annotate scripts/roundup.rc-debian @ 6375:c4371ec7d1c0

Call verifyPassword even if user does not exist. Address timing attack caused by not doing the password check if the user doesn't exist. Can expose valid usernames. Really only useful for a tracker that doesn't allow anonymous access to issues. Issues usually show usernames as part of the message display.
author John Rouillard <rouilj@ieee.org>
date Tue, 06 Apr 2021 22:51:55 -0400
parents 6e3e4f24c753
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1841
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
1 #!/bin/sh -e
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
2 #
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
3 # roundup Startup script for the roundup http server.
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
4
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
5 DESC='Roundup HTTP-Server'
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
6
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
7 BINFILE=roundup-server
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
8 EXECUTABLE=/usr/local/bin/$BINFILE
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
9 PIDFILE=/var/run/roundup/server.pid
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
10 LOGFILE=/var/log/roundup/roundup.log
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
11 TRACKERS=tttech=/tttech/org/software/roundup/tttech/
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
12 OPTIONS="-- -p 8080 -u roundup -d $PIDFILE -l $LOGFILE $TRACKERS"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
13
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
14
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
15 test -x $EXECUTABLE || exit 0
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
16
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
17 start_stop() {
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
18 case "$1" in
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
19 start)
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
20 printf "Starting $DESC:"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
21 start-stop-daemon --start --oknodo --quiet \
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
22 --pidfile $PIDFILE \
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
23 --exec $EXECUTABLE $OPTIONS
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
24 printf " $BINFILE"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
25 printf ".\n"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
26 ;;
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
27 stop)
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
28 printf "Stopping $DESC:"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
29 start-stop-daemon --stop --oknodo --quiet \
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
30 --pidfile $PIDFILE \
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
31 --exec $EXECUTABLE $OPTIONS
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
32 printf " $BINFILE"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
33 printf ".\n"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
34 ;;
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
35 restart | force-reload)
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
36 start_stop stop
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
37 sleep 1
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
38 start_stop start
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
39 ;;
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
40 *)
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
41 printf "Usage: $0 {start|stop|restart|force-reload}\n" >&2
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
42 exit 1
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
43 ;;
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
44 esac
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
45 }
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
46
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
47 start_stop "$@"
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
48
24fb163ddece added Debian rc script
Richard Jones <richard@users.sourceforge.net>
parents:
diff changeset
49 exit 0

Roundup Issue Tracker: http://roundup-tracker.org/