echelon/i2p.i2p
1
0
Fork 0
forked from I2P_Developers/i2p.i2p
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- Add password enabled property

Browse Source 
- Bypass nonce checking if passwords enabled
  - Add message about cookies if nonce fails
  - Minor susidns cleanup
This commit is contained in:
zzz
2012-10-26 13:08:23 +00:00
parent 49b2fbd2b0
commit af06fded73
9 changed files with 82 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/routerconsole/java/src/net/i2p/router/web/ConsolePasswordManager.java
View File

@ -105,11 +105,13 @@ public class ConsolePasswordManager extends RouterPasswordManager {
// consolePassword
String pw = _context.getProperty(PROP_CONSOLE_OLD);
if (pw != null) {
Map toAdd = new HashMap(2);
if (pw.length() > 0) {
saveMD5(RouterConsoleRunner.PROP_CONSOLE_PW, RouterConsoleRunner.JETTY_REALM,
CONSOLE_USER, pw);
toAdd.put(RouterConsoleRunner.PROP_PW_ENABLE, "true");
}
Map toAdd = Collections.singletonMap(PROP_MIGRATED, "true");
toAdd.put(PROP_MIGRATED, "true");
List toDel = Collections.singletonList(PROP_CONSOLE_OLD);
return _context.router().saveConfig(toAdd, toDel);
}

19
apps/routerconsole/java/src/net/i2p/router/web/FormHandler.java
View File

@ -177,17 +177,22 @@ public class FormHandler {
_valid = false;
return;
}
if (_nonce == null) {
//addFormError("You trying to mess with me? Huh? Are you?");
_valid = false;
return;
}
// To prevent actions with GET, jsps must call storeMethod()
if (_method != null && !"POST".equals(_method)) {
addFormError("Invalid form submission, requires POST not " + _method);
_valid = false;
return;
}
// If passwords are turned on, all is assumed good
if (_context.getBooleanProperty(RouterConsoleRunner.PROP_PW_ENABLE)) {
_valid = true;
return;
}
if (_nonce == null) {
//addFormError("You trying to mess with me? Huh? Are you?");
_valid = false;
return;
}
String sharedNonce = System.getProperty("router.consoleNonce");
if ( (sharedNonce != null) && (sharedNonce.equals(_nonce) ) ) {
@ -195,7 +200,9 @@ public class FormHandler {
}
if (!_nonce.equals(_nonce1) && !_nonce.equals(_nonce2)) {
addFormError(_("Invalid form submission, probably because you used the 'back' or 'reload' button on your browser. Please resubmit."));
addFormError(_("Invalid form submission, probably because you used the 'back' or 'reload' button on your browser. Please resubmit.")
+ ' ' +
_("If the problem persists, verify that you have cookies enabled in your browser."));
_valid = false;
}
}

39
apps/routerconsole/java/src/net/i2p/router/web/RouterConsoleRunner.java
View File

@ -87,6 +87,7 @@ public class RouterConsoleRunner implements RouterApp {
public static final String JETTY_REALM = "i2prouter";
private static final String JETTY_ROLE = "routerAdmin";
public static final String PROP_CONSOLE_PW = "routerconsole.auth." + JETTY_REALM;
public static final String PROP_PW_ENABLE = "routerconsole.auth.enable";
public static final String ROUTERCONSOLE = "routerconsole";
public static final String PREFIX = "webapps.";
@ -735,22 +736,28 @@ public class RouterConsoleRunner implements RouterApp {
SecurityHandler sec = new SecurityHandler();
List<ConstraintMapping> constraints = new ArrayList(4);
ConsolePasswordManager mgr = new ConsolePasswordManager(ctx);
Map<String, String> userpw = mgr.getMD5(PROP_CONSOLE_PW);
if (!userpw.isEmpty()) {
HashUserRealm realm = new HashUserRealm(JETTY_REALM);
sec.setUserRealm(realm);
sec.setAuthenticator(authenticator);
for (Map.Entry<String, String> e : userpw.entrySet()) {
String user = e.getKey();
String pw = e.getValue();
realm.put(user, MD5.__TYPE + pw);
realm.addUserToRole(user, JETTY_ROLE);
Constraint constraint = new Constraint(user, JETTY_ROLE);
constraint.setAuthenticate(true);
ConstraintMapping cm = new ConstraintMapping();
cm.setConstraint(constraint);
cm.setPathSpec("/");
constraints.add(cm);
boolean enable = ctx.getBooleanProperty(PROP_PW_ENABLE);
if (enable) {
Map<String, String> userpw = mgr.getMD5(PROP_CONSOLE_PW);
if (userpw.isEmpty()) {
enable = false;
ctx.router().saveConfig(PROP_CONSOLE_PW, "false");
} else {
HashUserRealm realm = new HashUserRealm(JETTY_REALM);
sec.setUserRealm(realm);
sec.setAuthenticator(authenticator);
for (Map.Entry<String, String> e : userpw.entrySet()) {
String user = e.getKey();
String pw = e.getValue();
realm.put(user, MD5.__TYPE + pw);
realm.addUserToRole(user, JETTY_ROLE);
Constraint constraint = new Constraint(user, JETTY_ROLE);
constraint.setAuthenticate(true);
ConstraintMapping cm = new ConstraintMapping();
cm.setConstraint(constraint);
cm.setPathSpec("/");
constraints.add(cm);
}
}
}