Paj's Home
About Me
Cryptography
RSA
JavaScript MD5
md4.js
md5.js
sha1.js
Authentication
md5auth.cgi
Vigenere Cipher
Word Patterns
Programming
Site Info

Guest Book
E-Mail Me

md5auth.cgi

This file is slightly unusual. It is actually called md5auth.cgi.pip and is put through Pipp to produce md5auth.cgi. This process interprets the #include and similar commands towards the bottom of the file, hard coding the HTML headers, site map, etc. into the resulting Perl script. The script uses cgi-lib to access the form details, and the Perl MD5 module to check the hash.

#!/usr/bin/perl
use MD5;

#-----------------------------------------------------------------------------#
# Configuration
#-----------------------------------------------------------------------------#
$passwd = "secret";
if($^O eq "MSWin32")
{
  $msg_file = "e:/webdata/md5_msg";
  $log_file = "e:/webdata/md5_msglog";
}
else
{
  $msg_file = "data/md5_msg";
  $log_file = "data/md5_msglog";
}

#-----------------------------------------------------------------------------#
# Use the cgi-lib.pl libarary to make all CGI parameters available in an
# associative array
#-----------------------------------------------------------------------------#
require 'cgi-lib.pl';
ReadParse(*cgi_parm);

#-----------------------------------------------------------------------------#
# If the msg parameter was passed, then this is a request to update the
# message, not just to view it.
#-----------------------------------------------------------------------------#
if(defined($cgi_parm{'msg'}))
{
  #---------------------------------------------------------------------------#
  # If the password field matches the hash, allow but issue warning
  #---------------------------------------------------------------------------#
  if($cgi_parm{'password'} eq $passwd)
  {
    $stat_warn = "(WARNING: Password was transmitted unencrypted)";
  }
  else
  {
    #-------------------------------------------------------------------------#
    # Calculate what the hash should be, with the correct password
    #-------------------------------------------------------------------------#
    $hash_str = $cgi_parm{'msg'} . $cgi_parm{'timestamp'} . $passwd;
    $hash = MD5->hexhash($hash_str);

    #-------------------------------------------------------------------------#
    # If this doesn't match what the user sent as a hash, then the password
    # was wrong
    #-------------------------------------------------------------------------#
    if ($hash ne $cgi_parm{'password'})
    {
      $status = "Bad password, or data corrupted during transmission";
      goto UPDATE_ERROR;
    }

    #-------------------------------------------------------------------------#
    # Check the timestamp is in range
    #-------------------------------------------------------------------------#
    $cur_time = time;
    if( ($cgi_parm{'timestamp'} > $cur_time) ||
        ($cgi_parm{'timestamp'} < ($cur_time - 300)) )
    {
      $status = "Time stamp invalid";
      goto UPDATE_ERROR;
    }
  }

  #---------------------------------------------------------------------------#
  # Open message file for writing
  #---------------------------------------------------------------------------#
  if(!open(MSG, ">$msg_file"))
  {
    $status = "Server error - update rejected";
    goto UPDATE_ERROR;
  }
  for($cgi_parm{'msg'})
  {
    s/</&lt;/g;
    s/>/&gt;/g;
    s/\n/ /g;
    s/\r//g;
  }
  print MSG $cgi_parm{'msg'};
  close(MSG);

  #---------------------------------------------------------------------------#
  # Log the change
  #---------------------------------------------------------------------------#
  if(open(LOG, ">>$log_file"))
  {
    print LOG $cgi_parm{'msg'}."\n";
    close(LOG);
  }

  #---------------------------------------------------------------------------#
  # Set status message to "accepted" before we reunite with error path
  #---------------------------------------------------------------------------#
  $status = "Message update accepted";
UPDATE_ERROR:
}
else
{
  #---------------------------------------------------------------------------#
  # Suitible status message for just viewing the message/page
  #---------------------------------------------------------------------------#
  $status = "Please try changing the message";
}

#-----------------------------------------------------------------------------#
# Read in the user defined message
#-----------------------------------------------------------------------------#
if(!open(MSG, "<$msg_file"))
{
  $msg = "Server error - can't access message";
}
else
{
  $msg = <MSG>;
  close(MSG);
}

#-----------------------------------------------------------------------------#
# Output CGI header, and paj.ph header
#-----------------------------------------------------------------------------#
print "Content-type: text/html\n\n";
print <<'EOM';
#define %TITLE% Authentication
#define %CGI%
#include <paj.ph>
EOM

#-----------------------------------------------------------------------------#
# Text of the page, note EOM is double quoted this time
#-----------------------------------------------------------------------------#
$timestamp = time;
print <<"EOM";
#include "../crypt/md5/auth.pip"
EOM

#-----------------------------------------------------------------------------#
# Take special care with the footer, as it must come before EOM
#-----------------------------------------------------------------------------#
print <<'EOM';
%PIPP_FOOTER%
#undef %PIPP_FOOTER%
EOM

© Copyright 1998 - 2001 Paul Johnston   Disclaimer   Updated: 8 Apr 2001   Built: 8 Apr 2001