loncom/lond - diff

Return to lond CVS log

Up to [LON-CAPA] / loncom

Diff for /loncom/lond between versions 1.517 and 1.522

version 1.517, 2016/01/31 21:25:53	version 1.522, 2016/05/30 03:16:38
Line 55 use LONCAPA::lonssl;	Line 55 use LONCAPA::lonssl;
use Fcntl qw(:flock);	use Fcntl qw(:flock);
use Apache::lonnet;	use Apache::lonnet;
use Mail::Send;	use Mail::Send;
	use Crypt::Eksblowfish::Bcrypt;
	use Digest::SHA;
	use Encode;

my $DEBUG = 0; # Non zero to enable debug log entries.	my $DEBUG = 0; # Non zero to enable debug log entries.

Line 2013 sub change_password_handler {	Line 2016 sub change_password_handler {
my ($howpwd,$contentpwd)=split(/:/,$realpasswd);	my ($howpwd,$contentpwd)=split(/:/,$realpasswd);
if ($howpwd eq 'internal') {	if ($howpwd eq 'internal') {
&Debug("internal auth");	&Debug("internal auth");
my $salt=time;	my $ncpass = &hash_passwd($udom,$npass);
$salt=substr($salt,6,2);
my $ncpass=crypt($npass,$salt);
if(&rewrite_password_file($udom, $uname, "internal:$ncpass")) {	if(&rewrite_password_file($udom, $uname, "internal:$ncpass")) {
my $msg="Result of password change for $uname: pwchange_success";	my $msg="Result of password change for $uname: pwchange_success";
if ($lonhost) {	if ($lonhost) {
$msg .= " - request originated from: $lonhost";	$msg .= " - request originated from: $lonhost";
}	}
&logthis($msg);	&logthis($msg);
	&update_passwd_history($uname,$udom,$howpwd,$context);
&Reply($client, "ok\n", $userinput);	&Reply($client, "ok\n", $userinput);
} else {	} else {
&logthis("Unable to open $uname passwd "	&logthis("Unable to open $uname passwd "
Line 2030 sub change_password_handler {	Line 2032 sub change_password_handler {
}	}
} elsif ($howpwd eq 'unix' && $context ne 'reset_by_email') {	} elsif ($howpwd eq 'unix' && $context ne 'reset_by_email') {
my $result = &change_unix_password($uname, $npass);	my $result = &change_unix_password($uname, $npass);
	if ($result eq 'ok') {
	&update_passwd_history($uname,$udom,$howpwd,$context);
	}
&logthis("Result of password change for $uname: ".	&logthis("Result of password change for $uname: ".
$result);	$result);
&Reply($client, \$result, $userinput);	&Reply($client, \$result, $userinput);
Line 2052 sub change_password_handler {	Line 2057 sub change_password_handler {
}	}
&register_handler("passwd", \&change_password_handler, 1, 1, 0);	&register_handler("passwd", \&change_password_handler, 1, 1, 0);

	sub hash_passwd {
	my ($domain,$plainpass,@rest) = @_;
	my ($salt,$cost);
	if (@rest) {
	$cost = $rest[0];
	# salt is first 22 characters, base-64 encoded by bcrypt
	my $plainsalt = substr($rest[1],0,22);
	$salt = Crypt::Eksblowfish::Bcrypt::de_base64($plainsalt);
	} else {
	my $defaultcost;
	my %domconfig =
	&Apache::lonnet::get_dom('configuration',['password'],$domain);
	if (ref($domconfig{'password'}) eq 'HASH') {
	$defaultcost = $domconfig{'password'}{'cost'};
	}
	if (($defaultcost eq '') \|\| ($defaultcost =~ /D/)) {
	$cost = 10;
	} else {
	$cost = $defaultcost;
	}
	# Generate random 16-octet base64 salt
	$salt = "";
	$salt .= pack("C", int rand(256)) for 1..16;
	}
	my $hash = &Crypt::Eksblowfish::Bcrypt::bcrypt_hash({
	key_nul => 1,
	cost => $cost,
	salt => $salt,
	}, Digest::SHA::sha512(Encode::encode('UTF-8',$plainpass)));

	my $result = join("!", "", "bcrypt", sprintf("%02d",$cost),
	&Crypt::Eksblowfish::Bcrypt::en_base64($salt).
	&Crypt::Eksblowfish::Bcrypt::en_base64($hash));
	return $result;
	}

#	#
# Create a new user. User in this case means a lon-capa user.	# Create a new user. User in this case means a lon-capa user.
# The user must either already exist in some authentication realm	# The user must either already exist in some authentication realm
Line 2095 sub add_user_handler {	Line 2136 sub add_user_handler {
."makeuser";	."makeuser";
}	}
unless ($fperror) {	unless ($fperror) {
my $result=&make_passwd_file($uname,$udom,$umode,$npass, $passfilename);	my $result=&make_passwd_file($uname,$udom,$umode,$npass,
	$passfilename,'makeuser');
&Reply($client,\$result, $userinput); #BUGBUG - could be fail	&Reply($client,\$result, $userinput); #BUGBUG - could be fail
} else {	} else {
&Failure($client, \$fperror, $userinput);	&Failure($client, \$fperror, $userinput);
Line 2164 sub change_authentication_handler {	Line 2206 sub change_authentication_handler {
my $result = &change_unix_password($uname, $npass);	my $result = &change_unix_password($uname, $npass);
&logthis("Result of password change for $uname: ".$result);	&logthis("Result of password change for $uname: ".$result);
if ($result eq "ok") {	if ($result eq "ok") {
	&update_passwd_history($uname,$udom,$umode,'changeuserauth');
&Reply($client, \$result);	&Reply($client, \$result);
} else {	} else {
&Failure($client, \$result);	&Failure($client, \$result);
}	}
} else {	} else {
my $result=&make_passwd_file($uname,$udom,$umode,$npass,$passfilename);	my $result=&make_passwd_file($uname,$udom,$umode,$npass,
	$passfilename,'changeuserauth');
#	#
# If the current auth mode is internal, and the old auth mode was	# If the current auth mode is internal, and the old auth mode was
# unix, or krb*, and the user is an author for this domain,	# unix, or krb*, and the user is an author for this domain,
Line 2190 sub change_authentication_handler {	Line 2234 sub change_authentication_handler {
}	}
&register_handler("changeuserauth", \&change_authentication_handler, 1,1, 0);	&register_handler("changeuserauth", \&change_authentication_handler, 1,1, 0);

	sub update_passwd_history {
	my ($uname,$udom,$umode,$context) = @_;
	my $proname=&propath($udom,$uname);
	my $now = time;
	if (open(my $fh,">>$proname/passwd.log")) {
	print $fh "$now:$umode:$context\n";
	close($fh);
	}
	return;
	}

#	#
# Determines if this is the home server for a user. The home server	# Determines if this is the home server for a user. The home server
# for a user will have his/her lon-capa passwd file. Therefore all we need	# for a user will have his/her lon-capa passwd file. Therefore all we need
Line 2441 sub remove_user_file_handler {	Line 2496 sub remove_user_file_handler {
if (-e $file) {	if (-e $file) {
#	#
# If the file is a regular file unlink is fine...	# If the file is a regular file unlink is fine...
# However it's possible the client wants a dir.	# However it's possible the client wants a dir
# removed, in which case rmdir is more approprate:	# removed, in which case rmdir is more appropriate.
	# Note: rmdir will only remove an empty directory.
#	#
if (-f $file){	if (-f $file){
unlink($file);	unlink($file);
	# for html files remove the associated .bak file
	# which may have been created by the editor.
	if ($ufile =~ m{^((docs\|supplemental)/(?:\d+\|default)/\d+(?:\|/.+)/)[^/]+\.x?html?$}i) {
	my $path = $1;
	if (-e $file.'.bak') {
	unlink($file.'.bak');
	}
	}
} elsif(-d $file) {	} elsif(-d $file) {
rmdir($file);	rmdir($file);
}	}
Line 5398 sub create_auto_enroll_password_handler	Line 5462 sub create_auto_enroll_password_handler
&register_handler("autocreatepassword", \&create_auto_enroll_password_handler,	&register_handler("autocreatepassword", \&create_auto_enroll_password_handler,
0, 1, 0);	0, 1, 0);

	sub auto_export_grades_handler {
	my ($cmd, $tail, $client) = @_;
	my $userinput = "$cmd:$tail";
	my ($cdom,$cnum,$info,$data) = split(/:/,$tail);
	my $inforef = &Apache::lonnet::thaw_unescape($info);
	my $dataref = &Apache::lonnet::thaw_unescape($data);
	my ($outcome,$result);;
	eval {
	local($SIG{__DIE__})='DEFAULT';
	my %rtnhash;
	$outcome=&localenroll::export_grades($cdom,$cnum,$inforef,$dataref,\%rtnhash);
	if ($outcome eq 'ok') {
	foreach my $key (keys(%rtnhash)) {
	$result .= &escape($key).'='.&Apache::lonnet::freeze_escape($rtnhash{$key}).'&';
	}
	$result =~ s/\&$//;
	}
	};
	if (!$@) {
	if ($outcome eq 'ok') {
	if ($cipher) {
	my $cmdlength=length($result);
	$result.=" ";
	my $encresult='';
	for (my $encidx=0;$encidx<=$cmdlength;$encidx+=8) {
	$encresult.= unpack("H16",
	$cipher->encrypt(substr($result,
	$encidx,
	8)));
	}
	&Reply( $client, "enc:$cmdlength:$encresult\n", $userinput);
	} else {
	&Failure( $client, "error:no_key\n", $userinput);
	}
	} else {
	&Reply($client, "$outcome\n", $userinput);
	}
	} else {
	&Failure($client,"export_error\n",$userinput);
	}
	return 1;
	}
	&register_handler("autoexportgrades", \&auto_export_grades_handler,
	0, 1, 0);

# Retrieve and remove temporary files created by/during autoenrollment.	# Retrieve and remove temporary files created by/during autoenrollment.
#	#
# Formal Parameters:	# Formal Parameters:
Line 5418 sub retrieve_auto_file_handler {	Line 5527 sub retrieve_auto_file_handler {
my ($filename) = split(/:/, $tail);	my ($filename) = split(/:/, $tail);

my $source = $perlvar{'lonDaemons'}.'/tmp/'.$filename;	my $source = $perlvar{'lonDaemons'}.'/tmp/'.$filename;
if ( (-e $source) && ($filename ne '') ) {
	if ($filename =~m{/\.\./}) {
	&Failure($client, "refused\n", $userinput);
	} elsif ( (-e $source) && ($filename ne '') ) {
my $reply = '';	my $reply = '';
if (open(my $fh,$source)) {	if (open(my $fh,$source)) {
while (<$fh>) {	while (<$fh>) {
Line 5450 sub crsreq_checks_handler {	Line 5562 sub crsreq_checks_handler {
my $userinput = "$cmd:$tail";	my $userinput = "$cmd:$tail";
my $dom = $tail;	my $dom = $tail;
my $result;	my $result;
my @reqtypes = ('official','unofficial','community','textbook');	my @reqtypes = ('official','unofficial','community','textbook','placement');
eval {	eval {
local($SIG{__DIE__})='DEFAULT';	local($SIG{__DIE__})='DEFAULT';
my %validations;	my %validations;
Line 7147 sub validate_user {	Line 7259 sub validate_user {
}	}
if ($howpwd ne 'nouser') {	if ($howpwd ne 'nouser') {
if($howpwd eq "internal") { # Encrypted is in local password file.	if($howpwd eq "internal") { # Encrypted is in local password file.
$validated = (crypt($password, $contentpwd) eq $contentpwd);	if (length($contentpwd) == 13) {
	$validated = (crypt($password,$contentpwd) eq $contentpwd);
	if ($validated) {
	my $ncpass = &hash_passwd($domain,$password);
	if (&rewrite_password_file($domain,$user,"$howpwd:$ncpass")) {
	&update_passwd_history($user,$domain,$howpwd,'conversion');
	&logthis("Validated password hashed with bcrypt for $user:$domain");
	}
	}
	} else {
	$validated = &check_internal_passwd($password,$contentpwd,$domain);
	}
}	}
elsif ($howpwd eq "unix") { # User is a normal unix user.	elsif ($howpwd eq "unix") { # User is a normal unix user.
$contentpwd = (getpwnam($user))[1];	$contentpwd = (getpwnam($user))[1];
Line 7215 sub validate_user {	Line 7338 sub validate_user {
return $validated;	return $validated;
}	}

	sub check_internal_passwd {
	my ($plainpass,$stored,$domain) = @_;
	my (undef,$method,@rest) = split(/!/,$stored);
	if ($method eq "bcrypt") {
	my $result = &hash_passwd($domain,$plainpass,@rest);
	if ($result ne $stored) {
	return 0;
	}
	# Upgrade to a larger number of rounds if necessary
	my $defaultcost;
	my %domconfig =
	&Apache::lonnet::get_dom('configuration',['password'],$domain);
	if (ref($domconfig{'password'}) eq 'HASH') {
	$defaultcost = $domconfig{'password'}{'cost'};
	}
	if (($defaultcost eq '') \|\| ($defaultcost =~ /D/)) {
	$defaultcost = 10;
	}
	return 1 unless($rest[0]<$defaultcost);
	}
	return 0;
	}

	sub get_last_authchg {
	my ($domain,$user) = @_;
	my $lastmod;
	my $logname = &propath($domain,$user).'/passwd.log';
	if (-e "$logname") {
	$lastmod = (stat("$logname"))[9];
	}
	return $lastmod;
	}

sub krb4_authen {	sub krb4_authen {
my ($password,$null,$user,$contentpwd) = @_;	my ($password,$null,$user,$contentpwd) = @_;
my $validated = 0;	my $validated = 0;
Line 7530 sub change_unix_password {	Line 7686 sub change_unix_password {


sub make_passwd_file {	sub make_passwd_file {
my ($uname,$udom,$umode,$npass,$passfilename)=@_;	my ($uname,$udom,$umode,$npass,$passfilename,$action)=@_;
my $result="ok";	my $result="ok";
if ($umode eq 'krb4' or $umode eq 'krb5') {	if ($umode eq 'krb4' or $umode eq 'krb5') {
{	{
my $pf = IO::File->new(">$passfilename");	my $pf = IO::File->new(">$passfilename");
if ($pf) {	if ($pf) {
print $pf "$umode:$npass\n";	print $pf "$umode:$npass\n";
	&update_passwd_history($uname,$udom,$umode,$action);
} else {	} else {
$result = "pass_file_failed_error";	$result = "pass_file_failed_error";
}	}
}	}
} elsif ($umode eq 'internal') {	} elsif ($umode eq 'internal') {
my $salt=time;	my $ncpass = &hash_passwd($udom,$npass);
$salt=substr($salt,6,2);
my $ncpass=crypt($npass,$salt);
{	{
&Debug("Creating internal auth");	&Debug("Creating internal auth");
my $pf = IO::File->new(">$passfilename");	my $pf = IO::File->new(">$passfilename");
if($pf) {	if($pf) {
print $pf "internal:$ncpass\n";	print $pf "internal:$ncpass\n";
	&update_passwd_history($uname,$udom,$umode,$action);
} else {	} else {
$result = "pass_file_failed_error";	$result = "pass_file_failed_error";
}	}

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>

Removed from v.1.517
changed lines
	Added in v.1.522