unset($_COOKIE[$DARWINCOOKIENAME]);
$cookieexpire = 1;
if (isset($_SERVER['HTTP_HOST'])) {
$host = $_SERVER['HTTP_HOST'];
$secure = $host != 'localhost';
if (!$secure) {
$host = NULL;
}
} else {
$host = 'darwin.bournemouth.ac.uk';
$secure = TRUE;
}
// Actually unset the cookie
setrawcookie($DARWINCOOKIENAME, '', $cookieexpire, '/', $host, $secure);
if (isset($authtoken)) {
$db = getAuthDb();
$requestip = $_SERVER["REMOTE_ADDR"];
$stmt = checkPrepare($db, 'DELETE FROM `tokens` WHERE `ip`=? AND `token`=?');
checkBindParam($db, $stmt, "ss", $requestip, $authtoken);
checkExecute($db, $stmt);
$stmt->close();
$db->commit();
cleanTokens($db);
$db->close();
}
// Whatever happens set the user for the rest of the page to null.
setDarwinUser(NULL);
if (isset($_REQUEST['redirect'])) {
header('Location: ' . $_REQUEST['redirect']);
exit;
// Finished
<?php
error_reporting(E_ALL);
ini_set('display_errors', 'On');
require_once '../lib/common.php';
require_once '../lib/authadmin.php';
$AUTHONLY = !isset($_POST["pubkey"]);
if (!(isset($_POST["username"]) && isset($_POST["password"]))) {
handleError("insufficient credentials", 403, "Forbidden");
}
$USERNAME = $_POST["username"];
$PASSWORD = $_POST["password"];
$DB = getAuthDb();
if ($DB === NULL) {
handleError("Database connection error", 500);
}
$DB->autocommit(FALSE);
if (verifyCredentials($DB, $USERNAME, $PASSWORD) !== True) {
handleError("Invalid credentials", 403, "Forbidden");
exit;
// Exit just for certainty. HandleError should have exited already.
}
if ($AUTHONLY) {
header("HTTP/1.1 200 Created");
header("Content-type: text/plain");
print "authenticated {$USERNAME}\n";
exit;
}
// Now we are authenticated. Now add the key
if (isset($_POST["id"])) {
$REQUESTKEYID = $_POST["id"];
exit;
}
if (isset($HEADERS["Accept"])) {
$accept = $HEADERS["Accept"];
} else {
$accept = "";
}
if (strpos($accept, "text/html") === False) {
$htmloutput = false;
header("Content-type: text/plain");
} else {
$htmloutput = true;
}
$MAXTOKENLIFETIME = 86400;
// Tokens remain valid for one day on the client side (becomes invalid after half hour of inactivity on the server)
if ($db = getAuthDb()) {
$authtoken = getauthtoken($db, $_REQUEST['newuser'], $_SERVER["REMOTE_ADDR"]);
$cookieexpire = time() + $MAXTOKENLIFETIME;
if (isset($_SERVER['HTTP_HOST'])) {
$host = $_SERVER['HTTP_HOST'];
$secure = $host != 'localhost';
if (!$secure) {
$host = NULL;
}
} else {
$host = 'darwin.bournemouth.ac.uk';
$secure = TRUE;
}
setrawcookie($DARWINCOOKIENAME, $authtoken, $cookieexpire, '/', $host, $secure);
error_log(__FILE__ . ": Cookie set.");
if (isset($_REQUEST['redirect'])) {
/**
* @param int $keyid
* @param string $response
*/
function handleresponse($keyid, $response)
{
global $DARWINCOOKIENAME;
global $MAXTOKENLIFETIME;
if (($db = getAuthDb()) === NULL) {
handleError("Database connection error", 500);
}
$db->autocommit(FALSE);
cleanChallenges($db);
$stmt = $db->prepare('SELECT `challenge`, `requestip` FROM `challenges` WHERE `keyid`=?');
$stmt->bind_param("i", $keyid);
$stmt->bind_result($challenge, $challengeip);
if (!$stmt->execute()) {
handleError($db->error);
}
if ($stmt->fetch() !== TRUE || $challengeip != $_SERVER["REMOTE_ADDR"]) {
handleError("Invalid challenge", 403, "Not authorized");
}
$stmt->close();
$stmt = $db->prepare('SELECT `user`, `privkey` FROM `pubkeys` WHERE `keyid`=?');
$stmt->bind_param("i", $keyid);
$stmt->bind_result($user, $pubkey);
$stmt->execute();
if ($stmt->fetch() === TRUE) {
$stmt->close();
$decryptresponse = rsadecrypt($response, $pubkey);
if ($decryptresponse !== $challenge) {
handleError("Invalid response", 403, "Not Authorized");
// } else {
// print("Challenge successfully decrypted: $decryptresponse\n");
}
$db->commit();
$authtoken = getauthtoken($db, $user, $challengeip, $keyid);
header("HTTP/1.1 200 Success");
$cookieexpire = time() + $MAXTOKENLIFETIME;
setrawcookie($DARWINCOOKIENAME, $authtoken, $cookieexpire, '/', 'darwin.bournemouth.ac.uk', TRUE);
print $authtoken;
} else {
$stmt->close();
handleError("key not found: \"{$decryptresponse}\"", 403, "Not Authorized");
}
$db->close();
}
