Diffstat (limited to 'filters/simple-authentication.lua')
| -rw-r--r-- | filters/simple-authentication.lua | 34 |
1 files changed, 13 insertions, 21 deletions
diff --git a/filters/simple-authentication.lua b/filters/simple-authentication.lua index de34d09..cc86b7e 100644 --- a/filters/simple-authentication.lua +++ b/filters/simple-authentication.lua @@ -46,7 +46,7 @@ local secret = "BE SURE TO CUSTOMIZE THIS STRING TO SOMETHING BIG AND RANDOM" -- Sets HTTP cookie headers based on post and sets up redirection. function authenticate_post() local password = users[post["username"]] - local redirect = validate_value("redirect", post["redirect"]) + local redirect = validate_value(post["redirect"]) if redirect == nil then not_found() @@ -60,7 +60,7 @@ function authenticate_post() set_cookie("cgitauth", "") else -- One week expiration time - local username = secure_value("username", post["username"], os.time() + 604800) + local username = secure_value(post["username"], os.time() + 604800) set_cookie("cgitauth", username) end @@ -77,7 +77,7 @@ function authenticate_cookie() return 1 end - local username = validate_value("username", get_cookie(http["cookie"], "cgitauth")) + local username = validate_value(get_cookie(http["cookie"], "cgitauth")) if username == nil or not accepted_users[username:lower()] then return 0 else @@ -92,7 +92,7 @@ function body() html_attr(cgit["login"]) html("'>") html("<input type='hidden' name='redirect' value='") - html_attr(secure_value("redirect", cgit["url"], 0)) + html_attr(secure_value(cgit["url"], 0)) html("' />") html("<table>") html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>") @@ -194,10 +194,9 @@ end local crypto = require("crypto") -- Returns value of cookie if cookie is valid. Otherwise returns nil. -function validate_value(expected_field, cookie) +function validate_value(cookie) local i = 0 local value = "" - local field = "" local expiration = 0 local salt = "" local hmac = "" @@ -208,17 +207,15 @@ function validate_value(expected_field, cookie) for component in string.gmatch(cookie, "[^|]+") do if i == 0 then - field = component - elseif i == 1 then value = component - elseif i == 2 then + elseif i == 1 then expiration = tonumber(component) if expiration == nil then - expiration = -1 + expiration = 0 end - elseif i == 3 then + elseif i == 2 then salt = component - elseif i == 4 then + elseif i == 3 then hmac = component else break @@ -231,22 +228,18 @@ function validate_value(expected_field, cookie) end -- Lua hashes strings, so these comparisons are time invariant. - if hmac ~= crypto.hmac.digest("sha1", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then - return nil - end - - if expiration == -1 or (expiration ~= 0 and expiration <= os.time()) then + if hmac ~= crypto.hmac.digest("sha1", value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then return nil end - if url_decode(field) ~= expected_field then + if expiration ~= 0 and expiration <= os.time() then return nil end return url_decode(value) end -function secure_value(field, value, expiration) +function secure_value(value, expiration) if value == nil or value:len() <= 0 then return "" end @@ -254,8 +247,7 @@ function secure_value(field, value, expiration) local authstr = "" local salt = crypto.hex(crypto.rand.bytes(16)) value = url_encode(value) - field = url_encode(field) - authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt + authstr = value .. "|" .. tostring(expiration) .. "|" .. salt authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret) return authstr end |