#!/usr/bin/perl
# cpanel - realchpass                             Copyright(c) 2010 cPanel, Inc.
#                                                           All rights Reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

BEGIN {
    $ENV{'LANG'} = 'C';
    unshift @INC, '/usr/local/cpanel';
}

use Cpanel::OSSys ();
use Cpanel::SafeFile   ();
use Cpanel::Rand       ();
use Cpanel::StringFunc ();
use Cpanel::CheckPass  ();
use Cpanel::Logger     ();
use strict;
use Carp qw(confess);
my $logger = Cpanel::Logger->new();

my $user = $ARGV[0];
my $pass = $ARGV[1];

if ( !$user ) {
    my ($up);
    chomp( $up = <STDIN> );
    ( $user, $pass ) = split( / /, $up, 2 );
}

if ( ( getpwnam($user) )[0] eq '' ) {
    confess("${user} does not exist, so the password cannot be changed!");
}
elsif ( -e '/var/cpanel/suspended/' . $user ) {
    confess("$user is suspended. Changing the password would unsuspend the account!");
}

if ( !$pass ) {
    confess("You cannot set a blank password!");
}
my $hasmd5auth = hasmd5auth();

if ( -e "/etc/master.passwd" ) {
    my ( $fd0, $fd1 ) = Cpanel::OSSys::pipe();
    Cpanel::OSSys::write( $fd0, $pass, length($pass) );
    system( '/usr/sbin/pw', 'usermod', $user, '-h', $fd1 );
    print "Password for $user has been changed\n";
    exit;
}

my $cpass = '*';
if ( $pass ne '*' ) {
    if ($hasmd5auth) {
        my $random = Cpanel::Rand::getranddata( 16, 0 );
        $cpass = Cpanel::CheckPass::unix_md5_crypt( $pass, $random );
    }
    $cpass =~ s/[\r\n]//g;
    if ( $cpass eq '*' || $cpass eq '' ) {
        while ( !defined($cpass) || $cpass eq '*' || $cpass =~ /:/ ) {
            my $random = Cpanel::Rand::getranddata( 16, 0 );
            $cpass = crypt( $pass, $random );
        }
    }
}

my $mytime = int( time / ( 60 * 60 * 24 ) );

my $slock = Cpanel::SafeFile::safeopen( \*SHADOW, '+<', '/etc/shadow' );
if ( !$slock ) {
    $logger->die("Could not edit /etc/shadow");    # freebsd already handled above
}
my @SHADOW = <SHADOW>;
seek( SHADOW, 0, 0 );
my $seenline = 0;
foreach (@SHADOW) {
    if ( Cpanel::StringFunc::beginmatch( $_, $user . ':' ) ) {
        chomp();

        print "Changing password for $user\n";

        #operator:*:10325:-1:-1:-1:-1:-1:-1
        my ( $s1, $s2, $s3, $s4, $s5, $s6 ) = ( split( /:/, $_ ) )[ 3, 4, 5, 6, 7, 8 ];
        $_ = join( ':', $user, $cpass, $mytime, $s1, $s2, $s3, $s4, $s5, $s6 ) . "\n";

        $seenline = 1;
    }
    print SHADOW $_;
}
if ( !$seenline ) {
    print SHADOW join( ':', $user, $cpass, $mytime, '', '', '', '', '', '' ) . "\n";
}
truncate( SHADOW, tell(SHADOW) );
Cpanel::SafeFile::safeclose( \*SHADOW, $slock );

print "Password for $user has been changed\n";

sub hasmd5auth {
    my $hasmd5auth = 0;
    open( SA, '<', '/etc/pam.d/system-auth' );
    while (<SA>) {
        if (/^[\s\t]*password.*md5/) {
            $hasmd5auth = 1;
        }
    }
    close(SA);
    return ($hasmd5auth);
}