diff options
| -rwxr-xr-x | pinyweb/cgi-bin/newuser.cgi | 36 |
1 files changed, 20 insertions, 16 deletions
diff --git a/pinyweb/cgi-bin/newuser.cgi b/pinyweb/cgi-bin/newuser.cgi index 0fad219..98db83e 100755 --- a/pinyweb/cgi-bin/newuser.cgi +++ b/pinyweb/cgi-bin/newuser.cgi @@ -34,18 +34,22 @@ if( $q->param("n") && $q->param("a") && $q->param("p") ) { $pass = encode_base32( $cipher->encrypt( $pass ) ); }; - if ( $q->param("h") && $q->param("h") eq $code ) { - unless( open2( OUT, IN, "/usr/bin/sudo", "/usr/sbin/newuser", "--batch", $q->param("a"), $q->param("n") ) ) { - print "could not execute newrepo"; - die; - }; - # make things flushier - select((select(IN), $| = 1)[0]); - select((select(OUT), $| = 1)[0]); - print( IN $pass . "\n" ); - close( IN ); - while( <OUT> ) { - print; + if ( $q->param("h") ) { + if ( $q->param("h") eq $code ) { + unless( open2( OUT, IN, "/usr/bin/sudo", "/usr/sbin/newuser", "--batch", $q->param("a"), $q->param("n") ) ) { + print "could not execute newrepo"; + die; + }; + # make things flushier + select((select(IN), $| = 1)[0]); + select((select(OUT), $| = 1)[0]); + print( IN $pass . "\n" ); + close( IN ); + while( <OUT> ) { + print; + }; + } else { # Invalid hash + print( "I'm sorry, the link you followed is invalid.\n" ); }; } else { # No hash, they need one sent to their address print( "Dispatching email to " . $q->param("a") . "...\n" ); @@ -61,10 +65,10 @@ if( $q->param("n") && $q->param("a") && $q->param("p") ) { print( MAIL "s" ); }; print( MAIL "://" . $ENV{"SERVER_NAME"} . $ENV{"SCRIPT_NAME"} . "?" ); - print( MAIL "h=" . $code ); - print( MAIL "&n=" . $q->param("n") ); - print( MAIL "&a=" . $q->param("a") ); - print( MAIL "&p=" . $pass ); + print( MAIL "h=" . CGI::escape( $code ) ); + print( MAIL "&n=" . CGI::escape( $q->param("n") ) ); + print( MAIL "&a=" . CGI::escape( $q->param("a") ) ); + print( MAIL "&p=" . CGI::escape( $pass ) ); print( MAIL "\n"); close( MAIL ); print( "Done!" ); |