jakob/ldap-chpw-cgi
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Use STDIN instead of command line to read new password safely into openssl

Browse source
This commit is contained in:
Janek Bevendorff 2015-10-21 16:44:02 +02:00
parent 042a26c7bd
commit 8387797d32
1 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
index.py
View file

@ -1,8 +1,8 @@
#!/usr/bin/env python3 #!/usr/bin/env python3
import cgi, cgitb import cgi, cgitb
import re import re
import sys, os, subprocess import sys, os
from subprocess import check_output, Popen, PIPE, CalledProcessError from subprocess import check_output, Popen, PIPE, STDOUT, CalledProcessError
from os.path import expanduser from os.path import expanduser
cgitb.enable() cgitb.enable()
@ -38,11 +38,16 @@ def check_oldpw(accountname, oldpass):
except CalledProcessError: except CalledProcessError:
return False return False
opensslargs = ['openssl', 'passwd', '-' + hashtype, '-salt', salt, oldpass] opensslargs = ['openssl', 'passwd', '-' + hashtype, '-salt', salt, '-stdin']
newhash = check_output(opensslargs).strip().decode('utf-8'); p = Popen(opensslargs, stdin=PIPE, stdout=PIPE, stderr=STDOUT)
p.stdin.write(oldpass.encode('utf-8') + b'\n')
p.stdin.close()
if p.wait() == 0:
newhash = p.stdout.readline().strip().decode('utf-8');
if newhash == oldhash: if newhash == oldhash:
return True return True
return False return False
def generate_headers(): def generate_headers():
@ -64,7 +69,7 @@ def main():
if newpass == newpass2: if newpass == newpass2:
if check_oldpw(accountname, oldpass): if check_oldpw(accountname, oldpass):
vpasswdargs = ['vpasswd', accountname] vpasswdargs = ['vpasswd', accountname]
p = Popen(vpasswdargs, stdin=PIPE, stdout=PIPE, stderr=subprocess.STDOUT) p = Popen(vpasswdargs, stdin=PIPE, stdout=PIPE, stderr=STDOUT)
p.stdin.write(newpass.encode('utf-8') + b'\n') p.stdin.write(newpass.encode('utf-8') + b'\n')
p.stdin.write(newpass2.encode('utf-8') + b'\n') p.stdin.write(newpass2.encode('utf-8') + b'\n')
p.stdin.close() p.stdin.close()