Rough stab at hmacing newuser.cgi

1 files changed, 36 insertions, 13 deletions

diff --git a/pinyweb/cgi-bin/newuser.cgi b/pinyweb/cgi-bin/newuser.cgi
index 90c2d59..7763f67 100755
--- a/pinyweb/cgi-bin/newuser.cgi
+++ b/pinyweb/cgi-bin/newuser.cgi
@@ -13,19 +13,42 @@ $q = CGI->new;
 
 print( "Content-type: text/plain\n\n" );
 
-if( $q->param('n') && $q->param('a') && $q->param('p') ) {
-  unless( open2( OUT, IN, '/usr/bin/sudo', '/usr/sbin/newuser', '--batch', $q->param('a'), $q->param('n') ) ) {
-    print 'could not execute newrepo';
-    die;
-  };
-  # make things flushier
-  select((select(IN), $| = 1)[0]);
-  select((select(OUT), $| = 1)[0]);
-  print( IN $q->param('p') . "\n" );
-  close( IN );
-  while( <OUT> ) {
-    print;
+if( $q->param("n") && $q->param("a") && $q->param("p") ) {
+  if ( $q->param("h") && $q->param("h") eq "REPLACE_THIS_WITH_REFERENCE_TO_HASH" ) {
+    unless( open2( OUT, IN, "/usr/bin/sudo", "/usr/sbin/newuser", "--batch", $q->param("a"), $q->param("n") ) ) {
+      print "could not execute newrepo";
+      die;
+    };
+    # make things flushier
+    select((select(IN), $| = 1)[0]);
+    select((select(OUT), $| = 1)[0]);
+    print( IN $q->param("p") . "\n" );
+    close( IN );
+    while( <OUT> ) {
+      print;
+    };
+  } else { # No hash, they need one sent to their address
+    print( "Dispatching email to " . $q->param("a") . "...\n" );
+    unless( open( MAIL, "|/usr/lib/sendmail -t" ) ) {
+      print "could not execute sendmail";
+      die;
+    };
+    print( MAIL "To: " . $q->param("a") . "\n" );
+    print( MAIL "Subject: Verifying account " . $q->param("n") . "\n" );
+    print( MAIL "Content-Type: text/plain; charset=us-ascii\n\n" );
+    print( MAIL "http" );
+    if( $ENV{"HTTPS"} eq "on" ) {
+      print( MAIL "s" );
+    };
+    print( MAIL "://" . $ENV{"SERVER_NAME"} . $ENV{"SCRIPT_NAME"} . "?" );
+    print( MAIL "h=" . "REPLACE_THIS_WITH_REFERENCE_TO_HASH" );
+    print( MAIL "&n=" . $q->param("n") );
+    print( MAIL "&a=" . $q->param("a") );
+    print( MAIL "&p=" . $q->param("p") );
+    print( MAIL "\n");
+    close( MAIL ); 
+    print( "Done!" );
   };
 } else {
-  print 'Missing parameters.';
+  print( "Missing parameters." );
 };