Omarchy-Big-PC
358027bf27
- PROTOCOL.md: base URL, login/session auth, request envelope, push, media - endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle - FINDINGS.md: security findings incl. hardcoded dev account in build - tools: endpoint extractor + credential-safe login script - results: original analysis report (IDs redacted)
45 lines
1.3 KiB
Bash
Executable File
45 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Log in to a Boti Education school API (Green Wood School variant) and cache the session token.
|
|
# Credentials are read from boti.ini in $XDG_CONFIG_HOME (default ~/.config), never hard-coded.
|
|
#
|
|
# boti.ini format:
|
|
# [boti]
|
|
# login = 0600000000
|
|
# password = whatever
|
|
#
|
|
set -euo pipefail
|
|
|
|
BASE="https://boti.education/p/greenwood/botiapi/"
|
|
CONF="${XDG_CONFIG_HOME:-$HOME/.config}/boti.ini"
|
|
CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/boti-key"
|
|
|
|
if [[ ! -f "$CONF" ]]; then
|
|
echo "missing $CONF (see header of this script for format)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
login=$(awk -F= '/^login/{gsub(/[[:space:]]/,"",$2); print $2}' "$CONF")
|
|
password=$(awk -F= '/^password/{gsub(/[[:space:]]/,"",$2); print $2}' "$CONF")
|
|
|
|
resp=$(curl -sS -m 20 "$BASE/login" \
|
|
-F "login=$login" \
|
|
-F "password=$password" \
|
|
-F "privacy=true" \
|
|
-F "remembreMe=false")
|
|
|
|
if ! grep -q '"error":false' <<<"$resp"; then
|
|
echo "login failed: $(head -c 200 <<<"$resp")" >&2
|
|
exit 1
|
|
fi
|
|
|
|
key=$(sed -n 's/.*"keyToken":"\([0-9a-f]*\)".*/\1/p' <<<"$resp")
|
|
if [[ -z "$key" ]]; then
|
|
echo "no keyToken in response" >&2
|
|
exit 1
|
|
fi
|
|
|
|
umask 077
|
|
printf '%s' "$key" > "$CACHE"
|
|
echo "session key cached at $CACHE (40 hex chars)"
|
|
echo "usage: curl \"$BASE/<endpoint>?user_id=<userId>&key=$(cat "$CACHE")\""
|