untaint template source

[freeside.git] / fs_signup / FS-SignupClient / cgi / signup.cgi

diff --git a/fs_signup/FS-SignupClient/cgi/signup.cgi b/fs_signup/FS-SignupClient/cgi/signup.cgi
index 7131ad2..7576b8b 100755 (executable)
--- a/fs_signup/FS-SignupClient/cgi/signup.cgi
+++ b/fs_signup/FS-SignupClient/cgi/signup.cgi
@@ -1,21 +1,53 @@
 #!/usr/bin/perl -Tw
 #
-# $Id: signup.cgi,v 1.1 1999-08-24 07:40:45 ivan Exp $
+# $Id: signup.cgi,v 1.8 2000-08-24 07:26:50 ivan Exp $
 
 use strict;
 use vars qw( @payby $cgi $locales $packages $pops $r $error
              $last $first $ss $company $address1 $address2 $city $state $county
              $country $zip $daytime $night $fax $invoicing_list $payby $payinfo
-             $paydate $payname $pkgpart $username $password $popnum );
+             $paydate $payname $pkgpart $username $password $popnum
+             $ieak_file $ieak_template $cck_file $cck_template
+             $ac $exch $loc
+           );
 use subs qw( print_form print_okay expselect );
 
 use CGI;
 use CGI::Carp qw(fatalsToBrowser);
+use HTTP::Headers::UserAgent 2.00;
 use FS::SignupClient qw( signup_info new_customer );
+use Text::Template;
 
+#acceptable payment methods
+#
 #@payby = qw( CARD BILL COMP );
 #@payby = qw( CARD BILL );
-@payby = qw( CARD );
+#@payby = qw( CARD );
+@payby = qw( CARD PREPAY );
+
+$ieak_file = '/usr/local/freeside/ieak.template';
+$cck_file = '/usr/local/freeside/cck.template';
+
+if ( -e $ieak_file ) {
+  my $ieak_txt = Text::Template::_load_text($ieak_file)
+    or die $Text::Template::ERROR;
+  $ieak_txt =~ /^(.*)$/s; #untaint the template source - it's trusted
+  $ieak_txt = $1;
+  $ieak_template = new Text::Template ( TYPE => 'STRING', SOURCE => $ieak_txt )
+    or die $Text::Template::ERROR;
+} else {
+  $ieak_template = '';
+}
+if ( -e $cck_file ) {
+  my $cck_txt = Text::Template::_load_text($cck_file)
+    or die $Text::Template::ERROR;
+  $cck_txt =~ /^(.*)$/s; #untaint the template source - it's trusted
+  $cck_txt = $1;
+  $cck_template = new Text::Template ( TYPE => 'STRING', SOURCE => $cck_txt )
+    or die $Text::Template::ERROR;
+} else {
+  $cck_template = '';
+}
 
 ( $locales, $packages, $pops ) = signup_info();
 
@@ -196,12 +228,14 @@ END
     'CARD' => qq!Credit card<BR>${r}<INPUT TYPE="text" NAME="CARD_payinfo" VALUE="" MAXLENGTH=19><BR>${r}Exp !. expselect("CARD"). qq!<BR>${r}Name on card<BR><INPUT TYPE="text" NAME="CARD_payname" VALUE="">!,
     'BILL' => qq!Billing<BR>P.O. <INPUT TYPE="text" NAME="BILL_payinfo" VALUE=""><BR>${r}Exp !. expselect("BILL", "12-2037"). qq!<BR>${r}Attention<BR><INPUT TYPE="text" NAME="BILL_payname" VALUE="Accounts Payable">!,
     'COMP' => qq!Complimentary<BR>${r}Approved by<INPUT TYPE="text" NAME="COMP_payinfo" VALUE=""><BR>${r}Exp !. expselect("COMP"),
+    'PREPAY' => qq!Prepaid card<BR>${r}<INPUT TYPE="text" NAME="PREPAY_payinfo" VALUE="" MAXLENGTH=80>!,
   );
 
   my %paybychecked = (
     'CARD' => qq!Credit card<BR>${r}<INPUT TYPE="text" NAME="CARD_payinfo" VALUE="$payinfo" MAXLENGTH=19><BR>${r}Exp !. expselect("CARD", $paydate). qq!<BR>${r}Name on card<BR><INPUT TYPE="text" NAME="CARD_payname" VALUE="$payname">!,
     'BILL' => qq!Billing<BR>P.O. <INPUT TYPE="text" NAME="BILL_payinfo" VALUE="$payinfo"><BR>${r}Exp !. expselect("BILL", $paydate). qq!<BR>${r}Attention<BR><INPUT TYPE="text" NAME="BILL_payname" VALUE="$payname">!,
     'COMP' => qq!Complimentary<BR>${r}Approved by<INPUT TYPE="text" NAME="COMP_payinfo" VALUE="$payinfo"><BR>${r}Exp !. expselect("COMP", $paydate),
+    'PREPAY' => qq!Prepaid card<BR>${r}<INPUT TYPE="text" NAME="PREPAY_payinfo" VALUE="$payinfo" MAXLENGTH=80>!,
   );
 
   for (@payby) {
@@ -265,13 +299,61 @@ END
 }
 
 sub print_okay {
-  print $cgi->header( '-expires' => 'now' ), <<END;
+  my $user_agent = new HTTP::Headers::UserAgent $ENV{HTTP_USER_AGENT};
+
+  $cgi->param('username') =~ /^(.+)$/
+    or die "fatal: invalid username got past FS::SignupClient::new_customer";
+  my $username = $1;
+  $cgi->param('_password') =~ /^(.+)$/
+    or die "fatal: invalid password got past FS::SignupClient::new_customer";
+  my $password = $1;
+  ( $cgi->param('first'). ' '. $cgi->param('last') ) =~ /^(.*)$/
+    or die "fatal: invalid email_name got past FS::SignupCLient::new_customer";
+  my $email_name = $1;
+
+  my $pop = pop_info($cgi->param('popnum'))
+    or die "fatal: invalid popnum got past FS::SignupClient::new_customer";
+  my ( $ac, $exch, $loc ) = ( $pop->{'ac'}, $pop->{'exch'}, $pop->{'loc'} );
+
+  if ( $ieak_template
+       && $user_agent->platform eq 'ia32'
+       && $user_agent->os =~ /^win/
+       && ($user_agent->browser)[0] eq 'IE'
+     )
+  { #send an IEAK config
+    print $cgi->header('application/x-Internet-signup'),
+          $ieak_template->fill_in();
+  } elsif ( $cck_template
+            && $user_agent->platform eq 'ia32'
+            && $user_agent->os =~ /^win/
+            && ($user_agent->browser)[0] eq 'Netscape'
+          )
+  { #send a Netscape config
+    my $cck_data = $cck_template->fill_in();
+    print $cgi->header('application/x-netscape-autoconfigure-dialer-v2'),
+          map {
+            m/(.*)\s+(.*)$/;
+            pack("N", length($1)). $1. pack("N", length($2)). $2;
+          } split(/\n/, $cck_data);
+
+  } else { #send a simple confirmation
+    print $cgi->header( '-expires' => 'now' ), <<END;
 <HTML><HEAD><TITLE>Signup successful</TITLE></HEAD>
 <BODY BGCOLOR="#e8e8e8"><FONT SIZE=7>Signup successful</FONT><BR><BR>
 blah blah blah
 </BODY>
 </HTML>
 END
+  }
+}
+
+sub pop_info {
+  my $popnum = shift;
+  my $pop;
+  foreach $pop ( @{$pops} ) {
+    if ( $pop->{'popnum'} == $popnum ) { return $pop; }
+  }
+  '';
 }
 
 sub expselect {