From a9edcc55eecf9633dfb5bb5770a03788fad60dbd Mon Sep 17 00:00:00 2001
From: Christopher Landwehr <clndwhr@gmail.com>
Date: Fri, 9 May 2025 12:33:14 -0400
Subject: [PATCH 1/3] fix issues with DEBUG_LOG

---
 scripts/cgi-bin/quecmanager/auth.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/scripts/cgi-bin/quecmanager/auth.sh b/scripts/cgi-bin/quecmanager/auth.sh
index dc53c38..a093907 100644
--- a/scripts/cgi-bin/quecmanager/auth.sh
+++ b/scripts/cgi-bin/quecmanager/auth.sh
@@ -9,10 +9,13 @@ read -r POST_DATA
 
 # Debug log for generated hash
 DEBUG_LOG="/tmp/auth.log"
+touch "/tmp/auth.log"
+echo "" > "$DEBUG_LOG"
 
 # Extract the password from POST data (URL encoded)
 USER="root"
 INPUT_PASSWORD=$(echo "$POST_DATA" | grep -o 'password=[^&]*' | cut -d= -f2-)
+echo "User: $USER" >> "$DEBUG_LOG"
 
 # URL-decode the password while preserving most special characters
 # First decode percent-encoded sequences
@@ -32,10 +35,11 @@ fi
 
 # Sanitize the password for shell usage
 INPUT_PASSWORD=$(printf '%s' "$INPUT_PASSWORD" | sed 's/[\"]/\\&/g')
-
 # Extract the hashed password from /etc/shadow for the specified user
 USER_SHADOW_ENTRY=$(grep "^$USER:" /etc/shadow)
 
+echo "USER: $USER - Shadow User: $USER_SHADOW_ENTRY" >> $DEBUG_LOG
+
 if [ -z "$USER_SHADOW_ENTRY" ]; then
     echo '{"state":"failed", "message":"User not found"}'
     exit 1
@@ -47,12 +51,14 @@ USER_HASH=$(echo "$USER_SHADOW_ENTRY" | cut -d: -f2)
 # Extract the salt (MD5 uses the $1$ prefix followed by the salt)
 SALT=$(echo "$USER_HASH" | cut -d'$' -f3)
 
+
+echo "SALT: $SALT" >> $DEBUG_LOG
 # Generate a hash from the input password using the same salt
 # Use printf to avoid issues with special characters in echo
 GENERATED_HASH=$(printf '%s' "$INPUT_PASSWORD" | openssl passwd -1 -salt "$SALT" -stdin)
 
 # Log generated hash for debugging
-printf "Generated hash: %s\n" "$GENERATED_HASH" >> "$DEBUG_LOG"
+echo "Generated hash: %s\n" "$GENERATED_HASH" >> "$DEBUG_LOG"
 
 # Compare the generated hash with the one in the shadow file
 if [ "$GENERATED_HASH" = "$USER_HASH" ]; then

From f4ccbfcba4ed9e514fc509cb628b85dcae432935 Mon Sep 17 00:00:00 2001
From: Christopher Landwehr <clndwhr@gmail.com>
Date: Fri, 9 May 2025 12:34:37 -0400
Subject: [PATCH 2/3] fetch Platform type to determine if we're fetching
 credentials from /etc/shadow or /opt/etc/.htpasswd

---
 scripts/cgi-bin/quecmanager/auth.sh | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/scripts/cgi-bin/quecmanager/auth.sh b/scripts/cgi-bin/quecmanager/auth.sh
index a093907..761b6d8 100644
--- a/scripts/cgi-bin/quecmanager/auth.sh
+++ b/scripts/cgi-bin/quecmanager/auth.sh
@@ -12,8 +12,17 @@ DEBUG_LOG="/tmp/auth.log"
 touch "/tmp/auth.log"
 echo "" > "$DEBUG_LOG"
 
+# get the platform type
+PLATFORM=$(cat /sys/devices/soc0/machine)
+echo "PLATFORM: $PLATFORM" >> "$DEBUG_LOG"
 # Extract the password from POST data (URL encoded)
-USER="root"
+if echo $PLATFORM | grep -q  "LEMUR"; then
+        USER="admin"
+        ACCESS_FILE="/opt/etc/.htpasswd"
+elif echo $PLATFORM | grep -q  "PINN"; then
+        USER="root"
+        ACCESS_FILE="/etc/shadow"
+fi
 INPUT_PASSWORD=$(echo "$POST_DATA" | grep -o 'password=[^&]*' | cut -d= -f2-)
 echo "User: $USER" >> "$DEBUG_LOG"
 
@@ -26,6 +35,7 @@ urldecode() {
 
 # Decode the password
 INPUT_PASSWORD=$(urldecode "$INPUT_PASSWORD")
+echo "ACCESS_FILE: $ACCESS_FILE" >> $DEBUG_LOG
 
 # Basic validation to reject & and $ characters
 if echo "$INPUT_PASSWORD" | grep -q '[&$]'; then
@@ -36,7 +46,7 @@ fi
 # Sanitize the password for shell usage
 INPUT_PASSWORD=$(printf '%s' "$INPUT_PASSWORD" | sed 's/[\"]/\\&/g')
 # Extract the hashed password from /etc/shadow for the specified user
-USER_SHADOW_ENTRY=$(grep "^$USER:" /etc/shadow)
+USER_SHADOW_ENTRY=$(grep "^$USER:" "$ACCESS_FILE")
 
 echo "USER: $USER - Shadow User: $USER_SHADOW_ENTRY" >> $DEBUG_LOG
 
@@ -51,11 +61,14 @@ USER_HASH=$(echo "$USER_SHADOW_ENTRY" | cut -d: -f2)
 # Extract the salt (MD5 uses the $1$ prefix followed by the salt)
 SALT=$(echo "$USER_HASH" | cut -d'$' -f3)
 
+HASH_TYPE=$(echo "$USER_HASH" | cut -d'$' -f2)
 
 echo "SALT: $SALT" >> $DEBUG_LOG
+echo "HASH_TYPE: $HASH_TYPE" >> $DEBUG_LOG
+
 # Generate a hash from the input password using the same salt
 # Use printf to avoid issues with special characters in echo
-GENERATED_HASH=$(printf '%s' "$INPUT_PASSWORD" | openssl passwd -1 -salt "$SALT" -stdin)
+GENERATED_HASH=$(printf '%s' "$INPUT_PASSWORD" | openssl passwd -$HASH_TYPE -salt "$SALT" -stdin)
 
 # Log generated hash for debugging
 echo "Generated hash: %s\n" "$GENERATED_HASH" >> "$DEBUG_LOG"

From a8c41ae2d44fc069d6290ee297b2b69e0df0f978 Mon Sep 17 00:00:00 2001
From: Christopher Landwehr <clndwhr@gmail.com>
Date: Thu, 3 Jul 2025 20:27:03 -0400
Subject: [PATCH 3/3] Finished DEBUG_LOG paramaterizing, added clarification on
 logging

---
 scripts/cgi-bin/quecmanager/auth.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/cgi-bin/quecmanager/auth.sh b/scripts/cgi-bin/quecmanager/auth.sh
index 761b6d8..ef9a0cf 100644
--- a/scripts/cgi-bin/quecmanager/auth.sh
+++ b/scripts/cgi-bin/quecmanager/auth.sh
@@ -9,7 +9,8 @@ read -r POST_DATA
 
 # Debug log for generated hash
 DEBUG_LOG="/tmp/auth.log"
-touch "/tmp/auth.log"
+touch $DEBUG_LOG
+# Clear log before each attempt to keep file space usage small
 echo "" > "$DEBUG_LOG"
 
 # get the platform type
@@ -78,4 +79,4 @@ if [ "$GENERATED_HASH" = "$USER_HASH" ]; then
     echo '{"state":"success"}'
 else
     echo '{"state":"failed", "message":"Authentication failed"}'
-fi
\ No newline at end of file
+fi