From e79b5f2fb9bc60d0ea82662c92a5b7708d4094bf Mon Sep 17 00:00:00 2001
From: Jean-Luc Cyr <me@jlcyr.com>
Date: Mon, 11 Jun 2018 11:23:16 -0400
Subject: [PATCH] validation public, owner, primary group

---
 mod_absec.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 65 insertions(+), 20 deletions(-)

diff --git a/mod_absec.c b/mod_absec.c
index a9517aa..d4a4736 100644
--- a/mod_absec.c
+++ b/mod_absec.c
@@ -72,22 +72,52 @@
 #include <sys/stat.h>
 
 ////////////////////////////////////////////////////////////////
-/* The sample content handler */
+/* Check user autentication against unix user/pass */
+static int check_autentication(request_rec *r)
+{
+    return 0;
+}
+
+////////////////////////////////////////////////////////////////
+/* Check check file perms */
+static int check_autorization(request_rec *r)
+{
+    return 0;
+}
+
+
+////////////////////////////////////////////////////////////////
+/* Main routine */
 static int absec_handler(request_rec *r)
 {
+    // Is this module really called?
     if (strcmp(r->handler, "absec")) {
         return DECLINED;
     }
 
+
+////////
+/* check file permission on filesystem */
+/* should include <sys/stat.h> */
+    struct stat fperm;
+    int status;
+    status = stat(r->filename, &fperm);
+    ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)<br/>\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
+
+    // If file is world readable return content
+    if (fperm.st_mode & 0x4) {
+        ap_rprintf(r, "Fichier public<br/>\r\n");
+        return (DECLINED);
+    }
+
     const char* auth64p;
-
-    r->content_type = "text/html";      
-
     if (!r->header_only)
         // Check if we have an auth header
         auth64p = apr_table_get(r->headers_in,"Authorization");
 
+    // If no basic auth, ask for one
     if (auth64p==NULL) {
+        r->content_type = "text/html";      
         apr_table_setn(r->err_headers_out,
                 (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
                                                 : "WWW-Authenticate",
@@ -101,10 +131,7 @@ static int absec_handler(request_rec *r)
     // Get the basic auth base64 string and decode it
     // Start at char 6 to skip 'Basic '
     char *auth64;
-    //apr_strtok((char*)auth64p, " ", &auth64);
-    //ap_rprintf(r, "Test: %s \n<br/>", auth64);
     auth64 = apr_pstrdup(r->pool, auth64p+6);
-    //ap_rprintf(r, "Test: %s \n<br/>", auth64);
     char *auth;
     auth = apr_pcalloc(r->pool, 64);
     apr_base64_decode(auth, auth64);
@@ -114,14 +141,14 @@ static int absec_handler(request_rec *r)
     char *pass;
     user = apr_strtok(auth, ":", &pass);
 
-    // Get UID, GIDs for the user
-
-    ap_rprintf(r, "The sample page from mod_absec.c %s \n<br/>", r->args);
+    r->content_type = "text/html";      
+    //ap_rprintf(r, "The sample page from mod_absec.c %s \n<br/>", r->args);
     ap_rprintf(r, "Url: %s from %s \n<br/>", r->filename, r->uri);
-    ap_rprintf(r, "Headers Authorization: %s \n<br/>", auth64);
-    ap_rprintf(r, "User/Pass: %s/%s \n<br/>", user, pass);
+    //ap_rprintf(r, "Headers Authorization: %s \n<br/>", auth64);
+    //ap_rprintf(r, "User/Pass: %s/%s \n<br/>", user, pass);
 
 ////////
+// Get UID, GIDs for the user
 /* Working example, but just UID not PW */
     apr_status_t ret;
     apr_uid_t i;
@@ -198,21 +225,39 @@ static int absec_handler(request_rec *r)
         return HTTP_UNAUTHORIZED;
     }
 
-////////
-/* check file permission on filesystem */
-/* should include <sys/stat.h> */
-    struct stat fperm;
-    int status;
-    status = stat(r->filename, &fperm);
-    ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
 
+    // If file is user readable and user match return content
+    if ((fperm.st_uid==i) && (fperm.st_mode & 0400)) {
+        ap_rprintf(r, "Fichier propriétaire<br/>\r\n");
+        return (DECLINED);
+    }
+
+    // If file is group readable and primary group match return content
+    if ((fperm.st_gid==g) && (fperm.st_mode & 0040)) {
+        ap_rprintf(r, "Fichier groupe<br/>\r\n");
+        return (DECLINED);
+    }
+
+    // now check supplemental groups
+    //ap_rprintf(r, "Fichier propriétaire %d %d %o %o<br/>\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
+
+    // else decline
+    ap_rprintf(r, "Aucuns droits de voir le fichier<br/>\r\n");
+        apr_table_setn(r->err_headers_out,
+                (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
+                                                : "WWW-Authenticate",
+                apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
+                            "\"", NULL));
+    return HTTP_UNAUTHORIZED;
     return OK;
+
 }
 
 ////////////////////////////////////////////////////////////////
 static void absec_register_hooks(apr_pool_t *p)
 {
-    ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
+    //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
+    ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_LAST);
 }
 
 ////////////////////////////////////////////////////////////////