diff --git a/mod_absec.c b/mod_absec.c
index 8c013d7..dd6b14a 100644
--- a/mod_absec.c
+++ b/mod_absec.c
@@ -194,86 +194,6 @@ static int absec_handler_first(request_rec *r)
//ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass);
////////
- // Validate user/pass against unix cred
-
- ////////
- // Get UID, GIDs for the user
- /* Working example, but just UID not PW */
- /*
- apr_status_t ret;
- apr_uid_t i;
- apr_gid_t g;
- ret = apr_uid_get ( &i, &g, user, r->pool );
- ap_rprintf(r, "Result2: G:%d, I:%d \n
", g,i);
- */
-
- ////////
- /* Retrieve PW (user details) from /etc/passwd */
- /* Should include */
- struct passwd *pw;
- if((pw = getpwnam(user)) == NULL)
- {
- ap_rprintf(r, "NULL \n
");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r),
- "\"", NULL));
- // User cannot be found, unauthorized
- return HTTP_UNAUTHORIZED;
- }
-
- ////////
- /* Retrieve PW from /etc/shadow */
- /* Should include */
-/* struct spwd *spw;
- errno = 0;
- if((spw = getspnam(user)) == NULL)
- {
- ap_rprintf(r, "NULL %d\n
", errno);
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
- else
- {
- ap_rprintf(r, "Shadow PW : %s \n
", spw->sp_pwdp);
- }
-
- if (spw->sp_pwdp[0] == 'x' || spw->sp_pwdp[0] == '*' || spw->sp_pwdp[0] == '!') {
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }*/
-
- ////////
- /* Encrypt and compare shadow password */
- // TODO : Valider qu'on a un user
- // TODO : Valider qu'il y a un password (pas * ! rien)
-/* char *encrypted;
- const char *correct;
- int rrr;
- encrypted = crypt(pass, spw->sp_pwdp);
- rrr = strcmp(encrypted, spw->sp_pwdp);
- ap_rprintf(r, "compare pw : %s \n
", encrypted);;
- ap_rprintf(r, "compare : %d \n
", rrr);
- if (rrr!=0) {
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-*/
-
- ////////
// Connect to PAM to auth user
pam_handle_t * pamh = NULL;
int rret;
@@ -294,7 +214,7 @@ static int absec_handler_first(request_rec *r)
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"PASSWORD INVALIDE ", ap_auth_name(r),
+ apr_pstrcat(r->pool, "Basic realm=\"USER/PASS INVALIDE ", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
printf("User auth failed\n");
@@ -311,6 +231,23 @@ static int absec_handler_first(request_rec *r)
////////
// Continue checking permission
+ ////////
+ /* Retrieve user details from /etc/passwd to get uid and primary group */
+ /* Should include */
+ struct passwd *pw;
+ if((pw = getpwnam(user)) == NULL)
+ {
+ // Should never happend as already verified with PAM
+ ap_rprintf(r, "NULL \n
");
+ apr_table_setn(r->err_headers_out,
+ (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
+ : "WWW-Authenticate",
+ apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r),
+ "\"", NULL));
+ // User cannot be found, unauthorized
+ return HTTP_UNAUTHORIZED;
+ }
+
// If file is user readable and user match return content
if ((fperm.st_uid==pw->pw_uid) && (fperm.st_mode & 0700 & permmask)) {
ap_rprintf(r, "Fichier propriƩtaire
\r\n");
@@ -341,16 +278,7 @@ static int absec_handler_first(request_rec *r)
return (DECLINED);
}
}
- } else {
-/* ap_rprintf(r, "Erreur pas de groupe supplementaires? (code %d)
\r\n", groupreturn);
- r->content_type = "text/html";
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
-*/ }
+ }
// else decline request
ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n");