From 772e927d6a0556dc68dd377dbf0328a2453af11d Mon Sep 17 00:00:00 2001
From: root <root@www.cacert.org>
Date: Thu, 4 Sep 2008 13:53:00 +0000
Subject: [PATCH] Hashserver interface

---
 www/alert_hash_collision.php | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 www/alert_hash_collision.php

diff --git a/www/alert_hash_collision.php b/www/alert_hash_collision.php
new file mode 100644
index 0000000..81ccc09
--- /dev/null
+++ b/www/alert_hash_collision.php
@@ -0,0 +1,28 @@
+<?php
+
+include("../includes/hash_password.php");
+define('REPORT_WEAK_SCRIPT', './report-weak');
+
+if (@$_GET['shared_secret'] != SHARED_SECRET)
+	die('not authenticated');
+if (!preg_match('/^[0-9a-f]{40}$/i', $_POST['pkhash']))
+	die('malformed or nonexistant pkhash');
+if (!preg_match('/^(mem|org)-[0-9]+$/', @$_POST['usernym']))
+	die('malformed or nonexistant usernym');
+
+// alert seems ok
+
+if (preg_match('/^mem-[0-9]+$/', @$_POST['usernym']))
+{
+  mysql_query("update emailcerts set coll_found=1 where memid='".substr(@$_POST['usernym'],4)."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+  mysql_query("update domaincerts set coll_found=1 where memid='".substr(@$_POST['usernym'],4)."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+}
+else
+{
+  mysql_query("update orgemailcerts set coll_found=1 where memid='".substr(@$_POST['usernym'],4)."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+  mysql_query("update orgdomaincerts set coll_found=1 where memid='".substr(@$_POST['usernym'],4)."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+}
+
+//exec(REPORT_WEAK . ' ' . $_POST['usernym'] . ' ' . lower($_POST['pkhash']));
+
+?>