From 948cac6b583bb8dbd43667a2837f3e641d172844 Mon Sep 17 00:00:00 2001 From: BlackLight Date: Sat, 25 Dec 2010 21:52:37 +0100 Subject: [PATCH] Multiuser support improved, su command --- blash.js | 40 +++++++++++++++ blash.json | 7 +-- commands/su.json | 87 ++++++++++++++++++++++++++++++++ commands/whoami.json | 37 +++++++++++++- modules/users/.userlist.php.swp | Bin 12288 -> 0 bytes modules/users/.users.php.swp | Bin 12288 -> 12288 bytes modules/users/userlist.php | 2 +- modules/users/users.php | 79 ++++++++++++++++++++++++++++- 8 files changed, 246 insertions(+), 6 deletions(-) create mode 100644 commands/su.json delete mode 100644 modules/users/.userlist.php.swp diff --git a/blash.js b/blash.js index bc46107..30f6a74 100644 --- a/blash.js +++ b/blash.js @@ -13,6 +13,9 @@ var shell = null; function blash () { /************ ATTRIBUTES **************/ + /** Current user */ + this.user = ''; + /** Object containing the parsed JSON configuration object */ this.json = {}; @@ -75,6 +78,38 @@ function blash () http.send ( null ); } + if ( document.cookie ) + { + if ( document.cookie.match ( 'auth=' ) && document.cookie.match ( 'username=([^;]+);?' )) + { + this.user = RegExp.$1; + var params = 'action=getuser'; + var users_php = window.location.href; + users_php = users_php.replace ( /\/([a-zA-Z\.]+)$/, '/modules/users/users.php' ); + + var xml = new XMLHttpRequest(); + xml.open ( "POST", users_php, true ); + xml.setRequestHeader ( "Content-type", "application/x-www-form-urlencoded" ); + xml.setRequestHeader ( "Content-length", params.length ); + xml.setRequestHeader ( "Connection", "close" ); + + xml.onreadystatechange = function () + { + if ( xml.readyState == 4 && xml.status == 200 ) + { + if ( xml.responseText.length > 0 ) + { + shell.user = xml.responseText; + } else { + shell.user = shell.json.user; + } + } + } + + xml.send ( params ); + } + } + this.prompt.focus(); var json_config = window.location.href; @@ -89,6 +124,11 @@ function blash () { shell.json = eval ( '(' + http.responseText + ')' ); + if ( shell.user == '' ) + { + shell.user = shell.json.user; + } + shell.promptText.innerHTML = ( shell.json.promptText ) ? shell.json.promptText : "[%n@%m %W] $ "; shell.promptText.innerHTML = shell.unescapePrompt ( promptText.innerHTML, shell.json.promptSequences ); diff --git a/blash.json b/blash.json index 974ff6c..d8fca3c 100644 --- a/blash.json +++ b/blash.json @@ -24,9 +24,9 @@ "promptSequences" : [ { "sequence" : "%n", - "default_text" : "blacklight", + "default_text" : "guest", "text" : function () { - return shell.json.user; + return shell.user; }, }, { @@ -38,7 +38,7 @@ }, { "sequence" : "%W", - "default_text" : "~", + "default_text" : "/", "text" : function () { return shell.path; }, @@ -195,6 +195,7 @@ "ls", "man", "pwd", + "su", "useradd", "whoami", ], diff --git a/commands/su.json b/commands/su.json new file mode 100644 index 0000000..ea03868 --- /dev/null +++ b/commands/su.json @@ -0,0 +1,87 @@ +{ + "name" : "su", + + "info" : { + "syntax" : "su [username]", + "brief" : "Change user ID or become superuser", + }, + + "action" : function ( arg ) + { + var out = ''; + + if ( !arg || arg.length == 0 ) + { + arg = 'root'; + } + + if ( shell.__first_cmd ) + { + shell.cmdOut.innerHTML = '
'; + shell.__first_cmd = false; + } + + shell.getPassword = this.getPassword; + shell.newuser = arg; + + shell.cmdOut.innerHTML += 'Password: ' + + '
'; + + shell.auto_prompt_focus = false; + shell.auto_prompt_refresh = false; + + this.password = document.getElementsByName ( "password" )[0]; + this.password.focus(); + + return out; + }, + + "getPassword" : function ( e ) + { + var evt = ( window.event ) ? window.event : e; + var key = ( evt.charCode ) ? evt.charCode : evt.keyCode; + var password = document.getElementsByName ( "password" )[0]; + + if ( key == 13 && password.value.length > 0 ) + { + var users_php = window.location.href; + users_php = users_php.replace ( /\/([a-zA-Z\.]+)$/, '/modules/users/users.php' ); + params = 'action=login&user=' + escape ( shell.newuser ) + '&pass=' + md5 ( password.value ); + + var http = new XMLHttpRequest(); + http.open ( "POST", users_php, true ); + http.setRequestHeader ( "Content-type", "application/x-www-form-urlencoded" ); + http.setRequestHeader ( "Content-length", params.length ); + http.setRequestHeader ( "Connection", "close" ); + + http.onreadystatechange = function () + { + if ( http.readyState == 4 && http.status == 200 ) + { + if ( http.responseText.match ( /^Successfully logged in as '(.+?)'\s+(.*)\s*$/i )) + { + var user = RegExp.$1; + var auth = RegExp.$2; + + shell.user = user; + shell.cmdOut.innerHTML = "Successfully logged in as '" + user + "'"; + } else { + shell.cmdOut.innerHTML = ''; + } + + shell.refreshPrompt ( false, false ); + } + } + + http.send ( params ); + + shell.cmdOut.innerHTML = ''; + shell.auto_prompt_focus = true; + shell.auto_prompt_refresh = true; + shell.refreshPrompt ( false, false ); + } + }, +} + diff --git a/commands/whoami.json b/commands/whoami.json index 2e1dbf0..049a868 100644 --- a/commands/whoami.json +++ b/commands/whoami.json @@ -15,7 +15,42 @@ return "whoami: extra operand `" + arg + "'
\n"; } - return shell.json.user + "
\n"; + if ( shell.user == shell.json.user ) + { + return shell.json.user + "
\n"; + } else { + shell.auto_prompt_refresh = false; + + var users_php = window.location.href; + users_php = users_php.replace ( /\/([a-zA-Z\.]+)$/, '/modules/users/users.php' ); + params = 'action=getuser'; + + var http = new XMLHttpRequest(); + http.open ( "POST", users_php, true ); + http.setRequestHeader( "Content-type", "application/x-www-form-urlencoded" ); + http.setRequestHeader( "Content-length", params.length ); + http.setRequestHeader( "Connection", "close" ); + + http.onreadystatechange = function () + { + if ( http.readyState == 4 && http.status == 200 ) + { + if ( http.responseText.length > 0 ) + { + shell.cmdOut.innerHTML = http.responseText + "\n"; + } else { + shell.cmdOut.innerHTML = shell.json.user + "
\n"; + } + + shell.auto_prompt_refresh = true; + shell.refreshPrompt ( false, false ); + } + } + + http.send ( params ); + shell.cmdOut.innerHTML = ''; + return out; + } }, } diff --git a/modules/users/.userlist.php.swp b/modules/users/.userlist.php.swp deleted file mode 100644 index 225fe82e97e1262078188cb7964271ddf855b2d2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 12288 zcmeI&Jx{_w7zgl!(ZrW%+|Sb$TI4-a*i1}h6XROigH}u1aEC98U%{B@qN}4H$w~bH zuCnNJ!9*4$uH=8ozel*&hRbUMge-ue&jg%Zto>8cDJ`K{p%VHG* z5SS-0(!E@5nH6^n_O{sK8|$5UJFpG`2tWV=5P$##AOHafESP{!Gwh4*l%*_DGC!dS z0|F3$00bZa0SG_<0uX=z1Rwx`1rcz4#yYEv-BQf||K>M1LdA_ zM=|e@R~7^T*MI;7AOHafKmY;|fB*y_0D(moXf+u-X&>$})-WySJaz}t5w7wDPhF)P zQLPoqm3l>b-Cn_?xl*f_y47mERId2NqAdjv60^lJlVvtq&FNB668*o_)Tt(&@Xg8b z6wR&6LB!9gJ3dTeM-=k5;4=0SKaBg1=p60mYJw~6#=aXRF&*qmDna#jXq%T%kAAGV P!yAnT-I^}lGM)9`J$-^S diff --git a/modules/users/.users.php.swp b/modules/users/.users.php.swp index 21565a08a031df67544dafea0e404665a73514e1..74c3fa5ec14fafde2ab681da86a53a03d7ae73bc 100644 GIT binary patch literal 12288 zcmeI2U1%It6vuD(a^6B%3x=ZS&EV5~Q@D_9ONqNy}vB?(Ue`nQ>;e z+cZ@xSnHemV!`TzFH+PBTET)^QSd<&!6GP95mE5LKKLL-i(mh9=VNEnO^F{!DR;_m zvpaL{z32SzIcGNMO!PdkZkXTG-OF&?#MsI0w+){-%-HD%8JnliN5FI75I6|-f^Fb#upG<-zu&;vPv8vr5xfPCgI!<~7zP`_ zx%rHp1t-Dl;23xngunxp3;;7;&I8)5+;fe*n6@FqA89tG22F<1l^fLp=oYZ&_y z90f>U;+5*YQ{bXhryFz8Y~BAuVU;I@G*D_902=34Lk%quokQYD?kVM z?n=hK0WX0Ufd?kQI2Z$WfJNZc6_^`50SlLeK_&MlO60z6M`_Q{Xf39(V)1 z29AN}!PDRnI0zmGj{(Z19bhLI250DxOBchjYLKyqSzFtLFZ9Viyzxa?^BumF-g`bC zW8t}SO$1@C4@$I=X_H9{o5(1BWyt~*Z1VoXi_OvOpZgTMHX{%OHX~k~LBw3xf#A~= zIF4AJ9+HQSXh?o<)$SUkr*ua1*7&IA=vASO$2Rd$tHe8adl34D9tflA;Zt6(g_Ta8 z-@SI@#`WulMm74Zjq^f*w8kL~_yDh(%gMauD!lu=3!WYXG)?3{w0^7QTh5pDha!q% zA)nxooU7#eX!DRWBmy6cbESH`%gVRy3XChnP(jq?L&&6|fdjSOwsI;ur!(TAlPvo#se8nWp}eF5cZIW4<_HbNjXsV@X!~@v zYYax0Mc zVx8~NZOh~pJZ3#J{bp}HO7Ai*zwgYdj_R9HW2K_Z z^i32Ay5=+s>Q>bJ^SFIju0v`<%SMZzW-`;0%L8#|hgo_m+rOh(Xd%ln?3#(MZcSYU Jl_*;y`wNS9Be(zn delta 277 zcmZojXh;xGG6?hZRWR2xW&i>K28KYMNCDl-89SAs6A diff --git a/modules/users/userlist.php b/modules/users/userlist.php index 29108df..5111870 100644 --- a/modules/users/userlist.php +++ b/modules/users/userlist.php @@ -3,7 +3,7 @@ $xmlcontent = << - + XML; diff --git a/modules/users/users.php b/modules/users/users.php index e381134..971346a 100644 --- a/modules/users/users.php +++ b/modules/users/users.php @@ -27,7 +27,7 @@ switch ( $action ) if ( preg_match ( '/[^a-zA-Z0-9]/', $password ) || strlen ( $password ) != 32 ) { - print "The provided password '$password' is not a valid hash\n"; + print "The provided password is not a valid hash\n"; return 1; } @@ -62,6 +62,83 @@ switch ( $action ) print 'User "'.$username.' successfully added, home directory set to "/home/'.$username."\"\n"; break; + + case 'login': + $username = $_REQUEST['user']; + $password = $_REQUEST['pass']; + + if ( !( $username != null && $password != null )) + { + die (""); + } + + if ( preg_match ( '/[^a-zA-Z0-9_]/', $username )) + { + print "The username can only contain characters in the charset '[a-zA-Z0-9_]'\n"; + return 1; + } + + if ( !( $xml = new SimpleXMLElement ( $xmlcontent ))) + { + print "Unable to open the users XML file\n"; + return 1; + } + + for ( $i = 0; $i < count ( $xml->user ) && !$found; $i++ ) + { + if ( !strcasecmp ( $xml->user[$i]['name'], $username )) + { + if ( strcasecmp ( $xml->user[$i]['pass'], $password )) + { + print "Wrong password provided for user '$username'\n"; + return 1; + } else { + $auth = md5 ( $xml->user[$i]['name'] . $xml->user[$i]['pass'] ); + setcookie ( 'username', $xml->user[$i]['name'], 0, "/" ); + setcookie ( 'auth', $auth, 0, "/" ); + + print "Successfully logged in as '$username' $auth\n"; + return 0; + } + } + } + + print "Username not found: '$username'\n"; + break; + + case 'getuser': + if ( isset ( $_COOKIE['username'] ) && isset ( $_COOKIE['auth'] )) + { + if ( !( $xml = new SimpleXMLElement ( $xmlcontent ))) + { + print "Unable to open the users XML file\n"; + return 1; + } + + for ( $i = 0; $i < count ( $xml->user ) && !$found; $i++ ) + { + if ( !strcasecmp ( $xml->user[$i]['name'], $_COOKIE['username'] )) + { + $auth = md5 ( $xml->user[$i]['name'] . $xml->user[$i]['pass'] ); + + if ( !strcasecmp ( $auth, $_COOKIE['auth'] )) + { + print $xml->user[$i]['name']; + return 0; + } else { + print "guest"; + return 1; + } + } + } + + print "guest"; + return 1; + } + + print "guest"; + return 1; + break; } ?>