NotAlexNoyle/sharing-service
1
0 Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

switch to using credential

Browse Source
This commit is contained in:
CodePoet80 committed 2021-05-27 13:58:24 -04:00
1 parent cd8481de7b
commit 6cc6718de6
8 files changed
+46 -56
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

common.php
+8 -20
View File
@@ -31,32 +31,20 @@ function get_authorization($errorhandler = 'gracefuldeath_json') {
$errorhandler("username not specified");
$username = $_GET["username"];
//Look for a sharephrase
if (!isset($_GET["sharephrase"])){
if (array_key_exists('share-phrase', $request_headers)) {
$credential = $request_headers['share-phrase'];
//Look for a credential
if (!isset($_GET["credential"])){
if (array_key_exists('credential', $request_headers)) {
$credential = $request_headers['credential'];
}
}
else {
//check for encoding
if (base64_encode(base64_decode($_GET["sharephrase"])) !== $_GET["sharephrase"]){
$errorhandler("refusing to use querystring share-phrase in the clear; encode and retry");
if (base64_encode(base64_decode($_GET["credential"])) !== $_GET["credential"]){
$errorhandler("refusing to use querystring credential in the clear; encode and retry");
}
$credential = $_GET["sharephrase"];
}
//Look for a password
if (!isset($_GET["password"])){
if (array_key_exists('password', $request_headers)) {
$credential = $request_headers['password'];
}
}
else {
//check for encoding
if (base64_encode(base64_decode($_GET["password"])) !== $_GET["password"]){
$errorhandler("refusing to use querystring password in the clear; encode and retry");
}
$credential = $_GET["password"];
$credential = $_GET["credential"];
}
if (!isset($credential))
$errorhandler("no credential in request");
$credential = strtolower($credential);
get-shares.php
+10 -7
View File
@@ -5,11 +5,14 @@ header('Content-Type: application/json');
$auth = get_authorization();
//Make sure the file exists and can be loaded
$jsondata = get_share_data($auth['username'], $auth['credential'], 'gracefuldeath_json');
//Load and return only the task list
$sharedata = convert_shares_to_public_schema($jsondata, $auth['username'], $auth['credential']);
print_r (json_encode($sharedata));
exit();
//Load share data
$sharedata = get_share_data($auth['username'], $auth['credential'], 'gracefuldeath_json');
//Convert to public schema
$sharedata = convert_shares_to_public_schema($sharedata, $auth['username'], $auth['credential']);
//Figure out if we're allowed to show this user
if ($sharedata->accesslevel == 'admin') {
print_r (json_encode($sharedata));
} else {
gracefuldeath_json("supplied credentials are only for sharing with this user; use admin password to view shares");
}
?>
share-image.php
+1 -1
View File
@@ -6,7 +6,7 @@ header('Content-Type: application/json');
$auth = array(
'username' => strtolower($_POST['username']),
'credential' => strtolower($_POST['sharephrase']),
'credential' => strtolower($_POST['credential']),
);
$error_message = null;
web-get-shares.php
+14 -15
View File
@@ -1,10 +1,6 @@
<?php
if (!isset($_GET["username"]) || !isset($_COOKIE["credential"])) {
header('Location: web-login.php?username=' . $_GET["username"]);
} else {
//echo "Welcome to your share space!<br>";
//echo $_GET["username"] . "<br>";
//echo $_COOKIE["credential"] . "<br>";
}
include("common.php");
@@ -41,17 +37,17 @@ if ($sharedata->accesslevel != 'admin') {
<body class="login" onload="swapTech()">
<div class="login-header"><?php echo $_GET["username"] ?> | <a href="index.php">Log Out</a>&nbsp;</div>
<div style="margin: 10px;">
<div class="shareSpaceTitle">
<b>Share Phrase: </b><img src="images/eyeball.png" id="imgTogglePass" style="display:inline;height:20px;width:20px;margin-top:-2px;vertical-align:middle" onclick="togglePassword()" title="<?php echo $sharedata->sharephrase; ?>">&nbsp;<span id="spnSharePhrase" style="display:none"><?php echo $sharedata->sharephrase; ?></span><br>
<b>Share Type: </b><?php echo $sharedata->sharetype; ?>
</div>
<table>
<?php
if ($sharedata->accesslevel == 'admin') {
?>
<div class="shareSpaceTitle">
<b>Share Phrase: </b><img src="images/eyeball.png" id="imgTogglePass" style="display:inline;height:20px;width:20px;margin-top:-2px;vertical-align:middle" onclick="togglePassword()" title="<?php echo $sharedata->sharephrase; ?>">&nbsp;<span id="spnSharePhrase" style="display:none"><?php echo $sharedata->sharephrase; ?></span><br>
<b>Share Type: </b><?php echo $sharedata->sharetype; ?>
</div>
<?php
foreach($sharedata->shares as $thisshare)
{
echo "<tr>";
echo "<table><tr>";
switch ($thisshare['contenttype']) {
case "text/plain":
$textLink = make_url_from_contentid($thisshare['guid'], $_GET["username"], "t");
@@ -77,14 +73,17 @@ if ($sharedata->accesslevel == 'admin') {
break;
}
echo "<div class='shareDelete'><a href='web-delete-item.php?username=" . $_GET["username"] . "&itemid=" . $thisshare['guid'] . "'>Delete</a></div>";
echo "</td></tr>";
echo "</td></tr></table>";
}
} else {
echo "not allowed";
?>
<div class="shareSpaceTitle">
<b>Wrong Access Level: </b>The credentials provided can only be used to share with this account.<br/>Login with the admin password to view previous shares.<br>
</div>
<?php
}
?>
</table>
</div>
</body>
</html>
web-new-user.php
+4 -4
View File
@@ -2,9 +2,9 @@
include("common.php");
include("functions.php");
if (isset($_POST["txtUsername"]) && isset($_POST["txtSharephrase"]) && isset($_POST["txtPassword"]))
if (isset($_POST["txtUsername"]) && isset($_POST["txtCredential"]) && isset($_POST["txtPassword"]))
{
$create_result = @create_new_user($_POST["txtUsername"], $_POST["txtSharephrase"], $_POST["txtPassword"], $_POST["txtCreateKey"], 'gracefuldeath_later');
$create_result = @create_new_user($_POST["txtUsername"], $_POST["txtCredential"], $_POST["txtPassword"], $_POST["txtCreateKey"], 'gracefuldeath_later');
if (isset($create_result)) {
setcookie("credential", $_POST["txtPassword"], time() + (3600), "/");
header('Location: web-get-shares.php?username=' . $_POST["txtUsername"]);
@@ -31,7 +31,7 @@
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (this.readyState === 4) {
document.getElementById("txtSharephrase").value = this.responseText;
document.getElementById("txtCredential").value = this.responseText;
}
};
xhr.open("GET", "random-words.php");
@@ -82,7 +82,7 @@
<form method="POST">
<table style="margin: 18px;">
<tr><td>User Name: </td><td><input type="text" name="txtUsername" id="txtUserName"></td></tr>
<tr><td>Share Phrase: </td><td><input type="text" id="txtSharephrase" name="txtSharephrase" value="<?php include("random-words.php"); ?>">&nbsp;<img src="images/refresh.png" id="imgNewWords" style="display:none; height:20px;width:20px; vertical-align:middle" onclick="getNewWords()"></td></tr>
<tr><td>Share Phrase: </td><td><input type="text" id="txtCredential" name="txtCredential" value="<?php include("random-words.php"); ?>">&nbsp;<img src="images/refresh.png" id="imgNewWords" style="display:none; height:20px;width:20px; vertical-align:middle" onclick="getNewWords()"></td></tr>
<tr><td>Admin Password: </td><td><input type="text" id="txtPassword" name="txtPassword"></td></tr>
<?php
if (isset($config["createkey"]) && $config["createkey"] != "") {
web-share-image.php
+4 -4
View File
@@ -9,8 +9,8 @@
$username = $_GET['username'];
$credential = "";
if (isset($_POST['txtSharephrase']))
$credential = $_POST['txtSharephrase'];
if (isset($_POST['txtCredential']))
$credential = $_POST['txtCredential'];
if (isset($_COOKIE["credential"]))
$credential = $_COOKIE["credential"];
@@ -43,7 +43,7 @@
}
function togglePassword(){
var passBox = document.getElementById("txtSharephrase");
var passBox = document.getElementById("txtCredential");
if(passBox.type == "text")
passBox.type = "password";
else
@@ -109,7 +109,7 @@
</div>
<table style="margin: 18px;">
<tr><td>User Name: </td><td><input type="text" name="txtUsername" id="txtUsername" value="<?php echo $username ?>"></td></tr>
<tr><td>Share Phrase: </td><td><input type="password" id="txtSharephrase" name="txtSharephrase" value="<?php echo $credential ?>">&nbsp;<img src="images/eyeball.png" id="imgTogglePass" style="display:none;height:20px;width:20px; vertical-align:middle" onclick="togglePassword()"></td></tr>
<tr><td>Share Phrase: </td><td><input type="password" id="txtCredential" name="txtCredential" value="<?php echo $credential ?>">&nbsp;<img src="images/eyeball.png" id="imgTogglePass" style="display:none;height:20px;width:20px; vertical-align:middle" onclick="togglePassword()"></td></tr>
<tr><td>Photo: </td><td><input type="file" name="frmImage" accept="image/gif, image/jpeg, image/png" /></td></tr>
</table>
<input type="submit" value="Share">
web-share-text.php
+4 -4
View File
@@ -9,8 +9,8 @@
$username = $_GET['username'];
$credential = "";
if (isset($_POST['txtSharephrase']))
$credential = $_POST['txtSharephrase'];
if (isset($_POST['txtCredential']))
$credential = $_POST['txtCredential'];
if (isset($_COOKIE["credential"]))
$credential = $_COOKIE["credential"];
@@ -47,7 +47,7 @@
}
function togglePassword(){
var passBox = document.getElementById("txtSharephrase");
var passBox = document.getElementById("txtCredential");
if(passBox.type == "text")
passBox.type = "password";
else
@@ -110,7 +110,7 @@
</div>
<table style="margin: 18px;">
<tr><td>User Name: </td><td><input type="text" name="txtUsername" id="txtUsername" value="<?php echo $username ?>"></td></tr>
<tr><td>Share Phrase: </td><td><input type="password" id="txtSharephrase" name="txtSharephrase" value="<?php echo $credential ?>">&nbsp;<img src="images/eyeball.png" id="imgTogglePass" style="display:none;height:20px;width:20px; vertical-align:middle" onclick="togglePassword()"></td></tr>
<tr><td>Share Phrase: </td><td><input type="password" id="txtCredential" name="txtCredential" value="<?php echo $credential ?>">&nbsp;<img src="images/eyeball.png" id="imgTogglePass" style="display:none;height:20px;width:20px; vertical-align:middle" onclick="togglePassword()"></td></tr>
<tr><td>Type: </td>
<td>
<select id="optContentType" name="optContentType">
web-share-type.php
+1 -1
View File
@@ -12,7 +12,7 @@
<?php include("web-meta.php") ?>
</head>
<body class="login">
<div class="login-header"><a href="web-login.php">Login</a>&nbsp;</div>
<div class="login-header"><a href="web-login.php">Cancel</a>&nbsp;</div>
<table width="100%" height="95%" style="padding-bottom: 20px;"><tr><td width="100%" align="center" valign="middle">
<div id="container">