From d61c137c1274d330d1ff8eb840ef7c3f138b4301 Mon Sep 17 00:00:00 2001
From: Josh Holtrop <jholtrop@gmail.com>
Date: Sun, 29 Mar 2026 21:00:05 -0400
Subject: [PATCH] Check credentials and create a session

---
 assets/page.erb |  4 ++--
 bin/setpasswd   | 12 ++++++------
 cgi-bin/malp.rb | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 53 insertions(+), 9 deletions(-)
diff --git a/assets/page.erb b/assets/page.erb
index 0721325..0d1baab 100644
--- a/assets/page.erb
+++ b/assets/page.erb
@@ -3,7 +3,7 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title><%= hostname %> status</title>
+  <title><%= hostname %> status - MALP</title>
   <style>
     body {
       background: #0f1117;
@@ -115,7 +115,7 @@
 <body>
 
 <header>
-  <h1><span><%= hostname %></span> &middot; status</h1>
+  <h1><span><%= hostname %></span> status - MALP</h1>
 </header>
 
 <div class="card">
diff --git a/bin/setpasswd b/bin/setpasswd
index 875b14e..4fa2809 100755
--- a/bin/setpasswd
+++ b/bin/setpasswd
@@ -5,6 +5,9 @@ require "fileutils"
 require "io/console"
 require "securerandom"
 
+DATA_DIR = File.join(__dir__, "../data")
+USER_FILE = File.join(DATA_DIR, "user.txt")
+
 print "User name: "
 username = $stdin.gets.chomp
 
@@ -16,14 +19,11 @@ end
 print "Password: "
 password = $stdin.noecho(&:gets).chomp
 
-user_path = File.join(File.dirname(__FILE__), "../user.txt")
-
-salt = SecureRandom.random_bytes(8)
-salthex = salt.chars.map {|c| sprintf("%02X", c.ord)}.join
+salt = SecureRandom.hex(8)
 input = salt + password
 hash = Digest::SHA256.hexdigest(input)
 hashhex = hash.chars.map {|c| sprintf("%02X", c.ord)}.join
-user_file_contents = "#{username}:#{salthex}:#{hashhex}\n"
+user_file_contents = "#{username}:#{salt}:#{hashhex}\n"
 
-File.binwrite(user_path, user_file_contents)
+File.binwrite(USER_FILE, user_file_contents)
 puts "User and password set"
diff --git a/cgi-bin/malp.rb b/cgi-bin/malp.rb
index 1f6183c..8393702 100755
--- a/cgi-bin/malp.rb
+++ b/cgi-bin/malp.rb
@@ -2,15 +2,59 @@
 
 require "cgi"
 require "erb"
+require "digest"
+require "securerandom"
 
 ASSETS_DIR = File.join(__dir__, "../assets")
+DATA_DIR = File.join(__dir__, "../data")
+SESSIONS_FILE = File.join(DATA_DIR, "sessions.txt")
+USER_FILE = File.join(DATA_DIR, "user.txt")
 
 cgi = CGI.new
 
 hostname = File.read("/etc/hostname").strip rescue "localhost"
 
+def valid_session?(token)
+  return false if token.nil? || token.empty?
+  return false unless File.exist?(SESSIONS_FILE)
+  File.readlines(SESSIONS_FILE).any? { |line| line.strip == token }
+end
+
+def check_credentials(username, password)
+  return false unless File.exist?(USER_FILE)
+  stored_user, salt, stored_hash_hex2 = File.read(USER_FILE).strip.split(":", 3)
+  return false unless username == stored_user
+  stored_hash = [stored_hash_hex2].pack("H*")
+  computed_hash = Digest::SHA256.hexdigest(salt + password)
+  stored_hash == computed_hash
+end
+
+def create_session
+  token = SecureRandom.hex(32)
+  File.open(SESSIONS_FILE, "a") { |f| f.puts(token) }
+  token
+end
+
+session_token = (cgi.cookies["MALP"] || []).first
+authenticated = valid_session?(session_token)
+cookie = nil
+
+if cgi.request_method == "POST" && !authenticated
+  username = cgi.params["username"]&.first.to_s
+  password = cgi.params["password"]&.first.to_s
+
+  if check_credentials(username, password)
+    token = create_session
+    cookie = CGI::Cookie.new("name" => "MALP", "value" => token, "path" => "/")
+    authenticated = true
+  end
+end
+
 template = ERB.new(File.read(File.join(ASSETS_DIR, "page.erb")))
 
-cgi.out("type" => "text/html", "charset" => "UTF-8") do
+out_params = { "type" => "text/html", "charset" => "UTF-8" }
+out_params["cookie"] = cookie if cookie
+
+cgi.out(out_params) do
   template.result(binding)
 end
