Merge lp:~gesha/linaro-license-protection/fix-https-and-chrome into lp:~linaro-automation/linaro-license-protection/trunk

[Georgy Redkozubov]

This branch adds https processing and fixes cookies handling.

[lp:~gesha/linaro-license-protection/fix-https-and-chrome]

67. By Georgy Redkozubov on 2012-04-25

Updated filename handling

68. By Georgy Redkozubov on 2012-04-25

Added symlinks support

[Paul Sokolovsky (pfalcon)]

I was here and eyeballed it for typos, etc.

Not sure I understand functionality enough to comment on that. One thing I could point to is:

+function check_file($fn)
70 +{
71 + if (is_file($fn) or is_link($fn)) {

if (file_exists($fn) and check_file($fn)) { // Requested download is file

Symlink is assumed to be a file, but it can point to a dir too.

review: Approve

[James Tunnicliffe (dooferlad)]

This looks fine to me. I assume it passes the tests :-)

On the subject of tests, I don't think we have one for the condition that Paul spotted (simlink to something that isn't a file). I don't think it is worth holding up releasing this since I don't think we simlink to directories at the moment on snapshots or releases, but it is worth filing a bug and getting it fixed when you have the time.

review: Approve

=== modified file '.htaccess'
--- .htaccess	2012-04-24 08:30:45 +0000
+++ .htaccess	2012-04-25 16:35:48 +0000
@@ -11,11 +11,13 @@
 
 ## CO_DOMAIN is set to host name or host address
 ## without port number for use in cookie domain
-RewriteCond %{SERVER_PORT} !^80$
+RewriteCond %{SERVER_PORT} !^80$ [OR]
+RewriteCond %{SERVER_PORT} !^443$
 RewriteCond %{HTTP_HOST} (.*)(\:.*)
 RewriteRule .* - [E=CO_DOMAIN:%1]
 
-RewriteCond %{SERVER_PORT} ^80$
+RewriteCond %{SERVER_PORT} !^80$ [OR]
+RewriteCond %{SERVER_PORT} !^443$
 RewriteCond %{HTTP_HOST} (^.*$)
 RewriteRule .* - [E=CO_DOMAIN:%1]
 
@@ -50,7 +52,7 @@
 ## Unset it to be able to process several protected files in the same dir
 RewriteCond %{HTTP_COOKIE} licenseaccepted=true
 RewriteCond %{HTTP_COOKIE} downloadrequested=([^\;]*\/)([^/\;]*)
-RewriteRule .* - [CO=licenseaccepted:INVALID:;:-1:%1,L]
+RewriteRule .* - [CO=licenseaccepted:INVALID:.%{ENV:CO_DOMAIN}:-1:%1,L]
 
 ## When license is accepted, set the cookie.
 RewriteCond %{REQUEST_URI} licenses/.*-accepted.html$
@@ -62,6 +64,17 @@
 RewriteCond %{HTTP_COOKIE} downloadrequested=(.*)
 RewriteRule .* /licenses/nolicense.html [L]
 
+## Exception for images.
+RewriteCond %{REQUEST_URI} /favicon.ico [OR]
+RewriteCond %{REQUEST_URI} .*\.png
+RewriteRule .* - [L]
+
+## Exception for restricted area
+RewriteCond %{REQUEST_URI} .*openid.* [OR]
+RewriteCond %{REQUEST_URI} .*restricted.* [OR]
+RewriteCond %{REQUEST_URI} .*private.*
+RewriteRule .* - [L]
+
 ## Pass through any non-protected dirs.
 RewriteCond %{REQUEST_FILENAME} -d
 RewriteCond %{REQUEST_FILENAME}/OPEN-EULA.txt -f 
@@ -73,11 +86,11 @@
 
 ## Unset cookie indicating redirect from license.php
 RewriteCond %{HTTP_COOKIE} redirectlicensephp=yes
-RewriteRule .* - [CO=redirectlicensephp:INVALID:;:-1,L]
+RewriteRule .* - [CO=redirectlicensephp:INVALID:.%{ENV:CO_DOMAIN}:-1,L]
 
 ## Redirect to the Samsung license file protected builds.
 RewriteCond %{REQUEST_URI} !^/$ 
-RewriteRule .* /licenses/license.php [CO=downloadrequested:%{REQUEST_URI}:.%{ENV:CO_DOMAIN},L,R]
+RewriteRule .* /licenses/license.php [CO=downloadrequested:%{REQUEST_URI}:.%{ENV:CO_DOMAIN}:5:/,L,R]
 
 ## Return "Permission denied" if no EULA/OPEN-EULA exists
 RewriteCond %{REQUEST_URI} !^/$

=== modified file 'licenses/license.php'
--- licenses/license.php	2012-04-24 08:30:45 +0000
+++ licenses/license.php	2012-04-25 16:35:48 +0000
@@ -1,12 +1,20 @@
 <?php
 // Get list of files into array to process them later.
 // Used to find special licenses and dirs with only subdirs.
+function check_file($fn)
+{
+	if (is_file($fn) or is_link($fn)) {
+		return true;
+	}
+	return false;
+}
+
 function getFilesList($dirname)
 {
 	$files = array(); 
 	if ($handle = opendir($dirname)) {
 		while ($handle && false !== ($entry = readdir($handle))) {
-			if ($entry != "." && $entry != ".." && !is_dir($dirname.$entry) && !is_link($dirname.$entry)) {
+			if ($entry != "." && $entry != ".." && !is_dir($dirname.$entry) && $entry != "HEADER.html") {
 				$files[] = $entry;
 			}
 		}
@@ -55,31 +63,58 @@
 		} else {
 			$theme = "linaro";
 		}
-	} 
+	}
 	return $theme;
 }
 
+function status_forbidden($dir)
+{
+	header("Status: 403");
+	header("HTTP/1.1 403 Forbidden");
+	echo "<h1>Forbidden</h1>";
+	echo "You don't have permission to access ".$dir." on this server.";
+	exit;
+}
+
+function status_ok($dir, $domain)
+{
+	header("Status: 200");
+	header("Location: ".$dir);
+	setcookie("redirectlicensephp", "yes", 0, "/", ".".$domain);
+	exit;
+}
+
+function status_not_found()
+{
+	header("Status: 404");
+	header("HTTP/1.0 404 Not Found");
+	echo "<h1>404 Not Found</h1>";
+	echo "The requested URL was not found on this server.";
+	exit;
+}
+
 $down = $_COOKIE["downloadrequested"];
 $host = $_SERVER["HTTP_HOST"];
 $doc = $_SERVER["DOCUMENT_ROOT"];
+$domain = $_SERVER["CO_DOMAIN"];
 $fn = $doc.$down; // Filename on server
 $flist = array();
 $eula = '';
 
-if (file_exists($fn) and is_file($fn)) { // Requested download is file
+if (preg_match("/.*openid.*/", $fn) or preg_match("/.*restricted.*/", $fn) or preg_match("/.*private.*/", $fn)) {
+	status_ok($down, $domain);
+}
+
+if (file_exists($fn) and check_file($fn)) { // Requested download is file
 	$search_dir = dirname($fn);
 	$repl = dirname($down);
-	$name_only = splitFilename(basename($down));
+	$name_only = array(basename($down), '');
 } elseif (is_dir($fn)) { // Requested download is directory
 	$search_dir = $fn;
 	$repl = $down;
 	$name_only = array();
 } else { // Requested download not found on server
-	header("HTTP/1.0 404 Not Found");
-	header("Status: 404");
-	echo "<h1>404 Not Found</h1>";
-	echo "The requested URL was not found on this server.";
-	exit;
+	status_not_found();
 }
 
 $flist = getFilesList($search_dir);
@@ -89,26 +124,26 @@
 	$eula = findSpecialEULA($flist, $pattern);
 }
 
-if (is_file($doc."/".$repl."/".$eula)) { // Special EULA found
-	$theme = getTheme($eula, $down);
-} elseif (is_file($doc."/".$repl."/EULA.txt")) { // No special EULA found
-	$theme = getTheme("EULA.txt", $down);
-} elseif (file_exists($fn) and findSpecialEULA($flist, "/.*EULA.txt.*/")) {
-	// If file is requested but no special EULA for it and no EULA.txt is present,
-	// look for any EULA and if found decide that current file is not protected.
-	setcookie("redirectlicensephp", "yes", 0, "/");
-	header("Location: ".$down);
-	exit;
-} elseif (empty($flist)) { // Directory contains only subdirs
-	setcookie("redirectlicensephp", "yes", 0, "/");
-	header("Location: ".$down);
-	exit;
-} else { // No special EULA, no EULA.txt, no OPEN-EULA.txt found
-	header("HTTP/1.1 403 Forbidden");
-	header("Status: 403");
-	echo "<h1>Forbidden</h1>";
-	echo "You don't have permission to access ".$down." on this server.";
-	exit;
+if (check_file($fn)) {
+	if (check_file($doc."/".$repl."/".$eula)) { // Special EULA found
+		$theme = getTheme($eula, $down);
+	} elseif (check_file($doc."/".$repl."/EULA.txt")) { // No special EULA found
+		$theme = getTheme("EULA.txt", $down);
+	} elseif (findSpecialEULA($flist, "/.*EULA.txt.*/")) {
+		// If file is requested but no special EULA for it and no EULA.txt is present,
+		// look for any EULA and if found decide that current file is not protected.
+		status_ok($down, $domain);
+	} else {
+		status_forbidden($down);
+	}
+} elseif (is_dir($fn)) {
+	if (empty($flist) or findSpecialEULA($flist, "/.*EULA.txt.*/")) { // Directory contains only subdirs or any EULA
+		status_ok($down, $domain);
+	} else { // No special EULA, no EULA.txt, no OPEN-EULA.txt found
+		status_forbidden($down);
+	}
+} else {
+	status_forbidden($down);
 }
 
 $template_content = file_get_contents($doc."/licenses/".$theme.".html");

=== modified file 'licenses/ste.html'
--- licenses/ste.html	2012-04-24 08:30:45 +0000
+++ licenses/ste.html	2012-04-25 16:35:48 +0000
@@ -108,8 +108,6 @@
 EULA.txt
 </div><!-- license-text -->
 
-</div><!-- content -->
-
 <div id="actions">
 
 <div style="float: left;">If accepting the license doesn't work, enable
@@ -120,5 +118,7 @@
 
 </div>
 
+</div><!-- content -->
+
 </body>
 </html>