Security hardening of the AUTOREGISTER option

[PBoissier]

The SQL_DB_USERS_AUTOREGISTER variable of WEBOBS.rc allows the automatic creation of WebObs user accounts when a person completes the register.pl form.

When the value of this variable is "Y" the SQLite user database is filled but leaves the "valid" field at "N". The newly created user is therefore not activated. Activation must be done by an administrator.
This variable will also trigger the filling of Apache's htpasswd file. This file contains the user's login and encrypted password.

As a result, the user who has just completed the registration form can immediately authenticate on the Apache server.
This does not allow him to display the WebObs pages because the latter detects the invalidity of the account. Nevertheless the user has access to all the resources of the virtualhost concerned by the htpasswd. This can lead to code injection attempts via the CGI interface (https://www.cgisecurity.com/lib/sips.html) or denial of service attacks.

[PBoissier]

I propose that when validating the register.pl form, the htpasswd file is still filled in but that the new entry is commented out.
It will also be necessary to modify the "WebObs User Manager" page so that the htpasswd file is modified according to the validation or not of a user.
We can also imagine a task in the scheduler which will completely deactivate users whose validity date has passed (in the database and in the htpasswd)

Perl code for commenting / uncommenting htpasswd could be :

use strict;
use warnings;

my $file = shift;
my $login = shift;
my $valid = shift;
open FILE, $file or die "Can't read from $file!\n";

my @lines;
while (my $line = <FILE>) {
	if ($line =~ /^$login/ && $valid eq 'N') {
		$line =~ s/^$login/#$login/ig;
	}
	if ($line =~ /^#$login/ && $valid eq 'Y') {
		$line =~ s/^#$login/$login/ig;
	}
	push @lines, $line;
}
close FILE;

open FILE, '>', $file or die "Can't write to $file!\n";
print FILE @lines;
close FILE;

[beaudu]

I suggest to add a colon : at the end of login name to prevent matching similar logins:
if ($line =~ /^$login:/ && $valid eq 'N') {
and
if ($line =~ /^#$login:/ && $valid eq 'Y') {