Carol-
Here is the sub lookup from the db.cgi:
sub lookup {
# --------------------------------------------------------
# This subroutine added for the secure_password_lookup mod
my ($message, $userid, $pw, $view, $add, $del, $mod, $mem, $admin, $email, $password, $found, $output);
# Check to make sure email is ok
unless ($in{'email'} =~ /.+\@.+\..+/) {
&html_lookup_form ("Invalid email address format: '$in{'email'}'.");
return;
}
open (PASSWD, "<$auth_pw_file") || &cgierr("unable to open password file. Reason: $!\n");
@passwds = <PASSWD>;
close PASSWD;
$found = '';
foreach $pass (@passwds) { # Go through each pass and see if we match.
chomp ($pass);
if ($pass =~ /$in{'email'}/) {
$found = $pass;
}
else {
$output .= $pass . "\n";
}
}
if (!$found) {
&html_lookup_form ("The email address you entered was not found in the file.");
return;
}
else {
open (PASS, ">$auth_pw_file") or &cgierr ("unable to open: $auth_pw_file.\nReason: $!");
if ($db_use_flock) {
flock(PASS, 2) or &cgierr("unable to get exclusive lock on $auth_pw_file.\nReason: $!");
}
print PASS $output;
close PASS;
($userid, $pw, $view, $add, $del, $mod, $mem, $admin, $email) = split (/:/, $found);
$password = &generate_password;
srand( time() ^ ($$ + ($$ << 15)) ); # Seed Random Number
my @salt_chars = ('A' .. 'Z', 0 .. 9, 'a' .. 'z', '.', '/');
my $salt = join '', @salt_chars[rand 64, rand 64];
my $encrypted = crypt($password, $salt);
# Add the userid into the file with default permissions.
open (PASSWD, ">>$auth_pw_file") or &cgierr ("unable to open: $auth_pw_file.\nReason: $!");
if ($db_use_flock) {
flock(PASSWD, 2) or &cgierr("unable to get exclusive lock on $auth_pw_file.\nReason: $!");
}
print PASSWD "$userid:$encrypted:$view:$add:$del:$mod:$mem:$admin:$email\n";
close PASSWD;
open (MAIL, "$mailprog") || &cgierr("Can't start mail program");
print MAIL "To: $in{'email'}\n";
print MAIL "From: $admin_email\n";
print MAIL "Subject: $html_title New Password\n\n";
print MAIL "-" x 75 . "\n\n";
print MAIL "Here is your new $html_title password.\n\n";
print MAIL "Your $html_title User ID is: $userid\n";
print MAIL "Your $html_title password is: $password\n\n";
print MAIL "Please keep this email for future reference.\n\n";
print MAIL "To log on, go to\n\n";
print MAIL "$db_script_url?db=$db_setup\n";
print MAIL "and enter your User ID and password.\n\n";
print MAIL "Please contact $html_title support at: $admin_email\n";
print MAIL "if you have any questions.\n\n";
close (MAIL);
&html_lookup_success;
}
}
As always thanks for your help !
-----------------
donm
