#!/usr/bin/perl
# -*- perl -*-
#
#  Copyright (C) 1996 DJ Delorie <dj@delorie.com> All rights reserved
#
#  Permission is granted to copy, use, and distribute this program
#  provided it is not modified in any way.
#
#  http://www.delorie.com/bin/pwmgr/
#

if ($ARGV[0] eq "-printme") {
    print "Content-type: text/plain\n\n";
    open(ME, $0);
    print while <ME>;
    close(ME);
    exit 0;
}

print "Content-type: text/html\n\n";

print "<title>Delorie Password Manager</title>\n";
print "<h1 align=center>Delorie Password Manager</h1>\n";

&ReadParse;
$userdir = $ENV{"PATH_TRANSLATED"};
$userdir =~ s@[^/]+$@@;
$userwdir = $ENV{"PATH_INFO"};
$userwdir =~ s@[^/]+$@@;

$secure = 1;

$me = $ENV{"REQUEST_URI"};

open(CONF, $ENV{"PATH_TRANSLATED"});
while (<CONF>) {
    ($cmd,$val) = split(' ');

    if ($cmd eq "file") {
	$file = $val;
	$file = $userdir.$file unless $file =~ m@^/@;
	$wfile = $val;
	$wfile = $userwdir.$wfile unless $wfile =~ m@^/@;

    } elsif ($cmd eq "admin") {
	$admin{$val} = 1;

    } elsif ($cmd eq "unsecure") {
	$secure = 0;
    }
}

&trailer("No <tt>file</tt> entry") unless $file;
#&trailer("No valid file <tt>file</tt> found") unless -f $file && -w $file;

@admins = sort keys %admin;
$admins = $#admins + 1;

print "<pre>";
if (!$secure || $admin{$user}) {
    print "Password file is $wfile\n";
    print "Secure mode\n" if $secure;

    if ($admins == 0) {
	print "No admins are listed.\n";
    } elsif ($admins == 1) {
	print "Admin is ", join(', ', sort keys %admin), "\n";
    } else {
	print "Admins are ", join(', ', sort keys %admin), "\n";
    }
}

$user = $ENV{"REMOTE_USER"};

open(PW, $file);
while (<PW>) {
    if (/:/) {
	s/[\r\n]+$//;
	($u,$p) = split(':');
	$users{$u} = $p;
    }
}
close(PW);

if ($user) {
    print "You are $user\n";
    printf "You are an administrator.\n" if $admin{$user};
    print "</pre>\n";

    if (!$admin{$user}) {
	$p1 = $in{'pw1'};
	$p2 = $in{'pw2'};
	if ($p1 && $p2) {
	    if ($p1 eq $p2) {
		&validate_oldpw($user, $in{'opw'});
		$in{'user'} = $user;
		$in{'password'} = $p1;
		&do_add();
	    }
	    &trailer("Passwords do not match");
	}
	if ($p1 || $p2) {
	    &trailer("You must enter your new password twice");
	}
	print "<pre>";
	print "<form method=POST action=\"$me\">\n";
	print "Old Password: <input name=opw>\n";
	print "New Password: <input name=pw1>\n";
	print "       Again: <input name=pw2>\n";
	print "              <input type=submit value=\"Change\">\n";
	print "</form></pre>\n";

	&trailer();
    }

} else {
    print "</pre>\n";
    if ($secure) {
	&trailer("Sorry, you must authenticate first.");
    }
    print "<p><strong>Warning: Running in unprotected mode!  Give\n";
    print "yourself an account and password and install your .htaccess\n";
    print "file!</strong></p>\n";
}

@users = sort keys %users;

&do_add if $in{'cmd'} eq "add";
&do_del if $in{'cmd'} eq "del";

print "<pre>";
print "<form method=POST action=\"$me?cmd=add\">\n";
print "<b>Add a user (or reset an existing user's password)</b>\n";
print "    User: <input name=user>\n";
print "Password: <input name=password>";
print "  <input type=submit value=\"Add or Update\"></form>\n";

if ($#users >= 0) {
    print "<form method=POST action=\"$me?cmd=del\">\n";
    print "<b>Delete a user</b>\n";
    print "    User: <input name=user>";
    print "  <input type=submit value=\"Delete\"></form>\n";

    print "<p><b>List of Users</b></p>\n";
    print join(' ', sort keys %users);
}

print "</pre>";

&trailer("");

#############################################################################

sub do_add {

    if ($in{'user'} =~ /[:\s,]/) {
	&trailer("User names may not have spaces, tabs, colons, or commas in them.");
    }

    unless ($in{'user'} =~ /\S/) {
	&trailer("No user name given.");
    }

    unless ($in{'password'} =~ /\S/) {
	&trailer("No password given.");
    }

    srand (time + $$);
    $salts = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789./";
    $newu = $in{'user'};
    $password = $in{'password'};
    $salt = substr($salts, int(rand(64)),1) . substr($salts, int(rand(64)),1);
    $des = crypt($password, $salt);
    if ($users{$newu}) {
	print "<p>Changing password of <tt>$newu</tt>\n";
	print "to <tt>$password</tt>...</p>\n";
    } else {
	print "<p>Adding user <tt>$newu</tt>\n";
	print "with password <tt>$password</tt>...</p>\n";
    }
    $prevuser = $users{$newu};
    $users{$newu} = $des;
    &store;
    if ($prevuser) {
	&trailer("Password change complete");
    } else {
	&trailer("Add/update complete");
    }
}

sub do_del {
    $delu = $in{'user'};
    &trailer("No such user <tt>$delu</tt>\n") unless $users{$delu};

    print "<p>Deleting user <tt>$delu</tt></p>\n";
    delete $users{$delu};
    &store;
    &trailer("Delete complete");
}

sub store {
    &trailer("I cannot write to $wfile: $!") unless (open(PW, ">$file"));

    for $u (sort keys %users) {
	print PW "$u:$users{$u}\n";
    }
    close(PW);
}

sub validate_oldpw {
    my ($u, $p) = @_;
    $salt = substr($users{$u}, 0, 2);
    $des = crypt($p, $salt);
    if ($des ne $users{$u}) {
	&trailer("Old password is not correct.");
    }
}

#############################################################################

sub trailer {
    local($t) = @_;
    print "<p>$t</p>\n";

    print while <DATA>;

    exit 0;
}

sub ReadParse {
  local (*in) = @_ if @_;
  local ($i, $key, $val);

  # Read in text
  if ($ENV{'REQUEST_METHOD'} eq "POST") {
    read(STDIN,$in,$ENV{'CONTENT_LENGTH'});
  }
  if ($ENV{'QUERY_STRING'}) {
    $in .= "&" . $ENV{'QUERY_STRING'};
    $in =~ s/^&//;
  }

  @in = split(/&/,$in);

  foreach $i (0 .. $#in) {
    # Convert plus's to spaces
    $in[$i] =~ s/\+/ /g;

    # Split into key and value.  
    ($key, $val) = split(/=/,$in[$i],2); # splits on the first =.

    # Convert %XX from hex numbers to alphanumeric
    $key =~ s/%(..)/pack("c",hex($1))/ge;
    $val =~ s/%(..)/pack("c",hex($1))/ge;

    # Associate key and value
    $in{$key} .= "\0" if (defined($in{$key})); # \0 is the multiple separator
    $in{$key} .= $val;

    $in[$i] = $key;
  }

  return length($in); 
}

__END__

<p><hr noshade size=1></p>

<p><strong>Warning:</strong> The Delorie Password Manager makes no
claims as to the security of the passwords it manages or the data it
protects.  This system is to be used for light-weight purposes only!
If you need true security, contact your local system administrator or
webmaster and ask them to advise you.</p>

<p><hr noshade size=1><i><a href="http://www.delorie.com/web/pwmgr/">
The Delorie Password Manager</a> is Copyright &copy;
1996 by <a href="mailto:dj@delorie.com">DJ Delorie</a></i></p>