#!/usr/bin/perl -w

#### Toccata SPPWMGR 
#### All Rights Reserverd 2006

print "Content-type: text/html\n\n";

#### Toccata Key
$tocatta_key = '3httum6rhy4c0tl';

#### Full path to your .htpasswd file (*Needs to be writable)
$full_path_to_htpasswd = '/home/theavaad/.htpasswd';

#### Full path to your log file (*Needs to be writable)
$full_path_to_logfile = '/home/theavaad/public_html/cgi-bin/sppwmgr.log';

#### Number of records to display on log display page
$number_of_log_records_to_display = 500;

################ No need to change anything below here

$buffer = $ENV{'QUERY_STRING'};

@pairs = split(/&/, $buffer);
foreach $pair (@pairs) { 
	($name, $value) = split(/=/, $pair);
	$value =~ tr/+/ /;
	$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
	$value =~ s/^( +)//;
	$value =~ s/( +)$//;
	$FORM{$name} = $value;
	$userinput .= "$name=$value&";
}

$key = $FORM{key};
$action = $FORM{action};
$username = $FORM{username};
$password = $FORM{password};


#### blank key
if (!$key)
{
	print "key required";

	$logdata = "Result:NoKey";
	log_action($logdata,$full_path_to_logfile);
	exit;
}

#### incorrect key
if ($key ne $tocatta_key)
{
	print "incorrect key";
	
	$logdata = "Result:IncorrectKey";
	log_action($logdata,$full_path_to_logfile);
	exit;
}


#### add action

if ($action eq 'add' && $username ne '' && $password ne '')
{
	#### check to see if user exists first
	if (user_exists($username))
	{
		print "already_exists";
		$logdata = "Result:$action:Abort $username Already Exists";
		log_action($logdata,$full_path_to_logfile);
		exit;
	}
	else # if (!user_exists($username))
	{
		$enc_password = encrypt_password($password);

		# Open and write to the data file
		open(DAT,">>$full_path_to_htpasswd") || cgi_error("Read permission problem on password file, not");
		flock(DAT,2);
		print DAT "$username:"; 
		print DAT "$enc_password"; 
		print DAT "\n";
		flock(DAT,8);
		close(DAT);
		#unlink($lockfile);
		print "added";
	}

	$logdata = "Result:$action:username=$username";
	log_action($logdata,$full_path_to_logfile);
	exit;
}


if ($action eq 'query' && $username)
{
	#### check to see if user exists first

	if(user_exists($username))
	{
		print "exists";
	}
	else
	{
		print "does not exist";
	}

	$logdata = "Result:$action:username=$username";
	log_action($logdata,$full_path_to_logfile);
	exit;
}


if ($action eq "list")
{
	open(DAT, $full_path_to_htpasswd) || cgi_error("Read permission problem on password file. ");
	@user_array=<DAT>;
	close(DAT);

	foreach $user(@user_array)
	{
		print "$user<br>\n";
	}

	$logdata = "Result:$action";
	log_action($logdata,$full_path_to_logfile);
	exit;
}

if ($action eq 'log')
{
	open(DAT, $full_path_to_logfile) || cgi_error("Read permission problem on log file. ");
	@record_array=<DAT>;
	close(DAT);

	@record_array = reverse @record_array;

	$display_counter = 0;

	foreach $record(@record_array)
	{
		print "$record<br>\n";
		$display_counter++;
		if ($display_counter eq $number_of_log_records_to_display)
		{
			last;
		}
	}

	$logdata = "Result:$action";
	log_action($logdata,$full_path_to_logfile);
	exit;
}

if ($action eq 'delete' && $username ne '')
{

	$removed = 0;

	open(DAT, $full_path_to_htpasswd) || cgi_error("Read permission problem on password file. ");
	@user_array=<DAT>;
	close(DAT);

	open(WRITEDAT, ">$full_path_to_htpasswd") || cgi_error("Could not open file to write."); 

	foreach $user(@user_array)
	{
		@temp_array = split(/:/, $user);

		if ($username eq $temp_array[0])
		{
			$removed = 1;
			$logdata = "Result:$action $username from htpasswd";
		}
		else
		{
			print WRITEDAT trim($user); 
			print WRITEDAT "\n";
		}
	}
	close(WRITEDAT);

	if (!$removed)
	{
		print "not found";
	}
        else
        {
		print "deleted";
	}

	$logdata = "Result:$action:username=$username:status=$removed";
	log_action($logdata,$full_path_to_logfile);
        exit;
}

if ($action == '')
{
print <<ENDHTML
<pre>
add
http://www.abc.com/cgi-bin/pwdmgr.cgi?key=abcdefg&action=add&username=bobsmith&password=M0n3y
- add the username specified to the htpasswd file along with the supplied password

delete
http://www.abc.com/cgi-bin/pwdmgr.cgi?key=abcdefg&action=delete&username=bobsmith
- remove the username specified from the htpasswd file, displays an error if the username 
  is not present in the htpasswd file

query
http://www.abc.com/cgi-bin/pwdmgr.cgi?key=abcdefg&action=query&username=bobsmith
- return either "Exists" if found or "Doesn't Exist" 
 
list
http://www.abc.com/cgi-bin/pwdmgr.cgi?key=abcdefg&action=list
- lists the contents of the htpasswd file

log
http://www.abc.com/cgi-bin/pwdmgr.cgi?key=abcdefg&action=log
- displays the log file (stored in .logfile) the number of lines displayed is controlled 
  by a variable that is defined at the top of the script (\$number_of_log_records_to_display)
ENDHTML
}



sub log_action($logdata,$full_path_to_logfile)
{
	$timestamp = time();
	$referrer = $ENV{'HTTP_REFERER'};

#### Swap this commented line for the otherone to debug
#### open(DAT,">>$full_path_to_logfile") || cgi_error("Read or Write permission problem on log file");
	open(DAT,">>$full_path_to_logfile") || die("Cannot Open File");
	print DAT "sppwmgr:$timestamp:$referrer:"; #referer url
	print DAT "$logdata"; 
	print DAT "\n";
	close(DAT);
}  

sub encrypt_password {
	my ($encpass) = $_[0];
	my ($salter) = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789./';
	srand(time);
	my ($salt) = substr($salter,rand(length($salter)),1);
	$salt .= substr($salter,rand(length($salter)),1);
	$encpass = crypt($encpass,$salt);
	return($encpass);
}

sub user_exists($username) {

	$user_exists = 0;

	open(DAT, $full_path_to_htpasswd) || cgi_error("Read permission problem on password file. ");
	@user_array=<DAT>;
	close(DAT);

	foreach $user(@user_array)
	{
		@temp_array = split(/:/, $user);

		if ($username eq $temp_array[0])
		{
			$user_exists = 1;
		}
	}


	if ($user_exists == 1)
	{
		return 1;
	}
	else
	{
		return 0;
	}
}

sub trim {
	my @out = @_;
	for (@out) {
	  s/^\s+//;
	  s/\s+$//;
	  }
	  return wantarray ? @out : $out[0];
}

exit;

sub cgi_error {
	my $message =shift;
	print <<"HTTP";
$message
HTTP
}

exit;