<?php
/**
 * Forced password-change destination — Layer 2 of the default-password
 * protection (see config/banner_warnings.inc for the redirect logic).
 *
 * Reached only when the operator is connecting from a remote subnet
 * AND still using the factory default basic-auth password. Renders a
 * single-purpose form: change the password, nothing else.
 *
 * The htpasswd / chpasswd update flow is a verbatim mirror of the
 * password-change section in admin/configure.php (~line 440 onward).
 * Keep the two in sync — any future fix to one belongs in the other.
 *
 * On success: redirect to /admin/. The Layer 2 trigger will no longer
 * fire (password is no longer 'raspberry'), so the operator returns
 * to normal dashboard navigation.
 *
 * Direct-URL access by an operator who is NOT using the default
 * password just redirects to /admin/ — the page is only useful when
 * the trigger condition holds.
 */

require_once($_SERVER['DOCUMENT_ROOT'] . '/config/security_headers.php');
require_once($_SERVER['DOCUMENT_ROOT'] . '/config/csrf.php');
require_once($_SERVER['DOCUMENT_ROOT'] . '/config/banner_warnings.inc');
setSecurityHeaders();

// CSRF: rejects forged POSTs cleanly with 403 before any chpasswd /
// htpasswd side-effect. Bootstraps the session on GET so the token
// cookie ships with the form render.
csrf_verify();

// If the operator's password is NOT the default, they don't need
// this page. Send them to the main admin dashboard.
//
// Done BEFORE any HTML output so the redirect is clean.
if (!_pistar_default_password_in_use()) {
    header('Location: /admin/', true, 302);
    exit;
}

require_once('../config/language.php');
$pistarReleaseConfig = '/etc/pistar-release';
$configPistarRelease = parse_ini_file($pistarReleaseConfig, true);
require_once('../config/version.php');

// Mirror of admin/configure.php password change (~line 440). Keep
// these two paths byte-equivalent so a fix to one always lands in
// the other. proc_open() + stdin pipes — password never on argv,
// never reaches a shell. chpasswd FIRST so PAM rejection blocks
// the htpasswd write and keeps web/shell auth in sync.
//
// Two-field verification: the form posts both `adminPassword` and
// `adminPasswordConfirm`. Client-side functions.js compares them on
// keystroke and only enables the submit button when they match;
// the server-side check below is defence in depth — never trust
// the client to enforce verification.
$passwordChanged  = false;
$passwordRejected = false;
$rejectReason     = '';
if (!empty($_POST['adminPassword'])) {
    $rawPassword        = stripslashes(trim($_POST['adminPassword']));
    $rawPasswordConfirm = isset($_POST['adminPasswordConfirm'])
        ? stripslashes(trim($_POST['adminPasswordConfirm']))
        : '';

    $hasIllegalChar = preg_match('/[\x00\r\n]/', $rawPassword);
    $tooLong        = strlen($rawPassword) > 256;
    $isStillDefault = hash_equals('raspberry', $rawPassword);
    // hash_equals on user-supplied vs user-supplied isn't a security
    // boundary (no secret on either side), but it's the right idiom
    // for password compares — and guards against any future caller
    // mistaking the result for an authentication signal.
    $confirmMatches = hash_equals($rawPassword, $rawPasswordConfirm);

    if ($rawPassword === '' || $hasIllegalChar || $tooLong) {
        $passwordRejected = true;
        $rejectReason     = 'invalid';
        error_log('Pi-Star change_password_required.php: adminPassword rejected '
                . '(empty, contains NUL/CR/LF, or > 256 bytes)');
    } elseif ($isStillDefault) {
        $passwordRejected = true;
        $rejectReason     = 'default';
        error_log('Pi-Star change_password_required.php: adminPassword rejected (still the default)');
    } elseif (!$confirmMatches) {
        $passwordRejected = true;
        $rejectReason     = 'mismatch';
        error_log('Pi-Star change_password_required.php: adminPassword rejected '
                . '(confirmation does not match)');
    } else {
        // Pi-Star runs with `/` mounted read-only by default. chpasswd
        // and htpasswd both write to files on the rootfs (/etc/shadow
        // and /var/www/.htpasswd respectively); without a remount-rw
        // they fail with PAM "Authentication token manipulation error"
        // and the symptom looks like every password is rejected. The
        // matching configure.php POST handler does this at line ~348.
        // Re-seal the rootfs at the bottom of this block on every
        // exit path (success, PAM rejection, htpasswd failure).
        system('sudo mount -o remount,rw /');

        $descriptors = array(
            0 => array('pipe', 'r'),
            1 => array('pipe', 'w'),
            2 => array('pipe', 'w'),
        );

        // 1. Linux user via chpasswd. Hardcoded command; payload on stdin only.
        $cpExit = 1;
        $cpStderr = '';
        $proc = proc_open('sudo -n /usr/sbin/chpasswd', $descriptors, $pipes);
        if (is_resource($proc)) {
            fwrite($pipes[0], 'pi-star:' . $rawPassword . "\n");
            fclose($pipes[0]);
            stream_get_contents($pipes[1]); fclose($pipes[1]);
            $cpStderr = stream_get_contents($pipes[2]); fclose($pipes[2]);
            $cpExit = proc_close($proc);
        } else {
            error_log('Pi-Star change_password_required.php: failed to spawn chpasswd');
        }

        if ($cpExit !== 0) {
            // PAM rejection (libpwquality, history, length, etc.).
            $passwordRejected = true;
            $rejectReason     = 'pam';
            error_log('Pi-Star change_password_required.php: chpasswd exit='
                    . $cpExit . '; stderr=' . trim($cpStderr));
        } else {
            // 2. Apache basic-auth file. /var/www/.htpasswd is owned by
            //    www-data, so no sudo needed.
            $htExit = 1;
            $htStderr = '';
            $proc = proc_open('htpasswd -i /var/www/.htpasswd pi-star',
                              $descriptors, $pipes);
            if (is_resource($proc)) {
                fwrite($pipes[0], $rawPassword);
                fclose($pipes[0]);
                stream_get_contents($pipes[1]); fclose($pipes[1]);
                $htStderr = stream_get_contents($pipes[2]); fclose($pipes[2]);
                $htExit = proc_close($proc);
                if ($htExit !== 0) {
                    error_log('Pi-Star change_password_required.php: htpasswd exit='
                            . $htExit . ' (Linux password updated); stderr='
                            . trim($htStderr));
                }
            } else {
                error_log('Pi-Star change_password_required.php: failed to spawn htpasswd');
            }
            // Tighten /var/www/.htpasswd from htpasswd's default 644
            // to 600. Owner stays www-data so nginx (running as
            // www-data) keeps reading for basic-auth checks; other
            // local users no longer see the bcrypt hash.
            //
            // Surface chmod failure into the error log. The realistic
            // failure modes are (a) htpasswd spawn failed and the
            // file is in some unexpected state, or (b) a future
            // refactor moves this call outside the rootfs-rw window
            // (it sits inside one today — see commit aa999d49).
            // Either way, the file silently staying mode 644 would
            // be worth knowing about.
            if (@chmod('/var/www/.htpasswd', 0600) === false) {
                error_log('Pi-Star change_password_required.php: chmod 0600 /var/www/.htpasswd failed (file may stay mode 644 until next save)');
            }
            // chpasswd succeeded; treat as success even if htpasswd
            // failed (operator can retry — same behaviour as
            // configure.php). The browser will re-prompt for the new
            // credentials on the next request.
            $passwordChanged = true;
        }

        // Re-seal the rootfs on every exit path out of the writable
        // block. sync first so the shadow / htpasswd writes land on
        // disk before the remount makes the FS read-only again.
        system('sudo sync && sudo sync && sudo sync && sudo mount -o remount,ro /');
    }
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="Author" content="Andrew Taylor (MW0MWZ)" />
<meta name="Description" content="Pi-Star — Default password change required" />
<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
<meta http-equiv="pragma" content="no-cache" />
<meta http-equiv="Expires" content="0" />
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon" />
<link rel="stylesheet" type="text/css" href="../css/pistar-css.php" />
<script type="text/javascript" src="/functions.js"></script>
<title>Pi-Star — Change Default Password</title>
</head>
<body>
<?php pistar_warnings_render(); ?>
<div class="container">
<div class="header">
  <h1>Pi-Star — Default Password Change Required</h1>
</div>
<div class="contentwide">
<?php if ($passwordChanged) { ?>
  <table>
    <tr><th>Working...</th></tr>
    <tr><td>Password changed. Your browser will re-prompt for the new credentials shortly.</td></tr>
  </table>
  <script type="text/javascript">setTimeout(function() { window.location='/admin/'; }, 5000);</script>
<?php } else { ?>
  <p>You are connecting from outside the local network and your dashboard is still using the
  factory default password. Set a new password to continue.</p>
<?php if ($passwordRejected) {
        // Distinct message per rejection class so the operator knows
        // exactly what to fix without having to guess.
        switch ($rejectReason) {
            case 'mismatch':
                $msg = '<b>Passwords do not match.</b> Please enter the same value in both fields.';
                break;
            case 'default':
                $msg = '<b>Password rejected.</b> The new password must be different from the factory default.';
                break;
            case 'pam':
                $msg = '<b>Password rejected by the system.</b> It must satisfy the system password-quality rules (length, complexity, history).';
                break;
            case 'invalid':
            default:
                $msg = '<b>Password rejected.</b> It must not contain NUL / CR / LF bytes and must be at most 256 bytes long.';
                break;
        }
?>
  <p style="color: #f01010;"><?php echo $msg; ?></p>
<?php } ?>
  <form id="adminPassForm" action="/admin/change_password_required.php" method="post" autocomplete="off">
    <?php echo csrf_field_html(); ?>
    <table>
      <tr>
        <td align="right" width="40%"><label for="pass1">New password:</label></td>
        <td align="left">
          <input type="password" name="adminPassword" id="pass1"
                 size="32" autocomplete="new-password"
                 onkeyup="checkPass(); return false;" required="required" />
        </td>
      </tr>
      <tr>
        <td align="right"><label for="pass2">Confirm password:</label></td>
        <td align="left">
          <input type="password" name="adminPasswordConfirm" id="pass2"
                 size="32" autocomplete="new-password"
                 onkeyup="checkPass(); return false;" required="required" />
        </td>
      </tr>
      <tr>
        <td colspan="2" align="center">
          <!-- id="submitpwd" matches the existing checkPass() in
               functions.js which enables this button only when both
               fields match. Server still re-verifies, so the JS gate
               is UX, not security. -->
          <input type="submit" id="submitpwd" value="Change Password" disabled="disabled" />
        </td>
      </tr>
    </table>
  </form>
<?php } ?>
</div>
<div class="footer">
Pi-Star / Pi-Star Dashboard, &copy; Andy Taylor (MW0MWZ) 2014-<?php echo date('Y'); ?>.<br />
</div>
</div>
</body>
</html>