Fix timing attacks in HMAC functions.

[irc/quakenet/newserv.git] / chanserv / authcmds / reset.c

/* Automatically generated by refactor.pl.
 *
 *
 * CMDNAME: reset
 * CMDLEVEL: QCMD_NOTAUTHED
 * CMDARGS: 2
 * CMDDESC: Restores the old details on an account after a change.
 * CMDFUNC: csa_doreset
 * CMDPROTO: int csa_doreset(void *source, int cargc, char **cargv);
 * CMDHELP: Usage: RESET <username> <code>
 * CMDHELP: Restores your old email address and password if any of these
 * CMDHELP: have recently changed, where the following parameters are:
 * CMDHELP: username - your username
 * CMDHELP: code     - the code received in the RESET email.
 */

#include "../chanserv.h"
#include "../authlib.h"
#include "../../lib/irc_string.h"
#include <stdio.h>
#include <string.h>
#include <time.h>

int csa_doreset(void *source, int cargc, char **cargv) {
  reguser *rup;
  nick *sender=source;
  char newpassword[PASSLEN+1];
  time_t t;

  if (cargc<2) {
    chanservstdmessage(sender, QM_NOTENOUGHPARAMS, "reset");
    return CMD_ERROR;
  }

  if (!(rup=findreguser(sender, cargv[0])))
    return CMD_ERROR;

  t=time(NULL);
  if(UHasStaffPriv(rup) || (!rup->lockuntil || rup->lockuntil <= t)) {
    chanservstdmessage(sender, QM_ACCOUNTNOTLOCKED);
    return CMD_ERROR;
  }

  if(hmac_strcmp(cargv[1], csc_generateresetcode(rup->lockuntil, rup->username))) {
    chanservstdmessage(sender, QM_BADRESETCODE);
    return CMD_ERROR;
  }

  csa_createrandompw(newpassword, PASSLEN);

  if(rup->lastemail) {
    csdb_accounthistory_insert(sender, rup->password, newpassword, rup->email?rup->email->content:NULL, rup->lastemail->content);
    if(rup->email)
      freesstring(rup->email);
    rup->email=rup->lastemail;
    rup->lastemail=NULL;
  } else {
    csdb_accounthistory_insert(sender, rup->password, newpassword, NULL, NULL);
  }
  setpassword(rup, newpassword);
  
  rup->lockuntil=0;
  rup->lastpasschange=t;

  cs_log(sender,"RESET OK username %s", rup->username);
  csdb_updateuser(rup);
  csdb_createmail(rup, QMAIL_RESET);
  chanservstdmessage(sender, QM_RESETOK);

  return CMD_OK;
}