← Back
Editing: login-lib-funcs.pl
# login-lib-funcs.pl # Login library reusable functions use strict; use warnings; no warnings 'uninitialized'; our (%in, %gconfig, $root_directory, $config_directory, %tconfig, %theme_text); our ($miniserv, $bg, $webprefix, $textbox_attrs, $hostname); # get_secure_cookie() # Returns the secure cookie string sub get_secure_cookie { my $secook = lc(get_env('https')) eq 'on' ? "; secure" : ""; $secook .= "; httpOnly" if (!$miniserv->{'no_httponly'}); return $secook; } # get_banner_auth_headers() # Returns headers for the login banner sub get_banner_auth_headers { my $secook = get_secure_cookie(); my @headers; push(@headers, ["Set-Cookie", "banner=1; path=/$secook"]); return \@headers; } # print_banner() # Prints the login banner sub print_banner { &PrintHeader(&get_charset(), undef, get_banner_auth_headers()); print ui_tag_start('html', { 'class' => 'session_login', 'data-bgs' => $bg }); embed_login_head(); print ui_tag_start('body', { 'class' => 'session_login', $tconfig{'inbody'} => undef }); embed_overlay_prebody(); print ui_tag_start('div', { 'class' => 'form-signin-banner container session_login alert alert-danger', 'data-dcontainer' => 1 }); print ui_icon('exclamation-triangle', { 'class' => 'fa-3x' }); print ui_br(), ui_br(); my $banner = &read_file_contents($gconfig{'loginbanner'}); my $page = $gconfig{'loginpage'} || $in{'page'} || $webprefix || '/'; $page = &filter_javascript($page); $banner =~ s/LOGINURL/$page/g; print "$banner\n"; print ui_tag_end('div'); print ui_tag_end('body'); print ui_tag_end('html'); } # get_login_auth_headers() # Returns headers for the login page sub get_login_auth_headers { my $sidname = $miniserv->{'sidname'} || "sid"; my $secook = get_secure_cookie(); my @headers; push(@headers, ["Auth-type", "auth-required=1"]); push(@headers, ["Set-Cookie", "banner=0; path=/$secook"]) if ($gconfig{'loginbanner'}); push(@headers, ["Set-Cookie", "$sidname=x; path=/$secook"]) if ($in{'logout'}); push(@headers, ["Set-Cookie", "redirect=1; path=/$secook"]); push(@headers, ["Set-Cookie", "testing=1; path=/$secook"]); return \@headers; } # print_login_start($type) # Prints the start of the login page sub print_login_start { my $type = shift; my $class = 'session_login'; $class .= ' pam_login' if ($type eq 'pam'); # Print the standard header &PrintHeader(&get_charset(), undef, get_login_auth_headers()); # Print the HTML header print ui_tag_start('html', { 'class' => $class, 'data-bgs' => $bg }); embed_login_head(); print ui_tag_start('body', { 'class' => $class, $tconfig{'inbody'} => undef }); embed_overlay_prebody(); # Print the container HTML print ui_tag_start('div', { 'class' => "container $class", 'data-dcontainer' => 1 }); # Print alert if bundled SSL cert is used if (&miniserv_using_default_cert()) { print ui_alert(&text('defcert_error', ucfirst(&get_product_name()), ($ENV{'MINISERV_KEYFILE'} || $miniserv->{'keyfile'})), 'warning', undef, { 'data-defcert' => 1, 'class' => 'faa-horizontal animated' }); } # Print success on password reset if ($in{'returned'}) { # Password reset successful print ui_alert($theme_text{'session_pwdsucc'}, 'success', ['fa-unlock', $theme_text{'login_success'}], { 'class' => 'faa-bounce animated' }); } # Print alert on failed login elsif ($in{'failed'}) { # Two-factor authentication failed if ($in{'twofactor_msg'}) { print ui_alert(&theme_text('session_twofailed', $in{'twofactor_msg'}), 'warning', undef, { 'data-twofactor' => 1, 'class' => 'faa-horizontal animated' }); } # Login failed else { print ui_alert($theme_text{'theme_xhred_session_failed'}, 'warning', undef, { 'class' => 'faa-horizontal animated' }); } } # Print alert on logout elsif ($in{'logout'}) { print ui_alert($theme_text{'session_logout'}, 'success', ['fa-sign-out', $theme_text{'login_success'}], { 'class' => 'faa-bounce animated' }); } # Print alert on session timeout elsif ($in{'timed_out'}) { print ui_alert(&theme_text('session_timed_out', int($in{'timed_out'} / 60)), 'warning', ['fa-clock'], { 'class' => 'faa-horizontal animated' }); } } # print_login_end() # Prints the end of the login page sub print_login_end { print ui_tag_end('div'); # flipper end print ui_tag_end('div'); # wrapper end print ui_tag_end('form'); # form end print ui_tag_end('div'); # main container end print ui_tag_end('body'); print ui_tag_end('html'); } # print_login_prefix(content) # Prints the login MOTD prefix without changing legacy postfix behavior. sub print_login_prefix { my $content = shift; return if (!defined($content) || $content !~ /\S/); if ($content =~ "href") { print_login_postfix($content); } else { print ui_alert(" ".$content, 'info', ['fa2 fa2-message', '', 1], { 'class' => 'login-prefix-alert' }); } } # print_login_postfix(type) # Prints the legacy raw/link post-login element. If the type is "href", it will # print a properly formatted link to the login page. sub print_login_postfix { my $type = shift; if ($type =~ "href") { my $link = get_link($type, 'ugly'); print ui_link_icon($link->[0], $link->[1], "unlock", { class => 'warning', target => "_blank" }); } else { print "$type\n"; } } # print_login_http_warning() # Prints a warning if the connection is not secure sub print_login_http_warning { return unless ($miniserv->{'ssl'}); # If the connection is not secure, print a warning if (lc(get_env('https')) ne 'on') { my $animated_class = 'faa faa-flash faa-slow animated'; my $icon = ui_icon('exclamation-triangle', { 'class' => $animated_class }); my $label = ui_tag('span', $theme_text{'login_notsecure'}, { 'class' => $animated_class }); my $link = ui_tag('a', "$icon $label", { 'href' => "javascript:void(0);", 'class' => 'inherit-color', 'onclick' => "window.location.href = ". "window.location.href.replace(/^http:/, 'https:'); return false;", }); print ui_tag('div', $link, { 'class' => 'badge badge-danger https-badge', 'data-tooltip' => 1, 'aria-label' => $theme_text{'login_notsecure_desc'} }); } } # print_login_logo() # Prints the Webmin logo and title sub print_login_logo { # Default icon and title my $product_name = &get_product_name(); local $root_directory = $root_directory; local $config_directory = $config_directory; # If request came from Usermin, use its branding instead if ($in{'return'}) { $product_name = "usermin"; $root_directory =~ s|/webmin|/usermin|; $config_directory =~ s|/webmin|/usermin|; } my %def_brand = ( file => "$root_directory/images/brand_$product_name.svg", title => $product_name eq "usermin" ? $theme_text{'theme_xhred_titles_um'} : $theme_text{'theme_xhred_titles_wm'} ); my %brand = %def_brand; # Read brand info from file if it exists my $brand_info = "$config_directory/brand.info"; if (-f $brand_info) { my %mod_brand; &read_file($brand_info, \%mod_brand); # If enabled, use the brand file if ($mod_brand{'enabled'}) { %brand = %mod_brand; # If brand file defined but doesn't exist use default if (defined($brand{'file'}) && !-f $brand{'file'}) { %brand = %def_brand; } } } # Print either logo from file or icon my $brand_file = $brand{'file'} && -r $brand{'file'} ? $brand{'file'} : undef; my $title = $brand_file ? undef : " ". $brand{'title'} // $theme_text{'theme_xhred_titles_wm'}; my $mime; $mime = &guess_mime_type($brand_file) if ($brand_file); if ($mime && $mime =~ /^image\//) { my $image = &read_file_contents($brand_file); $image =~ s/[\r\n\t ]+/ /g; print ui_tag('img', undef, { 'src' => "data:$mime;base64,".&encode_base64($image), 'alt' => $brand{'title'}, 'class' => 'img-title' }); } else { print ui_tag('i', undef, { 'class' => $brand{'icon'} // 'wbm-webmin' }); } # Print the product title print ui_tag('h2', ui_tag('span', $title), { 'class' => 'form-signin-heading' } ); } # login_username_filter(&in) # Filters the username returned by the server sub login_username_filter { my ($in) = @_; my $username = $in->{'failed'}; decode_utf8_ref(\$username); $username = ($username =~ /^[\p{L}\p{N}\@\_\.\-]+$/) ? $username : undef; $in->{'failed'} = $username; } # login_valid_miniserv_return_port(port) # Returns true if a miniserv return URL port is valid sub login_valid_miniserv_return_port { my $port = shift; return defined($port) && $port =~ /^\d+$/ && $port > 0 && $port <= 65535; } # login_miniserv_return_port_from_address(value) # Extracts a port from a miniserv socket/address value sub login_miniserv_return_port_from_address { my ($value) = @_; return undef if (!defined($value) || $value eq ''); return $1 if ($value =~ /^(\d+)$/); return $1 if ($value =~ /^\[[^\]]+\]:(\d+)$/); return $1 if ($value =~ /^[^:]+:(\d+)$/); return undef; } # login_miniserv_return_ports(&miniserv-config) # Extracts configured miniserv listener ports sub login_miniserv_return_ports { my $miniserv = shift; my (%seen, @ports); foreach my $port ($miniserv->{'port'}, $miniserv->{'listen'}) { if (&login_valid_miniserv_return_port($port) && !$seen{$port}++) { push(@ports, $port); } } foreach my $sock (split(/\s+/, $miniserv->{'sockets'} || '')) { my $port = &login_miniserv_return_port_from_address($sock); if (&login_valid_miniserv_return_port($port) && !$seen{$port}++) { push(@ports, $port); } } return @ports; } # login_valid_return_hostname(host) # Returns true if an ASCII/punycode return URL hostname has valid labels sub login_valid_return_hostname { my ($host) = @_; return 0 if (!defined($host) || $host eq '' || $host =~ /\.\./); foreach my $label (split(/\./, $host, -1)) { return 0 if ($label eq '' || length($label) > 63); return 0 if ($label !~ /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/); } return 1; } # login_normalize_return_host(host, [allow-wildcards]) # Normalizes a hostname from a URL or miniserv SNI key sub login_normalize_return_host { my ($host, $wildcards) = @_; return undef if (!defined($host)); $host =~ s/^\s+|\s+$//g; $host =~ s/^\[//; $host =~ s/\]$//; $host =~ s/\.$//; $host = lc($host); return undef if ($host eq '' || $host =~ /[\x00-\x20\x7f\/\\\@]/); if ($wildcards && $host =~ s/^\*\.//) { return undef if (!&login_valid_return_hostname($host)); return "*.$host"; } return $host if (&login_valid_return_hostname($host)); return $host if ($host =~ /^[a-f0-9:]+$/ && $host =~ /:/); return undef; } # login_miniserv_return_hosts(&miniserv-config) # Extracts trusted return hostnames from miniserv SNI configuration sub login_miniserv_return_hosts { my $miniserv = shift; my @hosts; foreach my $key (keys(%$miniserv)) { next if ($key !~ /^ipkey_(.+)$/); push(@hosts, split(/\s*,\s*/, $1)); } push(@hosts, $miniserv->{'musthost'}) if ($miniserv->{'musthost'}); my $system_host = eval { &get_system_hostname() }; push(@hosts, $system_host) if ($system_host); return @hosts; } # login_add_return_service(&services, ssl, &ports, &hosts) # Adds an allowed return URL service definition sub login_add_return_service { my ($services, $ssl, $ports, $hosts) = @_; my (%ports, %hosts, @wildcards); foreach my $port (@$ports) { $ports{$port} = 1 if (&login_valid_miniserv_return_port($port)); } foreach my $host (@$hosts) { my $norm = &login_normalize_return_host($host, 1); next if (!$norm); if ($norm =~ /^\*\.(.+)$/) { push(@wildcards, $1); } else { $hosts{$norm} = 1; } } return if (!%ports || (!%hosts && !@wildcards)); push(@$services, { 'ssl' => $ssl ? 1 : 0, 'ports' => \%ports, 'hosts' => \%hosts, 'wildcards' => \@wildcards, }); } # login_add_miniserv_return_service(&services, &miniserv-config) # Adds return URLs for a miniserv service sub login_add_miniserv_return_service { my ($services, $miniserv) = @_; my @ports = &login_miniserv_return_ports($miniserv); my @hosts = &login_miniserv_return_hosts($miniserv); &login_add_return_service($services, $miniserv->{'ssl'}, \@ports, \@hosts); } # login_add_url_return_service(&services, url) # Adds return URL service from an explicitly configured URL sub login_add_url_return_service { my ($services, $url) = @_; return if (!$url); my ($host, $port, undef, $ssl) = eval { &parse_http_url($url, undef, undef, undef, undef, undef, undef, 1) }; return if ($@ || !$host || !defined($ssl) || $ssl == 2); $port ||= $ssl ? 443 : 80; &login_add_return_service($services, $ssl, [ $port ], [ $host ]); } # login_trusted_return_services([base-url]) # Returns trusted Webmin/Usermin return URL services sub login_trusted_return_services { my $baseurl = shift; my @services; my @webmin_hosts; my %miniserv; if (&get_miniserv_config(\%miniserv)) { @webmin_hosts = &login_miniserv_return_hosts(\%miniserv); &login_add_miniserv_return_service(\@services, \%miniserv); } &login_add_url_return_service(\@services, $baseurl); &login_add_url_return_service(\@services, eval { &get_webmin_email_url() }); if (&foreign_check("usermin")) { eval { no warnings 'once'; local $main::error_must_die = 1; &foreign_require("usermin"); my %uminiserv; &usermin::get_usermin_miniserv_config(\%uminiserv); if (%uminiserv) { &login_add_miniserv_return_service(\@services, \%uminiserv); my @uports = &login_miniserv_return_ports(\%uminiserv); &login_add_return_service(\@services, $uminiserv{'ssl'}, \@uports, \@webmin_hosts); &login_add_url_return_service(\@services, $uminiserv{'redirect_url'}); } &login_add_url_return_service(\@services, &usermin::get_usermin_email_url()); }; } return @services; } # login_return_host_allowed(host, &service) # Returns true if the hostname matches a trusted return URL service sub login_return_host_allowed { my ($host, $service) = @_; return 1 if ($service->{'hosts'}->{$host}); foreach my $suffix (@{$service->{'wildcards'}}) { return 1 if ($host =~ /^[^.]+\.\Q$suffix\E$/); } return 0; } # login_validate_forgot_return_url(return, [base-url]) # Validates password-reset return URLs sub login_validate_forgot_return_url { my ($return, $baseurl) = @_; return undef if (!defined($return)); $return =~ s/^\s+|\s+$//g; return undef if ($return eq '' || $return =~ /[\x00-\x1f\x7f\\]/); if ($return =~ m{^/}) { return undef if ($return =~ m{^//}); return $return; } return undef if ($return !~ m{^https?://}i || $return =~ m{^https?://[^/]*\@}i); my ($host, $port, undef, $ssl) = eval { &parse_http_url($return, undef, undef, undef, undef, undef, undef, 1) }; return undef if ($@ || !$host || !defined($ssl) || $ssl == 2); $port ||= $ssl ? 443 : 80; return undef if (!&login_valid_miniserv_return_port($port)); $host = &login_normalize_return_host($host); return undef if (!$host); foreach my $service (&login_trusted_return_services($baseurl)) { next if ($service->{'ssl'} != ($ssl ? 1 : 0)); next if (!$service->{'ports'}->{$port}); return $return if (&login_return_host_allowed($host, $service)); } return undef; } # login_return_filter(&in) # Filters password-reset return URLs before they reach the browser sub login_return_filter { my ($in) = @_; my $return = $in->{'return'}; if (defined($return)) { $return =~ s/^\s+|\s+$//g; $return = &login_validate_forgot_return_url($return); } $in->{'return'} = $return; } # login_params_populate(&in) # Populates the input data not passed back by the server sub login_params_populate { my ($in) = @_; if ($gconfig{'forgot_pass'} && !$in->{'failed'}) { my $request_uri_u = &un_urlize(get_env('request_uri')); ($in->{'forgot'}) = $request_uri_u =~ /[?&]forgot=([A-Fa-f0-9]+)/; ($in->{'username'}) = $request_uri_u =~ /[?&]username=([\p{L}\p{N}\@\_\.\-]+)/ if ($in->{'forgot'}); ($in->{'return'}) = $request_uri_u =~ /[?&]return=([^&]+)/; ($in->{'returned'}) = $request_uri_u =~ /[?&]returned-username=([^&#]*)/; &login_return_filter($in); } } # print_login_container() # Prints the login container sub print_login_container { # Print login container wrapper print ui_tag_start('div', { 'class' => 'session_login_wrapper' }); print ui_tag_start('div', { 'class' => "session_login_flipper". ($in{'forgot'} ? ' flipped forgot no-transition' : '') }); # Front side print ui_tag_start('div', { 'class' => 'session_login_front' }); } # print_password_reset() # Prints the password reset inputs sub print_password_reset { # Can reset password and failed or forgot if ($gconfig{'forgot_pass'}) { # Back side my $extra_attrs = $in{'username'} ? { 'data-username' => $in{'username'}, 'data-forgot' => $in{'forgot'} } : {}; print ui_tag_start('div', { 'class' => 'session_login_back forgot', %{$extra_attrs} }); if($in{'forgot'}) { print ui_tag_start('p', { 'class' => 'form-signin-paragraph' }); print ui_tag_content( &theme_text('reset_message', &html_escape($in{'username'}))); print ui_tag('strong', &html_escape($hostname)); print ui_tag_end('p'); print ui_tag_start('div', { 'class' => 'input-group form-group' }); print &ui_password("newpass", undef, 20, 0, undef, "@{[$textbox_attrs->('off')]} autofocus ". "data-return='"."e_escape($in{'return'}, "'")."' ". "placeholder='$theme_text{'session_resetpass1'}'", 'session_login', 1); print ui_tag_start('span', { 'class' => 'input-group-addon' }); print ui_icon('fa2-account-key'); print ui_tag_end('span'); print ui_tag_end('div'); print ui_tag_start('div', { 'class' => 'input-group form-group' }); print &ui_password("newpass2", undef, 20, 0, undef, "@{[$textbox_attrs->('off')]} ". "placeholder='$theme_text{'session_resetpass2'}'", 'session_login', 1); print ui_tag_start('span', { 'class' => 'input-group-addon' }); print ui_icon('key-plus'); print ui_tag_end('span'); print ui_tag_end('div'); print ui_tag_start('div', { 'class' => 'form-group form-signin-group' }); print ui_button_icon( $theme_text{'theme_left_mail_change_password'}, "unlock", { class => "warning", 'data-unlocker' => undef }); print ui_button_icon( $theme_text{'theme_xhred_global_cancel'}, "fa2-back-in-time", { 'data-flipper' => undef }); print ui_tag_end('div'); print ui_tag_end('div'); # back side end } else { print ui_tag_start('p', { 'class' => 'form-signin-paragraph' }); print ui_tag_content($theme_text{'lost_message'}); print ui_tag_end('p'); print ui_tag_start('div', { 'class' => 'input-group form-group' }); print &ui_textbox("forgot", $in{'failed'}, 20, 0, undef, "@{[$textbox_attrs->()]} ". "data-return='"."e_escape($in{'return'}, "'")."' ". "placeholder='$theme_text{'theme_xhred_login_user'}'", "session_login", 1); print ui_tag_start('span', { 'class' => 'input-group-addon' }); print ui_icon('user-o'); print ui_tag_end('span'); print ui_tag_end('div'); print ui_tag_start('div', { 'class' => 'form-group form-signin-group' }); print ui_button_icon( $theme_text{'login_recover'}, "fa2-email", { class => "success", type => 'submit' }); print ui_button_icon( $theme_text{'login_back'}, "undo", { 'data-flipper' => undef }); print ui_tag_end('div'); } print ui_tag_end('div'); # back side end } } 1;
Save File
Cancel