brokenhttpd/src/auth-bozo.c
/*
 * Check if HTTP authentication is required
 */
Check if HTTP authentication is required
Check if HTTP authentication is required
int
bozo_auth_check(bozo_httpreq_t *request, const char *file)
{
	bozohttpd_t *httpd = request->hr_httpd;
	struct stat sb;
	char dir[MAXPATHLEN], authfile[MAXPATHLEN], *basename;
	char user[BUFSIZ], *pass;
	FILE *fp;
	int len;
	snprintf(dir, sizeof(dir), "%s", file);
	if ((basename = strrchr(dir, '/')) == NULL)
		strcpy(dir, ".");
	else {
		*basename++ = '\0';
		if (bozo_check_special_files(request, basename))
			return 1;
	}
	request->hr_authrealm = bozostrdup(httpd, request, dir);
	if ((size_t)snprintf(authfile, sizeof(authfile), "%s/%s", dir,
			     AUTH_FILE) >= sizeof(authfile)) {
		return bozo_http_error(httpd, 404, request,
			"authfile path too long");
	}
	if (stat(authfile, &sb) < 0) {
		debug((httpd, DEBUG_NORMAL,
		    "bozo_auth_check realm `%s' dir `%s' authfile `%s' missing",
		    dir, file, authfile));
		return 0;
	}
	if ((fp = fopen(authfile, "r")) == NULL)
		return bozo_http_error(httpd, 403, request,
			"no permission to open authfile");
	debug((httpd, DEBUG_NORMAL,
	    "bozo_auth_check realm `%s' dir `%s' authfile `%s' open",
	    dir, file, authfile));
	if (request->hr_authuser && request->hr_authpass) {
		while (fgets(user, sizeof(user), fp) != NULL) {
			len = strlen(user);
			if (len > 0 && user[len-1] == '\n')
				user[--len] = '\0';
			if ((pass = strchr(user, ':')) == NULL)
				continue;
			*pass++ = '\0';
			debug((httpd, DEBUG_NORMAL,
			    "bozo_auth_check authfile `%s':`%s' "
			    	"client `%s':`%s'",
			    user, pass, request->hr_authuser,
			    request->hr_authpass));
			if (strcmp(request->hr_authuser, user) != 0)
				continue;
			if (strcmp(crypt(request->hr_authpass, pass),
					pass) != 0)
				break;
			fclose(fp);
			return 0;
		}
	}
	fclose(fp);
	return bozo_http_error(httpd, 401, request, "bad auth");
}
int bozo_auth_check ( bozo_httpreq_t * request , const char * file ) { bozohttpd_t * httpd = request -> hr_httpd ; struct stat sb ; char dir [ MAXPATHLEN ] , authfile [ MAXPATHLEN ] , * basename ; char user [ BUFSIZ ] , * pass ; FILE * fp ; int len ; snprintf ( dir , sizeof ( dir ) , " " , file ) ; if ( ( basename = strrchr ( dir , ' ' ) ) == NULL ) strcpy ( dir , " " ) ; else { * basename ++ = ' \0 ' ; if ( bozo_check_special_files ( request , basename ) ) return 1 ; } request -> hr_authrealm = bozostrdup ( httpd , request , dir ) ; if ( ( size_t ) snprintf ( authfile , sizeof ( authfile ) , " " , dir , AUTH_FILE ) >= sizeof ( authfile ) ) { return bozo_http_error ( httpd , 404 , request , " " ) ; } if ( stat ( authfile , & sb ) < 0 ) { debug ( ( httpd , DEBUG_NORMAL , " " , dir , file , authfile ) ) ; return 0 ; } if ( ( fp = fopen ( authfile , " " ) ) == NULL ) return bozo_http_error ( httpd , 403 , request , " " ) ; debug ( ( httpd , DEBUG_NORMAL , " " , dir , file , authfile ) ) ; if ( request -> hr_authuser && request -> hr_authpass ) { while ( fgets ( user , sizeof ( user ) , fp ) != NULL ) { len = strlen ( user ) ; if ( len > 0 && user [ len - 1 ] == ' \n ' ) user [ -- len ] = ' \0 ' ; if ( ( pass = strchr ( user , ' ' ) ) == NULL ) continue ; * pass ++ = ' \0 ' ; debug ( ( httpd , DEBUG_NORMAL , " " " " , user , pass , request -> hr_authuser , request -> hr_authpass ) ) ; if ( strcmp ( request -> hr_authuser , user ) != 0 ) continue ; if ( strcmp ( crypt ( request -> hr_authpass , pass ) , pass ) != 0 ) break ; fclose ( fp ) ; return 0 ; } } fclose ( fp ) ; return bozo_http_error ( httpd , 401 , request , " " ) ; }
Check if HTTP authentication is required
Check if HTTP authentication is required
/* get dir=dirname(file) */ /* ensure basename(file) != AUTH_FILE */