view scripts/server-ctl @ 6375:c4371ec7d1c0

Call verifyPassword even if user does not exist. Address timing attack caused by not doing the password check if the user doesn't exist. Can expose valid usernames. Really only useful for a tracker that doesn't allow anonymous access to issues. Issues usually show usernames as part of the message display.
author John Rouillard <rouilj@ieee.org>
date Tue, 06 Apr 2021 22:51:55 -0400
parents 311ad623e2d1
children
line wrap: on
line source

#!/bin/sh

#
# Configuration
#
CONFFILE="/var/roundup/server-config.ini"

# this will end up with extra space, but it should be ignored in the script
PIDFILE=`grep '^pidfile' ${CONFFILE} | awk -F = '{print $2}' `
SERVER="/usr/local/bin/roundup-server -C ${CONFFILE}"
ERROR=0
ARGV="$@"
if [ "x$ARGV" = "x" ] ; then
    ARGS="help"
fi

if [ -z "${PIDFILE}" ] ; then
    echo "pidfile option must be set in configuration file"
    exit 1
fi

for ARG in $@ $ARGS
do
    # check for pidfile
    if [ -f $PIDFILE ] ; then
	PID=`cat $PIDFILE`
	if [ "x$PID" != "x" ] && kill -0 $PID 2>/dev/null ; then
	    STATUS="roundup-server (pid $PID) running"
	    RUNNING=1
	else
	    STATUS="roundup-server (pid $PID?) not running"
	    RUNNING=0
	fi
    else
	STATUS="roundup-server (no pid file) not running"
	RUNNING=0
    fi

    case $ARG in
    start)
	if [ $RUNNING -eq 1 ] ; then
	    echo "$0 $ARG: roundup-server (pid $PID) already running"
	    continue
	fi
	if $SERVER ; then
	    echo "$0 $ARG: roundup-server started"
	else
	    echo "$0 $ARG: roundup-server could not be started"
	    ERROR=1
	fi
	;;
    condstart)
	if [ $RUNNING -eq 1 ] ; then
	    continue
	fi
	if $SERVER ; then
	    echo "$0 $ARG: roundup-server started"
	else
	    echo "$0 $ARG: roundup-server could not be started"
	    ERROR=1
	fi
	;;
    stop)
	if [ $RUNNING -eq 0 ] ; then
	    echo "$0 $ARG: $STATUS"
	    continue
	fi
	if kill $PID ; then
	    echo "$0 $ARG: roundup-server stopped"
	else
	    echo "$0 $ARG: roundup-server could not be stopped"
	    ERROR=2
	fi
	;;
    status)
	echo $STATUS
	;;
    *)
	echo "usage: $0 (start|condstart|stop|status)"
	cat <<EOF

    start      - start roundup-server
    condstart  - start roundup-server if it's not running
    stop       - stop roundup-server
    status     - display roundup-server status

EOF
	ERROR=3
    ;;

    esac

done

exit $ERROR


Roundup Issue Tracker: http://roundup-tracker.org/