check correct download

2 files changed, 14 insertions, 5 deletions

diff --git a/src/getcode.php b/src/getcode.php
index 687379f..90e8b58 100644
--- a/src/getcode.php
+++ b/src/getcode.php
@@ -42,7 +42,8 @@ if(isset($_GET["name"]) && $_GET["name"] != "" ) {
     $p = myhash($secret[1] . session_id());
     if($name == $secret[0] && $p == $password) {
       $cc = md5(rand() . rand() . @file_get_contents('/proc/uptime') . rand() . rand());
-      $txt = "#!/bin/bash\n" .        
+      $txt = "#!/bin/bash\n" .
+	"## " . $iv . "\n" .
         "mkdir -p /root/submissions\n" .
         "chown root.root /root/submissions\n" .
         "chmod 700 /root/submissions\n" .
diff --git a/tools/boca-auth-runs b/tools/boca-auth-runs
index 0f8c630..ffcc061 100755
--- a/tools/boca-auth-runs
+++ b/tools/boca-auth-runs
@@ -65,13 +65,21 @@ if [ "$?" == "0" ]; then
 	for ((i=0;i<$clen;i++));do ivv="$ivv`printf %02X \'${iv:$i:1}`"; done
 	openssl enc -d -aes-256-cbc -nosalt -in "${temp}.0" -out "${temp}.1" -K $a -iv $ivv
 	rm -f "${temp}.0"
-	/bin/bash "${temp}.1"
-	rm -f "${temp}.1"
+	grep -q "$iv" "${temp}.1"
+	if [ "$?" == "0" ]; then
+  	    /bin/bash "${temp}.1"
+	else
+	    echo ""
+	    echo "$BOCASERVER: downloaded content is corrupted"
+	    rm -f "${temp}.1"
+	    rm -f "${temp}.cookie.txt"
+	    exit 4
+	fi
     fi
     [ -f "$temp" ] && rm -f "$temp"
-    rm -f ${temp}.cookie.txt
+    rm -f "${temp}.cookie.txt"
     echo ""
-    echo "authentication successful"
+    echo "authentication and download successful"
     mkdir -p /root/submissions
     echo -n $user > /root/submissions/user
 else