#!/usr/bin/perl
#
# File: verify_pass.cgi
#
# © 2002 Dallas Engelken
# - vpopmail password verify script
# - tested against md5 and crypt passwords in same database
# - by <dallas at engelken dot net>
#
# Usage:
# ./verify_pass.cgi <username> <domain> <password>
#
# or
#
# Create a Form with 3 input fields
# <form action="verify_pass.pl" metho=POST>
# <input type=text name=username>
# <input type=text name=domain>
# <input type=password name=password>
# <input type=submit>
#
# Basically it just kicks back some info and 
# tells you if the login was sucessfull or not.  
# You can do whatever you want from there!
#
# If you are testing from the console, 
# set $MODE to 0, if you are passing a html 
# form to it, set $MODE to 1
#
# If you want debug information, set $DEBUG 
# to 1 below.
#
# Little or no error checking involved on input.
# Have Fun.

use DBI;
use DBD::mysql;
use CGI;
my $query = new CGI;
my $username, $domain, $password;

######################
# GLOBAL DB SETTINGS #
######################
$dbdatabase             = "vpopmail";
$dbhostname             = "mail.hutchnet.com";
$dbport         = 3306;
$dbuser         = "vpopmail";
$dbpass         = "*********";  # removed password for clear txt version

# Debugging
$DEBUG=1;

# mode: 0=console, 1=webform
$MODE=1;

if ($MODE) {
  if (defined $query->param('username')) {
    $username		= $query->param('username');
    $username 		=~ s/[^A-z0-9_\.\-]//g;
  }
  else {
    $username 		= "not_defined";
  }
  if (defined $query->param('domain')) {
    $domain		= $query->param('domain');
    $domain		=~ s/[^A-z0-9_\.\-]//g;
  }
  else {
    $domain 		= "not_defined";
  }
  if (defined $query->param('password')) {
    $password		= $query->param('password');
  }
  else {
    $password 		= "not_defined";
  }
  print "Content-type: text/html\n\n";
}
else {
  if (defined $ARGV[0]) { $username = $ARGV[0]; } else { $username = "not_defined"; }
  if (defined $ARGV[1]) { $domain = $ARGV[1]; } else { $domain = "not_defined"; }
  if (defined $ARGV[2]) { $password = $ARGV[2]; } else { $password = "not_defined"; }
}

&print_line("----------------------------");
&print_line("Username = $username");
&print_line("Domain = $domain");
&print_line("Password = $password");
&print_line("----------------------------");

my $return = &verify_passwd($username,$domain,$password);

if ($return) {
  &print_line("Login Successfull.. do something constructive.");
}
else {
  &print_line("Login Failed.  Print form again.");
}

exit;

#############

sub verify_passwd {
 my $_username  = shift;
 my $_domain    = shift;
 my $_password  = shift;
 my $_query = "SELECT * FROM vpopmail WHERE pw_name=? AND pw_domain=? LIMIT 1";


 &debug("username = $_username");
 &debug("domain = $_domain");
 &debug("password = $_password");
 &debug("query = $_query");

 my $dbh = DBI->connect("DBI:mysql:$dbdatabase:$dbhostname:$dbport", $dbuser, $dbpass)
           or die("Cannot connect to database $dbdatabase on $dbhostname:$dbport using login $dbuser");
 my $sth = $dbh->prepare($_query);
 my $rv = $sth->execute($_username,$_domain);
 my $hash = $sth->fetchrow_hashref;
 $sth->finish;
 $dbh->disconnect;
 $crypt_pass = $hash->{pw_passwd};
 &debug("pw_passwd from vpopmail = $crypt_pass");

 my $length = length($crypt_pass);
 &debug("password length is $length");

 if ($length == 31) {
   $crypt_salt = substr($crypt_pass,0,8);
   &debug("md5 password detected, salt is = $crypt_salt");
 }
 else {
   $crypt_salt = substr($crypt_pass,0,2);
   &debug("crypt password detected, salt is = $crypt_salt");
 }

 $_password = crypt($_password,$crypt_salt);
 &debug("crypted user password is $_password");

 if ($_password eq $crypt_pass) {
    &debug("$_password == $crypt_pass");
    return(1);
 }
 else {
    &debug("$_password != $crypt_pass");
    return(0);
 }
}

#############

sub debug {
 my $text = shift;
 if ($DEBUG) {
   if ($MODE) {
     print "DEBUG: $text<BR>\n";
   }
   else {
     print "DEBUG: $text\n";
   }
 }
}

#############

sub print_line {
  my $text = shift;
  if ($MODE) {
   print "$text<BR>\n";
  }
  else {
   print "$text\n";
  }
}

#############
