ÿþ<!-- Start script ----- /*********************************************************************** * * MD5 - class encapsulating MD5 algorithm * * Copyright (c) Actinic Software Ltd 2000 * Derived from the RSA Data Security, Inc. MD5 Message-Digest Algorithm * ************************************************************************/ /*********************************************************************** * * DWord - constructor class for 32 bit unsigned object * * This is forced upon us by a bug in the implementation of bitwise * operators in the JavaScript for IE4 & IE5 on the Mac. * * Params: nHigh - high order word * nLow - low order word * ***********************************************************************/ function DWord(nHigh, nLow) { this.nLow = nLow; // Set low-order value this.nHigh = nHigh; // Set high order value } /*********************************************************************** * * DRotateLeft - rotate DWord left by n bits * * Params: x - DWord value to rotate * nCount - number of bits * * Returns: New variable with shifted result * ***********************************************************************/ function DRotateLeft(x, nCount) { var nResult, nCarry; // // If it's more than 16 bits, we can optimise the first part // by simply swapping the words // if (nCount >= 16) { nResult = new DWord(x.nLow, x.nHigh); // Swap words nCount -= 16; // Adjust count } else { nResult = new DWord(x.nHigh, x.nLow); // Normal order } // // Now rotate what's left // if (nCount > 0) { nCarry = nResult.nHigh >>> (16 - nCount); // Save top bits of high word nResult.nHigh = ((nResult.nHigh << nCount) | (nResult.nLow >>> (16 - nCount))) & 0xFFFF; nResult.nLow = ((nResult.nLow << nCount) | nCarry) & 0xFFFF; } return(nResult); } /*********************************************************************** * * DAdd - 32 bit addition * * Params: a, b - values to add * * Returns: 32 bit addition of the two * ***********************************************************************/ function DAdd(a, b) { var nLow = (a.nLow + b.nLow); // Add low-order words return(new DWord((a.nHigh + b.nHigh + (nLow >> 16)) & 0xFFFF, nLow & 0xFFFF)); } /*********************************************************************** * * DAnd - 32 bit bitwise AND (to deal with Mac bug) * * Params: a, b - values to and together * * Returns: 32 bit AND of the two * ***********************************************************************/ function DAnd(a, b) { return(new DWord((a.nHigh & b.nHigh), (a.nLow & b.nLow))); } /*********************************************************************** * * DOr - 32 bit bitwise OR (to deal with Mac bug) * * Params: a, b - values to and together * * Returns: 32 bit OR of the two * ***********************************************************************/ function DOr(a, b) { return(new DWord((a.nHigh | b.nHigh), (a.nLow | b.nLow))); } /*********************************************************************** * * DXor - 32 bit bitwise OR (to deal with Mac bug) * * Params: a, b - values to and together * * Returns: 32 bit OR of the two * ***********************************************************************/ function DXor(a, b) { return(new DWord((a.nHigh ^ b.nHigh), (a.nLow ^ b.nLow))); } /*********************************************************************** * * DNot - 32 bit bitwise inversion (to deal with Mac bug) * * Params: a - value * * Returns: 32 bit inversion * ***********************************************************************/ function DNot(a) { return(new DWord(a.nHigh ^ 0xFFFF, a.nLow ^ 0xFFFF)); } /*********************************************************************** * * DF, DG, DH, and DI transformations for rounds 1, 2, 3, and 4 * ***********************************************************************/ function DF(a, b, c, d, x, s, ac) { return(DAdd(DRotateLeft(DAdd(a, DAdd(DAdd(DOr(DAnd(b, c), DAnd(DNot(b), d)), x), ac)), s), b)); } function DG(a, b, c, d, x, s, ac) { return(DAdd(DRotateLeft(DAdd(a, DAdd(DAdd(DOr(DAnd(b, d), DAnd(c, DNot(d))), x), ac)), s), b)); } function DH(a, b, c, d, x, s, ac) { return(DAdd(DRotateLeft(DAdd(a, DAdd(DAdd(DXor(DXor(b, c), d), x), ac)), s), b)); } function DI(a, b, c, d, x, s, ac) { return(DAdd(DRotateLeft(DAdd(a, DAdd(DAdd(DXor(c, DOr(b, DNot(d))), x), ac)), s), b)); } /*************************************************************** * * DStringToBlocks - convert the input string to an array * * Params: sInput * * Returns: Array of blocks with length and padding * ***************************************************************/ function DStringToBlocks(sInput) { var nBlockCount = ((sInput.length + 8) >> 6) + 1; // Work out what we'll need var Blocks = new Array(nBlockCount * 16); // Allocate the array var nIndex, nByte; for (nIndex = 0; nIndex < nBlockCount * 16; nIndex++) { Blocks[nIndex] = new DWord(0, 0); // Zero out the block } // // Fill the blocks with the string. This gets moderately complicated // since we have to allow for the upper and lower words // for (nIndex = 0; nIndex < sInput.length; nIndex++) { nByte = nIndex & 0x3; // Get nybble index as 0-3 if (nByte == 0) { Blocks[nIndex >> 2].nLow = sInput.charCodeAt(nIndex); } if (nByte == 1) { Blocks[nIndex >> 2].nLow |= sInput.charCodeAt(nIndex) << 8; } if (nByte == 2) { Blocks[nIndex >> 2].nHigh = sInput.charCodeAt(nIndex); } if (nByte == 3) { Blocks[nIndex >> 2].nHigh |= sInput.charCodeAt(nIndex) << 8; } } // // Put padding bits and number of bits that we've used // nByte = nIndex & 0x3; // Get nybble index as 0-3 if (nByte == 0) { Blocks[nIndex >> 2].nLow = 0x80; } if (nByte == 1) { Blocks[nIndex >> 2].nLow |= 0x8000; } if (nByte == 2) { Blocks[nIndex >> 2].nHigh |= 0x80; } if (nByte == 3) { Blocks[nIndex >> 2].nHigh |= 0x8000; } // // We need the number of bits as a 32 bit integer, but we can't rely // on Javascript to get the value correct. However, the string really can't be // that long in this context, so we'll just assume that there aren't more than 8k bytes // of data being encoded. // Blocks[nBlockCount * 16 - 2] = new DWord(0, (sInput.length * 8)); // Number of bits return(Blocks); } /*************************************************************** * * DAsHex - show value as sequence of bytes, least significant * byte first. High nybble before low nybble in each byte. * * Params: dValue - value to display * * Returns: Hex string * ***************************************************************/ function DAsHex(dValue) { var sHex = "0123456789abcdef"; var nIndex; sResult = sHex.charAt((dValue.nLow >> 4) & 0xF) // Top nybble of low byte + sHex.charAt(dValue.nLow & 0xF) + sHex.charAt((dValue.nLow >> 12) & 0xF) + sHex.charAt((dValue.nLow >> 8) & 0xF) + sHex.charAt((dValue.nHigh >> 4) & 0xF) + sHex.charAt(dValue.nHigh & 0xF) + sHex.charAt((dValue.nHigh >> 12) & 0xF) + sHex.charAt((dValue.nHigh >> 8) & 0xF); return(sResult); } /*************************************************************** * * DCalculateMD5 - work out the MD5 * * Parms: sInput - input string * * Returns: MD5 hash of string * ***************************************************************/ function DCalculateMD5(sInput) { // // Proper MD5 initialisation values // var a = new DWord(0x6745, 0x2301); var b = new DWord(0xEFCD, 0xAB89); var c = new DWord(0x98BA, 0xDCFE); var d = new DWord(0x1032, 0x5476); var blk = DStringToBlocks(sInput); // Convert it to blocks var nIndex; var nSaveA, nSaveB, nSaveC, nSaveD; for (nIndex = 0; nIndex < blk.length; nIndex += 16) { nSaveA = new DWord(a.nHigh, a.nLow); // Save start values nSaveB = new DWord(b.nHigh, b.nLow); nSaveC = new DWord(c.nHigh, c.nLow); nSaveD = new DWord(d.nHigh, d.nLow); a = DF(a, b, c, d, blk[nIndex+0], 7, new DWord(0xd76a, 0xa478)); /* 1 */ d = DF(d, a, b, c, blk[nIndex+1], 12, new DWord(0xe8c7, 0xb756)); /* 2 */ c = DF(c, d, a, b, blk[nIndex+2], 17, new DWord(0x2420, 0x70db)); /* 3 */ b = DF(b, c, d, a, blk[nIndex+3], 22, new DWord(0xc1bd, 0xceee)); /* 4 */ a = DF(a, b, c, d, blk[nIndex+4], 7, new DWord(0xf57c, 0xfaf)); /* 5 */ d = DF(d, a, b, c, blk[nIndex+5], 12, new DWord(0x4787, 0xc62a)); /* 6 */ c = DF(c, d, a, b, blk[nIndex+6], 17, new DWord(0xa830, 0x4613)); /* 7 */ b = DF(b, c, d, a, blk[nIndex+7], 22, new DWord(0xfd46, 0x9501)); /* 8 */ a = DF(a, b, c, d, blk[nIndex+8], 7, new DWord(0x6980, 0x98d8)); /* 9 */ d = DF(d, a, b, c, blk[nIndex+9], 12, new DWord(0x8b44, 0xf7af)); /* 10 */ c = DF(c, d, a, b, blk[nIndex+10], 17, new DWord(0xffff, 0x5bb1)); /* 11 */ b = DF(b, c, d, a, blk[nIndex+11], 22, new DWord(0x895c, 0xd7be)); /* 12 */ a = DF(a, b, c, d, blk[nIndex+12], 7, new DWord(0x6b90, 0x1122)); /* 13 */ d = DF(d, a, b, c, blk[nIndex+13], 12, new DWord(0xfd98, 0x7193)); /* 14 */ c = DF(c, d, a, b, blk[nIndex+14], 17, new DWord(0xa679, 0x438e)); /* 15 */ b = DF(b, c, d, a, blk[nIndex+15], 22, new DWord(0x49b4, 0x821)); /* 16 */ /* Round 2 */ a = DG(a, b, c, d, blk[nIndex+1], 5, new DWord(0xf61e, 0x2562)); /* 17 */ d = DG(d, a, b, c, blk[nIndex+6], 9, new DWord(0xc040, 0xb340)); /* 18 */ c = DG(c, d, a, b, blk[nIndex+11], 14, new DWord(0x265e, 0x5a51)); /* 19 */ b = DG(b, c, d, a, blk[nIndex+0], 20, new DWord(0xe9b6, 0xc7aa)); /* 20 */ a = DG(a, b, c, d, blk[nIndex+5], 5, new DWord(0xd62f, 0x105d)); /* 21 */ d = DG(d, a, b, c, blk[nIndex+10], 9, new DWord(0x244, 0x1453)); /* 22 */ c = DG(c, d, a, b, blk[nIndex+15], 14, new DWord(0xd8a1, 0xe681)); /* 23 */ b = DG(b, c, d, a, blk[nIndex+4], 20, new DWord(0xe7d3, 0xfbc8)); /* 24 */ a = DG(a, b, c, d, blk[nIndex+9], 5, new DWord(0x21e1, 0xcde6)); /* 25 */ d = DG(d, a, b, c, blk[nIndex+14], 9, new DWord(0xc337, 0x7d6)); /* 26 */ c = DG(c, d, a, b, blk[nIndex+3], 14, new DWord(0xf4d5, 0xd87)); /* 27 */ b = DG(b, c, d, a, blk[nIndex+8], 20, new DWord(0x455a, 0x14ed)); /* 28 */ a = DG(a, b, c, d, blk[nIndex+13], 5, new DWord(0xa9e3, 0xe905)); /* 29 */ d = DG(d, a, b, c, blk[nIndex+2], 9, new DWord(0xfcef, 0xa3f8)); /* 30 */ c = DG(c, d, a, b, blk[nIndex+7], 14, new DWord(0x676f, 0x2d9)); /* 31 */ b = DG(b, c, d, a, blk[nIndex+12], 20, new DWord(0x8d2a, 0x4c8a)); /* 32 */ /* Round 3 */ a = DH(a, b, c, d, blk[nIndex+5], 4, new DWord(0xfffa, 0x3942)); /* 33 */ d = DH(d, a, b, c, blk[nIndex+8], 11, new DWord(0x8771, 0xf681)); /* 34 */ c = DH(c, d, a, b, blk[nIndex+11], 16, new DWord(0x6d9d, 0x6122)); /* 35 */ b = DH(b, c, d, a, blk[nIndex+14], 23, new DWord(0xfde5, 0x380c)); /* 36 */ a = DH(a, b, c, d, blk[nIndex+1], 4, new DWord(0xa4be, 0xea44)); /* 37 */ d = DH(d, a, b, c, blk[nIndex+4], 11, new DWord(0x4bde, 0xcfa9)); /* 38 */ c = DH(c, d, a, b, blk[nIndex+7], 16, new DWord(0xf6bb, 0x4b60)); /* 39 */ b = DH(b, c, d, a, blk[nIndex+10], 23, new DWord(0xbebf, 0xbc70)); /* 40 */ a = DH(a, b, c, d, blk[nIndex+13], 4, new DWord(0x289b, 0x7ec6)); /* 41 */ d = DH(d, a, b, c, blk[nIndex+0], 11, new DWord(0xeaa1, 0x27fa)); /* 42 */ c = DH(c, d, a, b, blk[nIndex+3], 16, new DWord(0xd4ef, 0x3085)); /* 43 */ b = DH(b, c, d, a, blk[nIndex+6], 23, new DWord(0x488, 0x1d05)); /* 44 */ a = DH(a, b, c, d, blk[nIndex+9], 4, new DWord(0xd9d4, 0xd039)); /* 45 */ d = DH(d, a, b, c, blk[nIndex+12], 11, new DWord(0xe6db, 0x99e5)); /* 46 */ c = DH(c, d, a, b, blk[nIndex+15], 16, new DWord(0x1fa2, 0x7cf8)); /* 47 */ b = DH(b, c, d, a, blk[nIndex+2], 23, new DWord(0xc4ac, 0x5665)); /* 48 */ /* Round 4 */ a = DI(a, b, c, d, blk[nIndex+0], 6, new DWord(0xf429, 0x2244)); /* 49 */ d = DI(d, a, b, c, blk[nIndex+7], 10, new DWord(0x432a, 0xff97)); /* 50 */ c = DI(c, d, a, b, blk[nIndex+14], 15, new DWord(0xab94, 0x23a7)); /* 51 */ b = DI(b, c, d, a, blk[nIndex+5], 21, new DWord(0xfc93, 0xa039)); /* 52 */ a = DI(a, b, c, d, blk[nIndex+12], 6, new DWord(0x655b, 0x59c3)); /* 53 */ d = DI(d, a, b, c, blk[nIndex+3], 10, new DWord(0x8f0c, 0xcc92)); /* 54 */ c = DI(c, d, a, b, blk[nIndex+10], 15, new DWord(0xffef, 0xf47d)); /* 55 */ b = DI(b, c, d, a, blk[nIndex+1], 21, new DWord(0x8584, 0x5dd1)); /* 56 */ a = DI(a, b, c, d, blk[nIndex+8], 6, new DWord(0x6fa8, 0x7e4f)); /* 57 */ d = DI(d, a, b, c, blk[nIndex+15], 10, new DWord(0xfe2c, 0xe6e0)); /* 58 */ c = DI(c, d, a, b, blk[nIndex+6], 15, new DWord(0xa301, 0x4314)); /* 59 */ b = DI(b, c, d, a, blk[nIndex+13], 21, new DWord(0x4e08, 0x11a1)); /* 60 */ a = DI(a, b, c, d, blk[nIndex+4], 6, new DWord(0xf753, 0x7e82)); /* 61 */ d = DI(d, a, b, c, blk[nIndex+11], 10, new DWord(0xbd3a, 0xf235)); /* 62 */ c = DI(c, d, a, b, blk[nIndex+2], 15, new DWord(0x2ad7, 0xd2bb)); /* 63 */ b = DI(b, c, d, a, blk[nIndex+9], 21, new DWord(0xeb86, 0xd391)); /* 64 */ a = DAdd(nSaveA, a); b = DAdd(nSaveB, b); c = DAdd(nSaveC, c); d = DAdd(nSaveD, d); } // // Now we have the digest in a,b,c and d so we'll convert it // to a string for debugging // return(DAsHex(a) + DAsHex(b) + DAsHex(c) + DAsHex(d)); } /*************************************************************** * * CalculateSignature - work out the MD5 signature and post to the script * * Expects: Username and password filled in * Hash contains MD5(u, MD5(p)) from login * OrderHash contains MD5 hash of order * * Affects: Stores signature in signature field * ***************************************************************/ function CalculateSignature() { // // Work out the correct form to use // nIndex = 0; // use 0 if we don't find the form so JS error generated for (nTest = 0; nTest < document.forms.length; nTest++) { if (document.forms[nTest] && document.forms[nTest].PASS) { nIndex = nTest; // found the form so keep the number } } var sUserName = document.forms[nIndex].USER.value; // Get user name var sPassword = document.forms[nIndex].PASS.value; // Get password var sLoginHash = document.forms[nIndex].HASH.value; // Get hash from login var sOrderHash = document.forms[nIndex].ORDERHASH.value; // Get hash of order details // // Let's just test for empty fields.. // if (sUserName.length == 0 || sPassword.length == 0) { alert("You must fill in both user name and password."); return; } // // There's something there, so compute the hashes and // validate that it's correct // var sMD5P = DCalculateMD5(sPassword); // Calculate MD5(p) var sHash1 = DCalculateMD5(sUserName + sMD5P); // Compute MD5(u, MD5(p)) var sHash2 = DCalculateMD5(sUserName + sHash1); // Compute MD5(u, MD5(u, MD5(p))) if (sHash2 != sLoginHash) // Hash doesn't match { // // Ideally these alerts would be strings in Catalog // alert("Your password is incorrect."); return; // Don't call the script } var sSignature = DCalculateMD5(sMD5P + sOrderHash); document.forms[nIndex].SIGNATURE.value = sSignature; // Set it in the form document.forms[nIndex].PASS.value = ""; // Empty the password field document.forms[nIndex].submit(); // Call the Perl script } /*************************************************************** * * SubmitLogin - work out the MD5 hashes and post to the script * * Expects: Username and password filled in * ***************************************************************/ function SubmitLogin(sFormName) { // // Work out the correct form to use // nIndex = 0; // use 0 if we don't find the form so JS error generated for (nTest = 0; nTest < document.forms.length; nTest++) { if (document.forms[nTest] && document.forms[nTest].name == sFormName) { nIndex = nTest; // found the form so keep the number } } var sUserName = document.forms[nIndex].USER.value; // Get user name var sPassword = document.forms[nIndex].PASS.value; // Get password var sChallenge = document.forms[nIndex].challenge.value; //Get challenge // // Let's just test for empty fields.. // if (sUserName.length == 0 || sPassword.length == 0) { alert("You must fill in both user name and password."); return; } // // There's something there, so compute the hashes and // let's go // var sMD5P = DCalculateMD5(sPassword); // Calculate MD5(p) var sHash = DCalculateMD5(sUserName + sMD5P); // Compute MD5(u, MD5(p)) var sChal = DCalculateMD5(sChallenge + sMD5P); //Compute MD5(c,MD5(p)) // // If the hash is "00000000000000000000000000000000", then it is IE // on the Mac and we can't handle it. // if (sHash == "00000000000000000000000000000000") { alert("It appears as if you are using Internet Explorer on a Mac. This configuration does not work properly with this catalog's login process. Please use Netscape, login via a PC, or contact us directly with your order."); return; } document.forms[nIndex].HASH.value = sHash; // Set it in the form document.forms[nIndex].PASS.value = ""; // Empty the password field document.forms[nIndex].challengeout.value = sChal; // Store challenge hash document.forms[nIndex].submit(); // Call the script } // end of script -->