From e338fc2e3eab278aa012f058472ba34b98ae80a3 Mon Sep 17 00:00:00 2001

From: Tomas Jelinek <tojeline@redhat.com>

Date: Fri, 31 Jul 2015 17:34:46 +0200

Subject: [PATCH] fixed session and cookies processing

---

 pcsd/auth.rb   | 24 +++++++++++-------------

 pcsd/pcs.rb    |  8 ++++----

 pcsd/pcsd.rb   | 14 ++++++++++----

 pcsd/remote.rb |  2 +-

 4 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/pcsd/auth.rb b/pcsd/auth.rb

index 8953d60..05bfadf 100644

--- a/pcsd/auth.rb

+++ b/pcsd/auth.rb

@@ -3,9 +3,8 @@ require 'pp'

 require 'securerandom'

 require 'rpam'

-class PCSAuth

   # Ruby 1.8.7 doesn't implement SecureRandom.uuid

-  def self.uuid

+  def pcsauth_uuid

     if defined? SecureRandom.uuid

       return SecureRandom.uuid

     else

@@ -16,7 +15,7 @@ class PCSAuth

     end

   end

-  def self.validUser(username, password, generate_token = false, request = nil)

+  def pcsauth_validUser(username, password, generate_token = false, request = nil)

     $logger.info("Attempting login by '#{username}'")

     if not Rpam.auth(username,password, :service => "pcsd")

       $logger.info("Failed login by '#{username}' (bad username or password)")

@@ -37,7 +36,7 @@ class PCSAuth

     $logger.info("Successful login by '#{username}'")

     if generate_token

-      token = PCSAuth.uuid

+      token = pcsauth_uuid

       begin

       	password_file = File.open($user_pass_file, File::RDWR|File::CREAT)

 	password_file.flock(File::LOCK_EX)

@@ -57,7 +56,7 @@ class PCSAuth

     return true

   end

-  def self.validToken(token)

+  def pcsauth_validToken(token)

     begin

       json = File.read($user_pass_file)

       users = JSON.parse(json)

@@ -73,10 +72,10 @@ class PCSAuth

     return false

   end

-  def self.isLoggedIn(session, cookies)

-    if username = validToken(cookies["token"])

-      if username == "hacluster" and $cookies.key?(:CIB_user) and $cookies.key?(:CIB_user) != ""

-        $session[:username] = $cookies[:CIB_user]

+  def pcsauth_isLoggedIn(session, cookies)

+    if username = pcsauth_validToken(cookies["token"])

+      if username == "hacluster" and cookies.key?('CIB_user') and cookies['CIB_user'] != ""

+        session[:username] = cookies['CIB_user']

       end

       return true

     else

@@ -85,11 +84,11 @@ class PCSAuth

   end

   # Always an admin until we implement groups

-  def self.isAdmin(session)

+  def pcsauth_isAdmin(session)

     true

   end

-  def self.createUser(username, password)

+  def pcsauth_createUser(username, password)

     begin

       json = File.read($user_pass_file)

       users = JSON.parse(json)

@@ -97,7 +96,7 @@ class PCSAuth

       users = []

     end

-    token = PCSAuth.uuid

+    token = pcsauth_uuid

     users.delete_if{|u| u["username"] == username}

     users << {"username" => username, "password" => password, "token" => token}

@@ -105,5 +104,4 @@ class PCSAuth

       f.write(JSON.pretty_generate(users))

     end

   end

-end

diff --git a/pcsd/pcs.rb b/pcsd/pcs.rb

index 3fad833..d8e27b3 100644

--- a/pcsd/pcs.rb

+++ b/pcsd/pcs.rb

@@ -306,7 +306,7 @@ def send_request_with_token(node, request, post=false, data={}, remote=true, raw

       req.set_form_data(data)

     end

     cookies_to_send = [CGI::Cookie.new("name" => 'token', "value" => token).to_s]

-    cookies_to_send << CGI::Cookie.new("name" =>  "CIB_user", "value" => $session[:username].to_s).to_s

+    cookies_to_send << CGI::Cookie.new("name" =>  "CIB_user", "value" => get_session()[:username].to_s).to_s

     req.add_field("Cookie",cookies_to_send.join(";"))

     myhttp = Net::HTTP.new(uri.host, uri.port)

     myhttp.use_ssl = true

@@ -623,10 +623,10 @@ def run_cmd(*args)

   start = Time.now

   out = ""

   errout = ""

-  if $session[:username] == "hacluster"

-    ENV['CIB_user'] = $cookies[:CIB_user]

+  if get_session()[:username] == "hacluster"

+    ENV['CIB_user'] = get_cookies()[:CIB_user]

   else

-    ENV['CIB_user'] = $session[:username]

+    ENV['CIB_user'] = get_session()[:username]

   end

   $logger.debug("CIB USER: #{ENV['CIB_user'].to_s}")

   status = Open4::popen4(*args) do |pid, stdin, stdout, stderr|

diff --git a/pcsd/pcsd.rb b/pcsd/pcsd.rb

index 5a0928a..2633360 100644

--- a/pcsd/pcsd.rb

+++ b/pcsd/pcsd.rb

@@ -49,8 +49,6 @@ also_reload 'auth.rb'

 also_reload 'wizard.rb'

 before do

-  $session = session

-  $cookies = cookies

   if request.path != '/login' and not request.path == "/logout" and not request.path == '/remote/auth'

     protected! 

   end

@@ -117,7 +115,7 @@ set :run, false

 helpers do

   def protected!

-    if not PCSAuth.isLoggedIn(session, request.cookies)

+    if not pcsauth_isLoggedIn(session, request.cookies)

       # If we're on /managec/<cluster_name>/main we redirect

       match_expr = "/managec/(.*)/(.*)"

       mymatch = request.path.match(match_expr)

@@ -198,7 +196,7 @@ if not DISABLE_GUI

   end

   post '/login' do

-    if PCSAuth.validUser(params['username'],params['password'])

+    if pcsauth_validUser(params['username'],params['password'])

       session["username"] = params['username']

       # Temporarily ignore pre_login_path until we come up with a list of valid

       # paths to redirect to (to prevent status_all issues)

@@ -741,4 +739,12 @@ helpers do

   def h(text)

     Rack::Utils.escape_html(text)

   end

+

+  def get_session

+    session

+  end

+

+  def get_cookies

+    return cookies

+  end

 end

diff --git a/pcsd/remote.rb b/pcsd/remote.rb

index b98e9a9..69142e4 100644

--- a/pcsd/remote.rb

+++ b/pcsd/remote.rb

@@ -628,7 +628,7 @@ def status_all(params, nodes = [])

 end

 def auth(params,request)

-  token = PCSAuth.validUser(params['username'],params['password'], true, request)

+  token = pcsauth_validUser(params['username'],params['password'], true, request)

   # If we authorized to this machine, attempt to authorize everywhere

   node_list = []

   if token and params["bidirectional"]

-- 

1.9.1