Squashed 'cgilite/' changes from 8c2e52f..506e2f9

506e2f9 Bugfix (security): fail session id check on undetermined condition
2638ffc function for providing file transaction IDs
9e0b693 portable sed invocations

git-subtree-dir: cgilite
git-subtree-split: 506e2f9f146c13919e65a9bbbd844391b96bbe9d

diff --git a/file.sh b/file.sh
index b6118f522d8b31d4fa0b19ec42226ab263b705cf..51ec245f2678602a12882d71d39173ff9acd98b1 100755 (executable)
--- a/file.sh
+++ b/file.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Copyright 2016 - 2018 Paul Hänsch
+# Copyright 2016 - 2019 Paul Hänsch
 #
 # This file is part of cgilite.
 # 
@@ -59,7 +59,7 @@ FILE(){
     # Parse the allowable date formats from Section 3.3.1 of
     # https://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html
     HEADER If-Modified-Since \
-    | sed -r 's;^[^ ]+, ([0-9]{2}) (...) ([0-9]{4}) (..:..:..) GMT$;\3-\2-\1 \4;;
+    | sed -E 's;^[^ ]+, ([0-9]{2}) (...) ([0-9]{4}) (..:..:..) GMT$;\3-\2-\1 \4;;
               s;^[^ ]+, ([0-9]{2})-(...)-([789][0-9]) (..:..:..) GMT$;19\3-\2-\1 \4;;
               s;^[^ ]+, ([0-9]{2})-(...)-([0-6][0-9]) (..:..:..) GMT$;20\3-\2-\1 \4;;
               s;^[^ ]+ (...) ([0-9]{2}) (..:..:..) ([0-9]{4})$;\4-\1-\2 \3;;
@@ -69,7 +69,7 @@ FILE(){
     | xargs -r0 date +%s -ud 2>&-
   )"
 
-  range="$(HEADER Range |sed -nr 's;^bytes=([0-9]+-[0-9]*|-[0-9]+)$;\1;p;q;')"
+  range="$(HEADER Range |sed -nE 's;^bytes=([0-9]+-[0-9]*|-[0-9]+)$;\1;p;q;')"
   case "$range" in
     *-) range="${range}$((file_size - 1))";;
     -*) [ ${range#-} -le $file_size ] \

diff --git a/session.sh b/session.sh
index 25a65987c3671df4f4c8499279a71487edad5775..8ed8d8808e0655cc8b89c6ce7bb0df318b0b571f 100755 (executable)
--- a/session.sh
+++ b/session.sh
@@ -41,6 +41,15 @@ timeid(){
 
 checkid(){ grep -m 1 -xE '[0-9a-zA-Z:=]{16}'; }
 
+transid(){
+  # transaction ID to modify a given file
+  local file="$1"
+  { stat -c %F%i%n%N%s%Y "$file" 2>&-
+    printf %s "$SESSION_ID"
+    server_key
+  } | sha256sum | cut -d\  -f1
+}
+
 update_session(){
   local session sid time sig serverkey checksig
 
@@ -53,9 +62,9 @@ update_session(){
   checksig="${checksig%% *}"
   d=$(date +%s)
   
-  if [ "$checksig" != "$sig" \
-    -o "$time" -lt "$d" \
-    -o ! "$(printf %s "$sid" |checkid)" ] 2>&-
+  if ! [ "$checksig" = "$sig" \
+    -a "$time" -ge "$d" \
+    -a "$(printf %s "$sid" |checkid)" ] 2>&-
   then
     debug Setting up new session
     sid="$(randomid)"

diff --git a/storage.sh b/storage.sh
index 0d09b262b4d700dac399dbc165ff5250570d16fa..10a802950465c813001a3aa27f95f2f4a22dd1b7 100755 (executable)
--- a/storage.sh
+++ b/storage.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Copyright 2018 Paul Hänsch
+# Copyright 2018, 2019 Paul Hänsch
 #
 # This is a file format helper, part of CGIlite.
 # 
@@ -74,7 +74,7 @@ STRING='
 
 STRING(){
   { [ $# -eq 0 ] && cat || printf %s "$*"; } \
-  | sed -r ':X; $!{N;bX;}'"$STRING"
+  | sed -E ':X; $!{N;bX;}'"$STRING"
 }
 
 UNSTRING='
@@ -89,5 +89,5 @@ UNSTRING='
 '
 UNSTRING(){
   { [ $# -eq 0 ] && cat || printf %s "$*"; } \
-  | sed -r "$UNSTRING"
+  | sed -E "$UNSTRING"
 }