diff --git a/auth_request.php b/auth-request.php similarity index 100% rename from auth_request.php rename to auth-request.php diff --git a/login.php b/login.php index 52524a175..09834b29d 100644 --- a/login.php +++ b/login.php @@ -1,47 +1,10 @@ $value) { - if ($value && $time - $value > $cooldown) { - unset ($fails[$key]); - $updatefails = true; - } - } - if ($updatefails) { - $failtext = implode("\n", $fails); - fileWrite($failfile, $failtext); - } - - if (count($fails) >= $maxfails) { - $error = 'Too many invalid login attempts'; - if (count($fails) == $maxfails) - exec("logger -t webGUI ".escapeshellarg("Ignoring login attempts for {$_POST['username']} from {$remote_addr}")); - - } else { - - // User Login attempt - foreach (file('/etc/nginx/htpasswd') as $strCredentials) { - list($user,$pwhash) = explode(':', trim($strCredentials)); - - // Validate credentials - if ($_POST['username'] == $user && password_verify($_POST['password'], $pwhash)) { - // Successful login, start session - @unlink($failfile); - session_start(); - $_SESSION['unraid_login'] = time(); - $_SESSION['unraid_user'] = $_POST['username']; - session_regenerate_id(true); - session_write_close(); - exec("logger -t webGUI ".escapeshellarg("Successful login user {$_POST['username']} from {$remote_addr}")); - header("Location: /".$var['START_PAGE']); - exit; - } - } - - // Invalid login - $error = 'Invalid Username or Password'; - exec("logger -t webGUI ".escapeshellarg("Unsuccessful login user {$_POST['username']} from {$remote_addr}")); - - } - fileAppend($failfile, $time."\n"); + $error = _('Successfully logged out'); } - -$boot = "/boot/config/plugins/dynamix"; -$myfile = "case-model.cfg"; -$mycase = file_exists("$boot/$myfile") ? file_get_contents("$boot/$myfile") : false; - -extract(parse_plugin_cfg('dynamix',true)); -$theme_dark = in_array($display['theme'],['black','gray']); +$result = exec( "/usr/bin/passwd --status root"); +if (($result === false) || (substr($result, 0, 6) !== "root P")) + include("$docroot/webGui/include/set-password.php"); +else + include("$docroot/webGui/include/login.php"); ?> - - - - - - - - - - - - - - <?=$var['NAME']?>/Login - - "> - - - - -
- -
-

- -

-

- -

- -
- - - - - - - -
- -
- -
-

- - -

- '.$error.'

'; ?> - -

- -

-
-
- -

Password recovery

-
-
- - diff --git a/plugins/dynamix/LogoutButton.page b/plugins/dynamix/LogoutButton.page index c5a8b2088..89d23dd25 100644 --- a/plugins/dynamix/LogoutButton.page +++ b/plugins/dynamix/LogoutButton.page @@ -1,4 +1,3 @@ -Cond="file_exists('/etc/nginx/htpasswd')" Menu="Buttons:2" Title="Logout" Icon="icon-u-logout" diff --git a/plugins/dynamix/include/login.php b/plugins/dynamix/include/login.php new file mode 100644 index 000000000..a6228199a --- /dev/null +++ b/plugins/dynamix/include/login.php @@ -0,0 +1,413 @@ + $value) { + if ($value && $time - $value > $cooldown) { + unset ($fails[$key]); + $updatefails = true; + } + } + if ($updatefails) { + $failtext = implode("\n", $fails); + fileWrite($failfile, $failtext); + } + + if (count($fails) >= $maxfails) { + $error = _('Too many invalid login attempts'); + if (count($fails) == $maxfails) + exec("logger -t webGUI ".escapeshellarg("Ignoring login attempts for {$_POST['username']} from {$remote_addr}")); + + } else { + // User Login attempt, validate credentials + if (($_POST['username'] == "root")) { + // more: integrate with PAM to avoid direct access to /etc/shadow and validate other user names (future) + $output = exec("/usr/bin/grep root /etc/shadow"); + if ($output !== false) { + $strCredentials = explode(":", $output); + if (password_verify($_POST['password'], $strCredentials[1])) { + // Successful login, start session + @unlink($failfile); + session_start(); + $_SESSION['unraid_login'] = time(); + $_SESSION['unraid_user'] = $_POST['username']; + session_regenerate_id(true); + session_write_close(); + exec("logger -t webGUI ".escapeshellarg("Successful login user {$_POST['username']} from {$remote_addr}")); + header("Location: /".$var['START_PAGE']); + exit; + } + } + } + + // Invalid login + $error = _('Invalid Username or Password'); + exec("logger -t webGUI ".escapeshellarg("Unsuccessful login user {$_POST['username']} from {$remote_addr}")); + + } + fileAppend($failfile, $time."\n"); +} + + +$boot = "/boot/config/plugins/dynamix"; +$myfile = "case-model.cfg"; +$mycase = file_exists("$boot/$myfile") ? file_get_contents("$boot/$myfile") : false; + +extract(parse_plugin_cfg('dynamix',true)); +$theme_dark = in_array($display['theme'],['black','gray']); +?> + + + + + + + + + + + + + + <?=$var['NAME']?>/Login + + "> + + + + +
+ +
+

+ +

+

+ +

+ +
+ + + + + + + +
+ +
+ +
+

+ + +

+ '.$error.'

'; ?> + +

+ +

+
+
+ +

+
+
+ + diff --git a/plugins/dynamix/include/set-password.php b/plugins/dynamix/include/set-password.php new file mode 100644 index 000000000..f1e71143b --- /dev/null +++ b/plugins/dynamix/include/set-password.php @@ -0,0 +1,440 @@ + _('root requires a password'), + 'mismatch' => _('Password confirmation does not match'), + 'maxLength' => _('Max password length is 128 characters'), + 'saveError' => _('Unable to set password'), +]; +$POST_ERROR = ''; + +/** + * POST handler + */ +if (!empty($_POST['password']) && !empty($_POST['confirmPassword'])) { + if ($_POST['password'] !== $_POST['confirmPassword']) return $POST_ERROR = $VALIDATION_MESSAGES['mismatch']; + if (strlen($_POST['password']) > $MAX_PASS_LENGTH) return $POST_ERROR = $VALIDATION_MESSAGES['maxLength']; + + $userName = 'root'; + $userPassword = base64_encode($_POST['password']); + + $result = exec("/usr/local/sbin/emcmd 'cmdUserEdit=Change&userName=$userName&userPassword=$userPassword'"); + if ($result == 0) { + // PAM service will log to syslog: "password changed for root" + session_start(); + $_SESSION['unraid_login'] = time(); + $_SESSION['unraid_user'] = 'root'; + session_regenerate_id(true); + session_write_close(); + + header("Location: /".$var['START_PAGE']); + exit; + } + + // Error when attempting to set password + exec("logger -t webGUI ".escapeshellarg($VALIDATION_MESSAGES['saveError'] . " [REMOTE_ADDR]: {$REMOTE_ADDR}")); + return $POST_ERROR = $VALIDATION_MESSAGES['saveError']; +} + +extract(parse_plugin_cfg('dynamix',true)); +$THEME_DARK = in_array($display['theme'],['black','gray']); +?> + + + + + + + + + + + + + + <?=$var['NAME']?>/<? _('SetPassword') ?> + + + + + + +
+
+ +
+
+
+

+

+

Please set a password for the root user account. Maximum length is 128 characters.

+
+ +
+ + + +
+ + +
+ + + + +

+
+ +
+
+
+
+ + +