diff --git a/server/src/uds/dispatchers/pam/views.py b/server/src/uds/dispatchers/pam/views.py index d2352224c..64c12a1c5 100644 --- a/server/src/uds/dispatchers/pam/views.py +++ b/server/src/uds/dispatchers/pam/views.py @@ -27,9 +27,9 @@ # OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -''' +""" @author: Adolfo Gómez, dkmaster at dkmon dot com -''' +""" from __future__ import unicode_literals from django.http import HttpResponseNotAllowed, HttpResponse @@ -49,12 +49,21 @@ def pam(request): return HttpResponseNotAllowed(['GET']) if 'id' in request.GET and 'pass' in request.GET: # This is an "auth" request - logger.debug("Auth request for user [{0}] and pass [{1}]".format(request.GET['id'], request.GET['pass'])) - password = TicketStore.get(request.GET['id']) + ids = request.GET.getlist('id') response = '0' - if password == request.GET['pass']: - response = '1' - + if len(ids) == 1: + userId = ids[0] + logger.debug("Auth request for user [{0}] and pass [{1}]".format(request.GET['id'], request.GET['pass'])) + try: + password = TicketStore.get(userId) + if password == request.GET['pass']: + response = '1' + except Exception: + # Non existing ticket, log it and stop + logger.info('Invalid access from {} using user {}'.format(request.ip, userId)) + else: + logger.warn('Invalid request from {}: {}'.format(request.ip, [v for v in request.GET.lists()])) + elif 'uid' in request.GET: # This is an "get name for id" call logger.debug("NSS Request for id [{0}]".format(request.GET['uid']))