authenticate against a hash of identifyable information from certificate instead...

diff --git a/functions.php b/functions.php
index 51731fa6e7e0a7028b56a915ca404a59d5648e04..c31727ca395b35b2c53573e313976b6d0c953d08 100644 (file)
--- a/functions.php
+++ b/functions.php
@@ -1757,9 +1757,19 @@
                return true;
        }
 
+       function get_ssl_certificate_id() {
+               if ($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"]) {
+                       return sha1($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"] .
+                               $_SERVER["REDIRECT_SSL_CLIENT_V_START"] .
+                               $_SERVER["REDIRECT_SSL_CLIENT_V_END"] .
+                               $_SERVER["REDIRECT_SSL_CLIENT_S_DN"]);
+               }
+               return "";
+       }
+
        function get_login_by_ssl_certificate($link) {
 
-               $cert_serial = db_escape_string($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"]);
+               $cert_serial = db_escape_string(get_ssl_certificate_id());
 
                if ($cert_serial) {
                        $result = db_query($link, "SELECT login FROM ttrss_user_prefs, ttrss_users

diff --git a/modules/pref-prefs.php b/modules/pref-prefs.php
index 1a2b2cd77080f9b1b8e6963c727d6f80bee0df49..ab54ea17407f3efe38525f2754f03424cbd98d7f 100644 (file)
--- a/modules/pref-prefs.php
+++ b/modules/pref-prefs.php
@@ -435,17 +435,21 @@
                                } else if ($pref_name == "SSL_CERT_SERIAL") {
 
                                        print "<input dojoType=\"dijit.form.ValidationTextBox\"
-                                               id=\"SSL_CERT_SERIAL\"
+                                               id=\"SSL_CERT_SERIAL\" readonly=\"1\"
                                                name=\"$pref_name\" value=\"$value\">";
 
-                                       $cert_serial = htmlspecialchars($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"]);
+                                       $cert_serial = htmlspecialchars(get_ssl_certificate_id());
 
                                        if ($cert_serial) {
                                                print " <button dojoType=\"dijit.form.Button\"
                                                        onclick=\"insertSSLserial('$cert_serial')\">" .
-                                                       __('Fill automatically') . "</button>";
+                                                       __('Register') . "</button>";
                                        }
 
+                                       print " <button dojoType=\"dijit.form.Button\"
+                                               onclick=\"insertSSLserial('')\">" .
+                                               __('Clear') . "</button>";
+
                                } else {
                                        $regexp = ($type_name == 'integer') ? 'regexp="^\d*$"' : '';
 

diff --git a/schema/ttrss_schema_mysql.sql b/schema/ttrss_schema_mysql.sql
index a4acf1e48bacf013ede9d349b75ff2fb80f51008..69cf6dce0c2d879a20aee449591ffbd55281a873 100644 (file)
--- a/schema/ttrss_schema_mysql.sql
+++ b/schema/ttrss_schema_mysql.sql
@@ -391,7 +391,7 @@ insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_
 
 insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id) values('_MOBILE_BROWSE_CATS', 1, 'true', '', 1);
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 create table ttrss_user_prefs (
    owner_uid integer not null,

diff --git a/schema/ttrss_schema_pgsql.sql b/schema/ttrss_schema_pgsql.sql
index fbb693cecc0c23382db7f04813384d5cb28e357b..7718aa30e3f572d29369bf81575a840e2d6fdebd 100644 (file)
--- a/schema/ttrss_schema_pgsql.sql
+++ b/schema/ttrss_schema_pgsql.sql
@@ -355,7 +355,7 @@ insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_
 
 insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id) values('_MOBILE_BROWSE_CATS', 1, 'true', '', 1);
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 create table ttrss_user_prefs (
        owner_uid integer not null references ttrss_users(id) ON DELETE CASCADE,

diff --git a/schema/versions/mysql/82.sql b/schema/versions/mysql/82.sql
index 79fe5f49d131e19edcf9925175346d374ebc3241..80ca24e721cd28458bd2c35f71cfe564e1ce64ac 100644 (file)
--- a/schema/versions/mysql/82.sql
+++ b/schema/versions/mysql/82.sql
@@ -1,6 +1,6 @@
 begin;
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 update ttrss_version set schema_version = 82;
 

diff --git a/schema/versions/pgsql/82.sql b/schema/versions/pgsql/82.sql
index 79fe5f49d131e19edcf9925175346d374ebc3241..80ca24e721cd28458bd2c35f71cfe564e1ce64ac 100644 (file)
--- a/schema/versions/pgsql/82.sql
+++ b/schema/versions/pgsql/82.sql
@@ -1,6 +1,6 @@
 begin;
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 update ttrss_version set schema_version = 82;