Fixed XSS bugs
[webmin.git] / pam_login.cgi
1 #!/usr/local/bin/perl
2 # Ask one PAM question
3
4 $pragma_no_cache = 1;
5 #$ENV{'MINISERV_INTERNAL'} || die "Can only be called by miniserv.pl";
6 require './web-lib.pl';
7 require './ui-lib.pl';
8 &init_config();
9 &ReadParse();
10 if ($gconfig{'loginbanner'} && $ENV{'HTTP_COOKIE'} !~ /banner=1/ &&
11     $in{'initial'}) {
12         # Show pre-login HTML page
13         print "Set-Cookie: banner=1; path=/\r\n";
14         &PrintHeader();
15         $url = $in{'page'};
16         open(BANNER, $gconfig{'loginbanner'});
17         while(<BANNER>) {
18                 s/LOGINURL/$url/g;
19                 print;
20                 }
21         close(BANNER);
22         return;
23         }
24 $sec = uc($ENV{'HTTPS'}) eq 'ON' ? "; secure" : "";
25 &get_miniserv_config(\%miniserv);
26 print "Set-Cookie: banner=0; path=/$sec\r\n" if ($gconfig{'loginbanner'});
27 print "Set-Cookie: testing=1; path=/$sec\r\n";
28 &ui_print_unbuffered_header(undef, undef, undef, undef, undef, 1, 1, undef,
29                             undef, "onLoad='document.forms[0].answer.focus()'");
30
31 print "<center>\n";
32 if (defined($in{'failed'})) {
33         print "<h3>$text{'session_failed'}</h3><p>\n";
34         }
35 elsif ($in{'logout'}) {
36         print "<h3>$text{'session_logout'}</h3><p>\n";
37         }
38 elsif ($in{'timed_out'}) {
39         print "<h3>",&text('session_timed_out', int($in{'timed_out'}/60)),"</h3><p>\n";
40         }
41
42 print "$text{'pam_prefix'}\n";
43 print "<form action=$gconfig{'webprefix'}/pam_login.cgi method=post>\n";
44 print "<input type=hidden name=cid value='",&quote_escape($in{'cid'}),"'>\n";
45
46 print "<table border width=40%>\n";
47 print "<tr $tb> <td><b>$text{'pam_header'}</b></td> </tr>\n";
48 print "<tr $cb> <td align=center><table cellpadding=3>\n";
49 if ($gconfig{'realname'}) {
50         $host = &get_system_hostname();
51         }
52 else {
53         $host = $ENV{'HTTP_HOST'};
54         $host =~ s/:\d+//g;
55         $host = &html_escape($host);
56         }
57
58 if ($in{'message'}) {
59         # Showing a message
60         print "<tr> <td colspan=2 align=center>",
61               &html_escape($in{'message'}),"</td> </tr>\n";
62         print "<input type=hidden name=message value=1>\n";
63         }
64 else {
65         # Asking a question
66         print "<tr> <td colspan=2 align=center>",
67               &text($gconfig{'nohostname'} ? 'pam_mesg2' : 'pam_mesg',
68                     "<tt>$host</tt>"),"</td> </tr>\n";
69
70         $pass = "type=password" if ($in{'password'});
71         print "<tr> <td><b>",&html_escape($in{'question'}),"</b></td>\n";
72         print "<td><input name=answer $pass size=20></td> </tr>\n";
73         }
74
75 print "<tr> <td colspan=2 align=center>\n";
76 print "<input type=submit value='$text{'pam_login'}'>\n";
77 print "<input type=reset value='$text{'session_clear'}'>\n";
78 if (!$in{'initial'}) {
79         print "<input type=submit name=restart value='$text{'pam_restart'}'>\n";
80         }
81 print "<br>\n";
82
83 print "</td> </tr>\n";
84 print "</table></td></tr></table><p>\n";
85 print "</form></center>\n";
86 print "$text{'pam_postfix'}\n";
87
88 # Output frame-detection Javascript, if theme uses frames
89 if ($tconfig{'inframe'}) {
90         print <<EOF;
91 <script>
92 if (window != window.top) {
93         window.top.location = window.location;
94         }
95 </script>
96 EOF
97         }
98
99 &ui_print_footer();
100