private static void HttpPostCredentials(HttpServerResponse resp, HttpServerRequest req)
{
networkLed.High();
try
{
string SessionId = req.Header.GetCookie("SessionId");
if (!CheckSession(SessionId))
{
throw new HttpTemporaryRedirectException("/");
}
FormParameters Parameters = req.Data as FormParameters;
if (Parameters == null)
{
throw new HttpException(HttpStatusCode.ClientError_BadRequest);
}
resp.ContentType = "text/html";
resp.Encoding = System.Text.Encoding.UTF8;
resp.ReturnCode = HttpStatusCode.Successful_OK;
string UserName = Parameters ["UserName"];
string Password = Parameters ["Password"];
string NewUserName = Parameters ["NewUserName"];
string NewPassword1 = Parameters ["NewPassword1"];
string NewPassword2 = Parameters ["NewPassword2"];
string Hash;
object AuthorizationObject;
GetDigestUserPasswordHash(UserName, out Hash, out AuthorizationObject);
if (AuthorizationObject == null || Hash != CalcHash(UserName, Password))
{
Log.Warning("Invalid attempt to change login credentials.", EventLevel.Minor, UserName, req.ClientAddress);
OutputCredentialsForm(resp, "<p>Login credentials provided were not correct. Please try again.</p>");
}
else if (NewPassword1 != NewPassword2)
{
OutputCredentialsForm(resp, "<p>The new password was not entered correctly. Please provide the same new password twice.</p>");
}
else if (string.IsNullOrEmpty(UserName) || string.IsNullOrEmpty(NewPassword1))
{
OutputCredentialsForm(resp, "<p>Please provide a non-empty user name and password.</p>");
}
else if (UserName.Length > DB.ShortStringClipLength)
{
OutputCredentialsForm(resp, "<p>The new user name was too long.</p>");
}
else
{
Log.Information("Login credentials changed.", EventLevel.Minor, UserName, req.ClientAddress);
credentials.UserName = NewUserName;
credentials.PasswordHash = CalcHash(NewUserName, NewPassword1);
credentials.UpdateIfModified();
resp.ReturnCode = HttpStatusCode.Redirection_SeeOther;
resp.AddHeader("Location", "/");
resp.SendResponse();
// PRG pattern, to avoid problems with post back warnings in the browser: http://en.wikipedia.org/wiki/Post/Redirect/Get
}
} finally
{
networkLed.Low();
}
}
