use POST for form data

lighttpd/htdocs/defs

@@ -11,15 +11,26 @@ END='</body></html>'
 
 function urldecode() { : "${*//+/ }"; echo -e "${_//%/\\x}"; }
 
-parse_arg()
+
+parse_get_arg()
 {
  while IFS='=' read -r -d '&' var val; do
  var=$(urldecode "$var")
  [ "$var" = "$1" ] && echo $(urldecode "$val") && return 0
- done <<<"${QUERY_STRING}&"
+ done<<<"${QUERY_STRING}&"
+ return 1
+}
+export -f parse_get_arg
 
+parse_post_arg()
+{
+ while IFS='=' read -r -d '&' var val; do
+ var=$(urldecode "$var")
+ [ "$var" = "$1" ] && echo $(urldecode "$val") && return 0
+ done<<<"${POST_STRING}&"
  return 1
 }
-export -f parse_arg
+export -f parse_post_arg
+
 
 . /etc/openvpn/http/easyrsa.env

lighttpd/htdocs/index.cgi

@@ -5,7 +5,7 @@ print_user_table()
 # name,begin,end,status
 # ariya,Jul 21 11:15:44 2020 GMT,Jul 6 11:15:44 2023 GMT,VALID
 
- echo '<form><table>'
+ echo '<form method="post"><table>'
 
  echo '<tr><th colspan=5>Existing users</th></tr>
  <tr><th>Username</th><th>Valid from</th><th>Valid to</th><th>Status</th><th>Config</th></tr>'
@@ -52,9 +52,11 @@ MY_PATH=$(readlink -f "$BASH_SOURCE")
 MYDIR=$(dirname "$MY_PATH")
 . "$MYDIR/defs"
 
-action=$(parse_arg "action")
-username=$(parse_arg "username")
-capassphrase=$(parse_arg "capassphrase")
+read -t 5 POST_STRING
+
+action=$(parse_post_arg "action")
+username=$(parse_post_arg "username")
+capassphrase=$(parse_post_arg "capassphrase")
 export EASYRSA_PASSIN="pass:$capassphrase"
 export EASYRSA_BATCH=1
 case "$action" in

lighttpd/htdocs/user_config.cgi

@@ -5,7 +5,7 @@ MYDIR=$(dirname "$MY_PATH")
 . "$MYDIR/defs"
 
 
-username=$(parse_arg username)
+username=$(parse_get_arg username)
 [ "$?" != 0 -o -z "$username" ] && echo -e "$HEAD\n no valid user supplied!\n$END" && exit 1
 
 CONFIG=$(ovpn_getclient "$username")