sms++ · 3 user authentication we investigated three methods of accessing a user’s credentials...

96
SMS++ Justin Anderson [email protected] Kailash Joshi [email protected] Matti Kariluoma [email protected] Prateek Rajan [email protected] 2012 May 07 Abstract SMS++ delivers web services (i.e. search engines) over the Short Messaging Service (SMS) protocol. A user wishing to access web ser- vices that require authentication (i.e. email) must first register with a central database. Otherwise, queries are processed and returned in an SMS (160 character) format. Contents 1 Introduction 3 2 SMS Server 3 2.1 SMS++ Daemon ......................... 4 2.2 Phone Gateway .......................... 4 2.3 Email Gateway .......................... 4 3 User Authentication 6 3.1 Centralized Database ....................... 6 4 Authentication with Username & Password 6 4.1 Google Data API ......................... 6 4.2 Accessing Gmail Data ...................... 7 5 Authentication with Tokens 7 5.1 Open Authentication ....................... 7 5.2 Accessing Google Calendar Data ................ 9 1

Upload: others

Post on 17-Mar-2020

6 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

SMS++

Justin [email protected]

Kailash [email protected]

Matti [email protected]

Prateek [email protected]

2012 May 07

Abstract

SMS++ delivers web services (i.e. search engines) over the ShortMessaging Service (SMS) protocol. A user wishing to access web ser-vices that require authentication (i.e. email) must first register with acentral database. Otherwise, queries are processed and returned in anSMS (160 character) format.

Contents

1 Introduction 3

2 SMS Server 32.1 SMS++ Daemon . . . . . . . . . . . . . . . . . . . . . . . . . 42.2 Phone Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 42.3 Email Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 4

3 User Authentication 63.1 Centralized Database . . . . . . . . . . . . . . . . . . . . . . . 6

4 Authentication with Username & Password 64.1 Google Data API . . . . . . . . . . . . . . . . . . . . . . . . . 64.2 Accessing Gmail Data . . . . . . . . . . . . . . . . . . . . . . 7

5 Authentication with Tokens 75.1 Open Authentication . . . . . . . . . . . . . . . . . . . . . . . 75.2 Accessing Google Calendar Data . . . . . . . . . . . . . . . . 9

1

Page 2: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

6 Future Work 10

References 11

A C# Listings 12A.1 Default.aspx . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12A.2 Default.aspx.cs . . . . . . . . . . . . . . . . . . . . . . . . . . 15

B Java Listings 19B.1 index.jsp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19B.2 Login.jsp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20B.3 Home.jsp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22B.4 Profile.jsp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24B.5 Query.jsp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27B.6 Cookie.jsp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28B.7 GoogleClientLogin.java . . . . . . . . . . . . . . . . . . . . . . 29B.8 MailReader.java . . . . . . . . . . . . . . . . . . . . . . . . . . 31B.9 LoginDatabase.java . . . . . . . . . . . . . . . . . . . . . . . . 32B.10 QueryDatabase.java . . . . . . . . . . . . . . . . . . . . . . . 34B.11 ConnectionData.java . . . . . . . . . . . . . . . . . . . . . . . 38B.12 ProfileData.java . . . . . . . . . . . . . . . . . . . . . . . . . . 39B.13 LoginAction.java . . . . . . . . . . . . . . . . . . . . . . . . . 41B.14 QueryAction.java . . . . . . . . . . . . . . . . . . . . . . . . . 44B.15 HomeAction.java . . . . . . . . . . . . . . . . . . . . . . . . . 45B.16 CookieAction.java . . . . . . . . . . . . . . . . . . . . . . . . 45B.17 ProfileAction.java . . . . . . . . . . . . . . . . . . . . . . . . . 46

C PHP Listings 48C.1 createuser.php . . . . . . . . . . . . . . . . . . . . . . . . . . 48C.2 gcalendar.php . . . . . . . . . . . . . . . . . . . . . . . . . . . 51C.3 gcalendarauth.php . . . . . . . . . . . . . . . . . . . . . . . . 59C.4 gplusauth.php . . . . . . . . . . . . . . . . . . . . . . . . . . . 61C.5 calendar.php . . . . . . . . . . . . . . . . . . . . . . . . . . . 63C.6 calender3.php . . . . . . . . . . . . . . . . . . . . . . . . . . . 65C.7 readcookie.php . . . . . . . . . . . . . . . . . . . . . . . . . . 66C.8 setcookie.php . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

D Python Listings 68D.1 sms responder.py . . . . . . . . . . . . . . . . . . . . . . . . . 68D.2 email responder.py . . . . . . . . . . . . . . . . . . . . . . . . 71

2

Page 3: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

D.3 sms nav.py . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74D.4 sms nav remote.py . . . . . . . . . . . . . . . . . . . . . . . . 79D.5 render html.py . . . . . . . . . . . . . . . . . . . . . . . . . . 84D.6 sms relay render server.py . . . . . . . . . . . . . . . . . . . . 85

E Presentation, 2012 Apr 30 87E.1 sms++odp.pdf . . . . . . . . . . . . . . . . . . . . . . . . . . 87

1 Introduction

SMS messages are 160-character messages that can be transmitted to cell-phones over the cellphone carrier’s network. SMS can be accessed in low-bandwidth areas where data services (i.e. 3G) cannot. In addition, econom-ical cellphones may not have hardware support to communicate with dataservices.

SMS++ (Figure 1) aims to offer web services over the SMS protocol.A user can send an SMS message to an SMS++ server (via phone numberor email address) using a set of commands (Table 1) to browse informationstored on the web.

Of the available web services, we chose to implement access to Google’sservices for our project. This does not prevent one from extending ourmethods to other services, such as Yahoo, eBay, Amazon, etc.

2 SMS Server

We investigated methods available to us for receiving and responding toSMS messages. We found the following to be most promising:

1. SMS capable phone with the server application

2. SMS phone with serial connection to computer with server application

3. Application server which listens on an Email server, SMS are sent usingan SMS to Email gateway (a service that translates the protocols)

4. Addon card for computer which participates with the telephone net-work

5. Application server which listens on a web server providing one of theabove

3

Page 4: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

We chose to implement the first and third; the latter two require a paid ac-count and the second was overly complicated, esp. given that we had accessto a smart phone to run our application server. The second method is moreappropriate for an implementation with a more basic, low-end cellphone asthe SMS gateway.

2.1 SMS++ Daemon

The same code[D.3] is running on both platforms, save one small differ-ence[D.4]: in the interest of time a third-party program, ”links” Labs [2012]was used to render HTML pages to plaintext[D.5]. The links binary wasnot available for the phone gateway; a resource server[D.6] was created torender the HTML remotely, where the ”links” program was available. Thisresource server runs on the same machine as the email gateway.

2.2 Phone Gateway

We wrote our SMS++ phone daemon [D.1] for a Nokia n900 smartphonerunning the Maemo Nokia [2012] operating system, a derivitave of DebianGNU/Linux. The authors limited the choice of programming language tothose available from the maemo distributions package manager: C, C++,bash, perl, and Python. Python was chosen for three reasons: portabilityof code, available libraries, and ease of data structure expression. It is thethird that separates bash from perl and Python; the choice between perland Python was a matter of preference.

When the SMS++ phone daemon receives an SMS message, it sleeps for1 second (otherwise the phone’s carrier, AT&T, will not deliver the messagedue to rate limiting), then processes and responds to the message. Themessages are processed as they travel through the phone’s subsystem Cue[2010], therefore if the SMS++ daemon is not running when a message isreceived, it will not be processed.

2.3 Email Gateway

A separate machine was used to host both an Email Server and the SMS++email daemon [D.2]. The SMS++ email daemon periodically checks it’sassigned mailbox and processes each unread email, marking it as read afterprocessing.

4

Page 5: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Figure 1: SMS++ system diagram. Legend: (u) User. (c) Cellphone. (t)Cellphone Tower. (e) Email Server. (s1) Application Server. (s2) Smart-phone. (r) Registration Server. (d) Centralized Database. (w) Web Services.

Type Command Usage Description

Navigation help help Replies with a list of commandsnext next Replies with the next page (in the current session)prev prev Replies with the previous pagepage page Replies with the nth page

Query url url example.com Replies with the specified webpagemail mail Uses stored credentials to access Gmailcal cal Uses stored credentials to access Google Calender

Table 1: The available SMS++ commands. The query commands performHTTP requests with certain parameters in order to fulfill the user’s query.Some queries require credentials to complete, namely ”cal” and ”mail”.

5

Page 6: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

3 User Authentication

We investigated three methods of accessing a user’s credentials for queriesto restricted web services:

• User sends username & password with SMS request

• User stores username & password in a centralized database

• User stores an authentication token in a centralized database

3.1 Centralized Database

An SQL database was set up on a centralized server where the registrationservers [A.1] [B.1] [C.1] could store a user’s data. The SMS++ daemons[D.1] [D.2] then accessed [D.3] this centralized database, using the reply-toaddress as an index into the SQL database for the credentials to access email[B.5] and calendar [C.2] services on behalf of the user.

4 Authentication with Username & Password

The authors were skeptical that a service could be accessed in an automatedway using a username & password (as opposed to a token), but it is possible.

Google’s email service, Gmail, does not yet fully support access viaOAuth. A user’s unread email can be accessed through a deprecated versionof OAuth (version 1), but until OAuth (version 2) is implemented, accessthrough the Atom RSS feed is recommended Google [2012a].

4.1 Google Data API

The Google Data API is based upon the Google Data protocol. The GoogleData protocol is extends the Atom 1.0 M˜Nottingham [2005] & RSS 2.0Board [2002] syndication formats, and the Atom Publishing Protocol (APP).J˜Gregorio [2007]

The Google Data protocol extends these standards in various ways, usingthe extension mechanisms built into the standards. Feeds conform to eitherthe Atom or RSS syndication formats. The publishing model conforms tothe Atom Publishing Protocol.

6

Page 7: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

4.2 Accessing Gmail Data

Gmail’s Atom RSS Feed https://mail.google.com/mail/feed/atom/ isaccessed using HTTP GET parameters.

When requesting a feed [B.8] the default data format is XML. One canspecify an alternative format using the HTTP GET parameter .alt to re-ceive data in the RSS .alt=rss or JSON .alt=json format.

In order to receive the data, a Base64 encoded ”Username” and ”Pass-word” header must be appended to the GET request.

5 Authentication with Tokens

Google uses a technology known as Open Authentication (OAuth) for sharinginformation between a user and an application. OAuth allows an applica-tion to retrieve and manipulate a user’s data without knowing the user’scredentials (username, password, etc) Google [2012b], Hammer [2010].

5.1 Open Authentication

OAuth uses tokens. A token is a string of characters that:

• Gives permission to an application to make API calls to retrieve andmanipulate data

• Determines what information can be accessed

In Figure 2 we can see the process of acquiring a token:

1. The user clicks a link or the application redirects the user to a loginpage on Google’s server.

2. The user puts in his/her credentials and clicks a button to agree to letthe application manipulate their data.

3. Google redirects the user back to the application with the grantedtoken.

4. The application then stores this token for further use.

5. Finally, the application can make various API calls using the token.

Google uses a data format called Javascript Object Notation (JSON) tostore the token and other related information:

7

Page 8: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Figure 2: Flow chart depicting retrieval of an OAuth token Google [2012b].

{

"access_token":"ya29.AHES6ZSg_VIVAOfJymD4SM-FKtX-Nepnuy6PGo0fd5W8fNo",

"token_type":"Bearer",

"expires_in":3600,

"refresh_token":"1/7MJ7VaylCRXUtrroOCPoZgkkgMOLf6Xk3-l6-Bf8OdE",

"created":1335813994

}

• access token: Is the token used to access the user’s data.

• token type: Google will always return the bearer type. In the OAuth2.0 protocol the bearer type is a token type that simply says ”thisapplication can access and manipulate any data it desires” MichaelB˜Jones [2011].

• expires in: The expiration time of the token, in milliseconds.

• refresh token: This token is used to get a new access token if needed.

• created: Unix timestamp (seconds since Jan 1, 1970) of the token’screation time.

8

Page 9: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

5.2 Accessing Google Calendar Data

In our project, we used Google’s OAuth to access a user’s Google Calendarinformation. We wrote a user creation webpage in PHP [C.1] that instructsthe user follow a link to a login page, on Google’s server, which returnthe user to our page with a token. We then store this access token in ourcentralized database.

Google’s OAuth implementation requires a named domain for the returnpage. One of our user creation pages [A.2] was written in C# in order totest the validity of our methods across platforms.

The C# implementation runs on a server separate from the server regis-tered with Google’s OAuth. In order to access and use the data being sentto the registered server (without writing temporary SQL rows), a Javascriptredirect script was written to access the token, after which it is written tothe centralized database.

To retrieve a user’s calendar events, both methods use the webpagegcalendar.php [C.2]. This webpage simply prints out all or a handful ofcalendar events in 3 formats. These formats are:

• User-readable HTML table

• JSON

• XML

In practice, our SMS++ daemons [D.1] [D.2] use the JSON format.The gcalendar.php webpage [C.2] prints and filters the data using

HTTP GET parameters. There exist 4 parameters:

1. number: The user requesting calendar information.

2. mode: Formatting of data. There are 3 choices: table, json, or xml.

3. today: Filters the calendar events to today only.

4. date: Filters the calendar events to a given date. The date format is:yyyy/mm/dd.

An example of getting all events on May 6, 2012 in the JSON format forthe phone number 218-849-6479:

http://134.129.125/232/gcalendar.php?mode=json&number=2188496479&date=2012/05/06

9

Page 10: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

6 Future Work

The centralized database was designed to use the user’s phone number asthe query column, but it was found that this is not a reliable method:

• Some phone carriers anonymize a user’s reply-to (number/email ad-dress)

• Users may be using applications that provide sms through a non-carrier service

In our limited testing, the three common types were:

• Subscriber’s 10-digit phone number

• Username with the phone carrier

• Username with the non-carrier service

Additionally, the routines that reduce the message to 160-character chunkscuts off in the middle of words, sentences, etc. More work can be done todigest the information presented to the user.

Security was not a concern during development of this project. As such,the code and methods used are extremely insecure. A common messagingdata format (such as JSON) should be implemented with some securitymodel for the intra-service calls.

References

RSS˜Advisory Board. Rss 2.0 specification, 2002.URL: http://www.rssboard.org/rss-specification.

Cue. Sms from cli (command line)?, 2010.URL: http://talk.maemo.org/showpost.php?p=558430&postcount=57.

Google. Google data api faq, 2012a.URL: https://developers.google.com/gdata/faq.

Google. Using oauth 2.0 to access google apis, 2012b.URL: https://developers.google.com/accounts/docs/OAuth2.

Eran Hammer. Introducion oauth2.0, 2010.URL: http://hueniverse.com/2010/05/introducing-oauth-2-0/.

10

Page 11: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

B˜de˜Hora J˜Gregorio. The atom publishing protocol. Internet EngineeringTask Force, 2007.URL: http://www.ietf.org/rfc/rfc5023.txt.

Twibright Labs. Links: Web browser, 2012.URL: http://links.twibright.com/.

R˜Sayre M˜Nottingham. The atom syndication format. InternetEngineering Task Force, 2005.URL: http://www.ietf.org/rfc/rfc4287.

David˜Recordon Michael B˜Jones, Dick˜Hardt. The oauth 2.0 protocol:Bearer tokens. Internet Engineering Task Force, 2011.URL: http://tools.ietf.org/pdf/draft-ietf-oauth-v2-bearer-04.pdf.

Nokia. Repository, 2012.URL: http://wiki.maemo.org/Repository.

11

Page 12: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

A C# Listings

A.1 Default.aspx

1 <%@ Page Language=”C#” AutoEventWireup=” true ” CodeFile=”Defau l t .aspx . cs ” I n h e r i t s=” De fau l t ” %>

< !DOCTYPE html PUBLIC ”−//W3C//DTD XHTML 1.0 Tran s i t i ona l //EN” ”http ://www.w3 . org /TR/xhtml1/DTD/xhtml1−t r a n s i t i o n a l . dtd”>

3 <html xmlns=”http ://www.w3 . org /1999/ xhtml”><head runat=” s e r v e r ”>

5 < t i t l e></ t i t l e><s t y l e type=” text / c s s ”>

7 . s t y l e 1{

9 width : 900px ;}

11 . s t y l e 2{

13 font−s i z e : xx−l a r g e ;font−weight : normal ;

15 c o l o r : #FFFFFF;border−l e f t −c o l o r : #A0A0A0 ;

17 border−r i ght−c o l o r : #C0C0C0 ;border−top−c o l o r : #A0A0A0 ;

19 border−bottom−c o l o r : #C0C0C0 ;}

21 . s t y l e 3{

23 width : 400px ;}

25 . s t y l e 4{

27 he ight : 19px ;}

29 . s t y l e 5{

31 c o l o r : #FFFFFF;}

33 . s t y l e 6{

35 he ight : 19px ;c o l o r : #FFFFFF;

37 }. s t y l e 7

39 {c o l o r : #FFFFFF;

41 he ight : 22px ;}

12

Page 13: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

43 </ s t y l e></head>

45 <body background=” background sty l e1 [ 1 ] . jpg ”><form id=”form1” runat=” s e r v e r ”>

47 <div><t ab l e c e l l padd ing=”0” c e l l s p a c i n g=”0” c l a s s=” s t y l e 1 ”>

49 <t r><td c l a s s=” s t y l e 2 ”><kbd>SMS++</kbd></ td>

51 </ t r><t r>

53 <td><t ab l e a l i g n=” cente r ” border=”1” ce l l padd ing=”0”

c e l l s p a c i n g=”0” c l a s s=” s t y l e 3 ”>55 <t r>

<td c l a s s=” s t y l e 5 ”>57 <asp : Label ID=”Label2 ” runat=” s e r v e r ” Text=”

Username”></asp : Label></ td>

59 <td c l a s s=” s t y l e 5 ” width=”200”><asp : TextBox ID=”TextBox1” runat=” s e r v e r ” Width=

”201px”></asp : TextBox>61 </ td>

</ t r>63 <t r>

<td c l a s s=” s t y l e 5 ”></ td>65 <td c l a s s=” s t y l e 5 ”>

<asp : Requ i redFie ldVa l idator ID=”Requ i redFie ldVa l idator1 ” runat=” s e r v e r ”

67 ControlToVal idate=”TextBox1” ErrorMessage=”Please Enter You Username”></asp :Requ i redFie ldVa l idator>

</ td>69 </ t r>

<t r>71 <td c l a s s=” s t y l e 7 ”>

<asp : Label ID=”Label3 ” runat=” s e r v e r ” Text=”Password”></asp : Label>

73 </ td><td c l a s s=” s t y l e 7 ”>

75 <asp : TextBox ID=”TextBox2” runat=” s e r v e r ” Width=”201px” TextMode=”Password”></asp : TextBox>

</ td>77 </ t r>

<t r>79 <td c l a s s=” s t y l e 5 ”></ td>

<td c l a s s=” s t y l e 5 ”>81 <asp : Requ i redFie ldVa l idator ID=”

Requ i redFie ldVa l idator2 ” runat=” s e r v e r ”

13

Page 14: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

ControlToVal idate=”TextBox2” ErrorMessage=”Please Enter Your Password”></asp :Requ i redFie ldVa l idator>

83 </ td></ t r>

85 <t r><td c l a s s=” s t y l e 6 ”>

87 <asp : Label ID=”Label4 ” runat=” s e r v e r ” Text=”Mobile Number”></asp : Label>

</ td>89 <td c l a s s=” s t y l e 4 ”>

<asp : TextBox ID=”TextBox3” runat=” s e r v e r ” Width=”201px”></asp : TextBox>

91 </ td></ t r>

93 <t r><td c l a s s=” s t y l e 5 ”></ td>

95 <td c l a s s=” s t y l e 5 ”><asp : Requ i redFie ldVa l idator ID=”

Requ i redFie ldVa l idator3 ” runat=” s e r v e r ”97 ControlToVal idate=”TextBox3” ErrorMessage=”

Please Enter Your Number”></asp :Requ i redFie ldVa l idator>

</ td>99 </ t r>

</ tab l e>101 </ td>

</ t r>103 <t r>

<td>105 <span c l a s s=” s t y l e 5 ”>

<asp : Label ID=”Label1 ” runat=” s e r v e r ” Text=”Label ”V i s i b l e=”Fal se ”></asp : Label>

107 </span><asp : Button ID=”Button1” runat=” s e r v e r ” CssClass=”

s t y l e 5 ” ForeColor=”Black”109 on c l i c k=”Button1 Cl ick ” Text=”Submit” Width=”88px” /

><br />

111 </ td></ t r>

113 </ tab l e></ div>

115 </ form></body>

117 </html>

14

Page 15: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

A.2 Default.aspx.cs

1 us ing System ;

3 us ing System . IO ;us ing System . Net ;

5 us ing System . Text ;us ing System . Co l l e c t i o n s . Generic ;

7 us ing System . Linq ;us ing System .Web;

9 us ing System .Web. UI ;us ing System .Web. UI . WebControls ;

11 us ing System . Text ;us ing MySql . Data . MySqlClient ;

13

pub l i c p a r t i a l c l a s s De fau l t : System .Web. UI . Page15 {

protec ted void Page Load ( ob j e c t sender , EventArgs e )17 {

St r ing message ;19 i f ( ( Request . Cookies [ ”phonenumber” ] != nu l l ) )

{21 i f ( Request . Cookies [ ” gapitoken ” ] == nu l l )

{23 // Convert the f o l l ow i ng C# to j a v a s c r i p t :

/∗25 WebClient c l i = new WebClient ( ) ;

Uri newurl = new Uri ( ’ http : //134 . 129 . 125 . 232/ readcook i e .php ’ ) ;

27 message = c l i . DownloadString ( newurl ) ;message = message . Trim ( ) ;

29 //Response . Write ( message ) ;i f ( ! message . StartsWith ( ’ Not ice ’ ) )

31 {HttpCookie abCookie = new HttpCookie ( ’ Token ’ ) ;

33 abCookie . Value = message ;abCookie . Expires = DateTime .Now. AddHours (1 ) ;

35 Response . Cookies .Add( abCookie ) ;}

37 e l s e{

39 Response . Red i rec t ( ’ http : //134 . 129 . 125 . 232/ ca l endar .php ’ ) ;

}41 ∗/

Response . Write (@”43 <s c r i p t s r c=’ https : // ajax . goog l e ap i s . com/ ajax / l i b s /

jquery /1 . 4 . 2 / jquery . min . j s ’></ s c r i p t><s c r i p t type=’ t ext / j a v a s c r i p t ’>

15

Page 16: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

45 f unc t i on s e t c o o k i e ( c name , value , exdays ){

47 var exdate=new Date ( ) ;exdate . setDate ( exdate . getDate ( ) + exdays ) ;

49 var c va lue=escape ( va lue ) + ( ( exdays==nu l l ) ? ’ ’ :’ ; e xp i r e s=’+exdate . toUTCString ( ) ) ;

document . cook i e=c name + ’= ’ + c va lue ;51 }

f unc t i on g e t c o ok i e ( c name )53 {

var i , x , y , ARRcookies=document . cook i e . s p l i t ( ’ ; ’ ) ;55 f o r ( i =0; i<ARRcookies . l ength ; i++)

{57 x=ARRcookies [ i ] . subs t r (0 , ARRcookies [ i ] . indexOf

( ’= ’) ) ;y=ARRcookies [ i ] . subs t r (ARRcookies [ i ] . indexOf ( ’= ’)

+1) ;59 x=x . r ep l a c e (/ˆ\ s+|\ s+$/g , ’ ’ ) ;

i f ( x==c name )61 {

re turn unescape (y ) ;63 }

}65 }

67 var message = ’ h e l l o ’ ;var my url = ’ http :// l o c a l h o s t :36499/WebSite1/Defau l t .

aspx ’ ;69 var t h e i r u r l = ’ http : //134 . 129 . 125 . 232/ readcook i e . php

’ ;var t h e i r r e d i r e c t u r l = ’ http : //134 . 129 . 125 . 232/

ca l ender3 . php ’ ;71 var cookie name = ’ gapitoken ’ ;

jQuery . getJSON(73 t h e i r u r l +’? cook i e=’+cookie name+’& r e d i r e c t=’+

escape ( my url )+’&ca l l b a ck =? ’ ,f unc t i on ( data )

75 {i f ( data && data [ cookie name ] )

77 {message = data [ cookie name ] ;

79 message = message . r ep l a c e (/ˆ\ s \ s ∗/ , ’ ’ ) . r ep l a c e(/\ s \ s ∗$ / , ’ ’ ) ; // message . tr im ( )

// a l e r t ( message ) ;81 e r r o r S t r i n g = ’ Not ice ’ ;

i f ( ! ( message . sub s t r i ng (0 , e r r o r S t r i n g . l ength )=== e r r o r S t r i n g ) ) //message . s tartsWith (e r r o r S t r i n g )

83 {

16

Page 17: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

s e t c o o k i e ( cookie name , message , 1) ;85 window . l o c a t i o n . r e l oad ( ) ;

}87 e l s e

{89 // a l e r t ( ’ r e d i r e c t ’ ) ;

window . l o c a t i o n = t h e i r r e d i r e c t u r l ;91 }

}93 e l s e

{95 window . l o c a t i o n = t h e i r r e d i r e c t u r l ;

}97 }

) ;99

</s c r i p t>101 ” ) ;

}103

i f ( Request . Cookies [ ” gapitoken ” ] != nu l l )105 {

St r ing conntext = ”Data Source =134 .129 .125 .232 ; Database=User data ; User ID=root ; Password=bender3krama” ;

107 MySqlConnection conn1 = new MySqlConnection ( conntext ) ;conn1 .Open ( ) ;

109 St r ing cmdtxt = ”UPDATE User data SET gapitoken=’” +Request . Cookies [ ” gapitoken ” ] . Value + ” ’ WHERE mnumber=’” +Request . Cookies [ ”phonenumber” ] . Value+” ’ ” ;

MySqlCommand Cmd1 = new MySqlCommand( cmdtxt , conn1 ) ;111 Cmd1. ExecuteNonQuery ( ) ;

conn1 . Close ( ) ;113 }

}115

i f ( Request . QueryString [ ”mn” ] != nu l l )117 {

119 Button1 . V i s i b l e = f a l s e ;Button1 . Enabled = f a l s e ;

121 TextBox2 . TextMode = TextBoxMode . S ing l eL ine ;TextBox1 . Enabled = f a l s e ;

123 TextBox2 . Enabled = f a l s e ;TextBox3 . Enabled = f a l s e ;

125 St r ing conntext = ”Data Source =134 .129 .125 .232 ; Database=User data ; User ID=root ; Password=bender3krama” ;

MySqlConnection conn = new MySqlConnection ( conntext ) ;127 conn .Open ( ) ;

17

Page 18: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

St r ing cmdtxt = ( ” S e l e c t ∗ from User data where mnumber=”+ Request . QueryString [ ”mn” ] ) ;

129 MySqlCommand Cmd = new MySqlCommand( cmdtxt , conn ) ;MySqlDataReader dr ;

131 dr = Cmd. ExecuteReader ( ) ;whi l e ( dr . Read ( ) )

133 {TextBox1 . Text = dr [ 0 ] . ToString ( ) ;

135 TextBox2 . Text = dr [ 1 ] . ToString ( ) ;TextBox3 . Text = dr [ 2 ] . ToString ( ) ;

137 }conn . Close ( ) ;

139 }}

141

protec ted void Button1 Cl ick ( ob j e c t sender , EventArgs e )143 {

St r ing u name , u password = ” ” ;145 double m number ;

u name = TextBox1 . Text ;147 u password = TextBox2 . Text ;

m number = double . Parse (TextBox3 . Text ) ;149 St r ing conntext = ”Data Source =134 .129 .125 .232 ; Database=

User data ; User ID=root ; Password=bender3krama” ;MySqlConnection conn = new MySqlConnection ( conntext ) ;

151 conn .Open ( ) ;S t r ing cmdtxt = ” INSERT INTO User data ( username , password ,

mnumber) VALUES ( ’ ” + u name + ” ’ , ’ ” + u password + ” ’ , ’ ”+ m number + ” ’ ) ” ;

153 MySqlCommand Cmd = new MySqlCommand( cmdtxt , conn ) ;Cmd. ExecuteNonQuery ( ) ;

155 Label1 . V i s i b l e = true ;Label1 . Text = ”Record In s e r t ed ” ;

157

HttpCookie aCookie = new HttpCookie ( ”phonenumber” ) ;159 aCookie . Value = Convert . ToString (m number ) ;

aCookie . Expires = DateTime .Now. AddHours (1 ) ;161 Response . Cookies .Add( aCookie ) ;

163 conn . Close ( ) ;Response . Write ( ”<s c r i p t type=’ t ext / j a v a s c r i p t ’>window .

l o c a t i o n . r e l oad ( ) ;</ s c r i p t>” ) ;165 }}

18

Page 19: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

B Java Listings

B.1 index.jsp

<%@ page contentType=” text /html ; cha r s e t=UTF−8”%>2 <%@ ta g l i b p r e f i x=” s ” u r i=”/ s t ru t s−tags ”%>< !DOCTYPE html PUBLIC ”−//W3C//DTD HTML 4.01 Tran s i t i ona l //EN” ”

http ://www.w3 . org /TR/html4/ l o o s e . dtd”>4 <html><head>

6 < l i n k r e l=” shor t cut i con ” h r e f=” image/ f av i con . i c o ” type=”image/i c o ” />

8 <meta http−equiv=”Content−Type” content=” text /html ; cha r s e t=ISO−8859−1”>

< l i n k h r e f=” c s s / S ty l e sh e e t . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>

10 < l i n k h r e f=” c s s /menu . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>< l i n k r e l=” s t y l e s h e e t ” h r e f=” c s s /main . c s s ” type=” text / c s s ” />

12 < t i t l e>Reg i s t e r Page</ t i t l e></head>

14 <body><div id=”formwrap”>

16 <ul id=”rounded−nav−bar”>< l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=”Home . j sp ”>Home<

/a></ l i>18 < l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=” index . j sp ”>

Reg i s t e r</a></ l i>< l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=”Login . j sp ”>

Login</a></ l i>20 </ u l>

<cente r>22 <img a l t=” logo ” s r c=”img/ smsplus . png”>

</ cente r>24

<div id=”form”>26 <img c l a s s=”myimage” a l t=” logo ” s r c=” image/ r e g i s t e r−banner . png

”><cente r>

28 <s : i f t e s t=” hasAct ionErrors ( ) ”><div c l a s s=” e r r o r s ”>

30 <s : a c t i o n e r r o r /></ div>

32 </ s : i f></ cente r>

34 <s : form act i on=”home . ac t i on ” method=”POST”><s : t e x t f i e l d name=”name” key=” l a b e l . name” s i z e=”60” />

36 <s : t e x t f i e l d name=” lastname” key=” l a b e l . l a s t ” s i z e=”60” />

19

Page 20: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

<s : t e x t f i e l d name=”phonenumber” key=” l a b e l . phone” s i z e=”60”/>

38 <s : t e x t f i e l d name=” phoneca r r i e r ” key=” l a b e l . c a r r i e r ” s i z e=”60” />

<s : t e x t f i e l d name=” emai laddres s ” key=” l a b e l . emai l ” s i z e=”60”/>

40 <s : password name=”password” key=” l a b e l . password” s i z e=”60”/>

<s : submit method=”submit” key=” l a b e l . l o g i n ” a l i g n=” cente r ” />

42 </ s : form></ div>

44 </ div><div id=” f o o t e r ”>

46 <p>Copyright ( c ) 2012 ndsu . edu . Al l r i g h t s r e s e rved . Designby <a h r e f=”http ://www. ndsu . edu/”><f on t c o l o r=”#FFA500”>

<b>SMS++ pro j e c t team (CS 778)</b></ font></a></p>48 </ div>

</body>50

</html>

B.2 Login.jsp

1 <%@ page contentType=” text /html ; cha r s e t=UTF−8”%><%@ ta g l i b p r e f i x=” s ” u r i=”/ s t ru t s−tags ”%>

3

< !DOCTYPE html PUBLIC ”−//W3C//DTD HTML 4.01 Tran s i t i ona l //EN” ”http ://www.w3 . org /TR/html4/ l o o s e . dtd”>

5 <html><head>

7 < l i n k r e l=” shor t cut i con ” h r e f=” image/ f av i con . i c o ” type=”image/i c o ” />

9 <meta http−equiv=”Content−Type” content=” text /html ; cha r s e t=ISO−8859−1”>

< l i n k h r e f=” c s s / S ty l e sh e e t . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>

11 < l i n k h r e f=” c s s /menu . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>< l i n k r e l=” s t y l e s h e e t ” h r e f=” c s s /main . c s s ” type=” text / c s s ” />

13 < t i t l e>Login Page</ t i t l e></head>

15 <body><div id=”formwrap”>

17 <ul id=”rounded−nav−bar”>

20

Page 21: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

< l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=”Home . j sp ”>Home</a></ l i>

19 < l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=” index . j sp ”>Reg i s t e r</a></ l i>

< l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=”Login . j sp ”>Login</a></ l i>

21 </ u l><cente r>

23 <img a l t=” logo ” s r c=”img/ smsplus . png”></ cente r>

25

<div id=”form”>27 <cente r>

<s : i f t e s t=” hasAct ionErrors ( ) ”>29 <div c l a s s=” e r r o r s ”>

<s : a c t i o n e r r o r />31 </ div>

</ s : i f>33 </ cente r>

<img c l a s s=”myimage” a l t=” logo ” s r c=” image/GMail−Logo . png”>35

<s : form act i on=” l o g i n . a c t i on ” method=”POST”>37 <s : t e x t f i e l d name=” emai l ” key=” l a b e l . emai l ” s i z e=”50” />

<s : password name=”passy ” key=” l a b e l . password” s i z e=”50” />39 <s : submit method=”submit” key=” l a b e l . s i g n i n ” a l i g n=” cente r ”

/></ s : form>

41

<br>43 <br>

<h1>Please l og in us ing your r e g i s t e r e d Gmail account .</h1>45 <h3>Problem s i gn i ng in ? Inform us at <a h r e f=”mai l to :

help@smsplus . com”>help@smsplus . com</a></h3><br>

47 <br></ div>

49 </ div><div id=” f o o t e r ”>

51 <p>Copyright ( c ) 2012 ndsu . edu . Al l r i g h t s r e s e rved . Designby <a h r e f=”http ://www. ndsu . edu/”><f on t c o l o r=”#FFA500”>

<b>SMS++ pro j e c t team (CS 778)</b></ font></a></p>53 </ div>

</body>55

</html>

21

Page 22: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

B.3 Home.jsp

<%@ page language=” java ” contentType=” text /html ; cha r s e t=ISO−8859−1” pageEncoding=”ISO−8859−1”%>

2

< !DOCTYPE html PUBLIC ”−//W3C//DTD HTML 4.01 Tran s i t i ona l //EN” ”http ://www.w3 . org /TR/html4/ l o o s e . dtd”>

4 <html><head>

6 < l i n k r e l=” shor t cut i con ” h r e f=” image/ f av i con . i c o ” type=”image/i c o ” />

8 < l i n k r e l=” s t y l e s h e e t ” h r e f=” c s s /main . c s s ” type=” text / c s s ” />< l i n k r e l=” s t y l e s h e e t ” h r e f=” c s s /sms . c s s ” type=” text / c s s ” />

10

<meta http−equiv=”Content−Type” content=” text /html ; cha r s e t=ISO−8859−1”>

12 < l i n k h r e f=” c s s / S ty l e sh e e t . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>

< l i n k h r e f=” c s s /menu . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>14 <s t y l e type=” text / c s s ”>

l i { font−f ami ly : Georgia ; c o l o r :#666;}16 </ s t y l e>

< t i t l e>Home Page</ t i t l e>18 </head>

<body>20

<div id=”formwrap”>22 <ul id=”rounded−nav−bar”>

< l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=”Home . j sp ”>Home</a></ l i>

24 < l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=” index . j sp ”>Reg i s t e r</a></ l i>

< l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=”Login . j sp ”>Login</a></ l i>

26 </ u l><cente r>

28 <img a l t=” logo ” s r c=”img/ smsplus . png”></ cente r>

30

<div id=”form”>32 <br>

<h1>SMS ++ Pro j e c t Overview</h1>34 <div>

<img c l a s s=”myimage” s r c=” image/sms . jpg ” a l t=”Img” />36 <p c l a s s=” i n t r o ”>

SMS++ i s a part o f Networking c l a s s p r o j e c t (CS 778) .38 SMS++ aim i s to prov ide s e r v i c e s to low end mobile user , f o r

a c c e s s i n g In t e rn e t us ing t h e i r c e l l phone .

22

Page 23: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Using Short Message Se rv i c e (SMS) to c r e a t e low−end c e l l phoneapp l i c a t i o n s : such as SMSbased emai l s e r v i c e , SMS−based

ca l endar s e r v i c e .40 Our aim i s to he lp those u s e r s with low−end c e l l phone s which

cannot a c c e s s web s e r v i c e s . The s e r v i c e can even be u s e f u lto SmartPhone user when t h e i r I n t e rn e t s e r v i c e i s temporaryd i s rupted .<br>

<br>42 Most messages are even tua l l y routed in to the mobile phone

networks . Many SMS gateways support media conver s i on fromemai l and other formats .

Some SMS gateway prov ide r s can be c l a s s i f i e d as aggrega to r s orSS7 prov ide r s . The aggregator model

44 i s based on mul t ip l e agreements with mobile c a r r i e r s toexchange two−way SMS t r a f f i c i n to and out o f

the operator ’ s shor t message s e r v i c e c ent e r (SMSC) , a l s o knownas l o c a l te rminat ion model . Aggregators

46 l a ck d i r e c t a c c e s s i n to the SS7 protoco l , which i s thep ro to co l where the SMS messages are exchanged .

These p rov ide r s have no v i s i b i l i t y and con t r o l over themessage de l i v e ry , be ing unable to o f f e r d e l i v e r y

48 guarantees . SMS messages are d e l i v e r e d in the operator ’ s SMSC,but not the subsc r ibe r ’ s handset .

</p>50 </ div>

52

<div c l a s s=” l i n e ”></ div>54 <h2>Our Approach</h2>

<div c l a s s=” r ”>56 <h3><f on t c o l o r=”#3366FF”>Website with database</ font></h3>

<ul >58 < l i >Phone number o f the u s e r s</ l i>

< l i>Gmail address , Gmail password and Gamil Tokens</ l i>60 < l i>Website t a l k s to u s e r s Google Account</ l i>

< l i>Website responds SMS o f the u s e r s</ l i>62 </ u l>

</ div>64

<div c l a s s=” l ”>66 <h3><f on t c o l o r=”#3366FF”>Methodologies</ font></h3>

<ul c l a s s=” s p e c i a l s ”>68 < l i>Agi l e so f tware development was f o l l owed f o r the p r o j e c t</ l i>

< l i>I t helped our team respond to the unp r e d i c t a b i l i t y o fbu i l d i ng so f tware through incremental , i t e r a t i v e workcadences , known as s p r i n t s .</ l i>

70 </ u l></ div>

72 <br>

23

Page 24: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

<br>74 <br>

<br>76 <br>

<br>78 <h3>Why we need a webs i te ?</h3>

<ul >80 < l i>The main reason i s s e c u r i t y o f our u s e r s . We do not want our

u s e r s to send there c o n f i d e n t i a l in fo rmat ion throughunsecure l i n k s . There fore i t w i l l be more s e cure f o r ouru s e r s to g ive t h e i r c o n f i d e n t i a l in fo rmat ion through our SMS++ webs i te .

</ l i></ u l>82

</ div>84 </ div>

<div id=” f o o t e r ”>86 <p>Copyright ( c ) 2012 ndsu . edu . Al l r i g h t s r e s e rved . Design

by <a h r e f=”http ://www. ndsu . edu/”><f on t c o l o r=”#FFA500”><b>SMS++ pro j e c t team (CS 778)</b></ font></a></p>

88 </ div></body>

90 </body></html>

B.4 Profile.jsp

1 <%@ page language=” java ” contentType=” text /html ; cha r s e t=ISO−8859−1”

pageEncoding=”ISO−8859−1”%>3 < !DOCTYPE html PUBLIC ”−//W3C//DTD HTML 4.01 Tran s i t i ona l //EN” ”

http ://www.w3 . org /TR/html4/ l o o s e . dtd”><html>

5 <head>< l i n k r e l=” shor t cut i con ” h r e f=” image/ f av i con . i c o ” type=”image/

i c o ” />7

<meta http−equiv=”Content−Type” content=” text /html ; cha r s e t=ISO−8859−1”>

9 < l i n k h r e f=” c s s / S ty l e sh e e t . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>

< l i n k h r e f=” c s s /menu . c s s ” r e l=” s t y l e s h e e t ” type=” text / c s s ”>11 < l i n k r e l=” s t y l e s h e e t ” h r e f=” c s s /main . c s s ” type=” text / c s s ” />

< t i t l e>Welcome</ t i t l e>13 <s t y l e type=” text / c s s ”>

24

Page 25: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

. c ss−grd {15 /∗ de f au l t background co lour , f o r a l l l ayout eng ine s that don ’ t

implement g rad i en t s ∗/background : #2a6da9 ;

17

/∗ gecko based browsers ∗/19 background : −moz−l i n e a r−grad i ent ( top , #55aaee , #003366) ;

21 /∗ webkit based browsers ∗/background : −webkit−grad i ent ( l i n e a r , l e f t top , l e f t bottom , from

(#55aaee ) , to (#003366) ) ;23

c o l o r : #000000; /∗ t ex t co l ou r ( b lack ) ∗/25 he ight : auto ; /∗ grad i ent uses the f u l l he ight o f the element ∗/

padding : 5px ; /∗ d i s t ance from border edge to text ∗/27 }

#customers {29 font−f ami ly : ”Trebuchet MS” , Ar ia l , He lvet i ca , sans−s e r i f ;

width : 100%;31 border−c o l l a p s e : c o l l a p s e ;}

33

#customers td ,#customers th {35 font−s i z e : 1em;

border : 1px s o l i d #98bf21 ;37 padding : 3px 7px 2px 7px ;}

39

#customers th {41 font−s i z e : 1 . 1em;

text−a l i g n : l e f t ;43 padding−top : 5px ;

padding−bottom : 4px ;45 background−c o l o r : #A7C942 ;

c o l o r : # f f f f f f ;47 }

49 #customers t r . a l t td {c o l o r : #000000;

51 background−c o l o r : #EAF2D3;}

53 </ s t y l e></head>

55 <body><div id=”formwrap”>

57 <ul id=”rounded−nav−bar”>< l i c l a s s=” i s t y l e i 2 ”><a c l a s s=” i s t y l e i 1 ” h r e f=”Home . j sp ”>

Home</a>59 </ l i>

25

Page 26: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

61 </ u l><cente r>

63 <img a l t=” logo ” s r c=”img/ smsplus . png”></ cente r>

65

<div id=”form”>67 <br>

<%69 out . p r i n t l n ( ”<h1>Welcome , ” + s e s s i o n . ge tAt t r ibute ( ”name

” )+ ”</h1>” ) ;

71 %><t ab l e id=” customers ”>

73 <t r><th>Se rv i c e</ th>

75 <th>Command</ th></ t r>

77 <t r c l a s s=” a l t ”><td>Se rv i c e number</ td>

79 <td>701−541−1477</ td></ t r>

81

<t r>83 <td>Se rv i c e emai l</ td>

<td>sms@kari luo .ma</ td>85 </ t r>

87 <t r c l a s s=” a l t ”><td>Command To r e c e i v e Email</ td>

89 <td>Mail</ td></ t r>

91 <t r><td>Command to r e c e i v e Calendar</ td>

93 <td>c a l</ td></ t r>

95 <t r c l a s s=” a l t ”><td>Command f o r Help</ td>

97 <td>Help</ td></ t r>

99 <t r><td>Command To r e c e i v e next page</ td>

101 <td>Next</ td></ t r>

103 <t r c l a s s=” a l t ”><td>Command f o r Previous page</ td>

105 <td>prev</ td></ t r>

107 <t r>

26

Page 27: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

<td>Command to r e c e i v e s p e c i f i e d page</ td>109 <td>page</ td>

</ t r>111 <t r c l a s s=” a l t ”>

<td>Command to r e c e i v ed s p e c i f i e d webpage</ td>113 <td>u r l</ td>

</ t r>115

117 </ tab l e><div c l a s s=” css−grd”>

119 <p><f on t c o l o r=”#FFFFFF”>For more in format ion , p l e a s e contact usat 1−800−SMSPLUSP</ font></p>

</ div>121 </ div>

</ div>123 <div id=” f o o t e r ”>

<p>Copyright ( c ) 2012 ndsu . edu . Al l r i g h t s r e s e rved . Designby <a h r e f=”http ://www. ndsu . edu/”><f on t c o l o r=”#FFA500”>

125 <b>SMS++ pro j e c t team (CS 778)</b></ font></a></p></ div>

127 </body></html>

B.5 Query.jsp

<%@ page language=” java ” contentType=” text /html ; cha r s e t=ISO−8859−1” pageEncoding=”ISO−8859−1”%>

2 <%@ ta g l i b p r e f i x=” s ” u r i=”/ s t ru t s−tags ” %><%@ page import=” javax . s e r v l e t . http . HttpServletRequest , com .

s t r u t s . Beans . Datadomain” %>4 <%@ page import=”com . s t r u t s . a c t i on . QueryAction” %>

6

< !DOCTYPE html PUBLIC ”−//W3C//DTD HTML 4.01 Tran s i t i ona l //EN” ”http ://www.w3 . org /TR/html4/ l o o s e . dtd”>

8 <html><head>

10 < l i n k r e l=” shor t cut i con ” h r e f=” image/ f av i con . i c o ” type=”image/i c o ” />

12 <meta http−equiv=”Content−Type” content=” text /html ; cha r s e t=ISO−8859−1”>

< t i t l e>SMS++ Query</ t i t l e>14 </head>

27

Page 28: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

<body>16 <%

Str ing u r l = reques t . getQueryStr ing ( ) ;18 QueryAction qa = new QueryAction ( ) ;

qa . setQuery ( r eque s t . g e tAt t r ibute ( ” javax . s e r v l e t . forward .r e q u e s t u r i ” ) . t oS t r i ng ( ) ) ;

20 qa . execute ( ) ;out . p r i n t l n ( qa . ge tResu l t ( ) ) ;

22 %></body>

24 </html>

B.6 Cookie.jsp

<%@ page language=” java ” contentType=” text /html ; cha r s e t=ISO−8859−1” pageEncoding=”ISO−8859−1”%>

2 <%@ page import=” javax . s e r v l e t . http . HttpServletRequest , com .s t r u t s . Beans . Datadomain” %>

4 < !DOCTYPE html PUBLIC ”−//W3C//DTD HTML 4.01 Tran s i t i ona l //EN” ”http ://www.w3 . org /TR/html4/ l o o s e . dtd”>

<html>6 <head>< l i n k r e l=” shor t cut i con ” h r e f=” image/ f av i con . i c o ” type=”image/

i c o ” />8

<meta http−equiv=”Content−Type” content=” text /html ; cha r s e t=ISO−8859−1”>

10 < t i t l e>View Cookie</ t i t l e></head>

12 <body><% Cookie [ ] cook i e = reques t . getCookies ( ) ;

14

i f ( cook i e != nu l l ) {16

java . i o . Pr intWriter outt = response . getWriter ( ) ;18 f o r ( i n t i =0; i< cook i e . l ength ; i++) {

Cookie aCookie = cook i e [ i ] ;20 out . p r i n t l n

( ”Name : ” + aCookie . getName ( )22 + ” Value : ” + aCookie . getValue ( ) ) ;

}24 } %>

26

28

Page 29: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

</body>28 </html>

B.7 GoogleClientLogin.java

package com . s t r u t s . Google ;2 import java . i o . IOException ;

import java . i o . UnsupportedEncodingException ;4 import java . u t i l . ArrayList ;

import java . u t i l . L i s t ;6

import org . apache . http . HttpEntity ;8 import org . apache . http . HttpResponse ;

import org . apache . http . NameValuePair ;10 import org . apache . http . c l i e n t . C l i entProtoco lExcept ion ;

import org . apache . http . c l i e n t . HttpCl ient ;12 import org . apache . http . c l i e n t . e n t i t y . UrlEncodedFormEntity ;

import org . apache . http . c l i e n t . methods . HttpPost ;14 import org . apache . http . impl . c l i e n t . De fau l tHttpCl i ent ;

import org . apache . http . message . BasicNameValuePair ;16 import org . apache . http . p ro to co l .HTTP;

import org . apache . http . u t i l . En t i t yUt i l s ;18 pub l i c c l a s s GoogleCl ientLogin {

St r ing token ;20

pub l i c S t r ing getToken ( ) {22 re turn token ;

}24

pub l i c void setToken ( St r ing token ) {26 t h i s . token = token ;

}28

pub l i c S t r ing Login ( St r ing username , S t r ing password ) {30 St r ing r e s u l t = nu l l ;

HttpCl ient c l i e n t = new Defau l tHttpCl i ent ( ) ;32 St r ing postURL = ”https : //www. goog l e . com/ accounts /

Cl i entLog in ” ;HttpPost post = new HttpPost (postURL) ;

34 List<NameValuePair> nvps = new ArrayList<NameValuePair>() ;

nvps . add (new BasicNameValuePair ( ”accountType” , ”HOSTEDORGOOGLE” ) ) ;

36 nvps . add (new BasicNameValuePair ( ”Email” , username ) ) ;nvps . add (new BasicNameValuePair ( ”Passwd” , password ) ) ;

29

Page 30: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

38 nvps . add (new BasicNameValuePair ( ” s e r v i c e ” , ”mail ” ) ) ; //Name o f Google s e r v i c e

nvps . add (new BasicNameValuePair ( ” source ” , ”SMS++” ) ) ;40 UrlEncodedFormEntity ent ;

t ry {42 ent = new UrlEncodedFormEntity ( nvps , HTTP.UTF 8

) ;post . s e tEnt i ty ( ent ) ;

44 HttpResponse responsePOST = c l i e n t . execute ( post) ;

HttpEntity r e sEnt i ty = responsePOST . getEnt i ty ( );

46 i f ( r e sEnt i ty != nu l l ) {St r ing authToken= Ent i t yUt i l s .

t oS t r i ng ( r e sEnt i ty ) ;48 setToken ( authToken . sub s t r i ng ( authToken .

indexOf ( ”Auth=” ) + 5 , authToken .l ength ( ) ) . tr im ( ) ) ;

System . out . p r i n t l n ( ”RESPONSE i s ”+authToken ) ;

50 i f ( authToken . sub s t r i ng ( authToken .indexOf ( ”Auth=” ) + 5 , authToken .l ength ( ) ) . tr im ( ) . equa l s ( ” r=BadAuthentication ” ) ) {

r e s u l t =” e r r o r ” ;52 } e l s e {

r e s u l t=” suc c e s s ” ;54 }

System . out . p r i n t l n ( ”Auth i s ”+authToken . sub s t r i ng ( authToken . indexOf( ”Auth=” ) + 5 , authToken . l ength ( ) ) .tr im ( ) ) ;

56 }} catch ( UnsupportedEncodingException e ) {

58 e . pr intStackTrace ( ) ;r e s u l t =” e r r o r ” ;

60 } catch ( Cl i entProtoco lExcept ion e ) {e . pr intStackTrace ( ) ;

62 r e s u l t =” e r r o r ” ;} catch ( IOException e ) {

64 e . pr intStackTrace ( ) ;r e s u l t =” e r r o r ” ;

66 }re turn r e s u l t ;

68 }}

30

Page 31: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

B.8 MailReader.java

1 package com . s t r u t s . Google ;

3 import com . sun . org . apache . x e r c e s . i n t e r n a l . impl . dv . u t i l . Base64 ;import java . i o . BufferedReader ;

5 import java . i o . InputStreamReader ;import java . net . HttpURLConnection ;

7 import java . net .URL;

9 pub l i c c l a s s MailReader {

11 // URL po in t ing to the f e edp r i va t e f i n a l S t r ing CONNECTIONURL = ”https : // mail . goog l e . com

/mail / f e ed /atom/” ;13 // Username and password Var iab l e s

p r i va t e S t r ing userName ;15 pr i va t e S t r ing password ;

17 /∗∗∗ Se t t e r s f o r Username and Password f i e l d s

19 ∗/pub l i c void setUserName ( St r ing userName ) {

21 t h i s . userName = userName ;}

23

pub l i c void setPassword ( St r ing password ) {25 t h i s . password = password ;

}27

/∗∗29 ∗ Getters f o r Username and Password f i e l d s

∗/31 pub l i c S t r ing getUserName ( ) {

re turn userName ;33 }

35 pub l i c S t r ing getPassword ( ) {re turn password ;

37 }

39 pub l i c S t r ing connect ( ) throws Exception {

41 // Make URL ObjectURL ur l = new URL(CONNECTIONURL) ;

43

// Open the connect ion , but t h i s doesn ’ t e s t a b l i s hconnect ion

31

Page 32: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

45 HttpURLConnection connect ion = (HttpURLConnection ) u r l .openConnection ( ) ;

47 // Put Base64 encoded Username : Password s t r i n g in to theheader

connect ion49 . setRequestProperty (

”Author i zat ion ” ,51 ”Bas ic ”

+ Base64 . encode ( ( userName + ” : ” + password )53 . getBytes ( ) ) ) ;

55 // Now e s t a b l i s h the connect ion .connect ion . connect ( ) ;

57 BufferedReader reader = new BufferedReader (newInputStreamReader (connect ion . getInputStream ( ) ) ) ;

59

St r ing l i n e ;61 St r ing contents = ”” ;

63 whi le ( ( l i n e = reader . readLine ( ) ) != nu l l ) {contents += l i n e ;

65 }System . out . p r i n t l n ( contents ) ;

67 re turn contents ;

69 }

71 }

B.9 LoginDatabase.java

1 package com . s t r u t s . database ;

3

import java . s q l . Connection ;5 import java . s q l . PreparedStatement ;

import java . s q l . Resu l tSet ;7 import java . s q l . SQLException ;

import java . s q l . Statement ;9

11 pub l i c c l a s s LoginDatabase {

32

Page 33: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

13 pub l i c S t r ing i n s e r t ( Connection connect ion , S t r ing f i r s tname ,S t r ing lastname , S t r ing phone , S t r ing c a r r i e r , S t r ing

email ,15 St r ing password ) throws ClassNotFoundException {

St r ing r e s u l t =”” ;17 boolean e x i s t=f a l s e ;

19 t ry {// c r e a t e a database connect ion

21

Statement statement = connect ion . createStatement ( ) ;23 statement . setQueryTimeout (30) ; // s e t timeout to 30 sec .

Resu l tSet r s = statement . executeQuery ( ” s e l e c t ∗ from i n f o ”) ;

25 whi le ( r s . next ( ) ) {// read the r e s u l t s e t

27 System . out . p r i n t l n ( ” emai l = ” + r s . g e tS t r i ng ( ”emai laddres s ” ) ) ;

i f ( r s . g e tS t r i ng ( ” emai laddres s ” ) . equa l s ( emai l ) ) {29 e x i s t=true ;

r e s u l t=” e r r o r 1 ” ;31 break ;

}33 //System . out . p r i n t l n (” lastname = ” + rs . g e tS t r i ng (”

lastname ”) ) ;}

35 i f ( e x i s t==f a l s e ) {PreparedStatement prep = connect ion

37 . prepareStatement ( ” i n s e r t i n to i n f o ( f i r s tname , lastname, phonenumber , phonecar r i e r , emai laddress , password )va lue s ( ? , ? , ? , ? , ? , ? ) ; ” ) ;

39 prep . s e t S t r i n g (1 , f i r s tname ) ;prep . s e t S t r i n g (2 , lastname ) ;

41 prep . s e t S t r i n g (3 , phone ) ;prep . s e t S t r i n g (4 , c a r r i e r ) ;

43 prep . s e t S t r i n g (5 , emai l ) ;prep . s e t S t r i n g (6 , password ) ;

45 prep . execute ( ) ;r e s u l t =” suc c e s s ” ;

47 }

49

} catch ( SQLException e ) {51 // i f the e r r o r message i s ”out o f memory” ,

// i t probably means no database f i l e i s found53 System . e r r . p r i n t l n ( e . getMessage ( ) ) ;

r e s u l t=” e r r o r ” ;55 } f i n a l l y {

33

Page 34: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

t ry {57 i f ( connect ion != nu l l ) {

connect ion . c l o s e ( ) ;59 }

} catch ( SQLException e ) {61 r e s u l t=” e r r o r ” ;

// connect ion c l o s e f a i l e d .63 System . e r r . p r i n t l n ( e ) ;

}65 }

67 re turn r e s u l t ;}

69

}

B.10 QueryDatabase.java

package com . s t r u t s . database ;2

import java . i o . BufferedReader ;4 import java . i o . ByteArrayInputStream ;

import java . i o . IOException ;6 import java . i o . InputStream ;

import java . i o . InputStreamReader ;8 import java . net . HttpURLConnection ;

import java . net .URL;10 import java . s q l . Connection ;

import java . s q l . Resu l tSet ;12 import java . s q l . SQLException ;

import java . s q l . Statement ;14 import java . u t i l . HashMap ;

import java . u t i l .Map;16 import java . u t i l . Set ;

import net . s f . j s on . xml . ∗ ;18 import net . s f . j s on .JSON;

20 import org . apache . commons . i o . IOUt i l s ;

22 import com . s t r u t s . Beans . Datadomain ;import com . s t r u t s . Google . MailReader ;

24

pub l i c c l a s s QueryDatabase {26 pr i va t e S t r ing phone ;

p r i va t e S t r ing s e r v i c e ;

34

Page 35: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

28

pub l i c S t r ing query ( Connection connect ion , S t r ing u r l ) throwsException {

30

St r ing r e s u l t = ”” ;32

i f ( getQueryMap ( u r l ) . equa l s ( ” e r r o r ” ) ) {34 r e s u l t = ”Bad Request ” ;

} e l s e {36 t ry {

38 Statement statement = connect ion . createStatement ( ) ;

40 Resu l tSet r s = statement . executeQuery ( ” s e l e c t ∗ fromi n f o ” ) ;

whi l e ( r s . next ( ) ) {42 // read the r e s u l t s e t

System . out44 . p r i n t l n ( ”phone = ” + rs . g e tS t r i ng ( ”phonenumber” ) )

;i f ( r s . g e tS t r i ng ( ”phonenumber” ) . equa l s ( getPhone ( ) ) ) {

46 St r ing emai l = r s . g e tS t r i ng ( ” emai laddres s ” ) ;S t r ing password = r s . g e tS t r i ng ( ”password” ) ;

48

r e s u l t = g e t S e r i c e ( g e tS e rv i c e ( ) , email , password ) ;50 }

i f ( r e s u l t == ”” ) {52 r e s u l t = ”Bad Request ” ;

}54

}56

} catch ( SQLException e ) {58 // i f the e r r o r message i s ”out o f memory” ,

// i t probably means no database f i l e i s found60 System . e r r . p r i n t l n ( e . getMessage ( ) ) ;

r e s u l t = e . getMessage ( ) ;62 } f i n a l l y {

t ry {64 i f ( connect ion != nu l l ) {

connect ion . c l o s e ( ) ;66 }

} catch ( SQLException e ) {68 r e s u l t = ”Bad Request ” ;

// connect ion c l o s e f a i l e d .70 System . e r r . p r i n t l n ( e ) ;

}72 }

}

35

Page 36: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

74

Datadomain . setMessage ( r e s u l t ) ;76 re turn r e s u l t ;

}78

pub l i c S t r ing getQueryMap ( St r ing query ) {80 i n t count = 0 ;

S t r ing r e s u l t = ”” ;82 t ry {

84 St r ing [ ] params = query . s p l i t ( ”&” ) ;Map<Str ing , Str ing> map = new HashMap<Str ing , Str ing >() ;

86

f o r ( S t r ing param : params ) {88 St r ing name = param . s p l i t ( ”=” ) [ 0 ] ;

S t r ing value = param . s p l i t ( ”=” ) [ 1 ] ;90 map . put (name , va lue ) ;

}92 Set<Str ing> keys = map . keySet ( ) ;

f o r ( S t r ing key : keys ) {94 i f ( count == 0) {

System . out . p r i n t l n ( ”Phone=” + map . get ( key ) ) ;96 setPhone (map . get ( key ) ) ;

} e l s e {98 System . out . p r i n t l n ( ” Se rv i c e=” + map . get ( key ) ) ;

s e t S e r v i c e (map . get ( key ) ) ;100 }

102 count++;}

104 r e s u l t = ” suc c e s s ” ;} catch ( Exception e ) {

106 r e s u l t = ”Bad Request ” ;}

108 re turn r e s u l t ;

110 }

112 pub l i c S t r ing getPhone ( ) {re turn phone ;

114 }

116 pub l i c void setPhone ( St r ing phone ) {t h i s . phone = phone ;

118 }

120 pub l i c S t r ing g e tS e r v i c e ( ) {re turn s e r v i c e ;

122 }

36

Page 37: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

124 pub l i c void s e t S e r v i c e ( S t r ing s e r v i c e ) {t h i s . s e r v i c e = s e r v i c e ;

126 }

128 pr i va t e S t r ing xmlToJson ( St r ing xmlstr ) throws IOException {InputStream i s = new ByteArrayInputStream ( xmlstr . getBytes ( ”

UTF−8” ) ) ;130 St r ing xml = IOUti l s . t oS t r i ng ( i s ) ;

132 XMLSerial izer xm l S e r i a l i z e r = new XMLSerial izer ( ) ;JSON json = xm lS e r i a l i z e r . read (xml ) ;

134 System . out . p r i n t l n ( j son . t oS t r i ng ( ) ) ;r e turn j son . t oS t r i ng ( ) ;

136 }pr i va t e S t r ing g e t S e r i c e ( S t r ing s e rv i c e , S t r ing email , S t r ing

password ) throws IOException , Exception {138 St r ing r e s u l t =”” ;

i f ( s e r v i c e . equa l s ( ”mail ” ) ) {140 MailReader mr = new MailReader ( ) ;

mr . setUserName ( emai l ) ;142 mr . setPassword ( password ) ;

r e s u l t = xmlToJson (mr . connect ( ) ) ;144 }

re turn r e s u l t ;146 }

148 pub l i c S t r ing getHTML( St r ing urlToRead ) {URL ur l ;

150 HttpURLConnection conn ;BufferedReader rd ;

152 St r ing l i n e ;S t r ing r e s u l t = ”” ;

154 t ry {u r l = new URL( urlToRead ) ;

156 conn = (HttpURLConnection ) u r l . openConnection ( ) ;conn . setRequestMethod ( ”GET” ) ;

158 rd = new BufferedReader (new InputStreamReader ( conn .getInputStream ( ) ) ) ;

whi l e ( ( l i n e = rd . readLine ( ) ) != nu l l ) {160 r e s u l t += l i n e ;

}162 rd . c l o s e ( ) ;

} catch ( Exception e ) {164 e . pr intStackTrace ( ) ;

}166 re turn r e s u l t ;

}168

37

Page 38: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

}

B.11 ConnectionData.java

1 package com . s t r u t s . database ;

3 import java . i o . F i l e ;import java . s q l . Connection ;

5 import java . s q l . DriverManager ;import java . s q l . SQLException ;

7

pub l i c c l a s s ConnectionData {9

pub l i c Connection connect ( ) throws ClassNotFoundException {11 Connection connect ion = nu l l ;

t ry13 {

Class . forName ( ”com . mysql . jdbc . Dr iver ” ) ;15 System . out . p r i n t l n ( ” d r i v e r loaded ” ) ;

connect ion = DriverManager . getConnect ion ( ” jdbc : mysql: / /134 . 129 . 125 . 232 : 3306/ sms? useUnicode=true&characterEncoding=UTF8” , ” root ” , ”bender3krama” ) ;

17 System . out . p r i n t l n ( ”Connected” ) ;}

19 catch ( SQLException sq l ex ){

21 System . e r r . p r i n t l n ( ”Exception [ DataConnector/newConnection] : ” + sq l ex . getMessage ( ) ) ;

}23 catch ( Exception ex )

{25 System . e r r . p r i n t l n ( ”Exception [ DataConnector/newConnection

] : ” + ex . getMessage ( ) ) ;}

27 re turn connect ion ;}

29

pub l i c S t r ing getPath ( ) {31 F i l e d i r e c t o r y = new F i l e ( ”sms . db” ) ;

boolean i sD i r e c t o r y = d i r e c t o r y . i sD i r e c t o r y ( ) ;33 i f ( i sD i r e c t o r y ) {

// I t r e tu rn s t rue i f d i r e c t o r y i s a d i r e c t o r y .35 System . out . p r i n t l n ( ” the name you have entered i s a

d i r e c t o r y : ”+ d i r e c t o r y ) ;

38

Page 39: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

37 // I t r e tu rn s the abso lutepath o f a d i r e c t o r y .System . out . p r i n t l n ( ” the path i s ” + d i r e c t o r y .

getAbsolutePath ( ) ) ;39 } e l s e {

// I t r e tu rn s f a l s e i f d i r e c t o r y i s a f i l e .41 System . out . p r i n t l n ( ” the name you have entered i s a f i l e :

”+ d i r e c t o r y ) ;

43 // I t r e tu rn s the abso lu t e path o f a f i l e .System . out . p r i n t l n ( ” the path i s ” + d i r e c t o r y .

getAbsolutePath ( ) ) ;45 }

re turn d i r e c t o r y . getAbsolutePath ( ) ;47 }

49 pub l i c s t a t i c Connection newConnection ( ){

51 Connection connect ion = nu l l ;t ry

53 {Class . forName ( ”com . mysql . jdbc . Dr iver ” ) ;

55 System . out . p r i n t l n ( ” d r i v e r loaded ” ) ;connect ion = DriverManager . getConnect ion ( ” jdbc : mysql : //

l o c a l h o s t :3306/ sms? useUnicode=true&characterEncoding=UTF8” , ” root ” , ”password” ) ;

57 System . out . p r i n t l n ( ”Connected” ) ;}

59 catch ( SQLException sq l ex ){

61 System . e r r . p r i n t l n ( ”Exception [ DataConnector/newConnection] : ” + sq l ex . getMessage ( ) ) ;

}63 catch ( Exception ex )

{65 System . e r r . p r i n t l n ( ”Exception [ DataConnector/newConnection

] : ” + ex . getMessage ( ) ) ;}

67 re turn connect ion ;}

69 }

B.12 ProfileData.java

1 package com . s t r u t s . database ;

39

Page 40: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

3 import java . s q l . Connection ;import java . s q l . Resu l tSet ;

5 import java . s q l . SQLException ;import java . s q l . Statement ;

7

pub l i c c l a s s Pro f i l eData {9 pr i va t e S t r ing name ;

11 pub l i c S t r ing g e tP r o f i l e ( Connection conn , S t r ing username ,S t r ing password ) {

St r ing r e s u l t=”” ;13 t ry {

15 Statement statement = conn . createStatement ( ) ;

17 Resu l tSet r s = statement . executeQuery ( ” s e l e c t ∗ from i n f o ”) ;

whi l e ( r s . next ( ) ) {19 System . out . p r i n t l n ( ” In s i d e ” + password ) ;

i f ( r s . g e tS t r i ng ( ” emai laddres s ” ) . equa l s ( username ) && rs .g e tS t r i ng ( ”password” ) . equa l s ( password ) ) {

21 System . out . p r i n t l n ( ” In s i d e ” ) ;setName ( r s . g e tS t r i ng ( ” lastname” ) ) ;

23 r e s u l t = ” suc c e s s ” ;break ;

25 } e l s e {r e s u l t = ” e r r o r ” ;

27 }

29 }

31 } catch ( SQLException e ) {// i f the e r r o r message i s ”out o f memory” ,

33 // i t probably means no database f i l e i s foundSystem . e r r . p r i n t l n ( e . getMessage ( ) ) ;

35 r e s u l t = ” e r r o r ” ;} f i n a l l y {

37 t ry {i f ( conn != nu l l ) {

39 conn . c l o s e ( ) ;}

41 } catch ( SQLException e ) {r e s u l t = ” e r r o r ” ;

43 // connect ion c l o s e f a i l e d .System . e r r . p r i n t l n ( e ) ;

45 }

47 }re turn r e s u l t ;

40

Page 41: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

49 }

51 pub l i c S t r ing getName ( ) {re turn name ;

53 }

55 pub l i c void setName ( St r ing name) {t h i s . name = name ;

57 }

59 }

B.13 LoginAction.java

1 package com . s t r u t s . a c t i on ;

3

import java . s q l . Connection ;5 import java . u t i l .Map;

import java . u t i l . P rope r t i e s ;7

import com . opensymphony . xwork2 . ActionContext ;9 import com . opensymphony . xwork2 . ActionSupport ;

11 import com . s t r u t s . Google . GoogleCl ientLogin ;import com . s t r u t s . Google . MailReader ;

13 import com . s t r u t s . database . ConnectionData ;import com . s t r u t s . database . JsonParseTest ;

15 import com . s t r u t s . database . LoginDatabase ;

17

19

pub l i c c l a s s LoginAction extends ActionSupport {21

pr i va t e s t a t i c f i n a l long se r ia lVers ionUID = 1L ;23 pr i va t e S t r ing name ;

p r i va t e S t r ing lastname ;25 pr i va t e S t r ing phonenumber ;

p r i va t e S t r ing emai laddres s ;27 pr i va t e S t r ing password ;

p r i va t e S t r ing phoneca r r i e r ;29

pub l i c S t r ing getPassword ( ) {31 re turn password ;

41

Page 42: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

}33

pub l i c void setPassword ( St r ing password ) {35 t h i s . password = password ;

}37

pub l i c S t r ing getName ( ) {39 re turn name ;

}41

pub l i c void setName ( St r ing name) {43 t h i s . name = name ;

}45

pub l i c S t r ing getLastname ( ) {47 re turn lastname ;

}49

pub l i c void setLastname ( St r ing lastname ) {51 t h i s . lastname = lastname ;

}53

pub l i c S t r ing getPhonenumber ( ) {55 re turn phonenumber ;

}57

pub l i c void setPhonenumber ( S t r ing phonenumber ) {59 t h i s . phonenumber = phonenumber ;

}61

pr i va t e S t r ing getEmai laddress ( ) {63 re turn emai laddres s ;

}65

pub l i c void setEmai laddres s ( S t r ing emai laddres s ) {67 t h i s . ema i laddres s = emai laddres s ;

}69

pub l i c S t r ing ge tPhoneca r r i e r ( ) {71 re turn phoneca r r i e r ;

}73

pub l i c void s e tPhoneca r r i e r ( S t r ing phoneca r r i e r ) {75 t h i s . phoneca r r i e r = phoneca r r i e r ;

}77

pub l i c S t r ing submit ( ) throws ClassNotFoundException {79 JsonParseTest j t e s t = new JsonParseTest ( ) ;

j t e s t . decodeJson ( ”” ) ;

42

Page 43: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

81 // j t e s t . encodeJson (” k a i l a s h j o s h i ” , ”He l lo He l lo ”) ;MailReader mr = new MailReader ( ) ;

83 mr . setPassword ( getPassword ( ) ) ;mr . setUserName ( getEmai laddress ( ) ) ;

85 t ry {mr . connect ( ) ;

87 } catch ( Exception e1 ) {e1 . pr intStackTrace ( ) ;

89 }Connection connect ion = nu l l ;

91 ConnectionData connectDatabase = new ConnectionData ( ) ;connect ion = connectDatabase . connect ( ) ;

93 LoginDatabase ldb = new LoginDatabase ( ) ;

95 St r ing r e s u l t = ”” ;t ry {

97 GoogleCl ientLogin gc = new GoogleCl ientLogin ( ) ;S t r ing l o g i n =gc . Login ( getEmai laddress ( ) , getPassword ( ) ) ;

99 System . out . p r i n t ( l o g i n ) ;i f ( l o g i n . equa l s ( ” su c c e s s ” ) ) {

101 l o g i n = ldb . i n s e r t ( connect ion , getName ( ) , getLastname ( ) ,getPhonenumber ( ) ,g e tPhonecar r i e r ( ) , getEmai laddress ( ) , getPassword ( ) )

;103 i f ( l o g i n . equa l s ( ” su c c e s s ” ) ) {

r e s u l t = ” suc c e s s ” ;105 Map s e s s i o n = ActionContext . getContext ( ) . g e tS e s s i on ( ) ;

s e s s i o n . put ( ”name” , getLastname ( ) ) ;107 } e l s e i f ( l o g i n . equa l s ( ” e r r o r 1 ” ) ) {

addActionError ( getText ( ” e r r o r 1 . l o g i n ” ) ) ;109 r e s u l t = ” e r r o r ” ;

} e l s e {111 addActionError ( getText ( ” e r r o r . l o g i n ” ) ) ;

r e s u l t = ” e r r o r ” ;113 }

115 } e l s e{

117 addActionError ( getText ( ” e r r o r . l o g i n ” ) ) ;r e s u l t = ” e r r o r ” ;

119 }

121

123 } catch ( Exception e ) {

125 addActionError ( getText ( ” e r r o r . l o g i n ” ) ) ;r e s u l t = ” e r r o r ” ;

127 }

43

Page 44: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

129 re turn r e s u l t ;

131 }s t a t i c Prope r t i e s p r op e r t i e s = new Prope r t i e s ( ) ;

133 s t a t i c {p r op e r t i e s . put ( ”mail . smtp . host ” , ”smtp . gmail . com” ) ;

135 p r op e r t i e s . put ( ”mail . smtp . socketFactory . port ” , ”465” ) ;p r op e r t i e s . put ( ”mail . smtp . socketFactory . c l a s s ” ,

137 ” javax . net . s s l . SSLSocketFactory” ) ;p r op e r t i e s . put ( ”mail . smtp . auth” , ” t rue ” ) ;

139 p r op e r t i e s . put ( ”mail . smtp . port ” , ”465” ) ;}

141

143 }

B.14 QueryAction.java

1 package com . s t r u t s . a c t i on ;

3

import java . s q l . Connection ;5

import com . opensymphony . xwork2 . ActionSupport ;7 import com . s t r u t s . database . ConnectionData ;

import com . s t r u t s . database . QueryDatabase ;9

pub l i c c l a s s QueryAction extends ActionSupport {11 pr i va t e s t a t i c f i n a l long se r ia lVers ionUID = 1L ;

p r i va t e S t r ing query ;13 pr i va t e S t r ing r e s u l t ;

15 pub l i c S t r ing execute ( ) {QueryDatabase qd = new QueryDatabase ( ) ;

17

Connection connect ion = nu l l ;19 ConnectionData connectDatabase = new ConnectionData ( ) ;

t ry {21 connect ion = connectDatabase . connect ( ) ;

s e tRe su l t ( qd . query ( connect ion , getQuery ( ) ) ) ;23 } catch ( ClassNotFoundException e ) {

s e tRe su l t ( ”Bad Request ” ) ;25 e . pr intStackTrace ( ) ;

} catch ( Exception e ) {

44

Page 45: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

27 s e tRe su l t ( ”Bad Request ” ) ;e . pr intStackTrace ( ) ;

29 }re turn ” suc c e s s ” ;

31 }

33 pub l i c S t r ing getQuery ( ) {re turn query ;

35 }

37 pub l i c void setQuery ( S t r ing query ) {t h i s . query = query ;

39 }

41 pub l i c S t r ing getResu l t ( ) {re turn r e s u l t ;

43 }

45 pub l i c void s e tRe su l t ( S t r ing r e s u l t ) {t h i s . r e s u l t = r e s u l t ;

47 }

49 }

B.15 HomeAction.java

1 package com . s t r u t s . a c t i on ;

3 import com . opensymphony . xwork2 . ActionSupport ;

5 pub l i c c l a s s HomeAction extends ActionSupport {

7 pr i va t e s t a t i c f i n a l long se r ia lVers ionUID = 1L ;

9 pub l i c S t r ing execute ( ) {re turn ” suc c e s s ” ;

11 }

13 }

B.16 CookieAction.java

45

Page 46: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

1 package com . s t r u t s . a c t i on ;

3 import com . opensymphony . xwork2 . ActionSupport ;

5 pub l i c c l a s s CookieAction extends ActionSupport {pr i va t e s t a t i c f i n a l long se r ia lVers ionUID = 1L ;

7

pub l i c S t r ing execute ( ) {9 re turn ” suc c e s s ” ;

}11

}

B.17 ProfileAction.java

package com . s t r u t s . a c t i on ;2

import java . s q l . Connection ;4 import java . u t i l .Map;

6 import com . opensymphony . xwork2 . ActionContext ;import com . opensymphony . xwork2 . ActionSupport ;

8 import com . s t r u t s . database . ConnectionData ;import com . s t r u t s . database . Pro f i l eData ;

10

pub l i c c l a s s P ro f i l eAc t i on extends ActionSupport {12

pr i va t e s t a t i c f i n a l long se r ia lVers ionUID = 1L ;14 pr i va t e S t r ing emai l ;

p r i va t e S t r ing passy ;16

18

pub l i c S t r ing submit ( ) throws ClassNotFoundException {20

Connection connect ion = nu l l ;22 ConnectionData connectDatabase = new ConnectionData ( ) ;

connect ion = connectDatabase . connect ( ) ;24

26 St r ing r e s u l t = ”” ;t ry {

28 Pro f i l eData pd = new Pro f i l eData ( ) ;S t r ing p r o f i l e = pd . g e tP r o f i l e ( connect ion , getEmail ( )

, getPassy ( ) ) ;

46

Page 47: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

30

i f ( p r o f i l e . equa l s ( ” su c c e s s ” ) ) {32 Map s e s s i o n = ActionContext . getContext ( ) . g e tS e s s i on ( ) ;

s e s s i o n . put ( ”name” ,pd . getName ( ) ) ;34 r e s u l t =” suc c e s s ” ;

36 } e l s e{

38 addActionError ( getText ( ” e r r o r . l o g i n ” ) ) ;r e s u l t = ” e r r o r ” ;

40 }

42 } catch ( Exception e ) {

44 addActionError ( getText ( ” e r r o r . l o g i n ” ) ) ;r e s u l t = ” e r r o r ” ;

46 }

48 re turn r e s u l t ;

50 }

52

54 pub l i c S t r ing getEmail ( ) {re turn emai l ;

56 }

58

60 pub l i c void setEmai l ( S t r ing emai l ) {t h i s . emai l = emai l ;

62 }

64

66 pub l i c S t r ing getPassy ( ) {re turn passy ;

68 }

70

72 pub l i c void setPassy ( St r ing passy ) {t h i s . passy = passy ;

74 }

76 }

47

Page 48: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

C PHP Listings

C.1 createuser.php

<?2 r e qu i r e on c e ( ” goog l eap i / s r c / ap iC l i en t . php” ) ;

r e qu i r e on c e ( ” goog l eap i / s r c / con t r ib / ap iCa l endarServ i ce . php” ) ;4

s e s s i o n s t a r t ( ) ;6 // unset ( $ SESSION [ ’ token ’ ] ) ;

8 /∗∗ Se t t i ng up the Google API

10 ∗/$ c l i e n t = new ap iC l i en t ( ) ;

12 $ c l i e n t−>setApplicationName ( ”Google+ PHP Sta r t e r App l i ca t ion ” ) ;$ c l i e n t−>s e tC l i e n t I d ( ”302689333082−

f r a l c5db8 l f i ob lqdkvrk j jmk4h8685d . apps . goog l eu s e r conten t . com” );

14 $ c l i e n t−>s e tC l i e n t S e c r e t ( ”HW4jUv TpZ4zd86SWGY9PkhV” ) ;$ c l i e n t−>s e tRed i r e c tUr i ( ” http ://www. pe r i ho s t . com/ c r e a t eu s e r . php”

) ;16 $ c l i e n t−>setDeveloperKey ( ”AIzaSyDA−zNNs3XdF5glF993D9−mTLG−3

r17rPs ” ) ;$ c l i e n t−>setAccessType ( ’ o f f l i n e ’ ) ;

18 //Google Calendar API S p e c i f i c

20

$ca l = new ap iCa lendarServ i ce ( $ c l i e n t ) ;22

24 //Mobile Car r i e r Array$ c a r r i e r s = array ( ) ;

26 $ c a r r i e r s [ ’ v e r i zon ’ ] = ”Verizon Wire l e s s ” ;$ c a r r i e r s [ ’ atnt ’ ] = ”AT&T” ;

28 $ c a r r i e r s [ ’ s p r i n t ’ ] = ” Spr int ” ;$ c a r r i e r s [ ’ a l t e l ’ ] = ” A l t e l ” ;

30 ?>

32 <html><head>

34 <t i t l e >Create New User</ t i t l e ><s t y l e type=” text / c s s ”>

36 body{margin : 0 px ; padding : 0 px ;}div { d i sp l ay : b lock ;}

38 #content {width :94%; margin : 0 px auto ; border : 1 px s o l i d #000;padding : 5 px ;}

48

Page 49: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

#banner{ v e r t i c a l−a l i g n : middle ; border : none ; width :200 px ; margin: 3 px auto ;}

40 #header { he ight :100 px ; background−image : u r l (”/ images /headbg . jpg ”); width :100%; margin : 0 px 0px 5px 0px ; border−bottom :1 px s o l i d#000;}

h2{ d i sp l ay : b lock ; margin : 0 px ;}42 l i { he ight : 50 px ;}

input , s e l e c t {border−rad iu s : 3px ; border : 1 px s o l i d #000 ; width:150 px ;}

44 input : hover , s e l e c t : hover{background−c o l o r :#BEF781 ;}</s ty l e>

46 </head>

48 <body><div id=”header ”>

50 <img s r c=”/ images / smsplus2 . png” /></div>

52 <?echo ”<div id=\”content\”>” ;

54 i f ( ! i s s e t ( $ SESSION [ ’ token ’ ] ) ){

56 // unset ($ SESSION [ ’ token ’ ] ) ;i f ( i s s e t ($ GET [ ’ code ’ ] ) )

58 {$ c l i e n t−>authent i ca t e ( ) ;

60 $tokenStr ing = $c l i e n t−>getAccessToken ( ) ;//var dump ( $tokenStr ing ) ;

62 $ SESSION [ ’ token ’ ] = $tokenStr ing ;header ( ” Locat ion : http : //134 . 129 . 125 . 232/ c r e a t eu s e r . php” ) ;

64

}66 e l s e

{68 $authUrl = $c l i e n t−>createAuthUrl ( ) ;

echo ”<center>” ;70 echo ”<h2>You can r e g i s t e r to SMS++ in 3 easy s t ep s !</h2><br

>” ;echo ”</center>” ;

72 echo ”<o l s t y l e=\”d i sp l ay : b lock ; width :500 px ; margin : 0 pxauto ; font−s i z e : 20 px;\”>” ;

echo ”< l i>Connect to Google <a c l a s s =’ l o g i n ’ h r e f =’$authUrl’><img width=\”100\” s r c=\”http : //134 . 129 . 125 . 232/ images /gooogleConn . png\” id=\”banner \” /></a></l i>” ;

74 echo ”< l i>F i l l out the form</ l i >” ;echo ”< l i> Reply to the SMS message</ l i>” ;

76 echo ”</ol>” ;

78

49

Page 50: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

80 }}

82 e l s e{

84

86

$tokenStr ing = $ SESSION [ ’ token ’ ] ;88 i f ( ! i s s e t ($ POST [ ’ submit ’ ] ) )

{90 echo ”<t ab l e co lpadding=\”2\” s t y l e=\”width :300 px ; margin

: 0 px auto ;\”>” ;echo ”<tr><td co l span=\”2\” a l i g n=\”cente r\”><h2>Join SMS

++</h2></td></tr>” ;92 echo ”<form method=\”post \” ac t i on=\”” . $ SERVER[ ’

PHP SELF ’ ] . ”\”>” ;

94 echo ”<tr><td><b>F i r s t Name</b>:</td><td><input type=\”text \” name=\” f i r s t name\”></td></tr>” ; ;

echo ”<tr><td><b>Last Name</b>:</td><td><input type=\” text\” name=\” last name\”></td></tr>” ;

96 echo ”<tr><td><b>Phone Carier</b>:</td><td>” ;echo ”<s e l e c t name=\” c a r r i e r \”>” ;

98 f o r each ( $ c a r r i e r s as $k => $v ){

100 echo ”<opt ion value=\”” . $k . ”\”>” . $v . ”</option>” ;}

102

echo ”</s e l e c t>” ;104 echo ”</td></tr>” ;

echo ”<tr><td><b>Phone Number</b>:</td><td><input type=\”text \” name=\”number\”></tr></tr>” ;

106 echo ”<tr><td><b>G−mail Account</b>:</td><td><input type=\” text \” name=\”emai l\”></td></tr>” ;

echo ”<tr><td co l span=\”2\”>< input type=\”submit \” value=\”Submit\” name=\”submit \” s t y l e=\”width :50 px\”></td></tr>” ;

108 echo ”</form>” ;echo ”</table>” ;

110 }e l s e

112 {$f i rstName = $ POST [ ’ f i r s t name ’ ] ;

114 $lastName = $ POST [ ’ last name ’ ] ;$arg = array ( ” ” , ”−” ) ;

116 $phoneNumber = $ POST [ ’ number ’ ] ;$phoneNumber2 = s t r r e p l a c e ( $arg , ”” , $phoneNumber ) ;

118

50

Page 51: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

120 $phoneCarr ier = $ POST [ ’ c a r r i e r ’ ] ;$emai l = $ POST [ ’ emai l ’ ] ;

122

124 $conn = mysql connect ( ” l o c a l h o s t ” , ” root ” , ”bender3krama” )or d i e ( ”Could not connect ” ) ;

126 $db = mysq l s e l e c t db ( ”sms” ) or d i e ( ”No DB” ) ;

128 $ sq l = ”INSERT INTO in f o ( f i r s tname , lastname , phonenumber, phonecar r i e r , emai laddress , token ) VALUES( ’ ” .$f i rstName . ” ’ , ’ ” . $lastName . ” ’ , ’ ” .$phoneNumber2 . ” ’ , ’ ” . $phoneCarr ier . ” ’ , ’ ” .$emai l . ” ’ , ’ ” . $ tokenStr ing . ” ’ ) ; ” ;

$query = mysql query ( $ sq l ) or d i e ( ”Error ” . mysq l e r ro r( ) ) ;

130

132 echo ”<center><h2>Su c c e s s f u l l y j o i n ed SMS++!</h2></center>” ;

134 }}

136 echo ”</div>” ;

138 ?>

140 </body></html>

C.2 gcalendar.php

1 <?/∗=======================================================

3 ∗ GOOGLE CALENDAR SCRIPT∗

5 ∗ Author : Jus t in Anderson∗ Vers ion : 1 . 0

7 ∗ Desc r ip t i on : This i s the s c r i p t that w i l l pu l l a u s e r sgoog l e ca l endar events . You can have the r e s u l t s pr in ted in3 formats . ( tab le , json , and xml ) .

∗ There are 3 f i l t e r opt ions . ( 1 ) View a l l9 ∗========================================================∗/

11

51

Page 52: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

/∗ The requi rements and in c l ud e s ∗/13 r e qu i r e on c e ( ” goog l eap i / s r c / ap iC l i en t . php” ) ;

r e qu i r e on c e ( ” goog l eap i / s r c / con t r ib / ap iCa l endarServ i ce . php” ) ;15

s e s s i o n s t a r t ( ) ;17

/∗19 ∗ Se t t i ng up the Google API∗/

21 $ c l i e n t = new ap iC l i en t ( ) ;$ c l i e n t−>setApplicationName ( ”Google+ PHP Sta r t e r App l i ca t ion ” ) ;

23 $ c l i e n t−>s e tC l i e n t I d ( ”302689333082−f r a l c5db8 l f i ob lqdkvrk j jmk4h8685d . apps . goog l eu s e r conten t . com” );

$ c l i e n t−>s e tC l i e n t S e c r e t ( ”HW4jUv TpZ4zd86SWGY9PkhV” ) ;25 $ c l i e n t−>s e tRed i r e c tUr i ( ” http ://www. pe r i ho s t . com/ gca lendar . php” )

;$ c l i e n t−>setDeveloperKey ( ”AIzaSyDA−zNNs3XdF5glF993D9−mTLG−3

r17rPs ” ) ;27 $ c l i e n t−>setAccessType ( ’ o f f l i n e ’ ) ;

29 //Google Calendar API S p e c i f i c$ ca l = new ap iCa lendarServ i ce ( $ c l i e n t ) ;

31

//Check i f we got our re sponse from the GOOGLE API33 i f ( i s s e t ($ GET [ ’ code ’ ] ) ){

35 $ c l i e n t−>authent i ca t e ( ) ;$ SESSION [ ’ a c c e s s t oken ’ ] = $ c l i e n t−>getAccessToken ( ) ;

37 // header ( ’ Locat ion : http : / /134 . 129 . 1 25 . 232/ ’ . $ SERVER[ ’PHP SELF ’ ] ) ;

}39

//We may a l ready have the token , so l e t s get the i n f o41 i f ( i s s e t ( $ SESSION [ ’ a c c e s s t oken ’ ] ) ){

43 $ c l i e n t−>setAccessToken ($ SESSION [ ’ a c c e s s t oken ’ ] ) ;}

45

i f ( i s s e t ($ GET [ ’ number ’ ] ) )47 {

$conn = mysql connect ( ” l o c a l h o s t ” , ” root ” , ”bender3krama” ) ord i e ( ”Could not connect ” ) ;

49

$db = mysq l s e l e c t db ( ”sms” ) or d i e ( ”No DB” ) ;51

53 $ sq l = ”SELECT ∗ FROM in f o WHERE ‘ phonenumber ‘ = ” . $ GET [ ’number ’ ] . ” ; ” ;

52

Page 53: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

$query = mysql query ( $ sq l ) ;55 $obj = mysq l f e t ch ob j e c t ( $query ) ;

@$token = $obj−>token ;57 i f ( ! ( i s n u l l ( $token ) ) )

{59 $ c l i e n t−>setAccessToken ( $token ) ;

//var dump ( $token ) ;61 }

e l s e63 {

//var dump ( $obj ) ;65 echo ” e r r o r ” ;

d i e ( ) ;67 }

69 }

71 //The token may be passed v ia URLi f ( i s s e t ($ GET [ ’ token ’ ] ) )

73 {$ c l i e n t−>setAccessToken ($ GET [ ’ token ’ ] ) ;

75 }

77

//No token found ! we must l i n k to connect79 i f ( ! $ c l i e n t−>getAccessToken ( ) ){

81 $authUrl = $c l i e n t−>createAuthUrl ( ) ;p r i n t ”<a c l a s s =’ l o g i n ’ h r e f =’$authUrl ’>Connect Me!</a>” ;

83 }e l s e

85 {//WE HAVE THE TOKEN AND MUST GET CALENDAR STUFF

87 $ SESSION [ ’ token ’ ] = $ c l i e n t−>getAccessToken ( ) ;$ c a l L i s t = $cal−>ca l endarL i s t−>l i s tCa l e nd a rL i s t ( ) ;

89 $events = array ( ) ;$x = 0 ;

91 //Merging a l l Calendar s t u f ff o r each ( $ c a l L i s t [ ’ i tems ’ ] as $e )

93 {$cevents = $cal−>events−>l i s tEv en t s ( $e [ ’ id ’ ] ) ;

95 @$cevents2 = $cevents [ ’ i tems ’ ] ;i f ( count ( $cevents2 ) > 0)

97 { $events = array merge ( $events , $cevents2 ) ; }//Do nothing

99

}101

53

Page 54: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

103 /∗ SORT THE EVENTS ∗/$x = 0 ;

105 f o r each ( $events as $e ){

107 //var dump ( $e ) ;i f ( i s s e t ( $e [ ’ s t a r t ’ ] ) )

109 {i f ( i s s e t ( $e [ ’ s t a r t ’ ] [ ’ date ’ ] ) )

111 {$date = $e [ ’ s t a r t ’ ] [ ’ date ’ ] ;

113 }e l s e

115 {$date = subs t r ( $e [ ’ s t a r t ’ ] [ ’ dateTime ’ ] , 0 , 10) ;

117 }$dateE [ $x ] = $date ;

119

}121 e l s e

{123 $dateE [ $x ] = ”0000−00−00” ;

}125 $x++;

}127 a r r ay mu l t i s o r t ( $dateE , SORT DESC, $events ) ;

//END SORT DATES129

131 i f ( i s s e t ($ GET [ ’mode ’ ] ) ){

133 $mode = s t r t o l owe r ($ GET [ ’mode ’ ] ) ;}

135 e l s e{

137 $mode = ” tab l e ” ;}

139 // F i l t e r a l l events f o r today

141 i f ( i s s e t ($ GET [ ’ today ’ ] ) ){

143 $tempEvents = $events ;unset ( $events ) ;

145 $events = array ( ) ;$today = date ( ”Y−m−d” ) ;

147 // $today = (”2012−04−21”) ;f o r each ( $tempEvents as $e )

149 {i f ( i s s e t ( $e [ ’ s t a r t ’ ] ) )

151 {

54

Page 55: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

i f ( i s s e t ( $e [ ’ s t a r t ’ ] [ ’ date ’ ] ) )153 {

$date = $e [ ’ s t a r t ’ ] [ ’ date ’ ] ;155 }

e l s e157 {

$date = subs t r ( $e [ ’ s t a r t ’ ] [ ’ dateTime ’ ] , 0 , 10) ;159 }

}161 i f ( $date == $today )

{163 // echo $date . ” = ” . $today . ”<br>”;

$events [ ] = $e ;165

}167 }

}169

i f ( i s s e t ($ GET [ ’ date ’ ] ) )171 {

$tempEvents = $events ;173 unset ( $events ) ;

$events = array ( ) ;175 $dateWanted = $ GET [ ’ date ’ ] ;

f o r each ( $tempEvents as $e )177 {

i f ( i s s e t ( $e [ ’ s t a r t ’ ] ) )179 {

i f ( i s s e t ( $e [ ’ s t a r t ’ ] [ ’ date ’ ] ) )181 {

$date = $e [ ’ s t a r t ’ ] [ ’ date ’ ] ;183 }

e l s e185 {

$date = subs t r ( $e [ ’ s t a r t ’ ] [ ’ dateTime ’ ] , 0 , 10) ;187 }

}189 i f ( $date == $dateWanted )

{191 // echo $date . ” = ” . $today . ”<br>”;

$events [ ] = $e ;193

}195 }

}197

i f ( count ( $events ) < 1)199 {

d i e ( ”NO EVENTS” ) ;

55

Page 56: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

201 }

203

switch ($mode)205 {

de f au l t :207 case ” tab l e ” :

$x = 0 ;209 echo ”<t ab l e border=\”1\” s t y l e=\”width :1100 px ; margin : 0

auto ;\”>\ r \n” ;f o r each ( $events as $e )

211 {

213

i f ( $e [ ’ s t a tu s ’ ] != ” can c e l l e d ” )215 {

echo ”<tr>” ;217 echo ”<td>” . $x . ”</td>” ;

echo ”<td>” . $e [ ’ summary ’ ] . ”</td>” ;219

i f ( i s s e t ( $e [ ’ d e s c r i p t i o n ’ ] ) )221 {

echo ”<td>” . $e [ ’ d e s c r i p t i o n ’ ] . ”</td>” ;223 }

e l s e225 {

echo ”<td>No Descr ipt ion</td>” ;227 }

i f ( i s s e t ( $e [ ’ s t a r t ’ ] ) )229 {

i f ( i s s e t ( $e [ ’ s t a r t ’ ] [ ’ date ’ ] ) )231 {

echo ”<td>” . $e [ ’ s t a r t ’ ] [ ’ date ’ ] . ”</td>” ;233 }

e l s e235 {

echo ”<td>” . $e [ ’ s t a r t ’ ] [ ’ dateTime ’ ] . ”</td>” ;237 }

}239 e l s e

{241 echo ”<td>No Star t Date/time</td>” ;

}243 i f ( i s s e t ( $e [ ’ c r e a t o r ’ ] [ ’ displayName ’ ] ) )

{245 echo ”<td>” . $e [ ’ c r e a t o r ’ ] [ ’ displayName ’ ] . ”</td>”

;}

247 e l s e

56

Page 57: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

{249 echo ”<TD> </td>” ;

}251 echo ”</tr>\r \n\ r \n” ;

}253 $x++;

}255 echo ”</table>\r \n” ;

break ;257

259 case ” j son ” :header ( ”Content−type : t ex t / p l a i n ” ) ;

261

echo ”{\ r \n” ;263 echo ”\” events \ ” : [ \ r \n” ;

$x = 1 ;265 f o r each ( $events as $e )

{267

i f ( $e [ ’ s t a tu s ’ ] != ” can c e l l e d ” )269 {

echo ”{” ;271 // echo ”<tr >”;

// echo ”<td>” . $x . ”</td>”;273 // echo ”<td>” . $e [ ’ summary ’ ] . ”</td>”;

echo ”\”summary\” : \”” . $e [ ’ summary ’ ] . ” \” , ” ;275 i f ( i s s e t ( $e [ ’ d e s c r i p t i o n ’ ] ) )

{277 $order = array ( ”\ r \n” , ”\n” , ”\ r ” ) ;

$ r ep l a c e = ’ ’ ;279

// Proce s s e s \ r \n ’ s f i r s t so they aren ’ t convertedtwice .

281 $d e s c r i p t i on = s t r r e p l a c e ( $order , $ rep lace , $e [ ’d e s c r i p t i o n ’ ] ) ;

echo ”\” d e s c r i p t i o n \” : \”” . $d e s c r i p t i o n . ” \” , ” ;283 }

i f ( i s s e t ( $e [ ’ s t a r t ’ ] ) )285 {

i f ( i s s e t ( $e [ ’ s t a r t ’ ] [ ’ date ’ ] ) )287 {

echo ”\” star tDate \” : \”” . $e [ ’ s t a r t ’ ] [ ’ date ’ ] .”\”” ;

289 }e l s e

291 {echo ”\” startDateTime \” : \”” . $e [ ’ s t a r t ’ ] [ ’

dateTime ’ ] . ”\”” ;

57

Page 58: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

293 }}

295 e l s e{

297 // echo ”<td>No Sta r t e Date/time</td>”;}

299 // echo ”\” kind \” : \”” . $e [ ’ kind ’ ] . ”\” ” ;i f ( i s s e t ( $e [ ’ c r e a t o r ’ ] [ ’ displayName ’ ] ) )

301 {echo ” , \” c r e a t o r \” : \”” . $e [ ’ c r e a t o r ’ ] [ ’

displayName ’ ] . ”\”” ;303 }

i f ( $x < count ( $events ) )305 {

echo ” } , \ r \n” ;307 }

e l s e309 {

echo ”}\ r \n” ;311 }

313 }$x++;

315 }echo ” ]\ r \n” ;

317 echo ”}\ r \n” ;

319 break ;

321

case ”xml” :323

header ( ”Content−Type : t ex t /xml” ) ;325

echo ”<?xml ve r s i on =\”1.0\” ?> \ r \n” ;327 echo ”<events>\r \n” ;

$x = 1 ;329 f o r each ( $events as $e )

{331

i f ( $e [ ’ s t a tu s ’ ] != ” can c e l l e d ” )333 {

echo ”<event>\r \n” ;335 // echo ”<tr >”;

// echo ”<td>” . $x . ”</td>”;337 // echo ”<td>” . $e [ ’ summary ’ ] . ”</td>”;

$summary = s t r r e p l a c e ( ”&” , ”&amp ; ” , $e [ ’ summary ’ ] ) ;339 echo ”<summary>” . $summary . ”</summary>\r \n” ;

i f ( i s s e t ( $e [ ’ d e s c r i p t i o n ’ ] ) )

58

Page 59: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

341 {$order = array ( ”\ r \n” , ”\n” , ”\ r ” ) ;

343 $ r ep l a c e = ’ ’ ;

345 // Proce s s e s \ r \n ’ s f i r s t so they aren ’ t convertedtwice .

$d e s c r i p t i on = s t r r e p l a c e ( $order , $ rep lace , $e [ ’d e s c r i p t i o n ’ ] ) ;

347 echo ”<de s c r i p t i on>” . $d e s c r i p t i o n . ”</de s c r i p t i on>\r \n” ;

}349 i f ( i s s e t ( $e [ ’ s t a r t ’ ] ) )

{351 i f ( i s s e t ( $e [ ’ s t a r t ’ ] [ ’ date ’ ] ) )

{353 echo ”<startDate>” . $e [ ’ s t a r t ’ ] [ ’ date ’ ] . ”</

startDate>\r \n” ; ;}

355 e l s e{

357 echo ”<startDateTime>” . $e [ ’ s t a r t ’ ] [ ’ dateTime ’ ] .”</startDateTime>\r \n” ;

}359 }

e l s e361 {

// echo ”<td>No Sta r t e Date/time</td>”;363 }

echo ”</event>\r \n” ;365 }

$x++;367 }

echo ”</events>\r \n” ;369 break ;

}371 }

C.3 gcalendarauth.php

1 <?r equ i r e on c e ( ” goog l eap i / s r c / ap iC l i en t . php” ) ;

3

r e qu i r e on c e ( ” goog l eap i / s r c / con t r ib / ap iCa l endarServ i ce . php” ) ;5 s e s s i o n s t a r t ( ) ;

$ c l i e n t = new ap iC l i en t ( ) ;

59

Page 60: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

7

$ c l i e n t−>setApplicationName ( ”Google+ PHP Sta r t e r App l i ca t ion ” ) ;9

$ c l i e n t−>s e tC l i e n t I d ( ”302689333082−f r a l c5db8 l f i ob lqdkvrk j jmk4h8685d . apps . goog l eu s e r conten t . com” );

11 $ c l i e n t−>s e tC l i e n t S e c r e t ( ”HW4jUv TpZ4zd86SWGY9PkhV” ) ;$ c l i e n t−>s e tRed i r e c tUr i ( ” http ://www. pe r i ho s t . com/ gcalendarauth .

php” ) ;13 $ c l i e n t−>setDeveloperKey ( ”AIzaSyDA−zNNs3XdF5glF993D9−mTLG−3

r17rPs ” ) ;

15 $ca l = new ap iCa lendarServ i ce ( $ c l i e n t ) ;i f ( i s s e t ($ GET [ ’ l ogout ’ ] ) ) {

17 unset ( $ SESSION [ ’ token ’ ] ) ;}

19

i f ( i s s e t ($ GET [ ’ code ’ ] ) ) {21 $ c l i e n t−>authent i ca t e ( ) ;

$ SESSION [ ’ a c c e s s t oken ’ ] = $ c l i e n t−>getAccessToken ( ) ;23

header ( ’ Locat ion : http : //134 . 129 . 125 . 232/ ’ . $ SERVER[ ’PHP SELF ’ ] ) ;

25 }

27 i f ( i s s e t ( $ SESSION [ ’ a c c e s s t oken ’ ] ) ) {

29 $ c l i e n t−>setAccessToken ($ SESSION [ ’ a c c e s s t oken ’ ] ) ;}

31

i f ( $ c l i e n t−>getAccessToken ( ) ) {33 $ c a l L i s t = $cal−>ca l endarL i s t−>l i s tCa l e nd a rL i s t ( ) ;

$optEvent = array ( ’ timeMax ’ => ’ 2012−01−18T00 : 0 0 : 0 0 ’ ) ;35 $idCalendar = $ c a l L i s t [ ’ i tems ’ ] [ 1 ] [ ’ id ’ ] ;

$events = $cal−>events−>l i s tEv en t s ( $ idCalendar ) ;37 $ SESSION [ ’ token ’ ] = $ c l i e n t−>getAccessToken ( ) ;}

39 e l s e{

41 $authUrl = $c l i e n t−>createAuthUrl ( ) ;p r i n t ”<a c l a s s =’ l o g i n ’ h r e f =’$authUrl ’>Connect Me!</a>” ;

43 }

45 echo ”<hr>” ;

47 t ry {$ c a l L i s t = $cal−>ca l endarL i s t−>l i s tCa l e nd a rL i s t ( ) ;

49

$events = array ( ) ;

60

Page 61: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

51

$x = 0 ;53 f o r each ( $ c a l L i s t [ ’ i tems ’ ] as $e )

{55 $cevents = $cal−>events−>l i s tEv en t s ( $e [ ’ id ’ ] ) ;

$cevents2 = $cevents [ ’ i tems ’ ] ;57 $events = array merge ( $events , $cevents2 ) ;

// p r i n t ”<pre>” . p r i n t r ( $events , t rue ) . ”</pre>”;59 // echo ”<hr>”;

//var dump ( $cevents ) ;61 }

pr in t ”<pre>” . p r i n t r ( $events , t rue ) . ”</pre>” ;63

}65 catch ( ap iSe rv i c eExcept i on $e ) {

// Handle except ion . You can a l s o catch Exception here .67 // You can a l s o get the e r r o r code from $e−>getCode ( ) ;

echo ”<hr><hr><hr>” ;69 pr in t ”<pre>” . p r i n t r ( $e , t rue ) . ”</pre>” ;}

71

?>

C.4 gplusauth.php

<?2 r e qu i r e on c e ( ” goog l eap i / s r c / ap iC l i en t . php” ) ;

r e qu i r e on c e ( ” goog l eap i / s r c / con t r ib / ap iP lu sSe rv i c e . php” ) ;4 r e qu i r e on c e ( ” goog l eap i / s r c / con t r ib / ap iCa l endarServ i ce . php” ) ;

6 s e s s i o n s t a r t ( ) ;

8 $ c l i e n t = new ap iC l i en t ( ) ;

10 $ c l i e n t−>setApplicationName ( ”Google+ PHP Sta r t e r App l i ca t ion ” ) ;

12 $ c l i e n t−>s e tC l i e n t I d ( ”302689333082−f r a l c5db8 l f i ob lqdkvrk j jmk4h8685d . apps . goog l eu s e r conten t . com” );

$ c l i e n t−>s e tC l i e n t S e c r e t ( ”HW4jUv TpZ4zd86SWGY9PkhV” ) ;14 $ c l i e n t−>s e tRed i r e c tUr i ( ” http ://www. pe r i ho s t . com/ index . php” ) ;

$ c l i e n t−>setDeveloperKey ( ”AIzaSyDA−zNNs3XdF5glF993D9−mTLG−3r17rPs ” ) ;

16

$ c l i e n t−>s e tScopes ( array ( ’ https : //www. goog l e ap i s . com/auth/ p lus .me ’ , ” https : //www. goog l e . com/ ca l endar / f e ed s /” ) ) ;

61

Page 62: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

18

$plus = new ap iP lu sSe rv i c e ( $ c l i e n t ) ;20 $ca l = new ap iCa lendarServ i ce ( $ c l i e n t ) ;

i f ( i s s e t ($ REQUEST[ ’ l ogout ’ ] ) )22 {

unset ( $ SESSION [ ’ a c c e s s t oken ’ ] ) ;24 }

26

i f ( i s s e t ($ GET [ ’ code ’ ] ) )28 {

$ c l i e n t−>authent i ca t e ( ) ;30 $ SESSION [ ’ a c c e s s t oken ’ ] = $ c l i e n t−>getAccessToken ( ) ;

32 header ( ’ Locat ion : http : //134 . 129 . 125 . 232/ ’ . $ SERVER[ ’PHP SELF ’ ] ) ;

}34

36

i f ( i s s e t ( $ SESSION [ ’ a c c e s s t oken ’ ] ) )38 {

$ c l i e n t−>setAccessToken ($ SESSION [ ’ a c c e s s t oken ’ ] ) ;40

}42

44

i f ( $ c l i e n t−>getAccessToken ( ) )46 {

$me = $plus−>people−>get ( ’me ’ ) ;48 $optParams = array ( ’ maxResults ’ => 100) ;

$ a c t i v i t i e s = $plus−>a c t i v i t i e s −> l i s t A c t i v i t i e s ( ’me ’ , ’ pub l i c ’, $optParams ) ;

50 $ c a l L i s t = $cal−>ca l endarL i s t−>l i s tCa l e nd a rL i s t ( ) ;p r i n t ”<h1>Calendar Lis t</h1><pre>” . p r i n t r ( $ ca lL i s t , t rue )

. ”</pre>” ;52

$ SESSION [ ’ a c c e s s t oken ’ ] = $ c l i e n t−>getAccessToken ( ) ;54 }

e l s e {56 $authUrl = $c l i e n t−>createAuthUrl ( ) ;}

58

60 ?>

62

Page 63: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

C.5 calendar.php

<?2 r e qu i r e on c e ’ Zend/Loader . php ’ ;

Zend Loader : : l oadClas s ( ’ Zend Gdata ’ ) ;4 Zend Loader : : l oadClas s ( ’ Zend Gdata AuthSub ’ ) ;

Zend Loader : : l oadClas s ( ’ Zend Gdata ClientLogin ’ ) ;6 Zend Loader : : l oadClas s ( ’ Zend Gdata Calendar ’ ) ;

8

s e s s i o n s t a r t ( ) ;10 f unc t i on getAuthSubUrl ( ){

12 $next = ”http : //134 . 129 . 125 . 232/ ca l endar . php” ;$scope = ’ https : //www. goog le . com/ ca l endar / f e ed s / ’ ;

14 $secure = f a l s e ;$ s e s s i o n = true ;

16 re turn Zend Gdata AuthSub : : getAuthSubTokenUri ( $next , $scope ,$secure ,$ s e s s i o n ) ;

18 }

20 f unc t i on outputCalendarList ( $ c l i e n t ){

22 $gdataCal = new Zend Gdata Calendar ( $ c l i e n t ) ;$calFeed = $gdataCal−>getCalendarListFeed ( ) ;

24 echo ’<h1> ’ . $calFeed−>t i t l e −>t ex t . ’</h1> ’ ;echo ’<ul> ’ ;

26 f o r each ( $calFeed as $ca lendar ) {echo ’< l i> ’ . $ca lendar−>t i t l e −>t ex t . ’</ l i > ’ ;

28 }echo ’</ul> ’ ;

30 }f unc t i on outputCalendar ( $ c l i e n t )

32 {$gdataCal = new Zend Gdata Calendar ( $ c l i e n t ) ;

34 $eventFeed = $gdataCal−>getCalendarEventFeed ( ) ;echo ”<ul>\n” ;

36 f o r each ( $eventFeed as $event ) {echo ”\ t<l i>” . $event−>t i t l e −>t ex t . ” ( ” . $event−>id−>

t ex t . ” ) \n” ;38 echo ”\ t \ t<ul>\n” ;

f o r each ( $event−>when as $when ) {40 echo ”\ t \ t \ t<l i>Sta r t s : ” . $when−>startTime . ”</ l i >\n” ;

}42 echo ”\ t \ t</ul>\n” ;

echo ”\ t</ l i >\n” ;44 }

echo ”</ul>\n” ;

63

Page 64: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

46 }

48 f unc t i on outputCalendarByFullTextQuery ( $ c l i e n t , $ fu l lTextQuery=’t enn i s ’ )

{50 $gdataCal = new Zend Gdata Calendar ( $ c l i e n t ) ;

$query = $gdataCal−>newEventQuery ( ) ;52 $query−>se tUser ( ’ d e f au l t ’ ) ;

$query−>s e t V i s i b i l i t y ( ’ p r i va t e ’ ) ;54 $query−>s e tP r o j e c t i o n ( ’ f u l l ’ ) ;

$query−>setQuery ( $fu l lTextQuery ) ;56 $eventFeed = $gdataCal−>getCalendarEventFeed ( $query ) ;

echo ”<ul>\n” ;58 f o r each ( $eventFeed as $event ) {

echo ”\ t<l i>” . $event−>t i t l e −>t ex t . ” ( ” . $event−>id−>t ex t . ” ) \n” ;

60 echo ”\ t \ t<ul>\n” ;f o r each ( $event−>when as $when ) {

62 echo ”\ t \ t \ t<l i>Sta r t s : ” . $when−>startTime . ”</ l i >\n” ;echo ”\ t \ t</ul>\n” ;

64 echo ”\ t</ l i >\n” ;}

66 }echo ”</ul>\n” ;

68 }

70 f unc t i on outputCalendarByDateRange ( $ c l i e n t , $s tar tDate=’2007−05−01 ’ ,

$endDate=’2007−08−01 ’ )72 {

$gdataCal = new Zend Gdata Calendar ( $ c l i e n t ) ;74 $query = $gdataCal−>newEventQuery ( ) ;

// $query−>se tUser ( ’ d e f au l t ’ ) ;76 $query−>s e t V i s i b i l i t y ( ’ p r i va t e ’ ) ;

$query−>s e tP r o j e c t i o n ( ’ f u l l ’ ) ;78 $query−>setOrderby ( ’ s t a r t t ime ’ ) ;

$query−>setStartMin ( $startDate ) ;80 $query−>setStartMax ( $endDate ) ;

$eventFeed = $gdataCal−>getCalendarEventFeed ( $query ) ;82 echo ”<ul>\n” ;

f o r each ( $eventFeed as $event ) {84 echo ”\ t<l i>” . $event−>t i t l e −>t ex t . ” ( ” . $event−>id−>

t ex t . ” ) \n” ;echo ”\ t \ t<ul>\n” ;

86 f o r each ( $event−>when as $when ) {echo ”\ t \ t \ t<l i>Sta r t s : ” . $when−>startTime . ”</ l i >\n” ;

88 }echo ”\ t \ t</ul>\n” ;

90 echo ”\ t</ l i >\n” ;

64

Page 65: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

}92 echo ”</ul>\n” ;}

94

i f ( i s s e t ($ GET [ ’ token ’ ] ) )96 {

// echo $ GET [ ’ token ’ ] ;98 // Set the cooke i f o r our domain

s e t c o ok i e ( ” gapitoken ” ,$ GET [ ’ token ’ ] , time ( ) +10800) ; //+3hrs100

i f ( i s s e t ($ COOKIE [ ’ r e d i r e c t−to ’ ] ) )102 {

$ r e d i r e c t = $ COOKIE [ ’ r e d i r e c t−to ’ ] ;104 s e t c o ok i e ( ’ r e d i r e c t−to ’ , ’ ’ , time ( ) − 3600) ; // exp i r e the

cook i eecho ”<s c r i p t type=’ t ext / j a v a s c r i p t ’>window . l o c a t i o n=

unescape ( ’ ” . $ r e d i r e c t . ” ’ ) ;</ s c r i p t>” ;106 }}

108

i f ( i s s e t ( $ SESSION [ ’ sess ionToken ’ ] ) )110 {

$ c l i e n t = Zend Gdata AuthSub : : getHttpCl i ent ($ SESSION [ ’sess ionToken ’ ] ) ;

112 var dump ( $ SESSION [ ’ sess ionToken ’ ] ) ;echo ”<br><br><hr>” ;

114 outputCalendarList ( $ c l i e n t ) ;echo ”<br><br><br><hr>” ;

116 outputCalendar ( $ c l i e n t ) ;}

118 e l s e{

120 $authSubUrl = getAuthSubUrl ( ) ;echo ”<a h r e f=\”$authSubUrl\”> l o g i n to your Google account</a>

” ;122

}124 ?>

C.6 calender3.php

<?2 r e qu i r e on c e ’ Zend/Loader . php ’ ;

Zend Loader : : l oadClas s ( ’ Zend Gdata ’ ) ;4 Zend Loader : : l oadClas s ( ’ Zend Gdata AuthSub ’ ) ;

65

Page 66: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Zend Loader : : l oadClas s ( ’ Zend Gdata ClientLogin ’ ) ;6 Zend Loader : : l oadClas s ( ’ Zend Gdata Calendar ’ ) ;

8

s e s s i o n s t a r t ( ) ;10 f unc t i on getAuthSubUrl ( ){

12 $next = ”http : //134 . 129 . 125 . 232/ ca l endar . php” ;$scope = ’ https : //www. goog le . com/ ca l endar / f e ed s / ’ ;

14 $secure = f a l s e ;$ s e s s i o n = true ;

16 re turn Zend Gdata AuthSub : : getAuthSubTokenUri ( $next , $scope ,$secure ,$ s e s s i o n ) ;

18 }

20 i f ( i s s e t ($ GET [ ’ token ’ ] ) ){

22 // echo $ GET [ ’ token ’ ] ;// Set the cooke i f o r our domain

24 s e t c o ok i e ( ” gapitoken ” ,$ GET [ ’ token ’ ] , time ( ) +10800) ; //+3hrs$ r e d i r e c t = ’ http%3A// l o c a l h o s t%3A36499/WebSite1/Defau l t . aspx ’

;26 s e t c o ok i e ( ” r ed i r e c t−to ” , $ r ed i r e c t , time ( ) +10800) ;

echo ”<s c r i p t type=’ t ext / j a v a s c r i p t ’>window . l o c a t i o n=unescape ( ’” . $ r e d i r e c t . ” ’ ) ;</ s c r i p t>” ;

28

}30 e l s e{

32 $ r e d i r e c t = ’ http%3A// l o c a l h o s t%3A36499/WebSite1/Defau l t . aspx ’;

i f ( i s s e t ($ GET [ ’ r e d i r e c t ’ ] ) )34 {

$ r e d i r e c t = $ GET [ ’ r e d i r e c t ’ ] ;36 s e t c o ok i e ( ’ r e d i r e c t ’ , ’ ’ , time ( ) −3600) ; // exp i r e t h i s cook i e

}38 s e t c o ok i e ( ” r ed i r e c t−to ” , $ r ed i r e c t , time ( ) +10800) ;

$authSubUrl = getAuthSubUrl ( ) ;40 echo ”<a h r e f=\”$authSubUrl\”> l o g i n to your Google account</a>

” ;}

42 ?>

C.7 readcookie.php

66

Page 67: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

<?php2 i f ( i s s e t ($ GET [ ’ cook i e ’ ] ) ){

4 $cook ie = $ GET [ ’ cook i e ’ ] ;}

6 e l s e{

8 $cook ie = ” gapitoken ” ;}

10

i f ( i s s e t ($ GET [ ’ r e d i r e c t ’ ] ) )12 {

s e t c o ok i e ( ’ r e d i r e c t ’ , $ GET [ ’ r e d i r e c t ’ ] , time ( ) +10800) ;14 }

16 $message = ’ Not ice : ’ . $cook i e . ’ not s e t . ’ ;

18 i f ( i s s e t ($ COOKIE [ $cook i e ] ) ){

20 $message = $ COOKIE [ $cook i e ] ;}

22

i f ( i s s e t ($ GET [ ’ c a l l b a ck ’ ] ) )24 {

echo $ GET [ ’ c a l l b a ck ’ ] . ’ ( {” ’ . $cook i e . ’ ” : ” ’ . $message. ’ ”}) ; ’ ;

26 }e l s e

28 {echo $message ;

30 }?>

C.8 setcookie.php

1 <?phpi f ( i s s e t ($ GET [ ’ cook i e ’ ] ) && i s s e t ($ GET [ ’ va lue ’ ] ) )

3 {$cook ie = $ GET [ ’ cook i e ’ ] ;

5 $value = $ GET [ ’ va lue ’ ] ;i f ( s e t c o ok i e ( $cookie , $value , time ( ) +10800) )

7 {echo ”TRUE” ;

9 }e l s e

67

Page 68: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

11 {echo ”FALSE” ;

13 }}

15 e l s e{

17 echo ”FALSE” ;}

19 ?>

D Python Listings

D.1 sms responder.py

1 #!/ usr /bin /env python#

3 # A copy and paste job from ”Cue” http :// t a l k .maemo . org / showpost. php?p=558430&postcount=57

#5 # Matti Kariluoma Mar 2012 <matt i@kar i luo .ma>

import dbus , gob j e c t7 import datet ime

from dbus . mainloop . g l i b import DBusGMainLoop9 from sms nav remote import process sms command

11 import pexpectimport time

13 from subproces s import ∗

15 de f o c t i f y ( s t r ) :’ ’ ’

17 Returns a l i s t o f o c t e t bytes r ep r e s en t i ngeach char o f the input s t r .

19 ’ ’ ’

21 bytes = map( ord , s t r )bitsconsumed = 0

23 r e f e r e n c e b i t = 7o c t e t s = [ ]

25

whi le l en ( bytes ) :27 byte = bytes . pop (0 )

byte = byte >> bitsconsumed29

t ry :

68

Page 69: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

31 nextbyte = bytes [ 0 ]b i t s t o copy = ( nextbyte & (0 x f f >> r e f e r e n c e b i t ) ) <<

r e f e r e n c e b i t33 oc t e t = ( byte | b i t s tocopy )

35 except :o c t e t = ( byte | 0x00 )

37

i f bitsconsumed != 7 :39 o c t e t s . append ( byte | b i t s tocopy )

bitsconsumed += 141 r e f e r e n c e b i t −= 1

e l s e :43 bitsconsumed = 0

r e f e r e n c e b i t = 745

re turn o c t e t s47

de f s em i o c t i f y ( s t r ) :49 ’ ’ ’

Expects a s t r i n g conta in ing two d i g i t s .51 Returns an oc t e t −

f i r s t n ibb l e in the o c t e c t i s the f i r s t53 d i g i t and the second n ibb l e r ep r e s en t s

the second d i g i t .55 ’ ’ ’

t ry :57 d i g i t 1 = in t ( s t r [ 0 ] )

d i g i t 2 = in t ( s t r [ 1 ] )59 oc t e t = ( d i g i t 2 << 4) | d i g i t 1

except :61 oc t e t = (1 << 4) | d i g i t 1

63 re turn oc t e t

65

de f d e o c t i f y ( a r r ) :67

r e f e r e n c e b i t = 169 doctec t = [ ]

bnext = 0x0071

f o r i in a r r :73

bcurr = ( ( i & (0 x f f >> r e f e r e n c e b i t ) ) << r e f e r e n c e b i t ) >> 175 bcurr = bcurr | bnext

77 i f r e f e r e n c e b i t != 7 :doc tec t . append ( bcurr )

69

Page 70: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

79 bnext = ( i & (0 x f f << (8 − r e f e r e n c e b i t ) ) ) >> 8 −r e f e r e n c e b i t

r e f e r e n c e b i t += 181 e l s e :

doc tec t . append ( bcurr )83 bnext = ( i & (0 x f f << (8 − r e f e r e n c e b i t ) ) ) >> 8 −

r e f e r e n c e b i tdoc tec t . append ( bnext )

85 bnext = 0x00r e f e r e n c e b i t = 1

87

re turn ’ ’ . j o i n ( [ chr ( i ) f o r i in doctec t ] )89

91 de f createPDUmessage (number , msg) :’ ’ ’

93 Returns a l i s t o f bytes to r ep r e s en t a va l i d PDU message’ ’ ’

95 numlength = len (number )i f ( numlength % 2) == 0 :

97 range l ength = numlengthe l s e :

99 number = number + ’F ’range l ength = len (number )

101

oct i f i ednumber = [ s em i o c t i f y (number [ i : i +2]) f o r i in range(0 , range length , 2 ) ]

103 oc t i f i e dmsg = o c t i f y (msg)HEADER = 1

105 FIRSTOCTETOFSMSDELIVERMSG = 10ADDRTYPE = 129 #unknown format

107 number length = len (number )msg length = len (msg)

109 pdu message = [HEADER, FIRSTOCTETOFSMSDELIVERMSG,number length , ADDRTYPE]

pdu message . extend ( oct i f i ednumber )111 pdu message . append (0)

pdu message . append (0)113 pdu message . append ( msg length )

pdu message . extend ( o c t i f i edmsg )115 re turn pdu message

117

de f recv sms (pdumsg , msgcenter , somestr ing , number ) :119

msglength = in t (pdumsg [ 1 8 ] )121 msgarray = pdumsg [ 1 9 : l en (pdumsg) ]

123 msg = deo c t i f y ( msgarray )

70

Page 71: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

125 i f msg > 0 :p r i n t ’%s \ tMessage from %s : %s ’ % ( datet ime . datet ime . now( ) ,

number , msg)127 time . s l e e p ( 1 0 . 0 )

send sms (number , process sms command (number [ 2 : : ] , msg) . s t r i p( ) )

129 pr in t ’Message sent ! ’

131 de f send sms (number , message ) :c h i l d = pexpect . spawn ( ’ pnatd ’ ) ;

133 ch i l d . send ( ’ at \ r ’ ) ;time . s l e e p ( 0 . 2 5 ) ;

135 ch i l d . send ( ’ at+cmgf=1\r ’ ) ;time . s l e e p ( 0 . 2 5 ) ;

137 # send to = ’ at+cmgs=”+17012342345”\ r ’s end to = ’ at+cmgs=”%s ”\ r ’ % (number )

139 ch i l d . send ( send to ) ;c h i l d . send (message ) ;

141 ch i l d . send ( chr (26) ) ;c h i l d . send ( chr (26) ) ;

143 ch i l d . s endeo f ( ) ;

145 de f main ( ) :DBusGMainLoop( s e t a s d e f a u l t=True )

147 bus = dbus . SystemBus ( ) #should connect to system bus in s t eado f s e s s i o n because the former i s where the incoming s i g n a l scome from

bus . a d d s i g n a l r e c e i v e r ( recv sms , path=’ /com/nokia /phone/SMS ’ ,dbu s i n t e r f a c e=’Phone .SMS ’ , s igna l name=’ IncomingSegment ’ )

149 pr in t ”sms auto−responding s e r v e r s t a r t ed ! ”gob j e c t . MainLoop ( ) . run ( )

151

i f name == ’ ma in ’ :153 main ( )

D.2 email responder.py

1 #!/ usr /bin /env python# −∗− coding : utf−8 −∗−

3 ## Matti Kariluoma Mar 2012 <matt i@kar i luo .ma>

5

import imaplib , smtpl ib , email , time , datet ime7 from emai l . pa r s e r import Parser

71

Page 72: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

from sms nav import process sms command9 username = ’ none ’

11 de f g e t ma i l ( imap , f o l d e r ) :”””

13 imap i s an imap instance , a l r eady logged in .f o l d e r i s the imap f o l d e r you l i k e to get mail from .

15

r e tu rn s a so r t ed l i s t o f tup l e s : ( i n t (message num ) ,heade r s d i c t ,

17 s t r ( message body ) , s t r (raw message ) )

”””19 mail = [ ]

21 imap . s e l e c t ( f o l d e r , readonly=True )( typ , data ) = imap . search (None , ’ (UNSEEN) ’ )

23 f o r num in data [ 0 ] . s p l i t ( ) :( typ , data ) = imap . f e t ch (num, ’ (RFC822) ’ )

25 imap . s t o r e (num, ’+FLAGS ’ , ’ \Seen ’ ) # mark as readheaders = Parser ( ) . p a r s e s t r ( data [ 0 ] [ 1 ] )

27 mail . append ( ( i n t (num) , d i c t ( headers ) , headers . payload , data[ 0 ] [ 1 ] ) )

29 re turn so r t ed ( mail )

31 de f r e spond to ema i l ( mail ) :”””

33 mail i s a so r t ed tup l e o f ( i n t (message num ) , heade r s d i c t ,s t r ( message body ) , s t r ( raw message )

)35 ”””

f o r message in mail :37 body = s t r ( message [ 2 ] )

t ry :39 i f i s i n s t a n c e ( message [ 2 ] [ 0 ] , emai l . message . Message ) and

l en ( message [ 2 ] [ 0 ] ) > 0 :body = ’ ’

41 f o r part in message [ 2 ] :i f part . i s mu l t i p a r t ( ) :

43 cont inuee l s e :

45 body += part . ge t pay load ( )

47 except IndexError :pass

49

headers = message [ 1 ]51 new message = emai l . message . Message ( )

72

Page 73: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

new message . s e t un ix f rom ( username )53 user = headers [ ’From ’ ]

p r i n t ’%s \ tResponding to message ”%s” from %s ’ % ( s t r (datet ime . datet ime . now( ) ) , body [0 : −1 ] , user )

55 new message [ ’To ’ ] = usernew message [ ’From ’ ] = username+’ @kari luo .ma ’

57 #new message [ ’ Subject ’ ] = ’Re : ’+headers [ ’ Subject ’ ]new message [ ’ Subject ’ ] = ’ ’

59 new message . s e t pay load ( process sms command ( user , body . s t r i p( ) ) )

61 s = smtpl ib .SMTP( ’ l o c a l h o s t ’ )t ry :

63 r e f u s e d r e c i p i e n t s d i c t = s . sendmai l (new message [ ’From ’ ] ,

65 new message [ ’To ’ ] . s p l i t ( ’ , ’ ) ,new message . a s s t r i n g ( )

67 )ma i l s en t = True

69 except :ma i l s en t = False

71 f i n a l l y :s . qu i t ( )

73

de f main ( ) :75 g l oba l username

username = ’ sms ’77 password = ’ sms2012 ’

f o l d e r = ’INBOX ’79 pr in t ” emai l auto−responding s e r v e r s t a r t ed ! ”

t ry :81 whi le (True ) :

imap = imapl ib . IMAP4( ) # lo ca l ho s t , port 14383 imap . l o g i n ( username , password )

85 s o r t ed ma i l = ge t ma i l ( imap , f o l d e r )r e spond to ema i l ( s o r t ed ma i l )

87

imap . c l o s e ( )89 imap . logout ( )

time . s l e e p ( 5 . 0 ) # s l e ep f o r 5 seconds91 except KeyboardInterrupt :

p r i n t ’ ˆC rece ived , shut t ing down s e r v e r ’93

i f name == ’ ma in ’ :95 main ( )

73

Page 74: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

D.3 sms nav.py

1 #!/ usr /bin /env python# −∗− coding : utf−8 −∗−

3 ## Matti Kariluoma Mar 2012 <matt i@kar i luo .ma>

5

import time , datet ime7 from render html import r e nd e r u r l

9 sms max length = 160

11 sms help msg = ”””Welcome to sms++! Commands are :he lp − t h i s message

13 next − d i sp l ay next pageprev − d i sp l ay prev ious page

15 page n − d i sp l ay the nth pageu r l www. example . com − re turn the provided u r l

17 wik i t op i c − re turn the eng l i s h wik iped ia page f o r ” t op i c ”ebay product − re turn ebay p r i c e r e s u l t s f o r ” product ”

19 l o g i n − l og inlogout − l og out

21 emai l − f e t ch emai l f o r a s s o c i a t ed accountemai l name@example . com − f e t ch emai l f o r s p e c i f i c account

23 ”””

25 c a l d e f a u l t s = [’ Dayl ight Saving Time Ends ’ , ’Tax Day ’ , ”Apr i l Fool ’ s Day” , ”

Father ’ s Day” ,27 ”New Year ’ s Day” , ’ Dayl ight Saving Time Begins ’ , ’ Christmas ’ ,

”St . Patr i ck ’ s Day” ,’ Christmas Eve ’ , ”Mother ’ s Day” , ”Valent ine ’ s Day” , ’ Cinco de

Mayo ’ , ’Groundhog Day ’ ,29 ”New Year ’ s Eve” , ’ Flag Day ’ , ’ P r e s ident s Day ’ , ’Columbus Day ’

, ’ Veterans Day ’ ,”John F . Kennedy ’ s Birthday” , ’ Thanksgiving ’ , ’ E l e c t i on Day ’ ,

’ Pa t r i o t Day ’ ,31 ” Linco ln ’ s Birthday” , ’ Labor Day ’ , ’Memorial Day ’ , ’ Earth Day ’

, ’ Halloween ’ ,’ Independence Day ’ , ”Martin Luther King , Jr ’ s Day”

33 ]

35 msgs = {}pages = {}

37

de f d i g e s t sms p r e c a l c ( message ) :39 header = ’ Reply ” help ” f o r command usage \n ’

f o o t e r = ’ \nPage 1 o f 1 ’41 message = s t r ( message ) # ensure we are dea l i ng with a s t r i n g

74

Page 75: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

43 ## Find the number o f pages to be made , msg maxmsg len = len (message )

45 msg len −= sms max length − l en ( header ) − l en ( f o o t e r ) # f i r s tmessage has header

msg num = 147 msg num += msg len % ( sms max len − l en ( f o o t e r ) )

msg max = msg num49 whi le (msg num >= 1 . 0 ) :

msg num /= 1051 pass # r e c a l c u l a t e with the f o o t e r + 1 charac t e r f o r the

next power o f messages

53 ## Make the pages and return the r e s u l tr e s u l t = [ ]

55 f o r i in range (msg max) :f o o t e r = ’Page %d o f %d ’ % ( i +1, msg max)

57 i f i > 0 : # After the f i r s theader = ’ ’

59 sk ip = sms max length − l en ( header ) − l en ( f o o t e r )r e s u l t . append ( ’%s%s%s ’ % ( header , message [ sk ip ∗ i : sk ip ∗( i +1)

] , f o o t e r ) )61

re turn r e s u l t63

de f d i ge s t sms (message ) :65 message = s t r ( message )

r e s u l t = [ ]67 i = 0

header = ’ Reply ” help ” f o r command usage \n ’69 est max = ( l en ( message ) + len ( header ) ) / ( sms max length − l en

( ’ \nPage 1 o f 10 ’ ) )est max = in t ( round ( est max , 0) ) + 1

71 whi le l en ( message ) > 0 :f o o t e r = ’ \nPage %d o f %d ’ % ( i +1, est max )

73 i f i > 0 : # After the f i r s theader = ’ ’

75 sk ip = sms max length − l en ( header ) − l en ( f o o t e r )r e s u l t . append ( ’%s%s%s ’ % ( header , message [ 0 : sk ip ] , f o o t e r ) )

77 message = message [ sk ip : : ]i+=1

79

re turn r e s u l t81

de f process sms command ( user , command) :83 cmd = s t r (command) . s p l i t ( ’ ’ ) [ 0 ] . s t r i p ( ) . lower ( )

g l oba l msgs85 g l oba l pages

75

Page 76: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

87 t ry :page = pages [ user ]

89 msg = msgs [ user ]except KeyError :

91 page = 0msg = [ ]

93 pages [ user ] = pagemsgs [ user ] = msg

95

i f cmd . s t a r t sw i t h ( ’ prev ’ ) :97 page −= 1

i f page < 0 :99 page = 0

e l i f cmd . s t a r t sw i t h ( ’ next ’ ) :101 page += 1

e l i f cmd . s t a r t sw i t h ( ’ page ’ ) :103 e r r o r = True

try :105 page num = in t ( f l o a t ( s t r (command) . s p l i t ( ’ ’ ) [ 1 ] ) )

e r r o r = False107 except :

pass109

i f not e r r o r :111 i f page num > l en (msg) :

page = len (msg) − 1113 e l s e :

page = page num − 1115 e l i f cmd . s t a r t sw i t h ( ’ u r l ’ ) :

e r r o r = True117 t ry :

webpage = r end e r u r l ( s t r (command) . s p l i t ( ’ ’ ) [ 1 ] )119 e r r o r = False

except IndexError :121 pass

123 i f not e r r o r :page = 0

125 buf = [ ]f o r l i n e in webpage . s p l i t l i n e s (True ) :

127 buf . append ( l i n e . s t r i p ( ’ \ t ’ ) ) # remove space and tabformatt ing

msg = d ige s t sms ( ’ ’ . j o i n ( buf ) )129 e l i f cmd . s t a r t sw i t h ( ’ mail ’ ) :

phonenumber = user . s p l i t ( ’@ ’ ) [ 0 ]131 e r r o r = True

try :133 webpage = r end e r u r l ( ’ http : //134 . 129 . 125 . 232 : 8080/

smsplusp lus /query . a c t i on ; s e r v i c e=mail&phone=%s ’ % (

76

Page 77: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

phonenumber ) )p r i n t l en (webpage )

135 l i n e s = webpage . s p l i t l i n e s ( )f o r l i n e in l i n e s :

137 l i n e . s t r i p ( )webpage = ’ ’ . j o i n ( l i n e s )

139 message = webpage# e r r o r i s html page with ”Bad Request ” in the body with

no surronding tag141 i f webpage != ’Bad Request ’ :

emai l s = eva l ( s t r (webpage ) ) #XSS ATTACK! #the returnshould be a j son d i c t i ona ry

143 i f i s i n s t a n c e ( emai ls , d i c t ) :t ry :

145 num = 0message = ’ ’

147 f o r emai l in emai l s [ ’ entry ’ ] :message += ”%d : %s (%s ) \n” % (num, emai l [ ’ t i t l e ’ ] ,

emai l [ ’ author ’ ] [ ’ emai l ’ ] )149 num += 1

except KeyError :151 message = webpage

e l s e :153 message = webpage

e r r o r = False155 except IndexError :

pass157

i f not e r r o r :159 page = 0

msg = d ige s t sms (message )161

e l i f cmd . s t a r t sw i t h ( ’ c a l ’ ) :163 phonenumber = user . s p l i t ( ’@ ’ ) [ 0 ]

g l oba l c a l d e f a u l t s165 e r r o r = True

try :167 webpage = r end e r u r l ( ’ http : //134 . 129 . 125 . 232/ gca lendar . php

?number=%s&mode=json ’ % ( phonenumber ) )l i n e s = webpage . s p l i t l i n e s ( )

169 f o r l i n e in l i n e s :l i n e . s t r i p ( )

171 webpage = ’ ’ . j o i n ( l i n e s )message = webpage

173 # er r o r i s html page with ” e r r o r ” in the body with nosurronding tag

i f webpage != ’ e r r o r ’ :175 c a l s = eva l ( s t r (webpage ) ) #XSS ATTACK! #the return

should be a j son d i c t i ona ry

77

Page 78: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

message = ’ ’177 num = 0

f o r c a l in c a l s [ ’ events ’ ] :179 c r e a t o r = ’ ’

t ry :181 c r e a t o r = ca l [ ’ c r e a t o r ’ ]

except KeyError :183 pass

i f c r e a t o r != ’US Hol idays ’ :185 i f c a l [ ’ summary ’ ] not in c a l d e f a u l t s :

t ry :187 message += ”%d : %s (%s ) \n” % (num, ca l [ ’ summary ’

] , c a l [ ’ s tar tDate ’ ] )except KeyError :

189 t ry :message += ”%d : %s (%s ) \n” % (num, ca l [ ’

summary ’ ] , c a l [ ’ startDateTime ’ ] )191 except KeyError :

pass193 num += 1

e r r o r = False195 except IndexError :

pass197

i f not e r r o r :199 page = 0

msg = d ige s t sms (message )201 e l s e :

msg = d ige s t sms ( sms help msg )203

t ry :205 message = msg [ page ]

except IndexError :207 page = len (msg)−1

message = ’ ’209 i f page >= 0 :

message = msg [ page ]211 i f message i s None or message i s ’ ’ :

msg = d ige s t sms ( sms help msg )213 page = 0

message = msg [ page ]215

msgs [ user ] = msg217 pages [ user ] = page

219 re turn message

221 de f main ( ) :p r i n t ”sms command i n t e r p r e t e r s e r v e r s t a r t ed ! ”

78

Page 79: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

223 t ry :import f i l e i n p u t

225 whi le (True ) :f o r l i n e in f i l e i n p u t . input ( ) :

227 pr in t process sms command ( ”nobody” , l i n e . s t r i p ( ) )

229 except KeyboardInterrupt :p r i n t ’ ˆC rece ived , shut t ing down s e r v e r ’

231

i f name == ’ ma in ’ :233 main ( )

D.4 sms nav remote.py

1 #!/ usr /bin /env python# −∗− coding : utf−8 −∗−

3 ## Matti Kariluoma Mar 2012 <matt i@kar i luo .ma>

5

import time , datet ime7 from render html import r ende r u r l r emo t e l y

9 sms max length = 160

11 sms help msg = ”””Welcome to sms++! Commands are :he lp − t h i s message

13 next − d i sp l ay next pageprev − d i sp l ay prev ious page

15 page n − d i sp l ay the nth pageu r l www. example . com − re turn the provided u r l

17 wik i t op i c − re turn the eng l i s h wik iped ia page f o r ” t op i c ”ebay product − re turn ebay p r i c e r e s u l t s f o r ” product ”

19 l o g i n − l og inlogout − l og out

21 emai l − f e t ch emai l f o r a s s o c i a t ed accountemai l name@example . com − f e t ch emai l f o r s p e c i f i c account

23 ”””

25 c a l d e f a u l t s = [’ Dayl ight Saving Time Ends ’ , ’Tax Day ’ , ”Apr i l Fool ’ s Day” , ”

Father ’ s Day” ,27 ”New Year ’ s Day” , ’ Dayl ight Saving Time Begins ’ , ’ Christmas ’ ,

”St . Patr i ck ’ s Day” ,’ Christmas Eve ’ , ”Mother ’ s Day” , ”Valent ine ’ s Day” , ’ Cinco de

Mayo ’ , ’Groundhog Day ’ ,

79

Page 80: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

29 ”New Year ’ s Eve” , ’ Flag Day ’ , ’ P r e s ident s Day ’ , ’Columbus Day ’, ’ Veterans Day ’ ,

”John F . Kennedy ’ s Birthday” , ’ Thanksgiving ’ , ’ E l e c t i on Day ’ ,’ Pa t r i o t Day ’ ,

31 ” Linco ln ’ s Birthday” , ’ Labor Day ’ , ’Memorial Day ’ , ’ Earth Day ’, ’ Halloween ’ ,

’ Independence Day ’ , ”Martin Luther King , Jr ’ s Day”33 ]

35 msgs = {}pages = {}

37

de f d i g e s t sms p r e c a l c ( message ) :39 header = ’ Reply ” help ” f o r command usage \n ’

f o o t e r = ’ \nPage 1 o f 1 ’41 message = s t r ( message ) # ensure we are dea l i ng with a s t r i n g

43 ## Find the number o f pages to be made , msg maxmsg len = len (message )

45 msg len −= sms max length − l en ( header ) − l en ( f o o t e r ) # f i r s tmessage has header

msg num = 147 msg num += msg len % ( sms max len − l en ( f o o t e r ) )

msg max = msg num49 whi le (msg num >= 1 . 0 ) :

msg num /= 1051 pass # r e c a l c u l a t e with the f o o t e r + 1 charac t e r f o r the

next power o f messages

53 ## Make the pages and return the r e s u l tr e s u l t = [ ]

55 f o r i in range (msg max) :f o o t e r = ’Page %d o f %d ’ % ( i +1, msg max)

57 i f i > 0 : # After the f i r s theader = ’ ’

59 sk ip = sms max length − l en ( header ) − l en ( f o o t e r )r e s u l t . append ( ’%s%s%s ’ % ( header , message [ sk ip ∗ i : sk ip ∗( i +1)

] , f o o t e r ) )61

re turn r e s u l t63

de f d i ge s t sms (message ) :65 message = s t r ( message )

r e s u l t = [ ]67 i = 0

header = ’ Reply ” help ” f o r command usage \n ’69 est max = ( l en ( message ) + len ( header ) ) / ( sms max length − l en

( ’ \nPage 1 o f 10 ’ ) )est max = in t ( round ( est max , 0) ) + 1

80

Page 81: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

71 whi le l en ( message ) > 0 :f o o t e r = ’ \nPage %d o f %d ’ % ( i +1, est max )

73 i f i > 0 : # After the f i r s theader = ’ ’

75 sk ip = sms max length − l en ( header ) − l en ( f o o t e r )r e s u l t . append ( ’%s%s%s ’ % ( header , message [ 0 : sk ip ] , f o o t e r ) )

77 message = message [ sk ip : : ]i+=1

79

re turn r e s u l t81

de f process sms command ( user , command) :83 cmd = s t r (command) . s p l i t ( ’ ’ ) [ 0 ] . s t r i p ( ) . lower ( )

g l oba l msgs85 g l oba l pages

87 t ry :page = pages [ user ]

89 msg = msgs [ user ]except KeyError :

91 page = 0msg = [ ]

93 pages [ user ] = pagemsgs [ user ] = msg

95

i f cmd . s t a r t sw i t h ( ’ prev ’ ) :97 page −= 1

i f page < 0 :99 page = 0

e l i f cmd . s t a r t sw i t h ( ’ next ’ ) :101 page += 1

e l i f cmd . s t a r t sw i t h ( ’ page ’ ) :103 e r r o r = True

try :105 page num = in t ( f l o a t ( s t r (command) . s p l i t ( ’ ’ ) [ 1 ] ) )

e r r o r = False107 except :

pass109

i f not e r r o r :111 i f page num > l en (msg) :

page = len (msg) − 1113 e l s e :

page = page num − 1115 e l i f cmd . s t a r t sw i t h ( ’ u r l ’ ) :

e r r o r = True117 t ry :

webpage = rende r u r l r emo t e l y ( s t r (command) . s p l i t ( ’ ’ ) [ 1 ] ,” http ://www. a t a r k r i . com:8080/ render ” )

81

Page 82: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

119 e r r o r = Falseexcept IndexError :

121 pass

123 i f not e r r o r :page = 0

125 buf = [ ]f o r l i n e in webpage . s p l i t l i n e s (True ) :

127 buf . append ( l i n e . s t r i p ( ’ \ t ’ ) ) # remove space and tabformatt ing

msg = d ige s t sms ( ’ ’ . j o i n ( buf ) )129 e l i f cmd . s t a r t sw i t h ( ’ mail ’ ) :

phonenumber = user . s p l i t ( ’@ ’ ) [ 0 ]131 pr in t phonenumber

e r r o r = True133 t ry :

webpage = rende r u r l r emo t e l y ( ’ http: / /134 . 129 . 125 . 232 : 8080/ smsplusp lus /query . a c t i on ;s e r v i c e=mail&phone=%s ’ % ( phonenumber ) , ” http ://www.a t a r k r i . com:8080/ render ” )

135 pr in t l en (webpage )l i n e s = webpage . s p l i t l i n e s ( )

137 f o r l i n e in l i n e s :l i n e . s t r i p ( )

139 webpage = ’ ’ . j o i n ( l i n e s )message = webpage

141 # er r o r i s html page with ”Bad Request ” in the body withno surronding tag

i f webpage != ’Bad Request ’ :143 emai l s = eva l ( s t r (webpage ) ) #XSS ATTACK! #the return

should be a j son d i c t i ona ryi f i s i n s t a n c e ( emai ls , d i c t ) :

145 t ry :num = 0

147 message = ’ ’f o r emai l in emai l s [ ’ entry ’ ] :

149 message += ”%d : %s (%s ) \n” % (num, emai l [ ’ t i t l e ’ ] ,emai l [ ’ author ’ ] [ ’ emai l ’ ] )

num += 1151 except KeyError :

message = webpage153 e l s e :

message = webpage155 e r r o r = False

except IndexError :157 pass

159 i f not e r r o r :page = 0

82

Page 83: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

161 msg = dige s t sms (message )

163 e l i f cmd . s t a r t sw i t h ( ’ c a l ’ ) :phonenumber = user . s p l i t ( ’@ ’ ) [ 0 ]

165 g l oba l c a l d e f a u l t se r r o r = True

167 t ry :webpage = rende r u r l r emo t e l y ( ’ http : //134 . 129 . 125 . 232/

gca lendar . php?number=%s&mode=json ’ % ( phonenumber ) , ”http ://www. a t a r k r i . com:8080/ render ” )

169 l i n e s = webpage . s p l i t l i n e s ( )f o r l i n e in l i n e s :

171 l i n e . s t r i p ( )webpage = ’ ’ . j o i n ( l i n e s )

173 message = webpage# e r r o r i s html page with ” e r r o r ” in the body with no

surronding tag175 i f webpage != ’ e r r o r ’ :

c a l s = eva l ( s t r (webpage ) ) #XSS ATTACK! #the returnshould be a j son d i c t i ona ry

177 message = ’ ’num = 0

179 f o r c a l in c a l s [ ’ events ’ ] :c r e a t o r = ’ ’

181 t ry :c r e a t o r = ca l [ ’ c r e a t o r ’ ]

183 except KeyError :pass

185 i f c r e a t o r != ’US Hol idays ’ :i f c a l [ ’ summary ’ ] not in c a l d e f a u l t s :

187 t ry :message += ”%d : %s (%s ) \n” % (num, ca l [ ’ summary ’

] , c a l [ ’ s tar tDate ’ ] )189 except KeyError :

t ry :191 message += ”%d : %s (%s ) \n” % (num, ca l [ ’

summary ’ ] , c a l [ ’ startDateTime ’ ] )except KeyError :

193 passnum += 1

195 e r r o r = Falseexcept IndexError :

197 pass

199 i f not e r r o r :page = 0

201 msg = dige s t sms (message )e l s e :

203 msg = dige s t sms ( sms help msg )

83

Page 84: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

205 t ry :message = msg [ page ]

207 except IndexError :page = len (msg)−1

209 message = ’ ’i f page >= 0 :

211 message = msg [ page ]i f message i s None or message i s ’ ’ :

213 msg = dige s t sms ( sms help msg )page = 0

215 message = msg [ page ]

217 msgs [ user ] = msgpages [ user ] = page

219

re turn message221

de f main ( ) :223 pr in t ”sms command i n t e r p r e t e r s e r v e r s t a r t ed ! ”

t ry :225 import f i l e i n p u t

whi l e (True ) :227 f o r l i n e in f i l e i n p u t . input ( ) :

p r i n t process sms command ( ”nobody” , l i n e . s t r i p ( ) )229

except KeyboardInterrupt :231 pr in t ’ ˆC rece ived , shut t ing down s e r v e r ’

233 i f name == ’ ma in ’ :main ( )

D.5 render html.py

#!/ usr /bin /env python2 # −∗− coding : utf−8 −∗−#

4 # Matti Kariluoma Mar 2012 <matt i@kar i luo .ma>

6 import time , datet imefrom os import sep

8 from subproces s import Popen , STDOUT, PIPEfrom u r l l i b import ur lopen

10

de f addsep ( p a t h l i s t ) :

84

Page 85: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

12 ”””I am convinced there e x i s t s a standard l i b r a r y func t i on to do

t h i s14 f o r me . Where i s i t ! ?

”””16 r e s u l t = ’ ’

f o r item in p a t h l i s t :18 r e s u l t = ’%s%s%s ’ % ( r e su l t , sep , item )

return r e s u l t20

de f r e nd e r u r l ( u r l ) :22 proce s s = Popen ( [ addsep ( [ ’ usr ’ , ’ bin ’ , ’ l i n k s ’ ] ) , ’−dump ’ , u r l ] ,

s tdout=PIPE , s t d e r r=STDOUT)( stdout , s t d e r r ) = proce s s . communicate ( )

24 i f p roc e s s . p o l l ( ) == None : # i f the proce s s i s runningproce s s . k i l l ( )

26 re turn stdout

28 de f r ende r u r l r emo t e l y ( ur l , remote ) :t ry :

30 f i l e = ur lopen ( ”%s ? u r l t o r e nd e r=%s” % ( remote , u r l ) )render = f i l e . read ( )

32 except IOError :render = ’ ’

34 re turn s t r ( render )

36

de f main ( ) :38 pr in t ”html render ing s e r v e r s t a r t ed ! ”

t ry :40 import f i l e i n p u t

whi l e (True ) :42 f o r u r l in f i l e i n p u t . input ( ) :

f o r l i n e in s t r ( r e nd e r u r l ( u r l . s t r i p ( ) ) ) . s p l i t l i n e s (True) :

44 pr in t l i n e . s t r i p ( ’ \ t ’ )

46 except KeyboardInterrupt :p r i n t ’ ˆC rece ived , shut t ing down s e r v e r ’

48

i f name == ’ ma in ’ :50 main ( )

D.6 sms relay render server.py

85

Page 86: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

#!/ usr /bin /env python2 # −∗− coding : utf−8 −∗−#

4 # Hel lo .#

6 #Matti Kariluoma <matt i@kar i luo .ma> Mar 2012

8 from bo t t l e import Bott le , run , view , s t a t i c f i l e , TEMPLATEPATH, reque s t

from render html import r e nd e r u r l10 root path = ’ . / ’

s t a t i c p a t h = root path+” s t a t i c /”12

s e r v e r = Bott l e ( )14 de l TEMPLATEPATH[ 0 : l en (TEMPLATEPATH) ]

TEMPLATEPATH. append ( ’ . / templates / ’ )16

”””18 # Python deco ra to r s :

# http ://www. ibm . com/deve loperworks / l i nux / l i b r a r y / l−cpdecor /index . html

20

# With deco ra t i on s :22 @server . route ( ’/ h e l l o ’ )

de f h e l l o ( ) :24 re turn ”No.\n”

26 #Without deco ra t i on s :de f again ( ) :

28 re turn ”Yes .\n”again = s e rv e r . route ( ’/ again ’ ) ( again )

30 ”””

32 @server . e r r o r (404)de f e r ro r404 ( e r r o r ) :

34 re turn ”””<h3>404</h3><p>Please , don ’ t do that .</p>”””

36

@server . route ( ’ / ’ ) # index . html38 @view ( ’main ’ ) # looks f o r a ’main . t p l ’ in the TEMPLATEPATH l i s t

de f index ( ) :40 re turn d i c t (name=”Guest” , root=root path )

42 @server . route ( ’ / render ’ ) # index . html@view ( ’ render ’ ) # looks f o r a ’main . t p l ’ in the TEMPLATEPATH

l i s t44 de f index ( ) :

dered = r end e r u r l ( r eque s t . query . u r l t o r e nd e r . r ep l a c e ( ’> ’ , ’ ? ’) . r ep l a c e ( ’< ’ , ’& ’ ) )

86

Page 87: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

46 dered = s t r ( dered ) . r ep l a c e ( ’&quot ; ’ , ’ ” ’ ) . r ep l a c e ( ’#039; ’ , ” ’ ” )re turn d i c t ( rendered=dered )

48

50 de f s e t u p s t a t i c ( ) :@server . route ( ’ / s t a t i c /< f i l ename : path> ’ )

52 de f s e n d s t a t i c ( f i l ename ) :r e turn s t a t i c f i l e ( f i l ename , root=s t a t i c p a t h )

54

de f main ( ) :56 s e t u p s t a t i c ( )

s e r v e r . run ( host=’www. a t a r k r i . com ’ , port=’ 8080 ’ , debug=True )58

i f name == ’ ma in ’ :60 main ( )

E Presentation, 2012 Apr 30

E.1 sms++odp.pdf

87

Page 88: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

SMS++

AndersonKailash

KariluomaRajan

Page 89: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Introduction

SMS++: Access web services over SMS•Short Messaging System (SMS)

– 160 character message– Included in most cellphone

plans– Requires Low-Bandwidth

(unlike 3g, etc.)

•Web service– Any information available

over the Internet– May require access

privileges (email, etc.)

Page 90: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Problem Description

• A user might:– Not be in range of a high-

bandwidth network– Not have access to a

smartphone

• Auxiliary problems that arise– Access restrictions– Storage of user credentials– Formatting of SMS messages– Parsing of SMS commands

Page 91: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Solution

• Use the service for queries– Simple web searches

(google, wikipedia, etc.)• Don’t require authentication

• Register with our service to access more– Allow the user to

authenticate with Oauth• No emails/passwords ever

touch our database• Authentication token stored in

central database

– Brave users may also give us their username & password• Also stored in a central

database

Page 92: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Solution (cont.)

• Message the service– 701 541 1477– [email protected]

• Commands accessible by anyone– Navigation: help, prev, next,

page– Query: url

• Commands that require authentication– Query: mail, cal (calender)– Contact central database

(using requestor’s phone number as a primary key) to fetch credentials

Page 93: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

SMS Communication• Phone → Phone

–SMS delivered in binary (PDU) or plaintext

–PDU: Mixed octal (two-byte) and semi-octal (decimal)• 07917283010010F5040BC87238880900F10000993092516195800AE8329BFD4697D9EC37

• Phone → Email gateway–SMS delivered as plaintext in body

–Can be replied to via Email

Page 94: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Authentication in Detail

• We used Google’s Open Auth (oAuth) 2.0

Page 95: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Future Work

• Security– Data stored in plaintext– Registration websites

• Share sensitive information• Store sensitive data in “temporary”

cookies

• Intra-service Messaging– JSON

• SMS message format– Cuts off in the middle of a

sentence– Cuts off in the middle of a word– Returns pages with no

information– Doesn’t summarize information

Page 96: SMS++ · 3 User Authentication We investigated three methods of accessing a user’s credentials for queries to restricted web services: User sends username & password with SMS request

Questions?