proxmox-mirrors/pve-http-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-http-server synced 2026-01-26 07:33:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

implement more reasonable ticket verification for demo server

Browse Source 
Do not pass secrets to client.
This commit is contained in:
Dietmar Maurer 2017-01-17 07:38:23 +01:00
parent c67d07fc66
commit 84df857fba
1 changed files with 22 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
simple-demo.pl
View File

@ -19,7 +19,27 @@ my $secret = Digest::MD5::md5_base64($$ . time());
sub create_ticket {
my ($username) = @_;
return "$username:$secret";
my $salt = sprintf("%08x", time());
my $data = "$username:$salt";
my $sig = Digest::MD5::md5_base64("$data:$secret");
return "$username:$salt:$sig";
}
sub verify_ticket {
my ($ticket) = @_;
die "no ticket" if !defined($ticket);
my ($userid, $salt, $rest) = split(/:/, $ticket, 3);
die "invalid ticket" if !defined($salt) || !defined($rest);
die "invalid unsername" if $userid ne 'demo';
my $sig = Digest::MD5::md5_base64("$userid:$salt:$secret");
die "invalid ticket" if $rest ne $sig;
return $userid;
}
sub auth_handler {
@ -31,12 +51,8 @@ sub auth_handler {
return; # allow call to create ticket
}
die "no ticket" if !defined($ticket);
my $userid = verify_ticket($ticket);
my ($userid, $rest) = split(/:/, $ticket, 2);
die "invalid unsername" if $userid ne 'demo';
die "invalid ticket" if $rest ne $secret;
return {
ticket => $ticket,
userid => $userid,