cgi_access.c

Go to the documentation of this file.

/******************************************************************************/
/* cgi_access.c © Copyright 2005 by Raosoft Inc. All Rights Reserved.         */
/*                                                                            */
/* You may use and modify this file for your own use, but may not distribute  */
/* it or derivative works without the prior written consent of Raosoft, Inc.  */
/*                                                                            */
/* If you choose to share your modifications with Raosoft, Inc. the company   */
/* will attempt to incorporate them into future versions of this file.        */
/*                                                                            */
/* This software is provided "as is," and Raosoft makes no warranty, express  */
/* or implied, of fitness for a particular application. Every measure has been*/
/* taken to anticipate risks inherent to computer networks, but we cannot     */
/* guarantee safety or reliability of this program in every situation.        */
/*                                                                            */
/******************************************************************************/

#include "cgi.h"
extern int CGILogLevel;

/************************ Security *****************************/

#ifdef CGI_ALLOW
int MatchesList(char * host, char * list)
{
 if (!stricmp(list,"all")) return 1; /* matches all */
 if (!stricmp(list,"(all)")) return 1; /* matches all */
 if (list[0] == 0) return 0;
 if (stristr(list,host)) return 1;
 return 0;
}

int CheckAllowDeny(char * host, char * allow,char * deny)
{
 if (host==NULL || !host[0]) return 0; /* localhost */
 if (allow==NULL) allow = "";
 if (deny==NULL) deny = "";

 if (!stricmp(allow,"all")||!stricmp(allow,"(all)")) return 1;
 if (!stricmp(deny,"all")||!stricmp(deny,"(all)")) return 0;

 if (allow[0]==0) /* check for denial */
  {
    if (deny[0] == 0) return 2; /* anything goes */
    if (MatchesList(host,deny)) return 0; /* more restrictive list */
    return 1;
  }
 /* else */
 if (MatchesList(host,allow))
  {
    if (deny[0] == 0) return 1; /* anything goes */
    if (MatchesList(host,deny)) return 0; /* more restrictive list */
    return 1;                             /* passed */
  }
 else return 0; /* wasn't allowed in */
}

int CheckAllow(char* host,CGINameValue* n,char*allow,char*deny,int value,int *i)
{
  if ((*i & value)
       && CheckAllowDeny(host,GetFieldValue(n,allow),
                              GetFieldValue(n,deny)) == 0)
    *i &= ~value;
  return (*i & value);
}

#endif

void CheckPass(CGINameValue* n,int *i,int value,char*pwd,char* field)
{
  char * comp= GetFieldValue(n,field);

  if (!*comp) return; /* default is to deny */

  if (!stricmp(comp,"(allow)"))
   *i |= value;/* grant all */
  else if (!stricmp(comp,"(deny)"))
   return;

  if (GetField(n,field))
   if (HasToken(pwd,comp,0))
    *i |= value;
}

int GetSecurityFlags(char* argv0,char* host,char* database,char* pwd)
{
 int i = CGI_ALLOW_NONE; /* default settings for a database */
 CGINameValue *n;
#ifdef CGI_ALLOW
 CGINameValue *m;
#endif

 int j = strcspn(database,"/.\\*?$|'\"<>~");

 if (database[j] != 0 || strlen(database) > 128 || strlen(pwd) > 128)
  {
   LogError("\nSecurity breach attempted\tHOST=");
   LogError(host);
   return CGI_ALLOW_NONE;
  }
 /* stop buffer overflow attacks */

#ifdef CGI_ALLOW
 {
    char fn[MAXPATH];
    ExpandLocalPath(argv0,fn,"cgi",".ini");
    m = ReadINIFileSection(fn,"access",0);

    /*m = LoadSettings(argv0,"cgi","access");*/
 }
#endif

 n = NULL;
 if (database != NULL)
  if (database[0] != 0)
  {
      char fn[MAXPATH];
      ExpandLocalPath(argv0,fn,database,".ini");
      n = ReadINIFileSection(fn,"access",0);
   /*n = LoadSettings(argv0, database, "access");*/
  }

 if (n != NULL)
 {
  CheckPass(n,&i,CGI_ALLOW_READ,pwd,"PWDREAD");
  CheckPass(n,&i,CGI_ALLOW_UPDATE,pwd,"PWDUPDATE");
  CheckPass(n,&i,CGI_ALLOW_APPEND,pwd,"PWDAPPEND");
  CheckPass(n,&i,CGI_ALLOW_DELETE,pwd,"PWDDELETE");
  CheckPass(n,&i,CGI_ALLOW_WRITE,pwd,"PWDWRITE");
  CheckPass(n,&i,CGI_ALLOW_ADMIN,pwd,"PWDADMIN");
  CheckPass(n,&i,CGI_ALLOW_REPORT,pwd,"PWDREPORT");
  CheckPass(n,&i,CGI_ALLOW_ALL,pwd,"PWD");
 }

#ifdef CGI_ALLOW
 if (n != NULL)
 {
  if (CheckAllowDeny(host,GetFieldValue(n,"ALLOW"),
                          GetFieldValue(n,"DENY")) ==0) i = CGI_ALLOW_NONE;

  if (i && m != NULL)
    if (CheckAllowDeny(host,GetFieldValue(m,"ALLOW"),
                            GetFieldValue(m,"DENY")) ==0) i = CGI_ALLOW_NONE;

  if (i) CheckAllow(host,n,"ALLOWREAD","DENYREAD",CGI_ALLOW_READ,&i);
  if (i) CheckAllow(host,n,"ALLOWUPDATE","DENYUPDATE",CGI_ALLOW_UPDATE,&i);
  if (i) CheckAllow(host,n,"ALLOWAPPEND","DENYAPPEND",CGI_ALLOW_APPEND,&i);
  if (i) CheckAllow(host,n,"ALLOWWRITE","DENYWRITE",CGI_ALLOW_WRITE,&i);
  if (i) CheckAllow(host,n,"ALLOWDELETE","DENYDELETE",CGI_ALLOW_DELETE,&i);
  if (i) CheckAllow(host,n,"ALLOWREPORT","DENYREPORT",CGI_ALLOW_REPORT,&i);
  if (i) CheckAllow(host,n,"ALLOWADMIN","DENYADMIN",CGI_ALLOW_ADMIN,&i);
 }

 /* if access is granted by the password, check domains */
 if (m != NULL)
 {
  if (i) CheckAllow(host,m,"ALLOWREAD","DENYREAD",CGI_ALLOW_READ,&i);
  if (i) CheckAllow(host,m,"ALLOWUPDATE","DENYUPDATE",CGI_ALLOW_UPDATE,&i);
  if (i) CheckAllow(host,m,"ALLOWAPPEND","DENYAPPEND",CGI_ALLOW_APPEND,&i);
  if (i) CheckAllow(host,m,"ALLOWWRITE","DENYWRITE",CGI_ALLOW_WRITE,&i);
  if (i) CheckAllow(host,m,"ALLOWDELETE","DENYDELETE",CGI_ALLOW_DELETE,&i);
  if (i) CheckAllow(host,m,"ALLOWREPORT","DENYREPORT",CGI_ALLOW_REPORT,&i);
  if (i) CheckAllow(host,m,"ALLOWADMIN","DENYADMIN",CGI_ALLOW_ADMIN,&i);
 }

 if (m != NULL) DeleteNVP(m);
#endif

 if (n != NULL) DeleteNVP(n);
 return i;
}

Raosoft EZReport, EZSurvey, InterForm, RapidReport, Raosoft, and SurveyWin are registered trademarks of Raosoft, Inc. Page contents © 1996-2007 by Raosoft, Inc. You may use and modify this file for your own use, but may not distribute it or derivative works without the prior written consent of Raosoft, Inc. This software is provided "as is," and Raosoft makes no warranty, express or implied, of fitness for a particular application. Every measure has been taken to anticipate risks inherent to computer networks, but we cannot guarantee safety or reliability of this program in every situation.

Tel: 206-525-4025 (US) Email: raosoft@raosoft.com
http://www.raosoft.com/