43 lines
1.6 KiB
Python
43 lines
1.6 KiB
Python
page = ""
|
|
args = ""
|
|
responseType = "200 OK"
|
|
contentType = "text/html"
|
|
|
|
if "username" in argumentsDict and "password" in argumentsDict:
|
|
username = urllib.parse.unquote(argumentsDict["username"])
|
|
password = urllib.parse.unquote(argumentsDict["password"])
|
|
|
|
# Validate and sanitize returnpath
|
|
returnpath = "/"
|
|
returnto = ""
|
|
if "returnto" in argumentsDict:
|
|
candidate = urllib.parse.unquote(argumentsDict["returnto"])
|
|
resolved = os.path.realpath(script_directory + "/webroot" + candidate)
|
|
webroot_real = os.path.realpath(script_directory + "/webroot")
|
|
if resolved.startswith(webroot_real + os.sep) or resolved == webroot_real:
|
|
returnpath = candidate
|
|
returnto = "&returnto=" + urllib.parse.quote(returnpath)
|
|
|
|
status, result = userManagement.login(username, password)
|
|
|
|
if status == "success":
|
|
token = result
|
|
responseHeaders += ("Set-Cookie: session=" + token + "; Path=/; HttpOnly; SameSite=Strict\n").encode()
|
|
url = "/?p=" + urllib.parse.quote(returnpath)
|
|
else:
|
|
url = "/?p=/login/" + returnto + "&errortext=" + urllib.parse.quote("Invalid username or password.")
|
|
|
|
page = ("<html><head><title>Redirecting...</title>"
|
|
"<meta http-equiv=\"refresh\" content=\"0; url='" + html.escape(url) + "'\" />"
|
|
"</head><body><p><a href=\"" + html.escape(url) + "\">Redirect</a></p></body></html>")
|
|
else:
|
|
responseType = "400 Bad Request"
|
|
fullRequestPath = script_directory + "/webroot/400.html"
|
|
page = open(fullRequestPath).read()
|
|
|
|
# Clear sensitive locals
|
|
username = ""
|
|
password = ""
|
|
|
|
responsecontent = page.encode()
|