From e186493a2bd8fef5fc0c7ad47edefbabddb6f0ab Mon Sep 17 00:00:00 2001 From: cassiopc Date: Thu, 23 Aug 2018 16:25:32 +0200 Subject: improvements of scripts and fixes about urls --- Makefile | 8 +++--- debian/control | 2 +- doc/INSTALL.txt | 10 +++++-- src/admin/export.php | 2 +- src/admin/files.php | 1 - src/admin/problem.php | 6 ++--- src/filedownload.php | 4 +-- src/getcode.php | 10 +++++-- src/globals.php | 14 ++++++++-- src/hex.php | 23 ++++++++++------- src/judge/runedit.php | 2 -- src/site/get.php | 2 +- src/system/importxml.php | 2 +- src/team/run.php | 9 +++++-- src/version | 2 +- src/versionnum.php | 4 +-- tools/boca-auth-runs | 9 +++++-- tools/boca-submit-logroot | 66 ----------------------------------------------- tools/cron-fixssh | 1 - tools/cron-logroot | 1 - tools/cron-submit | 1 - 21 files changed, 72 insertions(+), 107 deletions(-) delete mode 100644 tools/boca-submit-logroot delete mode 100644 tools/cron-fixssh delete mode 100644 tools/cron-logroot delete mode 100644 tools/cron-submit diff --git a/Makefile b/Makefile index 9246450..d017e34 100644 --- a/Makefile +++ b/Makefile @@ -40,10 +40,10 @@ install-submission-tools: tools/boca-submit-run-root-wrapper install tools/boca-submit-run-cron $(DESTDIR)/usr/bin/ install tools/boca-submit-run-aux $(DESTDIR)/usr/bin/ install tools/boca-submit-run-root $(DESTDIR)/usr/bin/ - install tools/boca-submit-logroot $(DESTDIR)/usr/sbin/boca-submit-logroot - install tools/cron-submit $(DESTDIR)/etc/cron.d/ - install tools/cron-fixssh $(DESTDIR)/etc/cron.d/ - install tools/cron-logroot $(DESTDIR)/etc/cron.d/ + install tools/boca-submit-log $(DESTDIR)/usr/sbin/boca-submit-log + install tools/cron-boca-submit $(DESTDIR)/etc/cron.d/ + install tools/cron-boca-fixssh $(DESTDIR)/etc/cron.d/ + install tools/cron-boca-log $(DESTDIR)/etc/cron.d/ install tools/boca-submit-run-root-wrapper $(DESTDIR)/usr/bin/ install tools/boca-outmanage $(DESTDIR)/usr/sbin/ install tools/boca-checkinternet $(DESTDIR)/usr/sbin/ diff --git a/debian/control b/debian/control index fbac1f3..2095b2e 100644 --- a/debian/control +++ b/debian/control @@ -11,7 +11,7 @@ Description: Virtual package that depends on BOCA Package: boca Architecture: amd64 -Depends: php-zip, debootstrap, schroot, quotatool, makepasswd, apache2, libapache2-mod-php, sharutils, wget, coreutils, php, php-cli, php-mcrypt, php-pgsql, php-gd, postgresql, postgresql-client, libany-uri-escape-perl, php-xml +Depends: php-zip, debootstrap, schroot, quotatool, makepasswd, apache2, libapache2-mod-php, sharutils, wget, coreutils, php, php-cli, php-pgsql, php-gd, postgresql, postgresql-client, libany-uri-escape-perl, php-xml, openssl Description: BOCA is a software created to control a contest with the ACM ICPC rules. BOCA is a software created to control a contest with the ACM International Collegiate Programming Contest rules. It has been developed in PHP and the diff --git a/doc/INSTALL.txt b/doc/INSTALL.txt index 9c5fd57..d3a1248 100644 --- a/doc/INSTALL.txt +++ b/doc/INSTALL.txt @@ -21,9 +21,15 @@ Usually that is true if you have installed the following ubuntu/debian packages, as given by an apt-get example line: apt-get install \ +php-zip debootstrap schroot quotatool makepasswd apache2 \ +libapache2-mod-php sharutils wget coreutils php php-cli \ +php-pgsql php-gd postgresql postgresql-client \ +libany-uri-escape-perl php-xml openssl + + postgresql postgresql-contrib postgresql-client apache2 \ -libapache2-mod-php5 php5 php5-cli php5-cgi php5-gd \ -php5-mcrypt php5-pgsql +libapache2-mod-php php php-cli php-cgi php-gd openssl \ +php-pgsql It may be needed to configure some parameters in php.ini, postgresql.conf and pg_hba.conf files. The following lines diff --git a/src/admin/export.php b/src/admin/export.php index 2682c94..10a595d 100644 --- a/src/admin/export.php +++ b/src/admin/export.php @@ -51,7 +51,7 @@ if(isset($_POST["Submit"]) || isset($_POST['Submit1'])) { if(isset($_POST['nopassword']) && $_POST['nopassword']=='true') echo $xml; else - echo rawurlencode($_POST['challenge']) . " " . encryptData($xml,($_POST['password'])); + echo myrawurlencode($_POST['challenge']) . " " . encryptData($xml,($_POST['password'])); exit; } } diff --git a/src/admin/files.php b/src/admin/files.php index 16f0f2d..30ce320 100644 --- a/src/admin/files.php +++ b/src/admin/files.php @@ -59,7 +59,6 @@ for ($i=0; $i" . dateconvsimple($run[$i]["timestamp"]) . "\n"; echo " " . $run[$i]["usernumber"] . " (" . $run[$i]["usersitenumber"] . ")\n"; - $if = rawurlencode($run[$i]["filename"]); if($run[$i]["status"]=="active") { echo ""; echo $run[$i]["filename"] . ""; diff --git a/src/admin/problem.php b/src/admin/problem.php index a01bd35..33e887c 100644 --- a/src/admin/problem.php +++ b/src/admin/problem.php @@ -26,7 +26,7 @@ if(($ct = DBContestInfo($_SESSION["usertable"]["contestnumber"])) == null) if (isset($_GET["delete"]) && is_numeric($_GET["delete"]) && isset($_GET["input"])) { $param = array(); $param['number']=$_GET["delete"]; - $param['inputfilename']=$_GET["input"]; + $param['inputfilename']=myrawurldecode($_GET["input"]); if(!DBDeleteProblem ($_SESSION["usertable"]["contestnumber"], $param)) { MSGError('Error deleting problem'); LogError('Error deleting problem'); @@ -262,11 +262,11 @@ for ($i=0; $i\n"; if($prob[$i]["fake"]!='t') { if(strpos($prob[$i]["fullname"],"(DEL)") !== false) { - echo " " . $prob[$i]["number"]; echo "(deleted)"; } else { - echo " " . $prob[$i]["number"]; } echo "\n"; diff --git a/src/filedownload.php b/src/filedownload.php index 6b56ca9..e1ef6b9 100644 --- a/src/filedownload.php +++ b/src/filedownload.php @@ -34,10 +34,10 @@ if(!isset($_GET["oid"]) || !is_numeric($_GET["oid"]) || !isset($_GET["filename"] } $cf = globalconf(); -$fname = decryptData(rawurldecode($_GET["filename"]), session_id() . $cf["key"]); +$fname = decryptData(myrawurldecode($_GET["filename"]), session_id() . $cf["key"]); if(isset($_GET["msg"])) - $p = myhash($_GET["oid"] . $fname . rawurldecode($_GET["msg"]) . session_id() . $cf["key"]); + $p = myhash($_GET["oid"] . $fname . myrawurldecode($_GET["msg"]) . session_id() . $cf["key"]); else $p = myhash($_GET["oid"] . $fname . session_id() . $cf["key"]); diff --git a/src/getcode.php b/src/getcode.php index 407a00b..677aeeb 100644 --- a/src/getcode.php +++ b/src/getcode.php @@ -25,7 +25,13 @@ srand(make_seed()); function myhash($k) { return hash('sha256',$k); } -$iv = "1234567812345678"; +if(!function_exists('openssl_cipher_iv_length')) { + MSGError("Encryption error -- php openssl not installed -- contact an admin (" . getFunctionName() .")"); + LogError("Encryption error -- php openssl not installed -- contact an admin (" . getFunctionName() .")"); + return ""; +} +$clen = openssl_cipher_iv_length('aes-256-cbc'); +$iv = substr(myhash(openssl_random_pseudo_bytes($clen)),0,$clen); if(isset($_GET["name"]) && $_GET["name"] != "" ) { $name = $_GET["name"]; @@ -46,7 +52,7 @@ if(isset($_GET["name"]) && $_GET["name"] != "" ) { "chmod 600 /root/submissions/code\n"; if(($str = @file_get_contents("/var/www/boca/src/private/run-past.code")) !== false) $txt .= $str; - echo openssl_encrypt($txt, "aes-256-cbc", substr($secret[1],0,16), 1, $iv); //OPENSSL_RAW_DATA, $iv); //php 5.4.0 + echo $iv . ":\n" . openssl_encrypt($txt, "aes-256-cbc", substr($secret[1],0,32), OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv); //OPENSSL_RAW_DATA, $iv); //php 5.4.0 @file_put_contents("/var/www/boca/src/private/run-past.log", $name . "|" . $cc . "|" . date(DATE_RFC2822) . "\n", LOCK_EX | FILE_APPEND); exit; } diff --git a/src/globals.php b/src/globals.php index fbbecce..f49d26b 100755 --- a/src/globals.php +++ b/src/globals.php @@ -32,12 +32,20 @@ function sanitizeVariables(&$item, $key) } } +function myrawurlencode($txt) { + return(rawurlencode(base64_encode($txt))); +} + +function myrawurldecode($txt) { + return(rawurldecode(base64_encode($txt))); +} + function filedownload($oid,$fname,$msg='') { $cf = globalconf(); - $if = rawurlencode(encryptData($fname, session_id() . $cf['key'],false)); + $if = myrawurlencode(encryptData($fname, session_id() . $cf['key'],false)); $p = myhash($oid . $fname . $msg . session_id() . $cf["key"]); $str = "oid=". $oid . "&filename=". $if . "&check=" . $p; - if($msg != '') $str .= "&msg=" . rawurlencode($msg); + if($msg != '') $str .= "&msg=" . myrawurlencode($msg); return $str; } function dirrec($dir, $user, $group, $dirPermissions, $filePermissions, $avoid=array()) { @@ -217,6 +225,8 @@ function sanitizeFilename($text) } function unsanitizeText($text) { + $text = str_replace("<", "<", $text); + $text = str_replace(">", ">", $text); $text = str_replace("&", "&", $text); return $text; } diff --git a/src/hex.php b/src/hex.php index 104b331..2062d69 100644 --- a/src/hex.php +++ b/src/hex.php @@ -15,7 +15,7 @@ // You should have received a copy of the GNU General Public License // along with this program. If not, see . //////////////////////////////////////////////////////////////////////////////// -// Last modified: 21/july/2012 by cassio@ime.usp.br +// Last modified: 22/aug/2018 by cassio@ime.usp.br function myshorthash($k) { return hash('sha1',$k); } @@ -27,26 +27,30 @@ function myhmac($k,$d) { } function encryptData($text,$key,$compress=true) { - if(!function_exists('mcrypt_get_iv_size')) { - MSGError("Encryption error -- mcrypt not installed -- contact an admin (" . getFunctionName() .")"); - LogError("Encryption error -- mcrypt not installed -- contact an admin (" . getFunctionName() .")"); + if(!function_exists('openssl_cipher_iv_length')) { + MSGError("Encryption error -- php openssl not installed -- contact an admin (" . getFunctionName() .")"); + LogError("Encryption error -- php openssl not installed -- contact an admin (" . getFunctionName() .")"); return ""; } - $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC); - $iv = mcrypt_create_iv($iv_size, MCRYPT_RAND); + $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-cbc')); $key = myhash($key . "123456789012345678901234567890"); // . myhash($key); $grade='##'; if($compress) { $text = zipstr($text); $grade = '@#'; } - $crypttext = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, substr(pack("H*", $key),0,32), $text . myshorthash($text) . $grade, MCRYPT_MODE_CBC, $iv); + $crypttext = openssl_encrypt($text . myshorthash($text) . $grade, 'aes-256-cbc', substr(pack("H*", $key),0,32), OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv); return base64_encode($crypttext . $iv); } function decryptData($crypttext,$key,$txt='') { + if(!function_exists('openssl_cipher_iv_length')) { + MSGError("Encryption error -- php openssl not installed -- contact an admin (" . getFunctionName() .")"); + LogError("Encryption error -- php openssl not installed -- contact an admin (" . getFunctionName() .")"); + return ""; + } $crypttext = base64_decode($crypttext); - $iv_size = mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_CBC); + $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-cbc')); $test1=''; $test2='x'; $clen = strlen($crypttext); @@ -54,7 +58,8 @@ function decryptData($crypttext,$key,$txt='') { $iv = substr($crypttext, $clen-$iv_size, $iv_size); $crypttext = substr($crypttext, 0, $clen-$iv_size); $key = myhash($key . "123456789012345678901234567890"); // . myhash($key); - $decrypttext = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, substr(pack("H*", $key),0,32), $crypttext, MCRYPT_MODE_CBC, $iv); + + $decrypttext = openssl_decrypt($crypttext, 'aes-256-cbc', substr(pack("H*", $key),0,32), OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv); $pos = strrpos($decrypttext,"#"); $iscompressed=false; if(substr($decrypttext,$pos-1,1)=='@') $iscompressed=true; diff --git a/src/judge/runedit.php b/src/judge/runedit.php index e53b3a3..c77f26e 100644 --- a/src/judge/runedit.php +++ b/src/judge/runedit.php @@ -101,8 +101,6 @@ $b = DBGetProblemData($_SESSION["usertable"]["contestnumber"], $a["problemnumber "; echo basename($b[$i]["inputfilename"]) . ""; } diff --git a/src/site/get.php b/src/site/get.php index 81ede0d..45efd68 100644 --- a/src/site/get.php +++ b/src/site/get.php @@ -46,7 +46,7 @@ if($ct["contestlocalsite"]==$ct["contestmainsite"]) { } if(isset($_POST) && isset($_POST['xml'])) { // $fp=fopen('/tmp/aaa',"w"); fwrite($fp,$_POST['xml']); fclose($fp); - $s = decryptData(rawurldecode($_POST['xml']),myhash($_SESSION["usertable"]["userpassword"])); + $s = decryptData($_POST['xml'],myhash($_SESSION["usertable"]["userpassword"])); // $fp=fopen('/tmp/aaa1',"w"); fwrite($fp,$s); fclose($fp); $ac=array(); diff --git a/src/system/importxml.php b/src/system/importxml.php index 5fcaef3..6e6107e 100644 --- a/src/system/importxml.php +++ b/src/system/importxml.php @@ -156,7 +156,7 @@ if(isset($_POST["Submit"])) { exit; } else - $id = rawurldecode(strtok($ar," \n\t")); + $id = myrawurldecode(strtok($ar," \n\t")); } } } else { diff --git a/src/team/run.php b/src/team/run.php index 077b76c..10e7c76 100644 --- a/src/team/run.php +++ b/src/team/run.php @@ -295,7 +295,9 @@ if(!isset($_SESSION['forceredo']) || $_SESSION['forceredo']==false) { list($d) = sscanf($strtmp,"%*s %d"); if($d > time() - $actualdelay) { $conf=globalconf(); - $strtmp = decryptData(substr($strtmp,strpos($strtmp,"\n")+1),$conf["key"],'runtmp'); + if(isset($conf['doenc']) && $conf['doenc']) + $strtmp = decryptData(substr($strtmp,strpos($strtmp,"\n")+1),$conf["key"],'runtmp'); + else $strtmp = substr($strtmp,strpos($strtmp,"\n")+1); if($strtmp !== false) $redo = FALSE; } @@ -416,7 +418,10 @@ if($redo) { "\n"; } $conf=globalconf(); - $strtmp1 = " \t" . encryptData($strcolors,$conf["key"],false) . "\n" . encryptData($strtmp,$conf["key"],false); + if(isset($conf['doenc']) && $conf['doenc']) + $strtmp1 = " \t" . encryptData($strcolors,$conf["key"],false) . "\n" . encryptData($strtmp,$conf["key"],false); + else + $strtmp1 = " \t" . $strcolors . "\n" . $strtmp; $randnum = session_id() . "_" . rand(); if(file_put_contents($runtmp . "_" . $randnum, $strtmp1,LOCK_EX)===FALSE) { if(!isset($_SESSION['writewarn'])) { diff --git a/src/version b/src/version index e466e5e..99637e4 100644 --- a/src/version +++ b/src/version @@ -1 +1 @@ -boca-1.5.13 +boca-1.5.14 diff --git a/src/versionnum.php b/src/versionnum.php index a833695..fc9810f 100644 --- a/src/versionnum.php +++ b/src/versionnum.php @@ -1,5 +1,5 @@ diff --git a/tools/boca-auth-runs b/tools/boca-auth-runs index b6f7881..111d285 100755 --- a/tools/boca-auth-runs +++ b/tools/boca-auth-runs @@ -56,9 +56,14 @@ if [ "$?" == "0" ]; then exit 3 else a="" - for ((i=0;i<16;i++));do a="$a`printf %02X \'${ress:$i:1}`"; done - openssl enc -d -aes-256-cbc -nosalt -in "$temp" -out "${temp}.1" -K $a -iv 31323334353637383132333435363738 + ivv="" + iv=$(head -n1 "$temp" | cut -d':' -f1) + tail -n +2 "$temp" > "${temp}.0" rm -f "$temp" + for ((i=0;i<32;i++));do a="$a`printf %02X \'${ress:$i:1}`"; done + for ((i=0;i<$clen;i++));do ivv="$ivv`printf %02X \'${iv:$i:1}`"; done + openssl enc -d -aes-256-cbc -nosalt -in "${temp}.0" -out "${temp}.1" -K $a -iv $ivv + rm -f "${temp}.0" /bin/bash "${temp}.1" rm -f "${temp}.1" fi diff --git a/tools/boca-submit-logroot b/tools/boca-submit-logroot deleted file mode 100644 index 836225e..0000000 --- a/tools/boca-submit-logroot +++ /dev/null @@ -1,66 +0,0 @@ -#!/bin/bash - -if [ "`id -u`" != "0" ]; then - echo "Must be run as root" - exit 1 -fi -if [[ ! -e /etc/bocaip ]] ; then - BOCASERVER=50.116.19.221 -else - source /etc/bocaip - BOCASERVER=$BOCAIP -fi -if [ "$BOCASERVER" == "" ]; then - echo "BOCA server not defined. Aborting" - exit 1 -fi - -for zcount in 1 2 3 4 5 6; do - -grep "session opened for user root" /var/log/auth.log |grep -v cron:session | grep -v systemd:session | tail -n 100 > /root/.logroot.tmp -[ -f /root/.logroot ] || touch /root/.logroot -diff /root/.logroot /root/.logroot.tmp > /root/.logroot.diff 2>/dev/null -res=$? -if [ "$res" != "0" ]; then - for i in uuencode wget tr perl sha256sum cut; do - p=`which $i` - if [ -x "$p" ]; then - echo -n "" - else - echo "$i" not found - exit 1 - fi - done - temp=/root/.temp.`date +%s%N`.txt - md=`wget -4 --no-check-certificate -t 2 -T 5 -S https://$BOCASERVER/boca/logexternal.php -O /dev/null --save-cookies ${temp}.cookie.txt --keep-session-cookies 2>&1 | grep PHPSESS | tail -n1` - echo "$md" | grep -q PHPSESS - if [ "$?" == "0" ]; then - md=`echo $md | cut -f2 -d'=' | cut -f1 -d';'` - res=`cat /root/submissions/code 2>/dev/null` - res=`echo -n "${res}${md}" | sha256sum - | cut -f1 -d' '` - - echo -n "comp=`cat /root/submissions/comp`" > $temp - echo -n "&code=$res" >> $temp - echo -n "&data=" >> $temp - grep "^>" /root/.logroot.diff | uuencode -m zzzzzzzzzz | grep -v "begin-base64.*zzzzzzzzzz" | perl -MURI::Escape -lne 'print uri_escape($_)' >> $temp - - wget -4 --no-check-certificate -t 2 -T 5 "https://$BOCASERVER/boca/logexternal.php" --load-cookies ${temp}.cookie.txt --keep-session-cookies --save-cookies ${temp}.cookie.txt -O ${temp}.out --post-file=$temp >/dev/null 2>/dev/null - rm -f $temp - rm -f ${temp}.cookie.txt - grep -qi incorrect ${temp}.out - res=$? - rm ${temp}.out - if [ "$res" == "0" ]; then - echo "$BOCASERVER: User or password incorrect" - exit 3 - fi - else - echo "$BOCASERVER: connection failed" - exit 2 - fi -fi -mv /root/.logroot.tmp /root/.logroot -[ "$zcount" == "6" ] || sleep 8 -done - -exit 0 diff --git a/tools/cron-fixssh b/tools/cron-fixssh deleted file mode 100644 index ac7b597..0000000 --- a/tools/cron-fixssh +++ /dev/null @@ -1 +0,0 @@ -* * * * * root /usr/sbin/boca-fixssh >>/var/log/boca-fixssh.out 2>>/var/log/boca-fixssh.err diff --git a/tools/cron-logroot b/tools/cron-logroot deleted file mode 100644 index d1a27bc..0000000 --- a/tools/cron-logroot +++ /dev/null @@ -1 +0,0 @@ -* * * * * root /usr/sbin/boca-submit-logroot >>/var/log/boca-submit-logroot.out 2>>/var/log/boca-submit-logroot.err diff --git a/tools/cron-submit b/tools/cron-submit deleted file mode 100644 index 5fda786..0000000 --- a/tools/cron-submit +++ /dev/null @@ -1 +0,0 @@ -*/2 * * * * root /usr/bin/boca-submit-run-cron >>/var/log/bocacron.out 2>>/var/log/bocacron.err -- cgit v1.2.3