From ab9a0b71d96032ea34621ac7063b35abea92a3a9 Mon Sep 17 00:00:00 2001
From: Rob van Son <R.J.J.H.vanSon@gmail.com>
Date: Mon, 1 Apr 2013 14:36:25 +0200
Subject: [PATCH] Changed SESSION tickets to hash(SESSIONTICKET) to enable
 direct setting of cookies

---
 CGIscriptor.pl                   |  4 ++--
 JavaScript/CGIscriptorSession.js |  2 +-
 Private/Login.html               |  2 +-
 PrivateTutorial.html             | 13 ++++++-------
 4 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/CGIscriptor.pl b/CGIscriptor.pl
index 24d50ea..8978cea 100755
--- a/CGIscriptor.pl
+++ b/CGIscriptor.pl
@@ -3300,7 +3300,7 @@ sub Log_In_Access	# () -> 0 = Access Allowed, Login page if access is not allowe
 					}
 					else
 					{
-						$SESSIONTICKET = $TMPTICKET;
+						$SESSIONTICKET = hash_string($TMPTICKET);
 						create_session_file("$SessionPath/$SESSIONTICKET", "$SessionPath/$LOGINTICKET", "$PasswordsPath/$userfile", $PATH_INFO);
 						$SETCOOKIELIST{"CGIscriptorSESSION"} = "-";
 					};
@@ -3313,7 +3313,7 @@ sub Log_In_Access	# () -> 0 = Access Allowed, Login page if access is not allowe
 			if($CHALLENGETICKET)
 			{
 				# Do not log into a CHALLENGE account if the SESSION cookie is present
-				goto Login if $SESSIONTICKET =~ /\S/;
+				#goto Login if $SESSIONTICKET =~ /\S/;
 				goto Login unless (-s "$SessionPath/$CHALLENGETICKET");
 				my $ticket_valid = check_ticket_validity("CHALLENGE", "$SessionPath/$CHALLENGETICKET", $REMOTE_ADDR, $PATH_INFO);
 				goto Login unless $ticket_valid;
diff --git a/JavaScript/CGIscriptorSession.js b/JavaScript/CGIscriptorSession.js
index 7f1702e..b4e947b 100644
--- a/JavaScript/CGIscriptorSession.js
+++ b/JavaScript/CGIscriptorSession.js
@@ -274,7 +274,7 @@ function setSessionParameters() {
 	if(!(sessionset &&sessionset.match(/[\S]/)))return false;
 
 	var sessionticket = "";
-	sessionticket = sessionStorage.getItem("CGIscriptorPRIVATE");
+	sessionticket = hex_sha256(sessionStorage.getItem("CGIscriptorPRIVATE"));
 	if(!sessionticket) return false;
 	createCookie("CGIscriptorSESSION",sessionticket, 0, "");
 	
diff --git a/Private/Login.html b/Private/Login.html
index 93e0b80..9588447 100644
--- a/Private/Login.html
+++ b/Private/Login.html
@@ -38,7 +38,7 @@
 <!-- Replace <form  > line with commented version -->
 <!-- Replace http://localhost:8080/Private/index.html with the correct URL of the login page -->
 <!-- <form method="POST" action="http://localhost:8080/Private/index.html" id="LoginForm" onSubmit='LoginSubmit ()'> -->
-<form method="POST" action="" id="LoginForm" onSubmit='LoginSubmit ()'>
+<form method="POST" action="" id="LoginForm" onSubmit='LoginSubmit();setSessionParameters();true'>
 <div style="margin-left: 30%; margin-right: 30%; text-align: right">
   <table>
   <tr><td>Username:</td><td><input type="text" name="CGIUSERNAME" id="CGIUSERNAME" size="60" /></td></tr>
diff --git a/PrivateTutorial.html b/PrivateTutorial.html
index afcda10..891da3a 100644
--- a/PrivateTutorial.html
+++ b/PrivateTutorial.html
@@ -158,13 +158,12 @@ With each new user, a home directory is automatically created as a copy of the
 
 <h2 style="text-align: Center">Creating web pages</h2>
 <p style="text-align: Left">
-	<em>IPADDRESS</em> type sessions do not require any changes in web pages
-	after login. <em>SESSION</em> type sessions require JavaScript code in 
-	the page the client lands on after login to continue. But later pages 
-	can be plain. <em>CHALLENGE</em> type sessions require JavaScript code 
-	on every single protected page (actually, only to get to the next page 
-	after that). To add support for the login sessions to simple web pages, add the 
-	following code to the HEAD section of each HTML file:
+	<em>IPADDRESS</em> and <em>SESSION</em>type sessions do not require 
+	any changes in web pages after login. <em>CHALLENGE</em> type sessions 
+	require JavaScript code on every single protected page (actually, only 
+	to get to the next page after that). To add support for the login 
+	sessions to simple web pages, add the following code to the HEAD 
+	section of each HTML file:
 </p>
 <pre>
 &lt;script type="text/javascript"&gt;
-- 
2.11.4.GIT