Changeset 615 for vendor/current/source3/web/cgi.c

Timestamp:

Jul 28, 2011, 4:21:02 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Samba 3.5: Update vendor to version 3.5.10

File:

• vendor/current/source3/web/cgi.c (modified) (5 diffs)

vendor/current/source3/web/cgi.c

@@ -20 +20 @@
 #include "includes.h"
 #include "web/swat_proto.h"
+#include "secrets.h"
+#include "../lib/util/util.h"
 
 #define MAX_VARIABLES 10000
@@ -43 +45 @@
 static char *pathinfo;
 static char *C_user;
+static char *C_pass;
 static bool inetd_server;
 static bool got_request;
@@ -321 +324 @@
         }
 
-        setuid(0);
+        C_user = SMB_STRDUP(user);
+
+        if (!setuid(0)) {
+                C_pass = secrets_fetch_generic("root", "SWAT");
+                if (C_pass == NULL) {
+                        char *tmp_pass = NULL;
+                        tmp_pass = generate_random_str(talloc_tos(), 16);
+                        if (tmp_pass == NULL) {
+                                printf("%sFailed to create random nonce for "
+                                       "SWAT session\n<br>%s\n", head, tail);
+                                exit(0);
+                        }
+                        secrets_store_generic("root", "SWAT", tmp_pass);
+                        C_pass = SMB_STRDUP(tmp_pass);
+                        TALLOC_FREE(tmp_pass);
+                }
+        }
         setuid(pwd->pw_uid);
         if (geteuid() != pwd->pw_uid || getuid() != pwd->pw_uid) {
@@ -389 +408 @@
                         /* Save the users name */
                         C_user = SMB_STRDUP(user);
+                        C_pass = SMB_STRDUP(user_pass);
                         TALLOC_FREE(pass);
                         return True;
@@ -423 +443 @@
 }
 
+/***************************************************************************
+return a ptr to the users password
+  ***************************************************************************/
+char *cgi_user_pass(void)
+{
+        return(C_pass);
+}
 
 /***************************************************************************