Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Begin adding the ability to restrict self-registration to people with a particular email address pattern. This check-in provides the setting to specify the authorized email addresses, but an attacker can still lie about his email address and sneak in that way. Still a work-in-progress. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | restricted-self-registration |
| Files: | files | file ages | folders |
| SHA3-256: |
7916dbaa03f6b8151cfb94ddb7663939 |
| User & Date: | drh 2020-04-23 18:36:42.159 |
Context
|
2020-04-23
| ||
| 18:50 | Merge the subscriber fix from trunk. check-in: 0be585a178 user: drh tags: restricted-self-registration | |
| 18:36 | Begin adding the ability to restrict self-registration to people with a particular email address pattern. This check-in provides the setting to specify the authorized email addresses, but an attacker can still lie about his email address and sneak in that way. Still a work-in-progress. check-in: 7916dbaa03 user: drh tags: restricted-self-registration | |
| 16:59 | Grammar and clarity tweaks to fossil-v-git.wiki check-in: 2cfd125640 user: wyoung tags: trunk | |
Changes
Changes to src/login.c.
| ︙ | ︙ | |||
1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 |
"SELECT 1 FROM user WHERE login=%Q "
"UNION ALL "
"SELECT 1 FROM event WHERE user=%Q OR euser=%Q",
zUserID, zUserID, zUserID
);
return rc;
}
/*
** WEBPAGE: register
**
** Page to allow users to self-register. The "self-register" setting
** must be enabled for this page to operate.
*/
| > > > > > > > > > > > > > > > > > > > > > > > > > > > | 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 |
"SELECT 1 FROM user WHERE login=%Q "
"UNION ALL "
"SELECT 1 FROM event WHERE user=%Q OR euser=%Q",
zUserID, zUserID, zUserID
);
return rc;
}
/*
** Check an email address and confirm that it is valid for self-registration.
** The email address is known already to be well-formed.
**
** The default behavior is that any valid email address is accepted.
** But if the "self-reg-email" setting exists and is not empty, then
** it is a comma-separated list of GLOB patterns for email addresses
** that are authorized to self-register.
*/
static int authorized_self_register_email(const char *zEAddr){
char *zGlob = db_get("self-reg-email",0);
Glob *pGlob;
char *zAddr;
int rc;
if( zGlob==0 || zGlob[0]==0 ) return 1;
zGlob = fossil_strtolwr(fossil_strdup(zGlob));
pGlob = glob_create(zGlob);
fossil_free(zGlob);
zAddr = fossil_strtolwr(fossil_strdup(zEAddr));
rc = glob_match(pGlob, zAddr);
fossil_free(zAddr);
glob_free(pGlob);
return rc!=0;
}
/*
** WEBPAGE: register
**
** Page to allow users to self-register. The "self-register" setting
** must be enabled for this page to operate.
*/
|
| ︙ | ︙ | |||
1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 |
zErr = "Required";
}else if( zEAddr[0]==0 ){
iErrLine = 3;
zErr = "Required";
}else if( email_address_is_valid(zEAddr,0)==0 ){
iErrLine = 3;
zErr = "Not a valid email address";
}else if( strlen(zPasswd)<6 ){
iErrLine = 4;
zErr = "Password must be at least 6 characters long";
}else if( fossil_strcmp(zPasswd,zConfirm)!=0 ){
iErrLine = 5;
zErr = "Passwords do not match";
}else if( login_self_choosen_userid_already_exists(zUserID) ){
| > > > | 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 |
zErr = "Required";
}else if( zEAddr[0]==0 ){
iErrLine = 3;
zErr = "Required";
}else if( email_address_is_valid(zEAddr,0)==0 ){
iErrLine = 3;
zErr = "Not a valid email address";
}else if( authorized_self_register_email(zEAddr)==0 ){
iErrLine = 3;
zErr = "Not an authorized email address";
}else if( strlen(zPasswd)<6 ){
iErrLine = 4;
zErr = "Password must be at least 6 characters long";
}else if( fossil_strcmp(zPasswd,zConfirm)!=0 ){
iErrLine = 5;
zErr = "Passwords do not match";
}else if( login_self_choosen_userid_already_exists(zUserID) ){
|
| ︙ | ︙ |
Changes to src/setup.c.
| ︙ | ︙ | |||
501 502 503 504 505 506 507 |
@ </p>
@ <hr />
onoff_attribute("Allow users to register themselves",
"self-register", "selfregister", 0, 0);
@ <p>Allow users to register themselves through the HTTP UI.
@ The registration form always requires filling in a CAPTCHA
| | > > > > > > > > > > > > > | 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 |
@ </p>
@ <hr />
onoff_attribute("Allow users to register themselves",
"self-register", "selfregister", 0, 0);
@ <p>Allow users to register themselves through the HTTP UI.
@ The registration form always requires filling in a CAPTCHA
@ (<em>auto-captcha</em> setting is ignored). Keep in mind that anyone
@ can register under any user name. This option is useful for public projects
@ where you do not want everyone in any ticket discussion to be named
@ "Anonymous". (Property: "self-register")</p>
@ <hr />
entry_attribute("Authorized self-registration email addresses", 35,
"self-reg-email", "selfregemail", "", 0);
@ <p>This is a comma-separated list of GLOB patterns that specify
@ email addresses that are authorized to self-register. If blank
@ (the usual case), then any email address can be used to self-register.
@ This setting is used to limit self-registration to members of a particular
@ organization or group based on their email address. For example,
@ if the pattern is "<tt>*@megacorp.com, *@af.mil.to</tt>" then
@ only employees of MegaCorp and members of the Tonganese airforce
@ can self-register.
@ (Property: "self-reg-email")</p>
@ <hr />
entry_attribute("Default privileges", 10, "default-perms",
"defaultperms", "u", 0);
@ <p>Permissions given to users that... <ul><li>register themselves using
@ the self-registration procedure (if enabled), or <li>access "public"
@ pages identified by the public-pages glob pattern above, or <li>
@ are users newly created by the administrator.</ul>
|
| ︙ | ︙ |
Changes to src/url.c.
| ︙ | ︙ | |||
64 65 66 67 68 69 70 | int useProxy; /* Used to remember that a proxy is in use */ char *proxyUrlPath; int proxyOrigPort; /* Tunneled port number for https through proxy */ }; #endif /* INTERFACE */ | < < < < < < < < < < | 64 65 66 67 68 69 70 71 72 73 74 75 76 77 | int useProxy; /* Used to remember that a proxy is in use */ char *proxyUrlPath; int proxyOrigPort; /* Tunneled port number for https through proxy */ }; #endif /* INTERFACE */ /* ** Parse the given URL. Populate members of the provided UrlData structure ** as follows: ** ** isFile True if FILE: ** isHttps True if HTTPS: ** isSsh True if SSH: |
| ︙ | ︙ | |||
175 176 177 178 179 180 181 |
n = strlen(pUrlData->name);
if( pUrlData->name[0]=='[' && n>2 && pUrlData->name[n-1]==']' ){
pUrlData->name++;
pUrlData->name[n-2] = 0;
}
zLogin = mprintf("");
}
| | | 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 |
n = strlen(pUrlData->name);
if( pUrlData->name[0]=='[' && n>2 && pUrlData->name[n-1]==']' ){
pUrlData->name++;
pUrlData->name[n-2] = 0;
}
zLogin = mprintf("");
}
fossil_strtolwr(pUrlData->name);
if( c==':' ){
pUrlData->port = 0;
i++;
while( (c = zUrl[i])!=0 && fossil_isdigit(c) ){
pUrlData->port = pUrlData->port*10 + c - '0';
i++;
}
|
| ︙ | ︙ |
Changes to src/util.c.
| ︙ | ︙ | |||
138 139 140 141 142 143 144 145 146 147 148 149 150 151 |
if( munmap(p, n) ){
fossil_panic("munmap failed: %d\n", errno);
}
#else
fossil_free(p);
#endif
}
/*
** This function implements a cross-platform "system()" interface.
*/
int fossil_system(const char *zOrigCmd){
int rc;
#if defined(_WIN32)
| > > > > > > > > > > > > > > > | 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 |
if( munmap(p, n) ){
fossil_panic("munmap failed: %d\n", errno);
}
#else
fossil_free(p);
#endif
}
/*
** Translate every upper-case character in the input string into
** its equivalent lower-case.
*/
char *fossil_strtolwr(char *zIn){
char *zStart = zIn;
if( zIn ){
while( *zIn ){
*zIn = fossil_tolower(*zIn);
zIn++;
}
}
return zStart;
}
/*
** This function implements a cross-platform "system()" interface.
*/
int fossil_system(const char *zOrigCmd){
int rc;
#if defined(_WIN32)
|
| ︙ | ︙ |