![]()
Paj's Home |
![]()
This file is slightly unusual. It is actually called
#!/usr/bin/perl use MD5; #-----------------------------------------------------------------------------# # Configuration #-----------------------------------------------------------------------------# $passwd = "secret"; if($^O eq "MSWin32") { $msg_file = "e:/webdata/md5_msg"; $log_file = "e:/webdata/md5_msglog"; } else { $msg_file = "data/md5_msg"; $log_file = "data/md5_msglog"; } #-----------------------------------------------------------------------------# # Use the cgi-lib.pl libarary to make all CGI parameters available in an # associative array #-----------------------------------------------------------------------------# require 'cgi-lib.pl'; ReadParse(*cgi_parm); #-----------------------------------------------------------------------------# # If the msg parameter was passed, then this is a request to update the # message, not just to view it. #-----------------------------------------------------------------------------# if(defined($cgi_parm{'msg'})) { #---------------------------------------------------------------------------# # If the password field matches the hash, allow but issue warning #---------------------------------------------------------------------------# if($cgi_parm{'password'} eq $passwd) { $stat_warn = "(WARNING: Password was transmitted unencrypted)"; } else { #-------------------------------------------------------------------------# # Calculate what the hash should be, with the correct password #-------------------------------------------------------------------------# $hash_str = $cgi_parm{'msg'} . $cgi_parm{'timestamp'} . $passwd; $hash = MD5->hexhash($hash_str); #-------------------------------------------------------------------------# # If this doesn't match what the user sent as a hash, then the password # was wrong #-------------------------------------------------------------------------# if ($hash ne $cgi_parm{'password'}) { $status = "Bad password, or data corrupted during transmission"; goto UPDATE_ERROR; } #-------------------------------------------------------------------------# # Check the timestamp is in range #-------------------------------------------------------------------------# $cur_time = time; if( ($cgi_parm{'timestamp'} > $cur_time) || ($cgi_parm{'timestamp'} < ($cur_time - 300)) ) { $status = "Time stamp invalid"; goto UPDATE_ERROR; } } #---------------------------------------------------------------------------# # Open message file for writing #---------------------------------------------------------------------------# if(!open(MSG, ">$msg_file")) { $status = "Server error - update rejected"; goto UPDATE_ERROR; } for($cgi_parm{'msg'}) { s/</</g; s/>/>/g; s/\n/ /g; s/\r//g; } print MSG $cgi_parm{'msg'}; close(MSG); #---------------------------------------------------------------------------# # Log the change #---------------------------------------------------------------------------# if(open(LOG, ">>$log_file")) { print LOG $cgi_parm{'msg'}."\n"; close(LOG); } #---------------------------------------------------------------------------# # Set status message to "accepted" before we reunite with error path #---------------------------------------------------------------------------# $status = "Message update accepted"; UPDATE_ERROR: } else { #---------------------------------------------------------------------------# # Suitible status message for just viewing the message/page #---------------------------------------------------------------------------# $status = "Please try changing the message"; } #-----------------------------------------------------------------------------# # Read in the user defined message #-----------------------------------------------------------------------------# if(!open(MSG, "<$msg_file")) { $msg = "Server error - can't access message"; } else { $msg = <MSG>; close(MSG); } #-----------------------------------------------------------------------------# # Output CGI header, and paj.ph header #-----------------------------------------------------------------------------# print "Content-type: text/html\n\n"; print <<'EOM'; #define %TITLE% Authentication #define %CGI% #include <paj.ph> EOM #-----------------------------------------------------------------------------# # Text of the page, note EOM is double quoted this time #-----------------------------------------------------------------------------# $timestamp = time; print <<"EOM"; #include "../crypt/md5/auth.pip" EOM #-----------------------------------------------------------------------------# # Take special care with the footer, as it must come before EOM #-----------------------------------------------------------------------------# print <<'EOM'; %PIPP_FOOTER% #undef %PIPP_FOOTER% EOM
© Copyright 1998 - 2001 Paul Johnston Disclaimer Updated: 8 Apr 2001 Built: 8 Apr 2001 |