On 2023-07-27, go-while <
no-reply@no.spam> wrote:
On 27.07.23 21:36, rek2 hispagatos wrote:
OK this is already deployed and working, feel free to submit patches,
there are a lot to do still but is working now and is live on my own
server.
Happy Hacking
ReK2
great work!
i dont know about rust and pgsql so i need ask question:
this code is safe against sql injection?
Indeed, is my first time using this libs and I asked myself the same
question when I was reading thru their documentation, so I have put it
on my TODO list to research and use better prepared queries
this is from their documentation:
```
Prepared queries have their query plan cached, use a binary mode of
communication (lower bandwidth and faster decoding),
and utilize parameters to avoid SQL injection.
```
Is in my TODO list, if I get help even better ;)
no need to check if username is alphanum before passing to db?
Yes some checks and balances will be nice to add also on my todo list, I
did this tool at the same time I was making a portal for my users to be
able to register for our usenet server(inn2) or
matrix server(dendrite) and later on maybe our mastodon instance.
So made the tool to plug inn and the portal,
but much work still to do, a lot more :)
fn clean() splits by whitespace and parses to string only?
yes, I am learning rust so I am sure there is more idiomatic ways and
elegant but as of now testing the inn stdout to the program it give us the
6 or 7 diff pieces of information, including the ClientAuthname,
ClientPassword (paste below) so I have it all put into a
slice/array and grab only 2 and sends it to the clean() function
and does exaccly that you mention, so later we can compare it vs
the database entries.
I was testing against the information I got from:
https://www.eyrie.org/~eagle/software/inn/docs-2.7/external-auth.html
But I found it to be mistaken or I did not understood it right, because
it says it only sends 2 pieces of information the Name and Password
information but it actually sends more so I had to do adjustments like:
["ClientHost: domain.net", "ClientIP: x.x.x.x", "ClientPort: 52014",
"LocalIP: x.x.x.x", "LocalPort: 563", "ClientAuthname: rek2",
"ClientPassword: HerePassword", ".", ""]
also was using for testing:
echo -e "Auth rek2\r\nPassword: testest222\r\n | cargo run
and from the ckpasswd man page:
(echo 'ClientAuthname: rek2' ; echo 'ClientPassword: testmeow') | nnrpd-password
Writing this super late 5:40 am been up all night coding, going to bed
if you find lot of bad grammar and stuff is because of that and that I
am not a native English speaker ;)
Happy Hacking
--
{gemini,https}://{,rek2.}hispagatos.org
https://hispagatos.space/@rek2
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)