debian_pkg-listmaster/archive-spam-removals/cgi-bin/request-password.pl

#!/usr/bin/perl -wT

# cord@debian.org

use lib "/var/list/reaper/lib";
use strict;
use CGI qw/:standard/;
use CGI::Carp qw(fatalsToBrowser);
use MIME::Lite;

my $userfile='/etc/postfix/debian';
my $passwd='/org/lists.debian.org/cgi-bin/review/.htpasswd';
my $bounce_addr = "cord\@liszt.debian.org";
my $logfile = '/org/lists.debian.org/spam-log/pw-reminder.log';

$ENV{'PATH'} = '';

print header;

open (HEADER, "/org/lists.debian.org/html/header.in") or 
  die ("$0: can't open /org/lists.debian.org/html/header.in: $!\n");
while (<HEADER>) {
  s/u_TITLE_u/Request a Password for Listarchive Review/;
  print;
}
close (HEADER);

print h2('Request A Password for Listarchive Review');

print "<hr noshade width=\"100%\" size=\"1\">\n";

print p("Only Debian Developer are allowed to review the Listarchive. Please
	enter your Debian userid, and press 'Submit', and a new generated
	password will be send to your Debian-Mailadress.");

print p("This user/pass-method is a temporary solution, when we have a
	solution for authorizing against a central DB, we will switch over.");

print start_form;

print p("Your Debian UserId:", textfield('uid'), "\@debian.org");

print submit('Request Password');
print end_form;

if (param()) {
  if (param('uid') =~ m#^(\w+)$#) {
    my $uid = $1;
    open(DD, $userfile) or die ("$0: can't open $userfile for reading: $!\n");
    my $line;
    my $found = 0;
    foreach $line (<DD>) {
      $line = (split(' ', $line))[0];
      if ($line eq "$uid\@debian.org") {
        $found = 1;
      }
    }
    close (DD);

    if (-e $logfile) {
      open (LOG, $logfile) or die ("$0: can't open $logfile for reading\n");
      my ($time, $ip, $user);
      foreach (<LOG>) {
        ($time, $ip, $user) = split(m#\s+#, $_);
        next if (time()-3600 > $time);
        next if ($user ne $uid);
        $found = -1;
      }
    }

    if ($found == 1) {
      my $pw=`/usr/bin/pwgen 8 1`;
      $pw =~ m#^([\w\d]+)$#;
      my $password = $1;
      system('/usr/bin/htpasswd', '-b', $passwd, $uid, $password);
      my $msg = MIME::Lite->new (
	From => "Debian Listmaster Team <listmaster\@lists.debian.org>",
        To => "$uid\@debian.org",
	Subject => "$uid\@debian.org Password for Debian Listarchive Review",
        Type => "text/plain",
	"X-Loop:" => "liszt-password-resetter",
        "Precedence:" => "junk",
        "Reply-To:" => "listmaster\@lists.debian.org",
        "Errors-To:" => "listmaster\@lists.debian.org",
        "Datestamp" => 0,
        Data => "Thank you for participating in the Debian Listarchive Review.

Now you can go to https://lists.debian.org/cgi-bin/review/review1.pl and
start reviewing.

When you are asked for Authorisation please enter:

user: $uid
pass: $password

        Sincerely,
The Listmaster Team
-- 
http://lists.debian.org
");
      $msg->send or die "$0: you DON'T have mail!: $!\n";
      print p("New password send out");
      open(LOG, '>>', $logfile) or die ("$0: can't open $logfile for writing: $!\n");
      print LOG time . " $ENV{'REMOTE_ADDR'} $uid\n";
      close LOG;
    } elsif ($found == 0) {
      print p("FAIL: user unknown");
    } elsif ($found == -1) {
      print p("FAIL: already requested a password in the last hour");
    } else {
      print p("FAIL: this shouldn't happen");
    }
  } else {
    print p("FAIL: invalid characters");
  }
}

open (FOOTER, "/org/lists.debian.org/html/footer.in") or 
  die ("$0: can't open /org/lists.debian.org/html/footer.in: $!\n");
while (<FOOTER>) {
  print;
}
close (FOOTER);