Login dialog: no password change or account creation; editor IPC sockets bound to loopback (#236 step 0)

The Change button sent cgi-bin/ecce_accounts?...&paramo=<old>&paramn=<new>
as a plain-HTTP request line. No ecce_accounts script is installed, so it
only ever got 404, but Apache's access log recorded both passwords.
Account creation (newUser) had no caller left. Both are removed with
their dialog branches; the Change button is no longer shown.

Calculation Editor, DirDyVTST and MetaDyn editors received the
code-registration dialogs' datagrams on an unbound wxIPV4address, i.e.
INADDR_ANY: anyone on the network could set theory and run-type values
in a running editor. The dialogs send to localhost, so the sockets now
bind to 127.0.0.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y1pWhDKvhakdnjg3taYGxM

Author: andy

include/wxgui/WxDavAuth.H

@@ -60,10 +60,6 @@ class WxDavAuth : public AuthEventListener
             string& password,
             int retryCount);
 
-      bool createNewUser(const string& strulg, const string& user,
-                         const string& password);
-      bool changePassword(const string& strulg, const string& user,
-                          const string& password, const string& newPassword);
 
       // True if this session has already seen `user` accepted by `host`
       // (any URL, via authorizationAccepted()) -- so a 401 for a

src/apps/calced/CalcEd.C

@@ -3744,6 +3744,9 @@ void CalcEd::startTheoryApp(const bool& localInitFlag)
     // Create datagram socket, Let Wx select a port for us - (Service(0))
     wxIPV4address bindAddress;
     bindAddress.Service(0);
+    // Only the dialog on this machine may send: unbound, anyone on the
+    // network could set this editor's values.
+    bindAddress.LocalHost();
     p_theoryInSocket = new wxDatagramSocket(bindAddress);
 
     // Check state of new socket, if its OK:
@@ -3830,6 +3833,9 @@ void CalcEd::startRuntypeApp(const bool& localInitFlag)
     // Create datagram socket, Let Wx select a port for us - (Service(0))
     wxIPV4address bindAddress;
     bindAddress.Service(0);
+    // Only the dialog on this machine may send: unbound, anyone on the
+    // network could set this editor's values.
+    bindAddress.LocalHost();
     p_runtypeInSocket = new wxDatagramSocket(bindAddress);
 
     // Check state of new socket, if its OK:

src/apps/dirdyed/NWDirdy.C

@@ -4141,6 +4141,9 @@ void NWDirdy::startGeneralTheoryApp(const bool& initFlag)
     // Create datagram socket, Let Wx select a port for us - (Service(0))
     wxIPV4address bindAddress;
     bindAddress.Service(0);
+    // Only the dialog on this machine may send: unbound, anyone on the
+    // network could set this editor's values.
+    bindAddress.LocalHost();
     p_generalTheoryInSocket = new wxDatagramSocket(bindAddress);
 
     // Check state of new socket, if its OK:
@@ -4258,6 +4261,9 @@ void NWDirdy::startSingleTheoryApp(const bool& initFlag)
     // Create datagram socket, Let Wx select a port for us - (Service(0))
     wxIPV4address bindAddress;
     bindAddress.Service(0);
+    // Only the dialog on this machine may send: unbound, anyone on the
+    // network could set this editor's values.
+    bindAddress.LocalHost();
     p_singleTheoryInSocket = new wxDatagramSocket(bindAddress);
 
     // Check state of new socket, if its OK:

src/apps/metadyn/MetaEd.C

@@ -1694,6 +1694,9 @@ void MetaEd::startTheoryApp(const bool& localInitFlag)
     // Create datagram socket, Let Wx select a port for us - (Service(0))
     wxIPV4address bindAddress;
     bindAddress.Service(0);
+    // Only the dialog on this machine may send: unbound, anyone on the
+    // network could set this editor's values.
+    bindAddress.LocalHost();
     p_theoryInSocket = new wxDatagramSocket(bindAddress);
 
     // Check state of new socket, if its OK:
@@ -1781,6 +1784,9 @@ void MetaEd::startRuntypeApp(const bool& localInitFlag)
     // Create datagram socket, Let Wx select a port for us - (Service(0))
     wxIPV4address bindAddress;
     bindAddress.Service(0);
+    // Only the dialog on this machine may send: unbound, anyone on the
+    // network could set this editor's values.
+    bindAddress.LocalHost();
     p_runtypeInSocket = new wxDatagramSocket(bindAddress);
 
     // Check state of new socket, if its OK:

src/wxgui/wxdialogs/WxDavAuth.C

@@ -383,7 +383,10 @@ bool WxDavAuth::prompt(const string& strurl,
                               wxMax(before.GetHeight(), after.GetHeight())));
      }
 
-     authDlg.showChangeBtn(true);
+     // No password change or account creation from here: there is no
+     // server side for them, and the request put both passwords in the
+     // URL, which the data server writes to its access log.
+     authDlg.showChangeBtn(false);
      authDlg.setServer(url.getHost());
      authDlg.setProtocol("http");
      // Prefilling the session user's own name here would invite retyping
@@ -414,43 +417,6 @@ bool WxDavAuth::prompt(const string& strurl,
          ret = true;
          user = authDlg.getUser();
          password = authDlg.getPassword();
-         string newPassword = authDlg.getNewPassword();
-
-         if (newUser) {
-           if (password.length() >= 6) {
-             ret = createNewUser(strurl, user, password);
-           } else {
-             done = false;
-             ewxMessageDialog dlg(NULL,
-                           "Unable to create new data server account.\n"
-                           "Password must be at least 6 characters.",
-                           "Create Data Server Account Failed",
-                           wxOK|wxICON_EXCLAMATION|wxSTAY_ON_TOP,
-                           wxDefaultPosition);
-             dlg.ShowModal();
-             authDlg.setPassword("");
-           }
-         } else if (newPassword != "") {
-           if (newPassword.length() >= 6) {
-             done = false;
-             ret = changePassword(strurl, user, password, newPassword);
-             if (ret) {
-               done = true;
-               // if the change succeeded, new password must be used
-               password = newPassword;
-             }
-           } else {
-             done = false;
-             ewxMessageDialog dlg(NULL,
-                           "Unable to change your data server password.\n"
-                           "New password must be at least 6 characters.",
-                           "Change Data Server Password Failed",
-                           wxOK|wxICON_EXCLAMATION|wxSTAY_ON_TOP,
-                           wxDefaultPosition);
-             dlg.ShowModal();
-             authDlg.setNewPassword("");
-           }
-         }
        }
      }
 
@@ -466,80 +432,6 @@ bool WxDavAuth::prompt(const string& strurl,
 }
 
 
-
-bool WxDavAuth::createNewUser(const string& strurl, const string& user,
-                              const string& password)
-{
-   bool ret = false;
-
-   string urlbase = strurl;
-   string::size_type pos = urlbase.rfind("/");
-   if (pos != string::npos)
-     urlbase.replace(pos+1, urlbase.length()-pos-1, "");
-
-   string urlcgi = urlbase + "cgi-bin/ecce_accounts?parama=create&paramu=";
-   string urlstr = urlcgi + user + "&paramr=Ecce-";
-
-   string realm = EDSIServerCentral::readRealm();
-   urlstr += realm;
-
-   urlstr += "&paramn=" + password;
-
-   EcceDAVClient edcCreate(urlstr);
-   ostrstream ostr;
-   ret = edcCreate.doPost(ostr) == 200;
-   if (ret) {
-     // just in case they already have this user,url cached even
-     // though it is a new user
-     AuthCache::getCache().changePass(urlbase, user, password);
-   } else {
-     string msg = "Unable to create new data server account.\n"
-                  "Contact your site ECCE administrator.";
-     ewxMessageDialog dlg(NULL, msg.c_str(),
-                          "Create Data Server Account Failed",
-                          wxOK|wxICON_EXCLAMATION|wxSTAY_ON_TOP,
-                          wxDefaultPosition);
-     dlg.ShowModal();
-   }
-
-   return ret;
-}
-
-
-
-bool WxDavAuth::changePassword(const string& strurl, const string& user,
-                               const string& password,const string& newPassword)
-{
-   bool ret = false;
-
-   string urlbase = strurl;
-   string::size_type pos = urlbase.rfind("/");
-   if (pos != string::npos)
-     urlbase.replace(pos+1, urlbase.length()-pos-1, "");
-
-   string urlcgi = urlbase + "cgi-bin/ecce_accounts?parama=modify&paramu=";
-   string urlstr = urlcgi + user + "&paramo=" + password;
-   urlstr += "&paramn=" + newPassword;
-
-   EcceDAVClient edcModify(urlstr);
-   ostrstream mostr;
-   ret = edcModify.doPost(mostr) == 200;
-   if (ret) {
-     AuthCache::getCache().changePass(urlbase, user, newPassword);
-   } else {
-     ewxMessageDialog dlg(NULL,
-                          "Unable to change your data server password.\n"
-                          "Current password may be incorrect.",
-                          "Change Data Server Password Failed",
-                          wxOK|wxICON_EXCLAMATION|wxSTAY_ON_TOP,
-                          wxDefaultPosition);
-     dlg.ShowModal();
-   }
-
-   return ret;
-}
-
-
 /**
  * Add to cache because it worked.  The addAuthentication method is
  * responsible for not adding duplicates.