#!/usr/bin/perl

# JumpBox                             Version 2.1                    
# Copyright 1999-2002 by Matt Riffle  All Rights Reserved.            
# Initial Release: 2/20/99            This Release: 6/6/02            
# pingPackets                         http://www.pingpackets.com/     

# This program is free software; you can redistribute it and/or      
# modify it under the terms of the GNU General Public License         
# as published by the Free Software Foundation; either version 2      
# of the License, or (at your option) any later version.              

# This program is distributed in the hope that it will be useful,     
# but WITHOUT ANY WARRANTY; without even the implied warranty of      
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the       
# GNU General Public License for more details.  It is included in     
# this distribution in the file "license.txt".                        

# You should have received a copy of the GNU General Public License   
# along with this program; if not, write to the Free Software         
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA           
# 02111-1307, USA.                                                    

## Edit the variables below accordingly.  See the included readme.txt file
## for more information.

use strict;
use CGI 'param';

# This is the list of referrers which are allowed to access this script.
# If you don't care who uses it, set it to ().  Note that you don't need the 
# "www" prefix for a domain name: each name in the script is check # with and 
# without it.  Also note that more and more, browsers are not sending referrer 
# info, for privacy.  (Not to mention that it's easy to fake it.)  This is 
# really a minimal protection.

my @valid_ref = ();

# $default should be set to the URL the script will redirect to in the
# case it is unable to determine where it's supposed to send the user

my $default = '';

# If $method is set to 0, the form input should be a URL to redirect to.
# Otherwise, it should be a "key" to a URL (see %keys below).  More info
# on this can be found in the README file.

my $method = 0;
$method = 1 if param('method') eq 'map';

# $if $method is set to 1, then the following array should be used to
# associate keywords with the URL they are to represent.

my %keys;
%keys = &load_map() if $method; 

###### Do Not Edit Below This Line ######

# referrer check, which will make unauthorized use a little problematic
# even if it doesn't stop anybody
kinda_secure() || error(0);

# get the URL
my $goto = param('goto') || error(1);
$goto = $keys{$goto} if $method;
good_url($goto) || ($goto = $default || error(1)); 

# and we're off...
print "Location: $goto\n\n";
exit;

sub kinda_secure {
    return 1 unless (@valid_ref && $ENV{HTTP_REFERER});
    for (@valid_ref) { 
        return 1 if $ENV{HTTP_REFERER} =~ m#^https?://(www\.)?$_/#;
    }
    return 0; 
}

sub good_url {
    return (shift =~ m#^https?://[\w\.\-]+/#i); 
}

sub error {
    my @errors = (
       'has been called from a domain that is not authorized to use it',
       'was unable to determine what URL to redirect you to',
       'was unable to find map file',
    );
    print "Content-type: text/html\n\nSorry, the script ",$errors[shift],'.<p>';
    exit;
}

sub load_map {
  my %keys;
  $ENV{'DOCUMENT_ROOT'} =~ /^\/[^\/]+\/[^\/]+\/[^\/]+\/([^\/]+)/;
  chomp(my $username = $1);
  chdir("/usr/home/$username") || &error(2);
  if (($username !~ /^[a-zA-Z0-9]{2,8}$/) ||
      (!-e ".jumpbox") ||                   
      (-l ".jumpbox")) { &error(2); }
  open (FILE,"<.jumpbox") || &error(2);
  while (<FILE>) {
    /^([^\=]+)\=(.+)$/;
    $keys{$1} = $2;
  }
  close (FILE);
  return %keys;
}