authenticate against a hash of identifyable information from certificate instead of only serial (refs #324)

functions.php

@@ -1757,9 +1757,19 @@
 		return true;
 	}
 
+	function get_ssl_certificate_id() {
+		if ($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"]) {
+			return sha1($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"] .
+				$_SERVER["REDIRECT_SSL_CLIENT_V_START"] .
+				$_SERVER["REDIRECT_SSL_CLIENT_V_END"] .
+				$_SERVER["REDIRECT_SSL_CLIENT_S_DN"]);
+		}
+		return "";
+	}
+
 	function get_login_by_ssl_certificate($link) {
 
-		$cert_serial = db_escape_string($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"]);
+		$cert_serial = db_escape_string(get_ssl_certificate_id());
 
 		if ($cert_serial) {
 			$result = db_query($link, "SELECT login FROM ttrss_user_prefs, ttrss_users

modules/pref-prefs.php

@@ -435,17 +435,21 @@
 				} else if ($pref_name == "SSL_CERT_SERIAL") {
 
 					print "<input dojoType=\"dijit.form.ValidationTextBox\"
-						id=\"SSL_CERT_SERIAL\"
+						id=\"SSL_CERT_SERIAL\" readonly=\"1\"
 						name=\"$pref_name\" value=\"$value\">";
 
-					$cert_serial = htmlspecialchars($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"]);
+					$cert_serial = htmlspecialchars(get_ssl_certificate_id());
 
 					if ($cert_serial) {
 						print " <button dojoType=\"dijit.form.Button\"
 							onclick=\"insertSSLserial('$cert_serial')\">" .
-							__('Fill automatically') . "</button>";
+							__('Register') . "</button>";
 					}
 
+					print " <button dojoType=\"dijit.form.Button\"
+						onclick=\"insertSSLserial('')\">" .
+						__('Clear') . "</button>";
+
 				} else {
 					$regexp = ($type_name == 'integer') ? 'regexp="^\d*$"' : '';
 

schema/ttrss_schema_mysql.sql

@@ -391,7 +391,7 @@ insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_
 
 insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id) values('_MOBILE_BROWSE_CATS', 1, 'true', '', 1);
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 create table ttrss_user_prefs (
    owner_uid integer not null,

schema/ttrss_schema_pgsql.sql

@@ -355,7 +355,7 @@ insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_
 
 insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id) values('_MOBILE_BROWSE_CATS', 1, 'true', '', 1);
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 create table ttrss_user_prefs (
 	owner_uid integer not null references ttrss_users(id) ON DELETE CASCADE,

schema/versions/mysql/82.sql

@@ -1,6 +1,6 @@
 begin;
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 update ttrss_version set schema_version = 82;
 

schema/versions/pgsql/82.sql

@@ -1,6 +1,6 @@
 begin;
 
-insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'You can login automatically with an active client SSL certificate if you fill in its serial number here.');
+insert into ttrss_prefs (pref_name,type_id,def_value,short_desc,section_id,help_text) values('SSL_CERT_SERIAL', 2, '', 'Login with an SSL certificate',3, 'Click to register your SSL client certificate with tt-rss');
 
 update ttrss_version set schema_version = 82;