From a4d4588509fdd151ad173b1d17ee87b35668a23f Mon Sep 17 00:00:00 2001 From: bergware Date: Sat, 11 Jan 2020 07:29:19 +0100 Subject: [PATCH 1/6] User password: hide base64 conversion --- plugins/dynamix/UserAdd.page | 14 +++++++++----- plugins/dynamix/UserEdit.page | 14 +++++++++----- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/plugins/dynamix/UserAdd.page b/plugins/dynamix/UserAdd.page index 5540ff0b9..0366746ea 100644 --- a/plugins/dynamix/UserAdd.page +++ b/plugins/dynamix/UserAdd.page @@ -55,15 +55,17 @@ function checkUsername(form) { swal({title:"Invalid user name",text:"Do not use reserved names",type:"error"}); return false; } - if (form.userPassword.value.length > 128 || form.userPasswordConf.value.length > 128) { + if (form.userPasswordGUI.value.length > 128 || form.userPasswordConfGUI.value.length > 128) { swal({title:"Password too long",text:"Use a password up to 128 characters",type:"error"}); return false; } if (filename) { $.post("/webGui/include/FileUpload.php",{cmd:'save',path:path,filename:filename,output:username+'.png'}); } - form.userPassword.value = base64(form.userPassword.value); - form.userPasswordConf.value = base64(form.userPasswordConf.value); + form.userPassword.value = base64(form.userPasswordGUI.value); + form.userPasswordConf.value = base64(form.userPasswordConfGUI.value); + form.userPasswordGUI.disabled = true; + form.userPasswordConfGUI.disabled = true; return true; } @@ -138,12 +140,14 @@ Custom image: > The image will be scaled to 48x48 pixels in size. The maximum image file upload size is 95 kB (97,280 bytes). Password: -: + +: > Up to 128 characters. Retype password: -: + +:   : diff --git a/plugins/dynamix/UserEdit.page b/plugins/dynamix/UserEdit.page index 804f4cf6f..5ce5c7c51 100644 --- a/plugins/dynamix/UserEdit.page +++ b/plugins/dynamix/UserEdit.page @@ -47,12 +47,14 @@ var path = '/boot/config/plugins/dynamix/users'; var filename = ''; function checkPassword(form) { - if (form.userPassword.value.length > 128 || form.userPasswordConf.value.length > 128) { + if (form.userPasswordGUI.value.length > 128 || form.userPasswordConfGUI.value.length > 128) { swal({title:"Password too long",text:"Use a password up to 128 characters",type:"error"}); return false; } - form.userPassword.value = base64(form.userPassword.value); - form.userPasswordConf.value = base64(form.userPasswordConf.value); + form.userPassword.value = base64(form.userPasswordGUI.value); + form.userPasswordConf.value = base64(form.userPasswordConfGUI.value); + form.userPasswordGUI.disabled = true; + form.userPasswordConfGUI.disabled = true; return true; } @@ -157,12 +159,14 @@ Delete Password: -: + +: > Up to 128 characters. Retype password: -: + +:   : From 7805001f1f572db882881363ba02ce7d06041a4a Mon Sep 17 00:00:00 2001 From: bergware Date: Sun, 12 Jan 2020 10:06:56 +0100 Subject: [PATCH 2/6] Select username field when login page is loaded --- login.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/login.php b/login.php index 3a877b663..ed2ded119 100644 --- a/login.php +++ b/login.php @@ -339,7 +339,7 @@ $theme_dark = in_array($display['theme'],['black','gray']);

- +

'.$error.'

'; ?> From 7bc3ddfded7f7dc5062968865792e54296f8b408 Mon Sep 17 00:00:00 2001 From: bergware Date: Sun, 12 Jan 2020 22:26:45 +0100 Subject: [PATCH 3/6] login: autocapitalize="none" --- login.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/login.php b/login.php index ed2ded119..e37942d81 100644 --- a/login.php +++ b/login.php @@ -339,7 +339,7 @@ $theme_dark = in_array($display['theme'],['black','gray']);

- +

'.$error.'

'; ?> From 76323ecc5c40240030a4d431728dadcff88c906e Mon Sep 17 00:00:00 2001 From: bergware Date: Sun, 12 Jan 2020 22:31:09 +0100 Subject: [PATCH 4/6] Login: trim trailing spaces --- login.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/login.php b/login.php index e37942d81..630c5aac9 100644 --- a/login.php +++ b/login.php @@ -31,7 +31,7 @@ if ($_SERVER['REQUEST_URI'] == '/logout') { $_SESSION['unraid_user'] = $_POST['username']; session_regenerate_id(true); session_write_close(); - exec("logger -t webGUI ".escapeshellarg("Successful login user {$_POST['username']} from {$_SERVER['REMOTE_ADDR']}")); + exec("logger -t webGUI ".escapeshellarg("Successful login user {$_POST['username']} from {$_SERVER['REMOTE_ADDR']}")); header("Location: /".$var['START_PAGE']); exit; } From 3a7fa8c351f4e106c921445412a733ecd4027fd8 Mon Sep 17 00:00:00 2001 From: bergware Date: Mon, 13 Jan 2020 22:07:21 +0100 Subject: [PATCH 5/6] Passphrase printable charcaters only --- plugins/dynamix/ArrayOperation.page | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/plugins/dynamix/ArrayOperation.page b/plugins/dynamix/ArrayOperation.page index 4e05f755a..cb12658d1 100644 --- a/plugins/dynamix/ArrayOperation.page +++ b/plugins/dynamix/ArrayOperation.page @@ -131,8 +131,18 @@ function prepareInput(form) { form.text.disabled = true; form.copy.disabled = true; if (form.text.value) { - $(form).append(''); - form.submit(); + var valid = new RegExp('^[ -~]+$'); + if (valid.test(form.text.value)) { + $(form).append(''); + form.submit(); + } else { + form.input.disabled = false; + form.local.disabled = false; + form.file.disabled = false; + form.text.disabled = false; + form.copy.disabled = false; + swal({title:'Printable Characters Only',text:'Use ASCII characters from space " " to tilde "~"
Otherwise use the keyfile method for UTF8 input',html:true,type:'error'}); + } return; } var data = {}; From b651ef23e91e31488aa39b55c25c7c9b10f001ae Mon Sep 17 00:00:00 2001 From: bergware Date: Tue, 14 Jan 2020 08:14:59 +0100 Subject: [PATCH 6/6] Encryption: enforced keyfile selection/deletion when file exists --- plugins/dynamix/ArrayOperation.page | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/dynamix/ArrayOperation.page b/plugins/dynamix/ArrayOperation.page index cb12658d1..68922ee1b 100644 --- a/plugins/dynamix/ArrayOperation.page +++ b/plugins/dynamix/ArrayOperation.page @@ -42,7 +42,7 @@ function check_encryption() { echo mk_option(1,'text','Passphrase'); echo mk_option(1,'file','Keyfile'); echo ""; - echo "Passphrase:show passphrase"; + echo "Passphrase:show passphrase"; echo "Retype passphrase:"; echo "Keyfile:"; } @@ -80,6 +80,10 @@ span#pass{display:none;margin-left:20px} var ctrl = "'>"; function selectInput(form) { + + form.input.value = 'file'; + form.input.disabled = true; + if (form.input.value == 'text') { form.file.value = ''; form.local.value = '';