG_ALERT, "turn off web server: command: $cmd");
$handle = popen($cmd, 'r');
$result = trim(fread($handle, 4192));
$status = pclose($handle);
if ($status > 0) {
- syslog(LOG_ALERT, "configure commissioning off failure: command: $cmd");
- syslog(LOG_ALERT, "passwd: status: $status result: $result");
- } else {
- // shut off web server
- $cmd = "/usr/sbin/start-stop-daemon -S -p /var/run/commissionoff.pid -b -a /bin/bash -- -c " .
- "/usr/libexec/commission/off.sh";
- syslog(LOG_ALERT, "turn off web server: command: $cmd");
- $handle = popen($cmd, 'r');
- $result = trim(fread($handle, 4192));
- $status = pclose($handle);
- if ($status > 0) {
- syslog(LOG_ALERT, "turn off commissioning service: command: $cmd");
- syslog(LOG_ALERT, "stopping service: status: $status result: $result");
- }
+ syslog(LOG_ALERT, "turn off commissioning service: command: $cmd");
+ syslog(LOG_ALERT, "stopping service: status: $status result: $result");
}
} else {
$finished = "Errors: " . $result;