@@ -1 +1,10 @@

 Private group web

+

+Dependencies

+============

+

+libmhash

+libscrypt

+webkernel

+

+

@@ -156,7 +156,6 @@ callback_http(wk *web, int connid, wk_uri *uri, void *userptr)

                 log_write("HTTP","Request: /newuser?...");

         else

                 log_write("HTTP","Request: %s",uri->path);

-

         /* extract the name */

         strncpy(partialpath,uri->path,sizeof(partialpath)-1);

         partialpath[sizeof(partialpath)-1]='\0';

@@ -188,7 +187,7 @@ callback_http(wk *web, int connid, wk_uri *uri, void *userptr)

                         return(wkact_finished);

                 } else if((res=res_find(resindexdata,"index.html"))!=NULL) {

                         log_write("HTTP","Not allowed page, redirecting to login");

-                        wk_serve_buffer_as_file(web,connid,res->data,res->len,mime_getdefault(res->name,"application/octet-stream"));

+                        wk_serve_redirect(web,connid,"/");

                         return(wkact_finished);

                 } else {

                         log_write("EINT","%s:%i",__FILE__,__LINE__);

@@ -287,8 +286,8 @@ http_newuser(wk *web, int connid, wk_uri *uri, void *userptr)

         /* check validity */

         if(kakumei_inviteexists(ka,i)!=0) {

                 /* retry login */

-                wk_serve_buffer_as_file(web,connid,"/",1,"text/plain");

                 log_write("NEWU","invalid invite %s, redirecting to login",i);

+                wk_serve_buffer_as_file(web,connid,"/",1,"text/plain");

                 return(wkact_finished);

         }

         /* create user */

@@ -303,8 +302,8 @@ http_newuser(wk *web, int connid, wk_uri *uri, void *userptr)

         /* create session and go to "posts" page */

         if(session_new(ka,u,session,sizeof(session))==NULL) {

                 /* "autologin" didn't work, ask for login */

-                wk_serve_buffer_as_file(web,connid,"/",1,"text/plain");

                 log_write("NEWU","couldn't generate new session, redirecting to login");

+                wk_serve_buffer_as_file(web,connid,"/",1,"text/plain");

                 return(wkact_finished);

         }

         /* valid login */

@@ -23,7 +23,7 @@

 #define SESSIONSDIR "data/sessions"

 #define MAXUSERSIZE 32

 #define MAXPASSWDSIZE 64

-#define SESSIONSIZE 65

+#define SESSIONSIZE 33

 typedef struct kakumei {

         sselect *ssel;

@@ -13,6 +13,7 @@

 #include <fcntl.h>

 #include <time.h>

 #include <mhash.h>

+#include "loglib.h"

 #include "kakumei.h"

 #include "kakumei_session.h"

@@ -49,7 +50,7 @@ session_new(kakumei *ka, char *user, char *session, int sessionsize)

                 mhash(td,&n,sizeof(n));

         }

         mhash_deinit(td,&binhash);

-        for(i=0;i<sizeof(binhash);i++) {

+        for(i=0;i<sizeof(binhash) && i<SESSIONSIZE;i++) {

                 c=(((unsigned char *)binhash)[i]>>4);

                 c=(c>=10)?(c-10+'a'):c+'0';

                 session[i<<1]=c;

@@ -57,7 +58,7 @@ session_new(kakumei *ka, char *user, char *session, int sessionsize)

                 c=(c>=10)?(c-10+'a'):c+'0';

                 session[(i<<1)+1]=c;

         }

-        session[sizeof(binhash)]='\0';

+        session[SESSIONSIZE-1]='\0';

         /* save the hash */

         mkdir(DATADIR,0700);

         mkdir(SESSIONSDIR,0700);

@@ -100,7 +101,7 @@ session_check(kakumei *ka, char *session, char *user, int usersize)

         if(ka==NULL || session==NULL || session[0]=='\0' || user==NULL || usersize<(MAXUSERSIZE+1))

                 return(NULL);

         for(i=0;session[i]!='\0';i++) {

-                if(!(session[i]>='0' && session[i]<='0') &&

+                if(!(session[i]>='0' && session[i]<='9') &&

                    !(session[i]>='a' && session[i]<='f')) {

                         return(NULL);

                 }

@@ -125,7 +126,7 @@ session_del(kakumei *ka, char *session)

         if(ka==NULL || session==NULL || session[0]=='\0')

                 return(-1);

         for(i=0;session[i]!='\0';i++) {

-                if(!(session[i]>='0' && session[i]<='0') &&

+                if(!(session[i]>='0' && session[i]<='9') &&

                    !(session[i]>='a' && session[i]<='f')) {

                         return(-1);

                 }