#!/usr/local/bin/perl
########################################################################
# HTPASSWD Password generator and manager - Version 1.0 - 11/4/2002
# The original htpass script writen by Tony Awtrey has been modified
# by Mike Hansen of the National Federation of the Blind of Nebraska
# (http://nfbn.inebraska.com). Building on the htpasswd ver. 0.9 script
# writen by Tony Awtrey the following features and bug fixes were added.
#	-- Ability to add custom headers and footers
#	-- Users and Groups are know sorted Alpahbeticaly
#	-- Appropriate HTML tags were added to make the forms blind friendly
#	-- A bug was corrected that would prevent you from assigning a user to
#	   to a group that currently had no members
#	-- A bug was corrected that would cause strange things to happen if the 
#	   Admin form was refreshed through the browser
#	-- Format of listings of group members was changed to better fit on a page
######################################################################
# HTPASSWD Password generator and manager - Version 0.9 - 7/13/98
# Copyright 1998 Anthony Awtrey
#
# This application is licensed under the GNU Public License.
# For more information see: http://www.gnu.org/copyleft/gpl.html
#
# This HTML will set up a form to return the correct line for an
# .htpasswd file. But Wait There's More!
#
# <P><FORM ACTION="http://www.domain.com/cgi-bin/htpass.cgi" METHOD="POST">
# <INPUT TYPE="hidden" NAME="formtype" VALUE="password">
# User Name: <INPUT NAME="user" SIZE="12" TYPE="TEXT"><BR>
# Password: <INPUT NAME="passwd" SIZE="12" TYPE="PASSWORD"><BR>
# <INPUT TYPE="SUBMIT" VALUE="   OK   ">&nbsp;&nbsp;<INPUT TYPE="reset" VALUE="CLEAR">
# </FORM></P>
#
# If you want to let it, the program will maintain the .htpasswd file
# for you. This is as secure as the .htaccess security is itself.
# (Read: Not Very Secure At All!! Do not rely on it completely!!)
# Set up a directory specifically for .htpasswd and .htgroup files.
# Include an .htaccess file to restrict access to the directory.
# Use the script and form above to get a username / passwd line for
# and add it in manually. Now, go to the URL of the script like this:
#
# http://www.domain.com/cgi-bin/htpass.cgi?admin
#
# The ?admin will cause the script to bring up a screen to allow you
# create and delete user accounts, add and remove groups and change
# group membership. The form is pretty straight-forward. If you have
# any questions on the script please go to the http://www.awtrey.com/
# website and leave a WebBoard message. I will answer any questions
# you have.
######################################################################
#Program Vars
$cgidir = "http://your.domain.com/cgi-bin/htpass";
$cgifile = "htpass.cgi";
$cgiurl = "$cgidir/$cgifile";
$htaccess_dir = "/server/path/to/directory/containing/.htpaswd/and/.htgroup";
$htpasswd_file = ".htpasswd";
$htgroup_file = ".htgroup";

###################################
#HTML Vars
$site_title = "Your Homepage";
$title = "User and Group Manager";
$stylesheet = "../style.css";
$bgcolor = "#FFFFFF";
# If you would like to use a header file set the next value to 1 and 
# specify the path to the header file, other wise set it to 0.
$header = 1;
$headerpath = "/server/path/to/header_file";
# If you would like to use a footer file set the next value to 1 and 
# specify the path to the footer file, other wise set it to 0.
$footer = 1;
$footerpath = "/server/path/to/footer_file";

#Do NOT Touch below this point
###################################
#Forms HTML Code.

$pw_form = qq{
<P>
<FORM METHOD="POST" ACTION="$cgiurl">
<INPUT TYPE="hidden" NAME="formtype" VALUE="password">
<Label for=uname>Username:</Label>
<INPUT TYPE="text" NAME="user" ID="uname" SIZE="12" MAXLENGTH="32">
<BR>
<Label for=pword>Password:</Label>
<INPUT TYPE="password" NAME="passwd" ID="pword" SIZE="12" MAXLENGTH="32">
<BR>
<INPUT TYPE="submit" VALUE="Get Password"><INPUT TYPE="reset" VALUE="Reset Form">
</FORM>
</P>
};

$au_form1 = qq{
<A NAME="adduser">
<HR SIZE="5">
<H5 ALIGN="center">Add New User</H5>
<CENTER>
<FORM ACTION="$cgiurl" METHOD="POST">
<INPUT TYPE="hidden" NAME="formtype" VALUE="adduser">
<Label for=aname>Admin Name:</Label> <INPUT NAME="user" ID="aname" SIZE="12" TYPE="TEXT"><BR>
<Label for=apword>Admin Password:</Label> <INPUT NAME="passwd" ID="apword" SIZE="12" TYPE="PASSWORD"><BR>
<Label for=nuname>New User Name:</Label> <INPUT NAME="new_user" ID="nuname" SIZE="12" TYPE="TEXT"><BR>
<Label for=npword1>New User Password1:</Label> <INPUT NAME="new_passwd1" ID="npword1" SIZE="12" TYPE="PASSWORD"><BR>
<Label for=npword2>New User Password2:</Label> <INPUT NAME="new_passwd2" ID="npword2" SIZE="12" TYPE="PASSWORD"><BR>
<Label for=agroup>Initial Group Member:</Label> <SELECT NAME="add_group" ID="agroup">
<OPTION VALUE="none">Select a group
};

$du_form1 = qq{
<A NAME="deluser">
<HR>
<H5 ALIGN="center">Delete User</H5>
<CENTER>
<FORM ACTION="$cgiurl" METHOD="POST">
<INPUT TYPE="hidden" NAME="formtype" VALUE="deluser">
<Label for=aname>Admin Name:</Label> <INPUT NAME="user" ID="aname" SIZE="12" TYPE="TEXT"><BR>
<Label for=apword>Admin Password:</Label> <INPUT NAME="passwd" ID="apword" SIZE="12" TYPE="PASSWORD"><BR>
<Label for=duser>User Name:</Label> <SELECT NAME="del_user" ID="duser">
<OPTION VALUE="none">Select a user
};

$ag_form = qq{
<A NAME="addgroup">
<HR>
<H5 ALIGN="center">Add New Group</H5>
<CENTER>
<FORM ACTION="$cgiurl" METHOD="POST">
<INPUT TYPE="hidden" NAME="formtype" VALUE="addgroup">
<Label for=aname>Admin Name:</Label> <INPUT NAME="user" ID="aname" SIZE="12" TYPE="TEXT"><BR>
<Label for=apword>Admin Password:</Label> <INPUT NAME="passwd" ID="apword" SIZE="12" TYPE="PASSWORD"><BR>
<Label for=ngroup>New Group Name:</Label> <INPUT NAME="new_group" ID="ngroup" SIZE="12" TYPE="TEXT"><BR>
<INPUT TYPE="SUBMIT" VALUE="   OK   ">&nbsp;&nbsp;<INPUT TYPE="reset" VALUE="CLEAR">
</FORM>
</CENTER>
};

$dg_form = qq{
<A NAME="delgroup">
<HR>
<H5 ALIGN="center">Delete Group</H5>
<CENTER>
<FORM ACTION="$cgiurl" METHOD="POST">
<INPUT TYPE="hidden" NAME="formtype" VALUE="delgroup">
<Label for=aname>Admin Name:</Label> <INPUT NAME="user" ID="aname" SIZE="12" TYPE="TEXT"><BR>
<Label for=apword>Admin Password:</Label> <INPUT NAME="passwd" ID="apword" SIZE="12" TYPE="PASSWORD"><BR>
<Label for=dgroup>Group Name:</Label> <SELECT NAME="del_group" ID="dgroup">
<OPTION VALUE="none">Select A Group...
};

$member_form1 = qq{
<A NAME="member">
<HR>
<H5 ALIGN="center">Add/Delete Group Members</H5>
<CENTER>
<FORM ACTION="$cgiurl" METHOD="POST">
<INPUT TYPE="hidden" NAME="formtype" VALUE="member">
<Label for=aname>Admin Name:</Label> <INPUT NAME="user" ID="aname" SIZE="12" TYPE="TEXT"><BR>
<Label for=apword>Admin Password:</Label> <INPUT NAME="passwd" ID="apword" SIZE="12" TYPE="PASSWORD"><BR>
<Label for=cmember>User Name:</Label> <SELECT NAME="ch_member" ID="cmember">
<OPTION VALUE="none">Select A User...
};
$member_form2 = qq{
</SELECT><BR>
<Label for=gname>Group Name:</Label> <SELECT NAME="tfgroup" ID="gname">
<OPTION VALUE="none">Select A Group...
};

$formend = qq{
</SELECT><BR>
<INPUT TYPE="SUBMIT" VALUE="   OK   ">&nbsp;&nbsp;<INPUT TYPE="reset" VALUE="CLEAR">
</FORM>
</CENTER>
};


###################################
###################################
#Start Main Prog

if ($ENV{'QUERY_STRING'} eq "admin") {
    &admin;
} elsif ($ENV{'REQUEST_METHOD'} eq 'POST') {
        &form_vars;
        if ($FORM{'formtype'} eq 'password') {
            &password_it;
            exit;
        } elsif ($FORM{'formtype'} eq 'adduser') {
            &auser;
            exit;
        } elsif ($FORM{'formtype'} eq 'deluser') {
            &duser;
            exit;
        } elsif ($FORM{'formtype'} eq 'addgroup') {
            &agroup;
            exit;
        } elsif ($FORM{'formtype'} eq 'delgroup') {
            &dgroup;
            exit;
        } elsif ($FORM{'formtype'} eq 'member') {
            &mgroup;
            exit;
        } else {
            &error_response(badcgi);
    }
} else {
    &getpass;
}

exit;

#End Main Prog
###################################
###################################
#Forms Subroutines

sub getpass {
    $title = "Get Password";
    &print_html_header;
    print "$pw_form\n";
    &print_html_footer;
}

sub password_it {
    &make_pass;
    $title = "The Survey Says...";
    &print_html_header;
    print "<P>The entry in the .htpasswd file should be:<BR>\n";
    print "$user\:$passwdcrypt</P>";
    &print_html_footer;
}

sub admin {
    &getgroups;
    &getusers;

    $title = "User and Group Manager";
    &print_html_header;

    print "<H3>User Manager</H3>\n";
    print "<P>Users:</P>\n";
    print "<PRE>\n";
    foreach $user (@users) {
        print "$user\n";
    }
    print "</PRE>\n";

    print "<UL>\n";
    print "<LI><A HREF=\"#adduser\">Add User</A>\n";
    print "<LI><A HREF=\"#deluser\">Delete User</A>\n";
    print "</UL>\n";

    print "<H3>Group Manager</H3>\n";
    print "<P>Groups:</P>\n";
    print "<PRE>\n";
    foreach $group (@groups) {
        print "$group: ";
	$memnum = 1;
        foreach $member (@$group) {
            if ($memnum == 9){
		$memnum = 1;
		print "\n$group Cont.: ";
	    }
	    print "$member ";
	    $memnum++;
    }
    print "\n";
    }
    print "</PRE>\n";

    print "<UL>\n";
    print "<LI><A HREF=\"#addgroup\">Add Group</A>\n";
    print "<LI><A HREF=\"#delgroup\">Delete Group</A>\n";
    print "<LI><A HREF=\"#member\">Add/Delete Group Member</A>\n";
    print "</UL>\n";


    print "$au_form1\n";
    foreach $group (@groups) {
        print "<OPTION VALUE=\"$group\">$group\n";
    }
    print "$formend\n";

    print "$du_form1\n";
    foreach $user (@users) {
        print "<OPTION VALUE=\"$user\">$user\n";
    }
    print "$formend\n";

    print "$ag_form\n";

    print "$dg_form\n";
    foreach $group (@groups) {
        print "<OPTION VALUE=\"$group\">$group\n";
    }
    print "$formend\n";

    print "$member_form1\n";
    foreach $user (@users) {
        print "<OPTION VALUE=\"$user\">$user\n";
    }
    print "$member_form2\n";
    foreach $group (@groups) {
        print "<OPTION VALUE=\"$group\">$group\n";
    }
    print "$formend\n";

    &print_html_footer;
}

sub auser {
    &is_admin;
    &check_passwd;
    &add_user;
    &reloadadmin;
}

sub duser {
    &is_admin;
    &check_passwd;
    &del_user;
    &reloadadmin;
}

sub agroup {
    &is_admin;
    &check_passwd;
    &add_group;
    &reloadadmin;
}

sub dgroup {
    &is_admin;
    &check_passwd;
    &del_group;
    &reloadadmin;
}

sub mgroup {
    &is_admin;
    &check_passwd;
    &member_group;
    &reloadadmin;
}

sub testscript {
    $title = "Testing Script";
    &print_html_header;
    print "<H1>$title</H1>\n";
    &print_html_footer;
}

###################################
#Real Subroutines

sub print_html_header {
    print "Content-type: text/html\n\n";
    print "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\" \"http://www.w3.org/TR/html4/strict.dtd\">\n";
    print "<HTML lang=\"en\">\n";
    print "<HEAD>\n";
    print "<LINK REL=\"StyleSheet\" HREF=\"$stylesheet\">\n" if $stylesheet;
    print "<TITLE>$title</TITLE>\n";
    print "<BODY BGCOLOR=\"$bgcolor\">\n";
    &prestuff;
}

sub print_html_footer {
    &poststuff;
    print "</BODY>\n";
    print "</HTML>\n";
}

sub error_response {
    $error = $_[0];

    if ($error eq 'badcgi') {
        $title = "Bad CGI Use";
        &print_html_header;
        print "<P>Please use the correct form to use this CGI script.</P>\n";
        &print_html_footer;
        exit;
    } elsif ($error eq 'badfile') {
        $title = "File Error!!";
        &print_html_header;
        print "<P>Please contact webmaster.</P>\n";
        &print_html_footer;
        exit;
    } elsif ($error eq 'badcombo') {
        $title = "Bad Username/Password!!";
        &print_html_header;
        print "<P>$title</P>\n";
        &print_html_footer;
        exit;
    } elsif ($error eq 'badnewcombo') {
        $title = "New user passwords do not match!!";
        &print_html_header;
        print "<P>$title</P>\n";
        &print_html_footer;
        exit;
    } elsif ($error eq 'notadmin') {
        $title = "User not an Admin!!";
        &print_html_header;
        print "<P>$title</P>\n";
        &print_html_footer;
        exit;
    } else {
        $title = "Unspecified Error!";
        &print_html_header;
        print "<P>Oops.</P>\n";
        &print_html_footer;
        exit;
    }
}

sub form_vars {
    read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
    @pairs = (split(/&/, $buffer));
    foreach $pair (@pairs) {
        ($name, $value) = split(/=/, $pair);
        $value =~ tr/+/ /;
        $value =~ s/%([a-fA_F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
        $value =~ s/<!--(.|\n)*-->//g;
        #$value =~ s/<([^>]|\n)*>//g;
        $FORM{$name} = $value;
    }
}

sub make_pass {
    $passwd = $FORM{'passwd'};
    $user = $FORM{'user'};
    srand($$|time);
    @saltchars=(a..z,A..Z,0..9,'.','/');
    $salt=$saltchars[int(rand($#saltchars+1))];
    $salt.=$saltchars[int(rand($#saltchars+1))];
    $passwdcrypt = crypt($passwd,$salt);
}

sub is_admin {
    $sent_user = $FORM{'user'};
    $sent_pw = $FORM{'passwd'};
    
    open(HTGROUP, "$htaccess_dir/$htgroup_file") || &error_response(badfile);
    @htgroup = <HTGROUP>;
    close(HTGROUP);

    foreach $group_line (@htgroup) {
        chop($group_line) if ($group_line =~ /\n/);
        ($group,$members) = split(/: /,$group_line);
        if (!($group eq "admin:")) { next; }
        @admins = split(/ /,$members);
    }

    foreach $member (@admins) {
        chop($member) if ($member =~ /\n/);
        if (!($sent_user eq $member)) { next; }
        return;
    }
    &error_response(notadmin);
}

sub check_passwd {
    $sent_user = $FORM{'user'};
    $sent_pw = $FORM{'passwd'};

    open(HTPASSWD, "$htaccess_dir/$htpasswd_file") || &error_response(badfile);
    @htpasswd = <HTPASSWD>;
    close(HTPASSWD);

    foreach $passwd_line (@htpasswd) {
        chop($passwd_line) if ($passwd_line =~ /\n/);
        ($real_user,$real_pw) = split(/:/,$passwd_line);
        if (!($real_user eq $sent_user)) { next; }
        $enc_pw = crypt($sent_pw,substr($real_pw, 0, 2));
        if (!($enc_pw eq $real_pw)) { &error_response(badcombo); }
        else { return; }
    }
    &error_response(badcombo);
}

sub getgroups {
    open(HTGROUP, "$htaccess_dir/$htgroup_file") || &error_response(badfile);
    @htgroup = <HTGROUP>;
    close(HTGROUP);

    undef @groups;

    foreach $group_line (@htgroup) {
        chop($group_line) if ($group_line =~ /\n/);
        ($group,$members) = split(/: /,$group_line);
        chop($group) if ($group =~ /\w+:$/);
        push(@groups,$group);
        @$group = split(/ /,$members);
    }
    foreach $group (@$group){
	@$group = sort @$group;
	@groups = sort @groups
    }
}

sub getusers {
    open(HTPASSWD, "$htaccess_dir/$htpasswd_file") || &error_response(badfile);
    @htpasswd = <HTPASSWD>;
    close(HTPASSWD);

    undef @users;

    foreach $passwd_line (@htpasswd) {
        chop($passwd_line) if ($passwd_line =~ /\n/);
        ($user,$pw) = split(/:/,$passwd_line);
        push(@users,$user);
        $$user = $pw
    }
 	@users = sort @users;
}

sub add_user {
    $new_user = $FORM{'new_user'};
    $new_pw1 = $FORM{'new_passwd1'};
    $new_pw2 = $FORM{'new_passwd2'};
    $add_group = $FORM{'add_group'} if (($FORM{'add_group'}) || (!($FORM{'add_group'} eq "none")));

    if (!($new_pw1 eq $new_pw2)) { &error_response(badnewcombo); }

    srand($$|time);
    @saltchars=(a..z,A..Z,0..9,'.','/');
    $salt=$saltchars[int(rand($#saltchars+1))];
    $salt.=$saltchars[int(rand($#saltchars+1))];
    $passwdcrypt = crypt($new_pw1,$salt);

    open(HTPASSWD, ">>$htaccess_dir/$htpasswd_file") || &error_response(badfile);
    print HTPASSWD "$new_user\:$passwdcrypt\n";
    close(HTPASSWD);

    if (!($add_group)) { return; }

    &getgroups;

    foreach $group (@groups) {
        if ($group eq $add_group) {
                push(@$group,$new_user);
        }
    }

    open(HTGROUP, ">$htaccess_dir/$htgroup_file") || &error_response(badfile);
    foreach $group (@groups) {
        print HTGROUP "$group\:";
        foreach $member (@$group) {
            print HTGROUP " $member";
        }
    print HTGROUP "\n";
    }
    close(HTGROUP);
}

sub del_user {
    $del_user = $FORM{'del_user'};

    &getusers;
    &getgroups;

    $m = 0;

    foreach $group (@groups) {
        $m = 0;
        foreach $member (@$group) {
            if ($member eq $del_user) {
                splice(@$group,$m,1);
            }
            $m++;
        }
    }

    $u = 0;

    foreach $user (@users) {
        if ($user eq $del_user) {
            splice(@users,$u,1);
        }
        $u++;
    }

    open(HTPASSWD, ">$htaccess_dir/$htpasswd_file") || &error_response(badfile);
    foreach $user (@users) {
        print HTPASSWD "$user\:$$user\n";
    }
    close(HTPASSWD);

    open(HTGROUP, ">$htaccess_dir/$htgroup_file") || &error_response(badfile);
    foreach $group (@groups) {
        print HTGROUP "$group\:";
        foreach $member (@$group) {
            print HTGROUP " $member";
        }
        print HTGROUP "\n";
    }
    close(HTGROUP);
}

sub add_group {
    $new_group = $FORM{'new_group'};

    &getgroups;

    push(@groups,$new_group);

    open(HTGROUP, ">$htaccess_dir/$htgroup_file") || &error_response(badfile);
    foreach $group (@groups) {
        print HTGROUP "$group\:";
        foreach $member (@$group) {
            print HTGROUP " $member";
        }
    print HTGROUP "\n";
    }
    close(HTGROUP);
}

sub del_group {
    $del_group = $FORM{'del_group'};
    $g = 0;

    &getgroups;

    foreach $group (@groups) {
        if ($group eq $del_group) {
                splice(@groups,$g,1);
        }
        $g++;
    }

    open(HTGROUP, ">$htaccess_dir/$htgroup_file") || &error_response(badfile);
    foreach $group (@groups) {
        print HTGROUP "$group\:";
        foreach $member (@$group) {
            print HTGROUP " $member";
        }
    print HTGROUP "\n";
    }
    close(HTGROUP);
}

sub member_group {
    $ch_member = $FORM{'ch_member'};
    $tfgroup = $FORM{'tfgroup'};
    $tstgroup = "Stuff";
    $m = 0;
    $gaction = "add";
    &getgroups;

####   Decide to delete or add the person
    foreach $member (@$tfgroup) {
        if ($member eq $ch_member) {
            $gaction = "delete";
	    last;
	}
     }

        foreach $member (@$tfgroup) {
            if ($member eq $ch_member) {
                splice(@$tfgroup,$m,1);
            } elsif ($#$tfgroup eq $m) {
		push(@$tfgroup,$ch_member);
		last;
            }     
        $m++;
        }

	if ($gaction eq "add"){
		if (@$tfgroup == ""){
			push(@$tfgroup,$ch_member);
		}
	}

    open(HTGROUP, ">$htaccess_dir/$htgroup_file") || &error_response(badfile);
    foreach $group (@groups) {
        print HTGROUP "$group\:";
        foreach $member (@$group) {
            print HTGROUP " $member";
        }
    print HTGROUP "\n";
    }
    close(HTGROUP);
}

sub reloadadmin {
	print "Content-type: text/html\n\n";
	print "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\" \"http://www.w3.org/TR/html4/strict.dtd\">\n";
        print "<HTML lang=\"en\"><head><title>$title Admin Redirector</title>\n";
	print "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=$cgiurl?admin\"></head><body>\n";
	print "<body>\n";
	print "<a href=\"$cgiurl?admin\">Back to $site_title $title</a>\n";
	print "</body></html>";
}

sub prestuff {
	if ($header) {
		open (FILE, "$headerpath");
        	@lines = <FILE>;
	        close(FILE);
		foreach $line (@lines) {print "$line";}
	}
	print "<center><H1>$title</H1></Center>\n<HR>";
}

sub poststuff {
	if ($footer) {
        	open (FILE, "$footerpath");
        	@lines = <FILE>;
        	close(FILE);
		foreach $line (@lines) {print "$line";}
	}
}