From 2f6a300572bd6048351af8c45394ae62230c83d9 Mon Sep 17 00:00:00 2001 From: Stefan Ritt Date: Wed, 24 Aug 2016 13:49:07 +0200 Subject: [PATCH] Fixed bypassing of user name check if entries are submitted by elog utility and guest menus are enabled --- src/elogd.c | 80 +++++++++++++++++++++++++++++++++-------------------- src/elogd.h | 3 +- 2 files changed, 52 insertions(+), 31 deletions(-) diff --git a/src/elogd.c b/src/elogd.c index 76a73890..896beeb2 100755 --- a/src/elogd.c +++ b/src/elogd.c @@ -3549,7 +3549,7 @@ void retrieve_email_from(LOGBOOK * lbs, char *ret, char *ret_name, char attrib[M break; get_user_line(lbs, login_name, NULL, NULL, email_from, NULL, NULL, NULL); sprintf(email_from_name, "%s <%s>", login_name, email_from); - if (is_admin_user(lbs->name, login_name) && strchr(email_from, '@')) + if (is_admin_user(lbs, login_name) && strchr(email_from, '@')) break; } } @@ -8952,7 +8952,7 @@ void show_change_pwd_page(LOGBOOK * lbs) wrong_pwd = 2; } else { /* administrator does not have to supply old password if changing other user's password */ - if (isparam("unm") && is_admin_user(lbs->name, getparam("unm")) + if (isparam("unm") && is_admin_user(lbs, getparam("unm")) && stricmp(getparam("unm"), user) != 0) wrong_pwd = 0; else { @@ -9030,7 +9030,7 @@ void show_change_pwd_page(LOGBOOK * lbs) /* do not ask for old pwasword if admin changes other user's password */ if (isparam("unm")) { - if (!is_admin_user(lbs->name, getparam("unm")) || stricmp(getparam("unm"), user) == 0) { + if (!is_admin_user(lbs, getparam("unm")) || stricmp(getparam("unm"), user) == 0) { if (isparam("oldpwd") && !(wrong_pwd == 1)) // hidden password for password recovery rsprintf("name, getparam("unm"))) + if (is_admin_user(lbs, getparam("unm"))) return TRUE; /* search attribute which contains short_name of author */ @@ -12652,7 +12652,7 @@ void show_admin_page(LOGBOOK * lbs, char *top_group) rsprintf("\n"); if (lbs->top_group[0] && (!top_group || strieq(top_group, "global"))) { - if (is_admin_user("global", getparam("unm"))) { + if (is_admin_user(NULL, getparam("unm"))) { if (lbs->top_group[0]) { sprintf(str, "global %s", lbs->top_group); @@ -12685,7 +12685,7 @@ void show_admin_page(LOGBOOK * lbs, char *top_group) } if (is_group("global") && !strieq(top_group, "global")) { - if (is_admin_user("global", getparam("unm"))) { + if (is_admin_user(NULL, getparam("unm"))) { rsprintf("\n", loc("Delete this logbook")); rsprintf("\n", loc("Rename this logbook")); rsprintf("\n", loc("Create new logbook")); @@ -13804,7 +13804,7 @@ void show_config_page(LOGBOOK * lbs) /*---- if admin user, show user list ----*/ - if (is_admin_user(logbook, getparam("unm"))) { + if (is_admin_user(lbs, getparam("unm"))) { rsprintf("\n"); rsprintf("%s:\n", loc("Select user")); rsprintf("\n", loc("Change password")); rsprintf("\n", loc("Remove user")); - if (is_admin_user(logbook, getparam("unm"))) { + if (is_admin_user(lbs, getparam("unm"))) { rsprintf("\n", loc("New user")); strlcpy(str, loc("Change config file"), sizeof(str)); rsprintf("\n", str); @@ -18628,6 +18628,17 @@ BOOL subst_param(char *str, int size, char *param, char *value) /*------------------------------------------------------------------*/ +BOOL logged_in(LOGBOOK *lbs) +{ + if (isparam("unm")) { + if (check_login_user(lbs, getparam("unm")) && check_login(lbs, getparam("sid"))) + return TRUE; + } + return FALSE; +} + +/*------------------------------------------------------------------*/ + BOOL is_user_allowed(LOGBOOK * lbs, char *command) { char str[1000], users[2000]; @@ -18658,7 +18669,7 @@ BOOL is_user_allowed(LOGBOOK * lbs, char *command) /* check admin command */ if (strieq(command, loc("Admin"))) { if (getcfg(lbs->name, "Admin user", str, sizeof(str))) { - return is_admin_user(lbs->name, getparam("unm")); + return is_admin_user(lbs, getparam("unm")); } } @@ -18702,7 +18713,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) return TRUE; /* check for guest access */ - if (!getcfg(lbs->name, "Guest Menu commands", menu_str, sizeof(menu_str)) || isparam("unm") != 0) + if (!getcfg(lbs->name, "Guest Menu commands", menu_str, sizeof(menu_str)) || logged_in(lbs)) getcfg(lbs->name, "Menu commands", menu_str, sizeof(menu_str)); /* default menu commands */ @@ -18711,7 +18722,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) if (getcfg(lbs->name, "Password file", str, sizeof(str))) { - if (is_admin_user(lbs->name, getparam("unm"))) { + if (is_admin_user(lbs, getparam("unm"))) { strcat(menu_str, "Admin, "); strcat(menu_str, "Change config file, "); @@ -18720,7 +18731,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) strcat(menu_str, "Create new logbook, "); strcat(menu_str, "GetPwdFile, "); - if (is_admin_user("global", getparam("unm"))) { + if (is_admin_user(NULL, getparam("unm"))) { if (lbs->top_group[0]) { sprintf(str, "Change [global %s]", lbs->top_group); @@ -18728,7 +18739,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) strcat(menu_str, ", "); } - if (!lbs->top_group[0] || (is_admin_user("global", getparam("unm")))) { + if (!lbs->top_group[0] || (is_admin_user(NULL, getparam("unm")))) { strcat(menu_str, "Change [global]"); strcat(menu_str, ", "); @@ -18752,7 +18763,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) menu_str[0] = 0; for (i = 0; i < n; i++) { if (strcmp(menu_item[i], "Admin") == 0) { - if (!is_admin_user(lbs->name, getparam("unm"))) + if (!is_admin_user(lbs, getparam("unm"))) continue; } strcat(menu_str, menu_item[i]); @@ -18761,7 +18772,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) strcat(menu_str, "HelpELCode, Synchronize, "); - if (is_admin_user(lbs->name, getparam("unm"))) { + if (is_admin_user(lbs, getparam("unm"))) { strcat(menu_str, "Change config file, "); strcat(menu_str, "Delete this logbook, "); @@ -18769,7 +18780,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) strcat(menu_str, "Create new logbook, "); strcat(menu_str, "GetPwdFile, "); - if (is_admin_user("global", getparam("unm"))) { + if (is_admin_user(NULL, getparam("unm"))) { if (lbs->top_group[0]) { sprintf(str, "Change [global %s]", lbs->top_group); @@ -18777,7 +18788,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) strcat(menu_str, ", "); } - if (!lbs->top_group[0] || (is_admin_user("global", getparam("unm")))) { + if (!lbs->top_group[0] || (is_admin_user(NULL, getparam("unm")))) { strcat(menu_str, "Change [global]"); strcat(menu_str, ", "); @@ -18788,11 +18799,11 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) /* check list menu commands */ str[0] = 0; - if (!getcfg(lbs->name, "Guest List Menu commands", str, sizeof(str)) || isparam("unm") != 0) + if (!getcfg(lbs->name, "Guest List Menu commands", str, sizeof(str)) || logged_in(lbs)) getcfg(lbs->name, "list menu commands", str, sizeof(str)); if (!str[0]) { - if (!getcfg(lbs->name, "Guest Find Menu commands", str, sizeof(str)) || isparam("unm") != 0) + if (!getcfg(lbs->name, "Guest Find Menu commands", str, sizeof(str)) || logged_in(lbs)) getcfg(lbs->name, "Find Menu commands", str, sizeof(str)); } @@ -18819,7 +18830,7 @@ BOOL is_command_allowed(LOGBOOK * lbs, char *command, int message_id) strlcat(other_str, "Save, ", sizeof(other_str)); /* admin commands */ - if (is_admin_user(lbs->name, getparam("unm"))) { + if (is_admin_user(lbs, getparam("unm"))) { strlcat(other_str, "Remove user, New user, Activate, ", sizeof(other_str)); } else if (getcfg(lbs->name, "Self register", str, sizeof(str)) && atoi(str) > 0) { strlcat(other_str, "Remove user, New user, ", sizeof(other_str)); @@ -20947,13 +20958,11 @@ void show_elog_list(LOGBOOK * lbs, int past_n, int last_n, int page_n, BOOL defa rsprintf("\">\n", str); } - if (!getcfg(lbs->name, "Guest Find menu commands", menu_str, sizeof(menu_str)) || isparam("unm") - != 0) + if (!getcfg(lbs->name, "Guest Find menu commands", menu_str, sizeof(menu_str)) || logged_in(lbs)) getcfg(lbs->name, "Find menu commands", menu_str, sizeof(menu_str)); if (!menu_str[0]) { - if (!getcfg(lbs->name, "Guest list menu commands", menu_str, sizeof(menu_str)) || isparam("unm") - != 0) + if (!getcfg(lbs->name, "Guest list menu commands", menu_str, sizeof(menu_str)) || logged_in(lbs)) getcfg(lbs->name, "list menu commands", menu_str, sizeof(menu_str)); } @@ -24304,7 +24313,7 @@ void show_elog_entry(LOGBOOK * lbs, char *dec_path, char *command) } /* check for guest access */ - if (!getcfg(lbs->name, "Guest Menu commands", menu_str, sizeof(menu_str)) || isparam("unm") != 0) + if (!getcfg(lbs->name, "Guest Menu commands", menu_str, sizeof(menu_str)) || logged_in(lbs)) getcfg(lbs->name, "Menu commands", menu_str, sizeof(menu_str)); /* default menu commands */ @@ -24324,7 +24333,7 @@ void show_elog_entry(LOGBOOK * lbs, char *dec_path, char *command) menu_str[0] = 0; for (i = 0; i < n; i++) { if (strcmp(menu_item[i], "Admin") == 0) { - if (!is_admin_user(lbs->name, getparam("unm"))) + if (!is_admin_user(lbs, getparam("unm"))) continue; } strcat(menu_str, menu_item[i]); @@ -26061,11 +26070,17 @@ BOOL check_login_user(LOGBOOK * lbs, char *user) /*------------------------------------------------------------------*/ -BOOL is_admin_user(char *logbook, char *user) +BOOL is_admin_user(LOGBOOK *lbs, char *user) { int i, n; char str[1000]; char list[MAX_N_LIST][NAME_LENGTH]; + char logbook[1000]; + + if (lbs == NULL) + strlcpy(logbook, "global", sizeof(logbook)); + else + strlcpy(logbook, lbs->name, sizeof(logbook)); /* Removed user[0] for cloning, have to check implications, same below. if (getcfg(logbook, "Admin user", str, sizeof(str)) && user[0]) { */ @@ -26082,6 +26097,11 @@ BOOL is_admin_user(char *logbook, char *user) if (i == n) return FALSE; } + + /* make sure user is logged in */ + if (!logged_in(lbs)) + return FALSE; + return TRUE; } @@ -26618,7 +26638,7 @@ void show_selection_page(void) if (getcfg("global", "mirror server", str, sizeof(str))) { /* only admin user sees synchronization link */ - if (is_admin_user("global", getparam("unm"))) { + if (is_admin_user(NULL, getparam("unm"))) { rsprintf("\n"); rsprintf("\n"); rsprintf("%s\n", loc("Synchronize all logbooks")); diff --git a/src/elogd.h b/src/elogd.h index 17f4a92c..b5c98051 100644 --- a/src/elogd.h +++ b/src/elogd.h @@ -286,7 +286,7 @@ void write_logfile(LOGBOOK * lbs, const char *str); BOOL check_login_user(LOGBOOK * lbs, char *user); LBLIST get_logbook_hierarchy(void); BOOL is_logbook_in_group(LBLIST pgrp, char *logbook); -BOOL is_admin_user(char *logbook, char *user); +BOOL is_admin_user(LOGBOOK * lbs, char *user); BOOL is_admin_user_global(char *user); void free_logbook_hierarchy(LBLIST root); void show_top_text(LOGBOOK * lbs); @@ -302,6 +302,7 @@ void highlight_searchtext(regex_t * re_buf, char *src, char *dst, BOOL hidden); int parse_config_file(char *config_file); PMXML_NODE load_password_file(LOGBOOK * lbs, char *error, int error_size); int load_password_files(); +BOOL check_login(LOGBOOK * lbs, char *sid); void compose_base_url(LOGBOOK * lbs, char *base_url, int size, BOOL email_notify); void show_elog_entry(LOGBOOK * lbs, char *dec_path, char *command); char *loc(char *orig);