sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

s3 swat: Add support for anti-XSRF token

Browse Source
This commit is contained in:
Kai Blin 2011-07-26 12:46:30 -07:00 committed by Jeremy Allison
parent b7521dc756
commit c379b3623a
2 changed files with 59 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
source3/web/swat.c
View File

@ -35,6 +35,7 @@
#include "printing/load.h"
#include "passdb.h"
#include "intl/lang_tdb.h"
#include "../lib/crypto/md5.h"
#include "lib/param/loadparm.h"
static int demo_mode = False;
@ -57,6 +58,7 @@ static int iNumNonAutoPrintServices = 0;
#define DISABLE_USER_FLAG "disable_user_flag"
#define ENABLE_USER_FLAG "enable_user_flag"
#define RHOST "remote_host"
#define XSRF_TOKEN "xsrf"
#define _(x) lang_msg_rotate(talloc_tos(),x)
@ -145,6 +147,58 @@ static char *make_parm_name(const char *label)
return parmname;
}
void get_xsrf_token(const char *username, const char *pass,
const char *formname, char token_str[33])
{
struct MD5Context md5_ctx;
uint8_t token[16];
int i;
token_str[0] = '\0';
ZERO_STRUCT(md5_ctx);
MD5Init(&md5_ctx);
MD5Update(&md5_ctx, (uint8_t *)formname, strlen(formname));
if (username != NULL) {
MD5Update(&md5_ctx, (uint8_t *)username, strlen(username));
}
if (pass != NULL) {
MD5Update(&md5_ctx, (uint8_t *)pass, strlen(pass));
}
MD5Final(token, &md5_ctx);
for(i = 0; i < sizeof(token); i++) {
char tmp[3];
snprintf(tmp, sizeof(tmp), "%02x", token[i]);
strncat(token_str, tmp, sizeof(tmp));
}
}
void print_xsrf_token(const char *username, const char *pass,
const char *formname)
{
char token[33];
get_xsrf_token(username, pass, formname, token);
printf("<input type=\"hidden\" name=\"%s\" value=\"%s\">\n",
XSRF_TOKEN, token);
}
bool verify_xsrf_token(const char *formname)
{
char expected[33];
const char *username = cgi_user_name();
const char *pass = cgi_user_pass();
const char *token = cgi_variable_nonull(XSRF_TOKEN);
get_xsrf_token(username, pass, formname, expected);
return (strncmp(expected, token, sizeof(expected)) == 0);
}
/****************************************************************************
include a lump of html in a page
****************************************************************************/

5
source3/web/swat_proto.h
View File

@ -67,5 +67,10 @@ void status_page(void);
/* The following definitions come from web/swat.c */
const char *lang_msg_rotate(TALLOC_CTX *ctx, const char *msgid);
void get_xsrf_token(const char *username, const char *pass,
const char *formname, char token_str[33]);
void print_xsrf_token(const char *username, const char *pass,
const char *formname);
bool verify_xsrf_token(const char *formname);
#endif /* _SWAT_PROTO_H_ */