#!/usr/bin/perl -wT
use strict; # Yes you need to make it work with this and Taint

###
# Modules
use CGI;
use Apache::Htpasswd;

###
# Init
$ENV{'PATH'} = '/var/www/cgi-bin/:/bin/:/usr/bin/';
$update = "was created by ";
$query = new CGI; 
print $query->header;
$login_used = `id`; # Take a look at perlvar 
					# specifically $) and $>

$date = `date`;		# Take a look at POSIX::strftime

chomp($login_used);
chomp($date);

&heredocs;			# This is named ambiguously
					# and won't work with strict
					# without some serious changes

&script;			# very ambiguous

$filepath = $ENV{'DOCUMENT_ROOT'};
$logpath = "$filepath/.secure"; # why would your logs be
								# kept under your webroot?
								
$htp = new Apache::Htpasswd("$logpath/.htpasswd");
$query = CGI->new();	# There is already a CGI object
						# in $query.

@names=$query->param;	# Do you really care about *all*
						# the params?
$count=0;
foreach $name(@names) {	# Why look at all the params
						# You are only interested in a few of them
						
	@values[$count] = $query->param($name); # This won't do what you want
											# it's actually $values[$count]
											# and so will only get the first
											# value.
	if ($name eq "name")
	{
		$nameofuser = $values[$count];
	}
	elsif ($name eq "login")
	{
		$formlogin = $values[$count];
	}
	elsif ($name eq "pw")
	{
		$formpw = $values[$count];
		if (   ($formlogin =~ /%3A/)	# This test doesn't do what you want
			|| ($formlogin =~ /%2F/)	# CGI handles escaped characters for you
			|| ($formlogin =~ /%3B/)	# so these will match a literal %2F
			|| ($formpw =~ /%3A/)
			|| ($formpw =~ /%3B/)		# What happens when 'pw' is the first
			|| ($formpw =~/%2F/)		# Param?
			|| ($nameofuser =~ /%3A/)
			|| ($nameofuser =~ /%3B/) 
			| ($nameofuser =~ /%2F/))	# | <- Typo? should be ||
		{
			print $illegal;
			die("Data contained malicious characters");
		}
	}
	elsif ($name eq "logins")
	{
		$delvalue="yes";
		$deluservalue=$values[$count];
	}
	elsif ($name eq "viewlog")
	{
		$viewlogvalue=$values[$count];
	}
	elsif ($name eq "viewdb")
	{
		$viewdbvalue=$values[$count];
	}
	elsif ($name eq "chpw")
	{
		$chpw=$values[$count];
	}
	elsif ($name eq "oldpw")
	{
		$oldpw=$values[$count];
	}
	else
	{
		$array[$count]=$value;	# Where did $value come from?
		$count++;
	}
	$count++;					# If the else above is executed $count
								# get's incremented twice.
}


$nameofuser =~ /([\w]+)/;		# You should probably show a error
$untainted_name = $1;			# if any of these fail to match
$formlogin =~ /([\w]+)/;
$untainted_formlogin = $1;		# Why not just assign back to the 
$formpw =~ /([\w]+)/;			# Original since you will show a
$untainted_formpw = $1;			# Error if any of them are bad.
$oldpw =~ /([\w]+)/;
$untainted_oldpw = $1;			# Passwords can only be letters ?

if ($viewdbvalue eq "on")		# Since you can do both this could be
{								# written as
	&db_viewer;					# db_viewer() if ($viewdbvalue eq 'on');
}								# log_view() if ($viewdbvalue eq 'on');
elsif ($viewlogvalue eq "on")	# log() if ($viewdbvalue ne 'on' &&
{								# 			$viewlogvalue ne 'on');
	&log_viewer;				# contin();
}
else
{
	&log;
}

sub log {				# And what does this do?
	if (-e ($logpath))
	{
		&eraser;
	}
	else
	{
		mkdir("$logpath", 0755);
		&eraser;
	}
}

sub mainprog {					# This isn't the main program
								# it just opens a log file
								# and calls usercreate
	if (-e ("$logpath/.log")){
		open(LOG, ">>$logpath/.log") || die("Could not open log file to add entry.");
	}
	else
	{
		open(LOG, ">$logpath/.log")|| die("Could not create log file at $logpath/.log");
	}
	&usercreate;
}

sub contin {
	print $footer;
}

sub log_viewer {
	$logupdater = $logupdate;
	unless ($viewlogvalue eq "off")		# The only way you can get
										# here is if $viewlogvalue
										# eq 'on'
	{
		# why not a here doc?
		print "<h2 align=\"center\">Users in database</h2>";
		print "<br>";
		print "<table border=\"6\" align=\"bottom\" bordercolor=\"#FF0000\">";
		print "<tr><td><b>Login</b></td><td><b>Added or modified?</b></td><td><b>by user</b></td><td><b>Creator logged in as</b></td><td><b>Date</b></td></tr>";
		
		open (DB, "$logpath/.log") || die("Could not open $logpath/.log for tabling");
		@dbarray=<DB>;				# Should use a while (<DB>)
		foreach $entry(@dbarray)	# to avoid reading the whole thing
		{							# into memory
			($usen, $creatr)=split(/&/, $entry);		# Take a look at
			($creatir, $loggedinas)=split(/,/, $creatr);# Text::CSV
			($loggedas, $day)=split(/-/, $loggedinas);	# or a DB module
			($daychanged, $action)=split(/¬/, $day);	# while simplify
			($creatr)=$creatir;							# this whole mess
			($loggedinas)=$loggedas;
			print "<tr><td>$usen</td><td>$action</td><td>$creatr</td><td>$loggedinas</td><td>$daychanged</td></tr>";
		}
		print "</table><br><br><br><br>";
		close(DB);
		&contin;	# contin? continue to what? (oooh print_footer()
					# well why didn't you say so?)
	}
}

sub db_viewer {
	unless ($viewdbvalue eq "off")	# You can't get here if it eq 'off'
									# so if you really think it could
									# happen die() if it does.
	{
		print "<form name=\"jim\" action=\"passwords.cgi\">";
		print "<input type=\"hidden\" name=\"del\" value=\"no\">";
		print "Your name:&nbsp;&nbsp;<input type=\"text\" name=\"name\">";
		$counter=0;
		open (DB, "$logpath/.htpasswd") || die ("Could not open DB file to view.");
		@dbarray=<DB>;				# This should all be handled by
		foreach $line (@dbarray) 	# Apache::Htpasswd
		{							# ($htp->fetchUsers())
			($usern, $crypw) = split(/:/, $line);	
			while ($counter == 0)
			{
				print "<select name=\"logins\">";
				print "<option selected>Select a user:</option>";
				$counter++;
			}
			print "<option name=\"fred\" value=\"$usern\">$usern</option>";
		}
	}
	close(DB);	# Why isn't the close in the same block as the open?
	print "</select>";
	print "<input type=\"button\" onClick=\"javascript:logdel()\" value=\"Delete user\">";
	print "<br>";
	print "</form>";
	if ($viewlogvalue eq "on") # You shouldn't need to this
	{
		&log_viewer;
	}
	else
	{
		&contin;	# aggg contin again..
	}
}

sub usercreate{
	unless(($viewlogvalue eq "on") || ($viewdbvalue eq "on"))
	{
	
		if($chpw eq "off")				# All 3 if's and the unless
		{								# can be combined and would 
			&checker;					# probably be clearer
		}
		else
		{
			$update="'s password was changed by ";
		}
	
		if($update eq "'s password was changed by ")
		{
			$logupdate="Password changed";
		}
		else
		{
			$logupdate="Login created";
		}

		unless ($chpw eq "on")
		{
			print "Login $untainted_formlogin $update $untainted_name,\nunder the username $login_used,\non $date.\n";
			print LOG "$untainted_formlogin&$untainted_name,$login_used-$date¬$logupdate\n";
			$htp->htpasswd("$untainted_formlogin", "$untainted_formpw");
			print $former;
		}
		
		if ($chpw eq "on")
		{
			&passwordchanger;
		}
		else
		{
			&contin;
		}
	}
}

sub passwordchanger{
	$htp->htpasswd("$untainted_formlogin", "$untainted_formpw", "$untainted_oldpw");
	if ($htp->error() eq "Apache::Htpasswd::htpasswd - Password not changed.")
	{	# Just check the return value from htpasswd
	
		print "$pwr\n$copy\n$footer";
	}
	else
	{
		# Try setting the password again? since it succeeded?
		$htp->htpasswd("$untainted_formlogin", "$untainted_formpw", "$untainted_oldpw");
		print "Password for user $untainted_formlogin was successfully changed.  Please update your records.";
		print $former;
		print $footer;
		print LOG "$untainted_formlogin&$untainted_name,$login_used-$date¬$logupdate\n";
	}
	close(LOG);
}
	
sub eraser{
	if ($delvalue eq "yes")
	{
		$htp->htDelete($deluservalue);
		print "Login $deluservalue been permanently removed from the personnel database by $untainted_name.";
		print "<br>";
		print "To undo this action, you must <a href=\"/passwords.htm\" onMouseover=\"window.status='Go back to the database admin page'; return true\" OnMouseout=\"window.status=\'\'\">";
		print "go back</a> to the RADB admin page and re-enter the employee mentioned above.";
		print "<br>";
		$logupdate="User deleted";
		chomp($deluservalue);
		chomp($nameofuser);
		chomp($logupdate);
		open(LOG, ">>$logpath/.log") || die("Could not open log file to add \"delete\" entry.");
		print LOG "$deluservalue&$untainted_name,$login_used-$date¬$logupdate\n";
		close(LOG);
		print $copy;
		print $footer;

	}
	else
	{
		&mainprog; # is it really the *main* program?
	}
}

sub checker{
	# Shouldn't this all be handled by Apache::Htpasswd?
	
	open(DB, ">>$logpath/.htpasswd")||die("Could not open DB file for view.");
	@checker=<DB>; 
	foreach $checker(@checker)
	{
		($username, $pws)=split(/:/, $checker);
		if (   ($username eq $untainted_formlogin)
			|| ("\L\b$username\E" eq "\L\b$untainted_formlogin\E")
			|| ("\U\b$username\E" eq "\U\b$untainted_formlogin\E"))
		{
			print "$rej $former <br> <br> $footer";
			close(DB);								
			die("User already exists");
		}
	}
	# Need another close here to make sure it gets closed
	# because it won't usually get closed above
}

sub script{
print <<SCRIPTER;
<html>
  <head>
    <title>RADB v1.0 modification results</title>
    <meta http-equiv="pragma" content="no-cache">
    <meta http-equiv="Cache-Control" content="no-cache">
    <meta http-equiv="Expires" content="0">
    <script language="javascript">

      function submitter(){
        if(document.jim.name.value==""){
          alert("Please fill in your name.");
        }
        else if((document.jim.login.value=="") || (document.jim.login.value.length < 2)){
          alert("Please provide the login you\'d like to edit.  Logins must be two characters or greater in length.");
        }
        else if(document.jim.pw.value==""){
          alert("Please provide a password for the user you'd like to add to the database.");
         }
         else if ((document.jim.pw.value.length > 0)&& (document.jim.pw.value.length < 6)){
           if(confirm("For security, passwords should be six characters or more in length.\\nYour password is " + document.jim.pw.value.length + " characters in length.\\nDo you still want to use this password?")){
              alert("Password is too short, but has been accepted");
              document.jim.submit();
              alert("Your changes to the database have been saved, and logged for record.");
          }
          else
          {
            document.jim.pw.focus();
          }
          }
          else
          {
            if(document.jim.changepw.checked=="true"){
              alert("User " + document.DBEdit.login.value + "'s password has been changed.  Please update your records.");
          }
          document.jim.submit();
          alert("Your changes to the database have been saved, and logged for record.");
          }
          }
    function logger(){
      document.jim.viewdb.value="on";
      document.jim.submit();
      }
    function DBviewer(){
      document.jim.viewlog.value="on";
      document.jim.submit();
      }
    function pwchanger(){
      if(document.jim.chp.value=="on"){
        document.jim.chp.value="off";
        }
      else
        {
        document.jim.chp.value="on";
        }

              if(document.jim.chp.value=="on"){
       document.jim.chpw.value="off";
       document.jim.oldpw.disabled=true;
       }
       else
       {
       document.jim.chpw.value="on";
       document.jim.oldpw.disabled=false;
       }

       }
    function logdel(){
      if(document.jim.name.value==""){
        alert("Please enter your name.");
      }
      else
      {
        if(confirm("Are you sure you want to delete " + document.jim.logins.options[document.jim.logins.selectedIndex].value + "?")){
          alert("User " + document.jim.logins.options[document.jim.logins.selectedIndex].value + " has been deleted");
          document.jim.del.value="yes";
          document.jim.submit();
          }
          else
          {
          alert("No changes have been made to the database.");
          }
          }
          }

    </script>
  </head>
  <body>
</script>
  </head>
  <body>
SCRIPTER
}

sub heredocs{
$illegal=<<ILLEGAL;
    <h2>Illegal login</h2>
    <br>
    <p>
    Some information you submitted, (either your name, the login you want to create, or the password for this login), contains illegal characters, which for security are not accepted.&nbsp;&nbsp;Please <a href="../passwords.htm" OnMouseOver="window.status='Go back to the RADB admin page'; return true" OnMouseOut="window.status='';">Go back to the RADB admin page</a>&nbsp; and try again, using only alphanumeric characters.<p></p>
ILLEGAL
$copy= <<COPY;
    <br>
    <br>
    <br>
RADB created by and © Pine Tree Internet Solutions.  Unauthorized use is prohibited.
    <br>
    <br>
    <a href="/passwords.htm" onMouseover="window.status='Go back to the RADB Admin page'; return true" OnMouseOut="window.status=''">Go back to the RADB admin page.</a>
COPY
$former=<<FORMERCHGPW;
    <br>
    <h2>Add another user:</h2><br><br>
    <form name="jim" method="post" action="../cgi-bin/passwords.cgi">
      <input type="hidden" name="chp" value="on">
      <input type="hidden" name="chpw" value="off">

Your name:&nbsp;&nbsp;
      <input type="text" name="name">
      <br>
Login you want to create/edit:&nbsp;&nbsp;
      <input type="text" name="login">
&nbsp;&nbsp;&nbsp;&nbsp;Desired password for this login:&nbsp;&nbsp;
      <input type="password" name="pw">&nbsp;&nbsp;&nbsp;&nbsp;
      <br>
If changing an existing user's password, please check the &#8220;Change password&#8221; box below and enter that user's <b><u>old</u></b> password in this box:&nbsp;&nbsp;<input type="password" name="oldpw" disabled>
      <br>
This user already exists, I'm changing the password associated with this login.&nbsp;&nbsp;<input type="checkbox" name="changepw" onClick="javascript:pwchanger()">
      <br>
      <br>
      <input type="button" value="Submit changes" OnClick="javascript:submitter()">
    </form>
    <br>
    <br>
FORMERCHGPW
$pwr=<<PWR;
    <h2>Password rejected!</h2>
    <br>
    <br>
    The password associated with user $untainted_formlogin could not be changed, as it could not be verified that you possess the authority to perform this action.  Perhaps you forgot your password?

PWR
$footer = <<FOOTER;
RADB V1.0 created by:<br>
    <a href="http://www.pinetreenet.com/" onMouseOver="window.status='Pine Tree Internet Solutions homepage'; return true" onMouseOut="window.status=''">
    <img src="../ptis_title_small.jpg" alt="Pine Tree Internet Solutions" border=0></a>
    <br>
    <font size="-2">RADB v1.0 &copy; 2003, Pine Tree Internet Solutions.&nbsp;&nbsp;
      No part of the RADB may be reproduced without explicit permission from an authorized Pine Tree Internet Solutions representative.
    </font>
    <br>
    <br>
    <img src="../poweredby.png" alt="Powered by Apache, running on Red Hat Linux 7.3 (Valhalla)">
  </body>
</html>
FOOTER
$rej=<<REJECTED;
    <h3>Login rejected</h3>
 <br>
    <br>
    <p>Login $untainted_formlogin is already in use, or is too similar to another existing login.  Please try again.<br><br><p>
    <br>
    <br>
    <br>
    <A HREF="javascript:window.history.back(1)" onMouseover="window.status='Go back to the RADB Admin page'; return true" OnMouseOut="window.status=''">Go back to the RADB admin page.</a>
    $former;
    <br>
    <br>
    $footer;
REJECTED
$copy= <<COPY;
    <br>
    <br>
    <br>
RADB created by and © Pine Tree Internet Solutions.  Unauthorized use is prohibited.
    <br>
    <br>
    <a href="/passwords.htm" onMouseover="window.status='Go back to the RADB Admin page'; return true" OnMouseOut="window.status=''">Go back to the RADB admin page.</a>
    <br>
    <br>
COPY
}