'metavar': 'FILE', 'dest': 'config',
'default': OS.path.join(HOME, 'chpwd.conf'),
'help': 'read configuration from FILE.' }),
+ ('-s', '--ssl', {
+ 'dest': 'sslp', 'action': 'store_true',
+ 'help': 'pretend CGI connection is carried over SSL/TLS' }),
('-u', '--user', {
'metavar': 'USER', 'dest': 'user', 'default': None,
'help': "impersonate USER, and default context to `userv'." })]:
## The special variables, to be picked out by `cgiparse'.
CGI.SPECIAL['%act'] = None
CGI.SPECIAL['%nonce'] = None
+CGI.SPECIAL['%user'] = None
## We don't want to parse arguments until we've settled on a context; but
## issuing redirects in the early setup phase fails because we don't know
## `cgi-noauth'.
if ctx != 'cgi-noauth':
+ ## The next part of the URL should be the user name, so that caches don't
+ ## cross things over.
+ expuser = CGI.SPECIAL['%user']
+ if expuser is None:
+ if i >= np: raise U.ExpectedError, (404, 'Missing user name')
+ expuser = CGI.PATH[i]
+ i += 1
+
## If there's no token cookie, then we have to bail.
try: token = CGI.COOKIE['chpwd-token']
except KeyError:
except HA.AuthenticationFailed, e:
CGI.redirect(CGI.action('login', why = e.why))
return
+ if CU.USER != expuser: raise U.ExpectedError, (401, 'User mismatch')
+ CGI.STATE.kw['user'] = CU.USER
## Invoke the subcommand handler.
c.cgi(CGI.PARAM, CGI.PATH[i:])
with cli_errors():
OPTS, args = OPTPARSE.parse_args()
CONF.loadconfig(OPTS.config)
+ CGI.SSLP = OPTS.sslp
ctx = OPTS.context
if OPTS.user:
CU.set_user(OPTS.user)