y'know I probably should have uploaded this to gh sooner

2026-06-22 23:53:22 -07:00
commit b55d3306c4
62 changed files with 1002233 additions and 0 deletions
@@ -0,0 +1,42 @@
+page = ""
+args = ""
+responseType = "200 OK"
+contentType = "text/html"
+
+if "username" in argumentsDict and "password" in argumentsDict:
+    username = urllib.parse.unquote(argumentsDict["username"])
+    password = urllib.parse.unquote(argumentsDict["password"])
+
+    # Validate and sanitize returnpath
+    returnpath = "/"
+    returnto = ""
+    if "returnto" in argumentsDict:
+        candidate = urllib.parse.unquote(argumentsDict["returnto"])
+        resolved = os.path.realpath(script_directory + "/webroot" + candidate)
+        webroot_real = os.path.realpath(script_directory + "/webroot")
+        if resolved.startswith(webroot_real + os.sep) or resolved == webroot_real:
+            returnpath = candidate
+        returnto = "&returnto=" + urllib.parse.quote(returnpath)
+
+    status, result = userManagement.login(username, password)
+
+    if status == "success":
+        token = result
+        responseHeaders += ("Set-Cookie: session=" + token + "; Path=/; HttpOnly; SameSite=Strict\n").encode()
+        url = "/?p=" + urllib.parse.quote(returnpath)
+    else:
+        url = "/?p=/login/" + returnto + "&errortext=" + urllib.parse.quote("Invalid username or password.")
+
+    page = ("<html><head><title>Redirecting...</title>"
+            "<meta http-equiv=\"refresh\" content=\"0; url='" + html.escape(url) + "'\" />"
+            "</head><body><p><a href=\"" + html.escape(url) + "\">Redirect</a></p></body></html>")
+else:
+    responseType = "400 Bad Request"
+    fullRequestPath = script_directory + "/webroot/400.html"
+    page = open(fullRequestPath).read()
+
+# Clear sensitive locals
+username = ""
+password = ""
+
+responsecontent = page.encode()