cacert-webdb/www/gpg.php

<? /*
    LibreSSL - CAcert web application
    Copyright (C) 2004-2008  CAcert Inc.

    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; version 2 of the License.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
*/ ?>
<?
	require_once("../includes/loggedin.php");

        $id = 0; if(array_key_exists('id',$_REQUEST)) $id=intval($_REQUEST['id']);
	$oldid = $_REQUEST['oldid'] = array_key_exists('oldid',$_REQUEST) ? intval($_REQUEST['oldid']) : 0;

	if($_SESSION['profile']['points'] < 50)
	{
		header("location: /account.php");
		exit;
	}

	loadem("account");



	$CSR=""; if(array_key_exists('CSR',$_REQUEST)) $CSR=stripslashes($_REQUEST['CSR']);


	if($oldid == "0")
	{
		if(array_key_exists('process',$_REQUEST) && $_REQUEST['process'] != "" && $CSR == "")
		{
			$_SESSION['_config']['errmsg'] = _("You failed to paste a valid GPG/PGP key.");
			$id = $oldid;
			$oldid=0;
		}
	}

	$keyid="";

if(0)
{
  if($_SESSION["profile"]["id"] != 5897)
  {
    showheader(_("Welcome to CAcert.org"));
    echo "The OpenPGP signing system is currently shutdown due to a maintenance. We hope to get it fixed within the next few hours. We are very sorry for the inconvenience.";
  
    exit(0);
  }
}


function verifyName($name)
{
	if($name == "") return 0;
	if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']) return 1;
	if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']) return 1;
	if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1;
	if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1;
	return 0;

}

function verifyEmail($email)
{
	if($email == "") return 0;
	if(mysql_num_rows(mysql_query("select * from `email` where `memid`='".$_SESSION['profile']['id']."' and `email`='".mysql_real_escape_string($email)."' and `deleted`=0 and `hash`=''")) > 0) return 1;
	return 0;
}



	$ToBeDeleted=array();
	$state=0;
	if($oldid == "0" && $CSR != "")
	{
		$debugkey = $gpgkey = clean_csr($CSR);
		$debugpg = $gpg = trim(`echo "$gpgkey"|gpg --with-colons --homedir /tmp 2>&1`);
		$lines = "";
		$gpgarr = explode("\n", $gpg);
		foreach($gpgarr as $line)
		{
			#echo "Line[]: $line <br/>\n";
			if(substr($line, 0, 3) == "pub" || substr($line, 0, 3) == "uid")
			{
				if($lines != "")
					$lines .= "\n";
				$lines .= $line;
			}
		}
		$gpg = $lines;
		$expires = 0;
		$nerr=0; $nok=0;
		$multiple = 0;

		$resulttable=_("The following UIDs were found in your key:")."<br/><table border='1'><tr><td>#</td><td>"._("Name")."</td><td>"._("Email")."</td><td>Result</td>";
		$i=0;
		$lastvalidemail="";
		foreach(explode("\n", $gpg) as $line)
		{
			$bits = explode(":", $line);
			$resulttable.="<tr><td>".++$i."</td>";
			$name = $comment = "";
			if($bits[0] == "pub" && (!$keyid || !$when))
			{
				$keyid = $bits[4];
				$when = $bits[5];
				if($bits[6] != "")
					$expires = 1;
			}
			$name="";
			$comm="";
			$mail="";
			$uidformatwrong=0;

			if(sizeof($bits)<10) $uidformatwrong=1;
			
			if(preg_match("/\@.*\@/",$bits[9]))
			{
				showheader(_("Welcome to CAcert.org"));

				echo "<font color='#ff0000'>"._("Multiple Email Adresses per UID are not allowed.")."</font>";
				unset($_REQUEST['process']);
				$id = $oldid;
				unset($oldid);
				exit();
			}

			// Name (Comment) <Email>
			if(preg_match("/^([^\(\)\[@<>]+) \(([^\(\)@<>]*)\) <([\w=\/%.-]*\@[\w.-]*|[\w.-]*\![\w=\/%.-]*)>/",$bits[9],$matches))
			{
			  $name=trim(hex2bin($matches[1]));
			  $nocomment=0;
			  $comm=trim(hex2bin($matches[2]));
			  $mail=trim(hex2bin($matches[3]));
			}
			// Name <EMail>
			elseif(preg_match("/^([^\(\)\[@<>]+) <([\w=\/%.-]*\@[\w.-]*|[\w.-]*\![\w=\/%.-]*)>/",$bits[9],$matches))
			{
			  $name=trim(hex2bin($matches[1]));
			  $nocomment=1;
			  $comm="";
			  $mail=trim(hex2bin($matches[2]));
			}
			// Unrecognized format
			else
			{
				$nocomment=1;
				$uidformatwrong=1;
			}
  		  	$nameok=verifyName($name);
			$emailok=verifyEmail($mail);


			if($comm != "")
				$comment[] = $comm;

			$resulttable.="<td bgcolor='#".($nameok?"c0ffc0":"ffc0c0")."'>".sanitizeHTML($name)."</td>";
                        $resulttable.="<td bgcolor='#".($emailok?"c0ffc0":"ffc0c0")."'>".sanitizeHTML($mail)."</td>";

			$uidok=0;
			if($bits[1]=="r")
			{
				$rmessage=_("Error: UID is revoked");
			}
			elseif($uidformatwrong==1)
			{
				$rmessage=_("The format of the UID was not recognized. Please use 'Name (comment) &lt;email@domain>'");
			}
			elseif($mail=="" and $name=="")
			{
				$rmessage=_("Error: Both Name and Email address are empty");
			}
			elseif($emailok and $nameok)
			{
				$uidok=1;
				$rmessage=_("Name and Email OK.");
			}
			elseif(!$emailok and !$nameok)
			{
				$rmessage=_("Name and Email both cannot be matched with your account.");
			}
			elseif($emailok and $name=="")
			{
				$uidok=1;
				$rmessage=_("The email is OK. The name is empty.");
			}
			elseif($nameok and $mail=="")
			{
				$uidok=1;
				$rmessage=_("The name is OK. The email is empty.");
			}
			elseif(!$emailok)
			{
				$rmessage=_("The email address has not been registered and verified in your account. Please add the email address to your account first.");
			}
			elseif(!$nameok)
			{
				$rmessage=_("The name in the UID does not match the name in your account. Please verify the name.");
			}

			else
			{
				$rmessage=_("Error");
			}
			if($uidok)
			{
				$nok++;
				$resulttable.="<td>$rmessage</td>";
				$lastvalidemail=$mail;
			}
			else
			{
				$nerr++;
				//$ToBeDeleted[]=$i;
				//echo "Adding UID $i\n";
				$resulttable.="<td bgcolor='#ffc0c0'>$rmessage</td>";
			}
			$resulttable.="</tr>\n";

			if($emailok) $multiple++;
		}
		$resulttable.="</table>";


		if($nok==0)
		{
			showheader(_("Welcome to CAcert.org"));
			echo $resulttable;

			echo "<font color='#ff0000'>"._("No valid UIDs found on your key")."</font>";
			unset($_REQUEST['process']);
			$id = $oldid;
			unset($oldid);
			$do = `echo "$debugkey\n--\n$debugpg\n--" >> /www/tmp/gpg.debug`;
			exit();
		}
		elseif($nerr)
		{
			$resulttable.=_("The unverified UIDs have been removed, the verified UIDs have been signed.");
		}


 	}


	if($oldid == "0" && $CSR != "")
	{
		$query = "insert into `gpg` set `memid`='".intval($_SESSION['profile']['id'])."',
						`email`='".mysql_real_escape_string($lastvalidemail)."',
						`level`='1',
						`expires`='".mysql_real_escape_string($expires)."',
						`multiple`='".mysql_real_escape_string($multiple)."',
						`keyid`='".mysql_real_escape_string($keyid)."'";
		mysql_query($query);
		$id = mysql_insert_id();


		$cwd = '/tmp/gpgspace'.$id;
		mkdir($cwd,0755);

		$fp = fopen("$cwd/gpg.csr", "w");
		fputs($fp, clean_csr($CSR));
		fclose($fp);


		system("gpg --homedir $cwd --import $cwd/gpg.csr");


		$debugpg = $gpg = trim(`gpg --homedir $cwd --with-colons --fixed-list-mode --list-keys $keyid 2>&1`);
		$lines = "";
		$gpgarr = explode("\n", $gpg);
		foreach($gpgarr as $line)
		{
			//echo "Line[]: $line <br/>\n";
			if(substr($line, 0, 4) == "uid:")
			{
				$name = $comment = "";
				$bits = explode(":", $line);

				$pos = strpos($bits[9], "(") - 1;
				$nocomment = 0;
				if($pos < 0)
				{
					$nocomment = 1;
					$pos = strpos($bits[9], "<") - 1;
				}
				if($pos < 0)
				{
					$pos = strlen($bits[9]);
				}

				$name = trim(hex2bin(trim(substr($bits[9], 0, $pos))));
				$nameok=verifyName($name);
				if($nocomment == 0)
				{
					$pos += 2;
					$pos2 = strpos($bits[9], ")");
					$comm = trim(hex2bin(trim(substr($bits[9], $pos, $pos2 - $pos))));
					if($comm != "")
						$comment[] = $comm;
					$pos = $pos2 + 3;
				} else {
					$pos = strpos($bits[9], "<") + 1;
				}

				$mail="";
	                        if (preg_match("/<([\w.-]*\@[\w.-]*)>/", $bits[9],$match)) {
					//echo "Found: ".$match[1];
					$mail = trim(hex2bin($match[1]));
				}
				else
				{
					//echo "Not found!\n";
				}
	
				$emailok=verifyEmail($mail);

				$uidid=$bits[7];

			if($bits[1]=="r")
			{
				$ToBeDeleted[]=$uidid;
			}
			elseif($mail=="" and $name=="")
			{
				//echo "$uidid will be deleted\n";
				$ToBeDeleted[]=$uidid;
			}
			elseif($emailok and $nameok)
			{
			}
			elseif($emailok and $name=="")
			{
			}
			elseif($nameok and $mail=="")
			{
			}
			elseif(!$emailok and !$nameok)
			{
				//echo "$uidid will be deleted\n";
				$ToBeDeleted[]=$uidid;
			}
			elseif(!$emailok)
			{
				//echo "$uidid will be deleted\n";
				$ToBeDeleted[]=$uidid;
			}
			elseif(!$nameok)
			{
				//echo "$uidid will be deleted\n";
				$ToBeDeleted[]=$uidid;
			}

			}
		}




        if(count($ToBeDeleted)>0)
	{


		$descriptorspec = array(
			0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
			1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
			2 => array("pipe", "w") // stderr is a file to write to
		);
 
		$stderr = fopen('php://stderr', 'w'); 


		//echo "Keyid: $keyid\n";

		$process = proc_open("/usr/bin/gpg --homedir $cwd --no-tty --command-fd 0 --status-fd 1 --logger-fd 2 --edit-key $keyid", $descriptorspec, $pipes);
 
		//echo "Process: $process\n";
		//fputs($stderr,"Process: $process\n");

		if (is_resource($process)) {
		//echo("it is a resource\n");
		// $pipes now looks like this:
		// 0 => writeable handle connected to child stdin
		// 1 => readable handle connected to child stdout
		// Any error output will be appended to /tmp/error-output.txt
			while (!feof($pipes[1])) 
			{
				$buffer = fgets($pipes[1], 4096);
				//echo $buffer;

      if($buffer == "[GNUPG:] GET_BOOL keyedit.sign_all.okay\n")
      {
        fputs($pipes[0],"yes\n");
      }
      elseif($buffer == "[GNUPG:] GOT_IT\n")
      {
      }
      elseif(ereg("^\[GNUPG:\] GET_BOOL keyedit\.remove\.uid\.okay\s*",$buffer))
      {
        fputs($pipes[0],"yes\n");
      }
      elseif(ereg("^\[GNUPG:\] GET_LINE keyedit\.prompt\s*",$buffer))
      {
        if(count($ToBeDeleted)>0)
        {
	  $delthisuid=array_pop($ToBeDeleted);
	  //echo "Deleting an UID $delthisuid\n";
          fputs($pipes[0],"uid ".$delthisuid."\n");
        }
        else
        {
	  //echo "Saving\n";
          fputs($pipes[0],$state?"save\n":"deluid\n");
          $state++;
        }
      }
      elseif($buffer == "[GNUPG:] GOOD_PASSPHRASE\n")
      {
      }
      elseif(ereg("^\[GNUPG:\] KEYEXPIRED ",$buffer))
      {
        echo "Key expired!\n";
	exit;
      }
      elseif($buffer == "")
      {
        //echo "Empty!\n";
      }
      else
      {
        echo "ERROR: UNKNOWN $buffer\n";
      }


			}
			//echo "Fertig\n";
			fclose($pipes[0]);
 
			//echo stream_get_contents($pipes[1]);
			fclose($pipes[1]);
 
			// It is important that you close any pipes before calling
			// proc_close in order to avoid a deadlock
			$return_value = proc_close($process);
 
			//echo "command returned $return_value\n";
		}
		else
		{
			echo "Keine ressource!\n";
		}


		}


		$csrname=generatecertpath("csr","gpg",$id);
		$do=`gpg --homedir $cwd --batch --export-options export-minimal --export $keyid >$csrname`;

		mysql_query("update `gpg` set `csr`='$csrname' where `id`='$id'");
		waitForResult('gpg', $id);

		showheader(_("Welcome to CAcert.org"));
		echo $resulttable;
		$query = "select * from `gpg` where `id`='$id' and `crt`!=''";
		$res = mysql_query($query);
		if(mysql_num_rows($res) <= 0)
		{
			echo _("Your certificate request has failed to be processed correctly, please try submitting it again.")."<br>\n";
			echo _("If this is a re-occuring problem, please send a copy of the key you are trying to signed to support@cacert.org. Thank you.");
		} else {
			echo "<pre>";
			readfile("../crt/gpg-$id.crt");
			echo "</pre>";
		}

		showfooter();
		exit;
	}

	$id = intval($id);

	showheader(_("Welcome to CAcert.org"));
	includeit($id, "gpg");
	showfooter();
?>