From a9975d4baca75fd5ee9e4795caf9065667a44247 Mon Sep 17 00:00:00 2001 From: einhornimmond Date: Fri, 9 Apr 2021 14:09:23 +0200 Subject: [PATCH] compare extern referer with actual host instead of default url, check by login if user came from correct community server --- .../src/cpp/HTTPInterface/LoginPage.cpp | 42 +++++++++++++------ .../PageRequestHandlerFactory.cpp | 7 +++- login_server/src/cpp/controller/Group.cpp | 12 ++++++ login_server/src/cpp/controller/Group.h | 2 + login_server/src/cpp/controller/User.h | 1 + login_server/src/cpsp/login.cpsp | 20 ++++++++- 6 files changed, 67 insertions(+), 17 deletions(-) diff --git a/login_server/src/cpp/HTTPInterface/LoginPage.cpp b/login_server/src/cpp/HTTPInterface/LoginPage.cpp index b7800d411..2ee28dde0 100644 --- a/login_server/src/cpp/HTTPInterface/LoginPage.cpp +++ b/login_server/src/cpp/HTTPInterface/LoginPage.cpp @@ -155,6 +155,12 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net:: if(email != "" && password != "") { UserState user_state; + auto host = request.find("Host"); + std::string host_string = ""; + if (host != request.end()) { + host_string = host->second; + } + try { user_state = mSession->loadUser(email, password); } catch (Poco::Exception& ex) { @@ -171,9 +177,18 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net:: user_state = USER_DISABLED; } } - } else { - //printf("pubkey exist: %p\n",user->getModel()->getPublicKey()); } + + // check if user group belong to host + if(!user.isNull() && host_string != "") { + auto group = user->getGroup(); + if(!group.isNull()) { + if(group->getHost() != host_string) { + printf("group host: %s, host string: %s\n", group->getHost().data(), host_string.data()); + user_state = USER_WRONG_HOST; + } + } + } getErrors(mSession); auto lastExternReferer = mSession->getLastReferer(); @@ -183,6 +198,7 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net:: switch(user_state) { case USER_EMPTY: case USER_PASSWORD_INCORRECT: + case USER_WRONG_HOST: addError(new Error(langCatalog->gettext("Login"), langCatalog->gettext("E-Mail or password isn't right, please try again!")), false); if(mSession) { getErrors(mSession); @@ -342,11 +358,11 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net:: responseStream << " "; // end include header.cpsp responseStream << "\n"; -#line 268 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" +#line 284 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" responseStream << ( getErrorsHtml() ); responseStream << "\n"; responseStream << "\n"; responseStream << "
\n"; @@ -380,22 +396,22 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net:: responseStream << "\n"; responseStream << "
\n"; responseStream << "\t\t
\n"; responseStream << "\t\t\tgettext("E-Mail") ); responseStream << "\" value=\""; -#line 274 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" +#line 290 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" responseStream << ( presetEmail ); responseStream << "\"/>\n"; responseStream << "\t\t\tgettext("Password") ); responseStream << "\" />\n"; responseStream << "\t\t \n"; responseStream << "\t\t
\n"; @@ -403,22 +419,22 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net:: responseStream << "
\n"; responseStream << "
\n"; responseStream << "\t

"; -#line 281 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" +#line 297 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" responseStream << ( langCatalog->gettext("You haven't any account yet? Please follow the link to create one.") ); responseStream << "

\n"; responseStream << "\t \n"; responseStream << "\t\t\t"; -#line 283 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" +#line 299 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" responseStream << ( langCatalog->gettext("Create New Account") ); responseStream << "\n"; responseStream << "\t\t \n"; responseStream << "\t
\n"; responseStream << "\t\t
\n"; responseStream << "\t\t\t"; -#line 287 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" +#line 303 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp" responseStream << ( langCatalog->gettext("Passwort vergessen") ); responseStream << "\n"; responseStream << "\t\t
\n"; diff --git a/login_server/src/cpp/HTTPInterface/PageRequestHandlerFactory.cpp b/login_server/src/cpp/HTTPInterface/PageRequestHandlerFactory.cpp index 23ff4e756..bc1c1148e 100644 --- a/login_server/src/cpp/HTTPInterface/PageRequestHandlerFactory.cpp +++ b/login_server/src/cpp/HTTPInterface/PageRequestHandlerFactory.cpp @@ -77,10 +77,12 @@ Poco::Net::HTTPRequestHandler* PageRequestHandlerFactory::createRequestHandler(c if (uri != "/favicon.ico") { //printf("[PageRequestHandlerFactory] uri: %s, first part: %s\n", uri.data(), url_first_part.data()); auto referer = request.find("Referer"); - if (referer != request.end()) { + auto host = request.find("Host"); + if (referer != request.end() && host != request.end()) { //printf("referer: %s\n", referer->second.data()); auto refererString = referer->second; - if (refererString.find(ServerConfig::g_serverPath) == refererString.npos) { + auto hostString = host->second; + if (refererString.find(hostString) == refererString.npos) { externReferer = refererString; } }//*/ @@ -154,6 +156,7 @@ Poco::Net::HTTPRequestHandler* PageRequestHandlerFactory::createRequestHandler(c } if (s) { if (externReferer != "") { + s->setLastReferer(externReferer); } model::table::User* userModel = nullptr; diff --git a/login_server/src/cpp/controller/Group.cpp b/login_server/src/cpp/controller/Group.cpp index cbd023a3d..43285abb3 100644 --- a/login_server/src/cpp/controller/Group.cpp +++ b/login_server/src/cpp/controller/Group.cpp @@ -1,6 +1,8 @@ #include "Group.h" +#include "Poco/URI.h" + namespace controller { Group::Group(model::table::Group* dbModel) @@ -95,5 +97,15 @@ namespace controller { return JsonRequest(model->getUrl(), port); } + std::string Group::getHost() + { + auto model = getModel(); + auto url = model->getUrl(); + if (url.find("http") != url.npos) { + auto uri = Poco::URI(url); + return uri.getHost(); + } + return url; + } } diff --git a/login_server/src/cpp/controller/Group.h b/login_server/src/cpp/controller/Group.h index 55b58906c..3f084acd4 100644 --- a/login_server/src/cpp/controller/Group.h +++ b/login_server/src/cpp/controller/Group.h @@ -26,6 +26,8 @@ namespace controller { inline Poco::AutoPtr getModel() { return _getModel(); } JsonRequest createJsonRequest(); + + std::string getHost(); protected: Group(model::table::Group* dbModel); diff --git a/login_server/src/cpp/controller/User.h b/login_server/src/cpp/controller/User.h index 94d52591f..649fc1742 100644 --- a/login_server/src/cpp/controller/User.h +++ b/login_server/src/cpp/controller/User.h @@ -20,6 +20,7 @@ enum UserState USER_NO_KEYS, USER_NO_PRIVATE_KEY, USER_NO_GROUP, + USER_WRONG_HOST, USER_KEYS_DONT_MATCH, USER_COMPLETE, USER_DISABLED diff --git a/login_server/src/cpsp/login.cpsp b/login_server/src/cpsp/login.cpsp index 8ee39315e..2089b2639 100644 --- a/login_server/src/cpsp/login.cpsp +++ b/login_server/src/cpsp/login.cpsp @@ -134,6 +134,12 @@ if(email != "" && password != "") { UserState user_state; + auto host = request.find("Host"); + std::string host_string = ""; + if (host != request.end()) { + host_string = host->second; + } + try { user_state = mSession->loadUser(email, password); } catch (Poco::Exception& ex) { @@ -150,9 +156,18 @@ user_state = USER_DISABLED; } } - } else { - //printf("pubkey exist: %p\n",user->getModel()->getPublicKey()); } + + // check if user group belong to host + if(!user.isNull() && host_string != "") { + auto group = user->getGroup(); + if(!group.isNull()) { + if(group->getHost() != host_string) { + printf("group host: %s, host string: %s\n", group->getHost().data(), host_string.data()); + user_state = USER_WRONG_HOST; + } + } + } getErrors(mSession); auto lastExternReferer = mSession->getLastReferer(); @@ -162,6 +177,7 @@ switch(user_state) { case USER_EMPTY: case USER_PASSWORD_INCORRECT: + case USER_WRONG_HOST: addError(new Error(langCatalog->gettext("Login"), langCatalog->gettext("E-Mail or password isn't right, please try again!")), false); if(mSession) { getErrors(mSession);