pclean.rb

#!/usr/bin/ruby
# pclean.rb
# cgi to clean a puppet ssl cert
class Puppetca
    # removes old certificate if it exists
    # The certname parameter is the node's certname
    # Make sure to add the _www user to your sudoers file
    # added using visudo:
    # _www    ALL = NOPASSWD: /usr/bin/puppet, !/usr/bin/puppet cert --clean --all
    def self.clean certname, addr
        command = "/usr/bin/sudo /usr/bin/puppet cert --clean #{certname}"
        # for some reason the "system" command causes Mac apache to crash
        # when used here
        %x{#{command}}
        %x{"logger #{addr} cleaned #{certname}"}
        return true
    end
end
=begin
CGI starts here
=end
# get the value of the passed param in the URL Query_string
require 'cgi'
cgi=CGI.new
certname = cgi["certname"]
# define the characters that are allow to avoid an injection attack
# 0-9, a-z, period, dash, and colon are allowed. All else is not
pattern = /[^a-z0-9.\-:]/
# determine if any other characters are in the certname
reject = (certname =~ pattern) ? 1 : 0
if ((reject == 0) && Puppetca.clean(certname, ENV['REMOTE_ADDR']))
    cgi.out("status" => "OK", "connection" => "close") {"OK #{certname} cleaned from testing.huronhs.com\n"}
else
    cgi.out("status" => "BAD_REQUEST", "connection" => "close") {"Not Processed: #{certname}\n"} 
end