version 1.93, 2006/06/26 18:56:50
|
version 1.94, 2006/10/23 21:22:51
|
Line 718 ENDVCCOL
|
Line 718 ENDVCCOL
|
# password handler subroutines # |
# password handler subroutines # |
###################################################### |
###################################################### |
sub passwordchanger { |
sub passwordchanger { |
|
my ($r,$errormessage,$caller,$mailtoken) = @_; |
# This function is a bit of a mess.... |
# This function is a bit of a mess.... |
# Passwords are encrypted using londes.js (DES encryption) |
# Passwords are encrypted using londes.js (DES encryption) |
my $r = shift; |
|
my $errormessage = shift; |
|
$errormessage = ($errormessage || ''); |
$errormessage = ($errormessage || ''); |
my $user = $env{'user.name'}; |
my ($user,$domain,$currentpass,$defdom); |
my $domain = $env{'user.domain'}; |
if ((!defined($caller)) || ($caller eq 'preferences')) { |
my $homeserver = $env{'user.home'}; |
$user = $env{'user.name'}; |
|
$domain = $env{'user.domain'}; |
|
if (!defined($caller)) { |
|
$caller = 'preferences'; |
|
} |
|
} elsif ($caller eq 'reset_by_email') { |
|
$defdom = $r->dir_config('lonDefDomain'); |
|
my %data = &Apache::lonnet::tmpget($mailtoken); |
|
if (keys(%data) == 0) { |
|
$r->print(&mt('Sorry, the URL you provided to complete the reset of your password was invalid. Either the token included in the URL has been deleted or the URL you provided was invalid. Please submit a <a href="/adm/resetpw">new request</a> for a password reset, and follow the link to the new URL included in the e-mail that will be sent to you, to allow you to enter a new password.')); |
|
return; |
|
} |
|
if (defined($data{time})) { |
|
if (time - $data{'time'} < 7200) { |
|
$user = $data{'username'}; |
|
$domain = $data{'domain'}; |
|
$currentpass = $data{'temppasswd'}; |
|
} else { |
|
$r->print(&mt('Sorry, the token generated when you requested a password reset has expired.').'<br />'); |
|
return; |
|
} |
|
} else { |
|
$r->print(&mt('Sorry, the URL generated when you requested reset of your password contained incomplete information.').'<br />'); |
|
return; |
|
} |
|
} else { |
|
$r->print(&mt('Page requested in unexpected context').'<br />'); |
|
return; |
|
} |
my $currentauth=&Apache::lonnet::queryauthenticate($user,$domain); |
my $currentauth=&Apache::lonnet::queryauthenticate($user,$domain); |
# Check for authentication types that allow changing of the password. |
# Check for authentication types that allow changing of the password. |
return if ($currentauth !~ /^(unix|internal):/); |
return if ($currentauth !~ /^(unix|internal):/); |
Line 742 sub passwordchanger {
|
Line 769 sub passwordchanger {
|
.$ukey_npass2 . $lkey_npass2, |
.$ukey_npass2 . $lkey_npass2, |
$lonhost); |
$lonhost); |
# Hexify the keys for output as javascript variables |
# Hexify the keys for output as javascript variables |
$ukey_cpass = hex($ukey_cpass); |
my %hexkey; |
$lkey_cpass = hex($lkey_cpass); |
$hexkey{'ukey_cpass'} = hex($ukey_cpass); |
$ukey_npass1= hex($ukey_npass1); |
$hexkey{'lkey_cpass'} = hex($lkey_cpass); |
$lkey_npass1= hex($lkey_npass1); |
$hexkey{'ukey_npass1'} = hex($ukey_npass1); |
$ukey_npass2= hex($ukey_npass2); |
$hexkey{'lkey_npass1'} = hex($lkey_npass1); |
$lkey_npass2= hex($lkey_npass2); |
$hexkey{'ukey_npass2'} = hex($ukey_npass2); |
|
$hexkey{'lkey_npass2'} = hex($lkey_npass2); |
# Output javascript to deal with passwords |
# Output javascript to deal with passwords |
# Output DES javascript |
# Output DES javascript |
{ |
{ |
Line 755 sub passwordchanger {
|
Line 783 sub passwordchanger {
|
my $jsh=Apache::File->new($include."/londes.js"); |
my $jsh=Apache::File->new($include."/londes.js"); |
$r->print(<$jsh>); |
$r->print(<$jsh>); |
} |
} |
|
$r->print(&jscript_send($caller)); |
$r->print(<<ENDFORM); |
$r->print(<<ENDFORM); |
|
$errormessage |
|
|
|
<p> |
|
<!-- We separate the forms into 'server' and 'client' in order to |
|
ensure that unencrypted passwords will not be sent out by a |
|
crappy browser --> |
|
ENDFORM |
|
$r->print(&server_form($logtoken,$caller,$mailtoken)); |
|
$r->print(&client_form($caller,\%hexkey,$currentpass,$defdom)); |
|
|
|
# |
|
return; |
|
} |
|
|
|
sub jscript_send { |
|
my ($caller) = @_; |
|
my $output = qq| |
<script language="JavaScript"> |
<script language="JavaScript"> |
|
|
function send() { |
function send() { |
Line 777 sub passwordchanger {
|
Line 823 sub passwordchanger {
|
initkeys(); |
initkeys(); |
this.document.pserver.elements.newpass_2.value |
this.document.pserver.elements.newpass_2.value |
=crypted(this.document.client.elements.newpass_2.value); |
=crypted(this.document.client.elements.newpass_2.value); |
|
|; |
|
if ($caller eq 'reset_by_email') { |
|
$output .= qq| |
|
this.document.pserver.elements.uname.value = |
|
this.document.client.elements.uname.value; |
|
this.document.pserver.elements.udom.value = |
|
this.document.client.elements.udom.options[this.document.client.elements.udom.selectedIndex].value; |
|
|; |
|
} |
|
$ output .= qq| |
this.document.pserver.submit(); |
this.document.pserver.submit(); |
} |
} |
|
|
</script> |
</script> |
$errormessage |
|; |
|
} |
<p> |
|
<!-- We separate the forms into 'server' and 'client' in order to |
|
ensure that unencrypted passwords will not be sent out by a |
|
crappy browser --> |
|
|
|
<form name="pserver" action="/adm/preferences" method="post"> |
|
<input type="hidden" name="logtoken" value="$logtoken" /> |
|
<input type="hidden" name="action" value="verify_and_change_pass" /> |
|
<input type="hidden" name="currentpass" value="" /> |
|
<input type="hidden" name="newpass_1" value="" /> |
|
<input type="hidden" name="newpass_2" value="" /> |
|
</form> |
|
|
|
|
sub client_form { |
|
my ($caller,$hexkey,$currentpass,$defdom) = @_; |
|
my $output = qq| |
<form name="client" > |
<form name="client" > |
<table> |
<table> |
|
|; |
|
if ($caller eq 'reset_by_email') { |
|
$output .= qq| |
|
<tr><td align="right"> E-mail address: </td> |
|
<td><input type="text" name="email" size="15" /> </td></tr> |
|
<tr><td align="right"> Username: </td> |
|
<td> |
|
<input type="text" name="uname" size="10" /> |
|
<input type="hidden" name="currentpass" value="$currentpass" /> |
|
</td></tr> |
|
<tr><td align="right"> Domain: </td> |
|
<td> |
|
|; |
|
$output .= &Apache::loncommon::select_dom_form($defdom,'udom').' |
|
</td> |
|
</tr> |
|
'; |
|
} else { |
|
$output .= qq| |
<tr><td align="right"> Current password: </td> |
<tr><td align="right"> Current password: </td> |
<td><input type="password" name="currentpass" size="10"/> </td></tr> |
<td><input type="password" name="currentpass" size="10"/> </td></tr> |
|
|; |
|
} |
|
$output .= <<"ENDFORM"; |
<tr><td align="right"> New password: </td> |
<tr><td align="right"> New password: </td> |
<td><input type="password" name="newpass_1" size="10" /> </td></tr> |
<td><input type="password" name="newpass_1" size="10" /> </td></tr> |
<tr><td align="right"> Confirm password: </td> |
<tr><td align="right"> Confirm password: </td> |
Line 808 $errormessage
|
Line 875 $errormessage
|
<tr><td colspan="2" align="center"> |
<tr><td colspan="2" align="center"> |
<input type="button" value="Change Password" onClick="send();"> |
<input type="button" value="Change Password" onClick="send();"> |
</table> |
</table> |
<input type="hidden" name="ukey_cpass" value="$ukey_cpass" /> |
<input type="hidden" name="ukey_cpass" value="$hexkey->{'ukey_cpass'}" /> |
<input type="hidden" name="lkey_cpass" value="$lkey_cpass" /> |
<input type="hidden" name="lkey_cpass" value="$hexkey->{'lkey_cpass'}" /> |
<input type="hidden" name="ukey_npass1" value="$ukey_npass1" /> |
<input type="hidden" name="ukey_npass1" value="$hexkey->{'ukey_npass1'}" /> |
<input type="hidden" name="lkey_npass1" value="$lkey_npass1" /> |
<input type="hidden" name="lkey_npass1" value="$hexkey->{'lkey_npass1'}" /> |
<input type="hidden" name="ukey_npass2" value="$ukey_npass2" /> |
<input type="hidden" name="ukey_npass2" value="$hexkey->{'ukey_npass2'}" /> |
<input type="hidden" name="lkey_npass2" value="$lkey_npass2" /> |
<input type="hidden" name="lkey_npass2" value="$hexkey->{'lkey_npass2'}" /> |
</form> |
</form> |
</p> |
</p> |
ENDFORM |
ENDFORM |
# |
return $output; |
return; |
} |
|
|
|
sub server_form { |
|
my ($logtoken,$caller,$mailtoken) = @_; |
|
my $action = '/adm/preferences'; |
|
if ($caller eq 'reset_by_email') { |
|
$action = '/adm/resetpw'; |
|
} |
|
my $output = qq| |
|
<form name="pserver" action="$action" method="post"> |
|
<input type="hidden" name="logtoken" value="$logtoken" /> |
|
<input type="hidden" name="currentpass" value="" /> |
|
<input type="hidden" name="newpass_1" value="" /> |
|
<input type="hidden" name="newpass_2" value="" /> |
|
|; |
|
if ($caller eq 'reset_by_email') { |
|
$output .= qq| |
|
<input type="hidden" name="token" value="$mailtoken" /> |
|
<input type="hidden" name="uname" value="" /> |
|
<input type="hidden" name="udom" value="" /> |
|
|
|
|; |
|
} |
|
$output .= qq| |
|
<input type="hidden" name="action" value="verify_and_change_pass" /> |
|
</form> |
|
|; |
|
return $output; |
} |
} |
|
|
sub verify_and_change_password { |
sub verify_and_change_password { |
my $r = shift; |
my ($r,$caller,$mailtoken) = @_; |
my $user = $env{'user.name'}; |
my ($user,$domain,$homeserver); |
my $domain = $env{'user.domain'}; |
if ($caller eq 'reset_by_email') { |
my $homeserver = $env{'user.home'}; |
$user = $env{'form.uname'}; |
|
$domain = $env{'form.udom'}; |
|
if ($user ne '' && $domain ne '') { |
|
$homeserver = &Apache::lonnet::homeserver($user,$domain); |
|
if ($homeserver eq 'no_host') { |
|
&passwordchanger($r,"<p>\n<font color='#ff0000'>ERROR</font>". |
|
"Invalid username and/or domain .\n</p>", |
|
$caller,$mailtoken); |
|
return 1; |
|
} |
|
} else { |
|
&passwordchanger($r,"<p>\n<font color='#ff0000'>ERROR</font>". |
|
"Username and Domain were blank.\n</p>", |
|
$caller,$mailtoken); |
|
return 1; |
|
} |
|
} else { |
|
$user = $env{'user.name'}; |
|
$domain = $env{'user.domain'}; |
|
$homeserver = $env{'user.home'}; |
|
} |
my $currentauth=&Apache::lonnet::queryauthenticate($user,$domain); |
my $currentauth=&Apache::lonnet::queryauthenticate($user,$domain); |
# Check for authentication types that allow changing of the password. |
# Check for authentication types that allow changing of the password. |
return if ($currentauth !~ /^(unix|internal):/); |
if ($currentauth !~ /^(unix|internal):/) { |
|
if ($caller eq 'reset_by_email') { |
|
&passwordchanger($r,"<p>\n<font color='#ff0000'>ERROR</font>". |
|
"Authentication type for this user can not be changed by this mechanism..\n</p>", |
|
$caller,$mailtoken); |
|
return 1; |
|
} else { |
|
return; |
|
} |
|
} |
# |
# |
my $currentpass = $env{'form.currentpass'}; |
my $currentpass = $env{'form.currentpass'}; |
my $newpass1 = $env{'form.newpass_1'}; |
my $newpass1 = $env{'form.newpass_1'}; |
Line 839 sub verify_and_change_password {
|
Line 962 sub verify_and_change_password {
|
defined($newpass1) && |
defined($newpass1) && |
defined($newpass2) ){ |
defined($newpass2) ){ |
&passwordchanger($r,"<p>\n<font color='#ff0000'>ERROR</font>". |
&passwordchanger($r,"<p>\n<font color='#ff0000'>ERROR</font>". |
"Password data was blank.\n</p>"); |
"One or more password fields were blank.\n</p>",$caller,$mailtoken); |
return; |
return; |
} |
} |
# Get the keys |
# Get the keys |
Line 847 sub verify_and_change_password {
|
Line 970 sub verify_and_change_password {
|
my $tmpinfo = Apache::lonnet::reply('tmpget:'.$logtoken,$lonhost); |
my $tmpinfo = Apache::lonnet::reply('tmpget:'.$logtoken,$lonhost); |
if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) { |
if (($tmpinfo=~/^error/) || ($tmpinfo eq 'con_lost')) { |
# I do not a have a better idea about how to handle this |
# I do not a have a better idea about how to handle this |
|
my $tryagain_text = &mt('Please log out and try again.'); |
|
if ($caller eq 'reset_by_email') { |
|
$tryagain_text = &mt('Please try again later.'); |
|
} |
$r->print(<<ENDERROR); |
$r->print(<<ENDERROR); |
<p> |
<p> |
<font color="#ff0000">ERROR:</font> Unable to retrieve stored token for |
<font color="#ff0000">ERROR:</font> Unable to retrieve stored token for |
password decryption. Please log out and try again. |
password decryption. $tryagain_text |
</p> |
</p> |
ENDERROR |
ENDERROR |
# Probably should log an error here |
# Probably should log an error here |
Line 861 ENDERROR
|
Line 988 ENDERROR
|
$currentpass = &des_decrypt($ckey ,$currentpass); |
$currentpass = &des_decrypt($ckey ,$currentpass); |
$newpass1 = &des_decrypt($n1key,$newpass1); |
$newpass1 = &des_decrypt($n1key,$newpass1); |
$newpass2 = &des_decrypt($n2key,$newpass2); |
$newpass2 = &des_decrypt($n2key,$newpass2); |
# |
# |
|
if ($caller eq 'reset_by_email') { |
|
my %data = &Apache::lonnet::tmpget($mailtoken); |
|
if ($currentpass ne $data{'temppasswd'}) { |
|
&passwordchanger($r, |
|
'<font color="#ff0000">ERROR:</font>'. |
|
'Could not verify current authentication. '. |
|
'Please try again.',$caller,$mailtoken); |
|
return 1; |
|
} |
|
} |
if ($newpass1 ne $newpass2) { |
if ($newpass1 ne $newpass2) { |
&passwordchanger($r, |
&passwordchanger($r, |
'<font color="#ff0000">ERROR:</font>'. |
'<font color="#ff0000">ERROR:</font>'. |
'The new passwords you entered do not match. '. |
'The new passwords you entered do not match. '. |
'Please try again.'); |
'Please try again.',$caller,$mailtoken); |
return 1; |
return 1; |
} |
} |
if (length($newpass1) < 7) { |
if (length($newpass1) < 7) { |
&passwordchanger($r, |
&passwordchanger($r, |
'<font color="#ff0000">ERROR:</font>'. |
'<font color="#ff0000">ERROR:</font>'. |
'Passwords must be a minimum of 7 characters long. '. |
'Passwords must be a minimum of 7 characters long. '. |
'Please try again.'); |
'Please try again.',$caller,$mailtoken); |
return 1; |
return 1; |
} |
} |
# |
# |
Line 884 ENDERROR
|
Line 1021 ENDERROR
|
} |
} |
if ($badpassword) { |
if ($badpassword) { |
# I can't figure out how to enter bad characters on my browser. |
# I can't figure out how to enter bad characters on my browser. |
&passwordchanger($r,<<ENDERROR); |
my $errormessage = <<"ENDERROR"; |
<font color="#ff0000">ERROR:</font> |
<font color="#ff0000">ERROR:</font> |
The password you entered contained illegal characters.<br /> |
The password you entered contained illegal characters.<br /> |
Valid characters are: space and <br /> |
Valid characters are: space and <br /> |
Line 893 Valid characters are: space and <br />
|
Line 1030 Valid characters are: space and <br />
|
ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_\`abcdefghijklmnopqrstuvwxyz{|}~ |
ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_\`abcdefghijklmnopqrstuvwxyz{|}~ |
</pre> |
</pre> |
ENDERROR |
ENDERROR |
|
&passwordchanger($r,$errormessage,$caller,$mailtoken); |
|
return 1; |
} |
} |
# |
# |
# Change the password (finally) |
# Change the password (finally) |
my $result = &Apache::lonnet::changepass |
my $result = &Apache::lonnet::changepass |
($user,$domain,$currentpass,$newpass1,$homeserver); |
($user,$domain,$currentpass,$newpass1,$homeserver,$caller); |
# Inform the user the password has (not?) been changed |
# Inform the user the password has (not?) been changed |
if ($result =~ /^ok$/) { |
if ($result =~ /^ok$/) { |
$r->print(<<"ENDTEXT"); |
$r->print(<<"ENDTEXT"); |
<h2>The password for $user was successfully changed</h2> |
<h3>The password for $user was successfully changed</h3> |
ENDTEXT |
ENDTEXT |
} else { |
} else { |
# error error: run in circles, scream and shout |
# error error: run in circles, scream and shout |
$r->print(<<ENDERROR); |
$r->print(<<ENDERROR); |
<h2><font color="#ff0000">The password for $user was not changed</font></h2> |
<h3><font color="#ff0000">The password for $user was not changed</font></h3> |
Please make sure your old password was entered correctly. |
Please make sure your old password was entered correctly. |
ENDERROR |
ENDERROR |
return 1; |
return 1; |