2.2.4-beta build

ipk-source/sdxpinn-quecmanager-beta/root/www/cgi-bin/quecmanager/auth.sh

@@ -9,7 +9,7 @@ read -r POST_DATA
 
 # Debug log for generated hash
 DEBUG_LOG="/tmp/auth.log"
-
+AUTH_FILE="/tmp/auth_success"
 # Extract the password from POST data (URL encoded)
 USER="root"
 INPUT_PASSWORD=$(echo "$POST_DATA" | grep -o 'password=[^&]*' | cut -d= -f2-)
@@ -56,7 +56,34 @@ printf "Generated hash: %s\n" "$GENERATED_HASH" >> "$DEBUG_LOG"
 
 # Compare the generated hash with the one in the shadow file
 if [ "$GENERATED_HASH" = "$USER_HASH" ]; then
-    echo '{"state":"success"}'
+    TOKEN=$(head -c 16 /dev/urandom | hexdump -v -e '/1 "%02x"')
+    CREATED_DATE=$(date +"%Y-%m-%dT%H:%M:%S")
+    touch ${AUTH_FILE}
+    echo "${CREATED_DATE} ${TOKEN}" >> ${AUTH_FILE}
+    echo "" >> ${AUTH_FILE}
+    echo "{\"state\":\"success\",\"token\":\"${TOKEN}\"}"
 else
+    # Remove token from file
+    if [ -n ${TOKEN} ]; then
+        sed -i -e "s/.*${TOKEN}.*//g" ${AUTH_FILE} 2>/dev/null
+    fi
     echo '{"state":"failed", "message":"Authentication failed"}'
-fi
+fi
+
+# AUTH_FILE cleanup process, Remove any token lines older than 2 hours from AUTH_FILE
+MAX_AGE=$((2 * 3600)) # 2 hours in seconds
+NOW_TIME=$(date +%s)
+TMP_FILE=$(mktemp)
+while read -r line; do
+    if [ -n "$(echo "$line" | tr -d '[:space:]')" ]; then
+        # Extract the date from the line and convert it to a timestamp
+        TOKEN_DATE=$(echo "$line" | awk '{print $1}' | sed 's/T/ /')
+        TOKEN_TIME=$(date -d "$TOKEN_DATE" +%s 2>/dev/null)
+        # If date is valid and not older than MAX_AGE, keep the line
+        if [ -n "$TOKEN_TIME" ] && [ $((NOW_TIME - TOKEN_TIME)) -le $MAX_AGE ]; then
+            echo "$line" >> "$TMP_FILE"
+        fi
+    fi
+done < "$AUTH_FILE"
+
+mv "$TMP_FILE" "$AUTH_FILE"