From 6afba8bc12e9307b8f92b286cd8e4d50107d50c3 Mon Sep 17 00:00:00 2001
From: Ilia Ross <ilia@ross.gdn>
Date: Sun, 9 Aug 2026 22:13:20 +0200
Subject: [PATCH] Fix to add login lib with reusable login warning

https://github.com/webmin/webmin/pull/2812#discussion_r3744668133
---
 login-lib.pl      | 27 +++++++++++++++++++++++++++
 makedist.pl       |  2 +-
 pam_login.cgi     | 20 ++------------------
 session_login.cgi | 19 ++-----------------
 4 files changed, 32 insertions(+), 36 deletions(-)
 create mode 100755 login-lib.pl

diff --git a/login-lib.pl b/login-lib.pl
new file mode 100755
index 000000000..eb22a83b6
--- /dev/null
+++ b/login-lib.pl
@@ -0,0 +1,27 @@
+# login-lib.pl
+# Common functions for the built-in login pages.
+
+# get_login_http_warning(&miniserv-config)
+# Returns the insecure-login warning HTML, or undef if none is needed
+sub get_login_http_warning
+{
+my ($miniserv) = @_;
+return undef if ($ENV{'HTTPS'} eq 'ON' ||
+		 (!$miniserv->{'ssl'} && $miniserv->{'no_ssl_warn'}));
+
+my $warning = "&#9888; $text{'login_notsecure'}";
+my $description = $text{'login_notsecure_http_desc'};
+if ($miniserv->{'ssl'}) {
+	$warning = ui_tag('a', $warning,
+		{ 'href' => "javascript:void(0);",
+		  'class' => 'inherit-color',
+		  'onclick' => "window.location.href = ".
+		    "window.location.href.replace(/^http:/, 'https:'); return false;",
+		});
+	$description = $text{'login_notsecure_desc'};
+	}
+return ui_tag('span', $warning,
+	{ class => 'not-secure', title => $description });
+}
+
+1;
diff --git a/makedist.pl b/makedist.pl
index b12249254..6f8175433 100755
--- a/makedist.pl
+++ b/makedist.pl
@@ -40,7 +40,7 @@ $vers || usage();
 	  "webmin-systemd", "webmin-init", "webmin-daemon",
 	  "config-openbsd",
 	  "config-macos", "LICENCE",
-	  "session_login.cgi", "acl_security.pl",
+	  "session_login.cgi", "login-lib.pl", "acl_security.pl",
 	  "defaultacl", "rpc.cgi", "date_chooser.cgi",
 	  "safeacl", "install-module.pl", "LICENCE.ja", 
 	  "favicon.ico", "config-netbsd", "fastrpc.cgi",
diff --git a/pam_login.cgi b/pam_login.cgi
index 139c29007..4b3b40814 100755
--- a/pam_login.cgi
+++ b/pam_login.cgi
@@ -3,6 +3,7 @@
 
 BEGIN { push(@INC, "."); };
 use WebminCore;
+require './login-lib.pl';
 
 $pragma_no_cache = 1;
 #$ENV{'MINISERV_INTERNAL'} || die "Can only be called by miniserv.pl";
@@ -73,23 +74,7 @@ print "$text{'pam_prefix'}\n";
 print &ui_form_start("@{[&get_webprefix()]}/pam_login.cgi", "post");
 print &ui_hidden("cid", $in{'cid'});
 
-my $not_secure;
-if ($ENV{'HTTPS'} ne 'ON' &&
-    ($miniserv{'ssl'} || !$miniserv{'no_ssl_warn'})) {
-	my $warning = "&#9888; $text{'login_notsecure'}";
-	my $description = $text{'login_notsecure_http_desc'};
-	if ($miniserv{'ssl'}) {
-		$warning = ui_tag('a', $warning,
-			{ 'href' => "javascript:void(0);",
-			  'class' => 'inherit-color',
-			  'onclick' => "window.location.href = ".
-			    "window.location.href.replace(/^http:/, 'https:'); return false;",
-			});
-		$description = $text{'login_notsecure_desc'};
-		}
-	$not_secure = ui_tag('span', $warning,
-		{ class => 'not-secure', title => $description });
-	}
+my $not_secure = &get_login_http_warning(\%miniserv);
 
 print &ui_table_start($text{'pam_header'} . $not_secure,
 		      "width=40% class='loginform'", 2);
@@ -159,4 +144,3 @@ EOF
 	}
 
 &ui_print_footer();
-
diff --git a/session_login.cgi b/session_login.cgi
index ba4df2edf..31e7a48df 100755
--- a/session_login.cgi
+++ b/session_login.cgi
@@ -4,6 +4,7 @@
 
 BEGIN { push(@INC, "."); };
 use WebminCore;
+require './login-lib.pl';
 
 $pragma_no_cache = 1;
 #$ENV{'MINISERV_INTERNAL'} || die "Can only be called by miniserv.pl";
@@ -93,23 +94,7 @@ print "$text{'session_prefix'}\n";
 print &ui_form_start("@{[&get_webprefix()]}/session_login.cgi", "post");
 print &ui_hidden("page", $in{'page'});
 
-my $not_secure;
-if ($ENV{'HTTPS'} ne 'ON' &&
-    ($miniserv{'ssl'} || !$miniserv{'no_ssl_warn'})) {
-	my $warning = "&#9888; $text{'login_notsecure'}";
-	my $description = $text{'login_notsecure_http_desc'};
-	if ($miniserv{'ssl'}) {
-		$warning = ui_tag('a', $warning,
-			{ 'href' => "javascript:void(0);",
-			  'class' => 'inherit-color',
-			  'onclick' => "window.location.href = ".
-			    "window.location.href.replace(/^http:/, 'https:'); return false;",
-			});
-		$description = $text{'login_notsecure_desc'};
-		}
-	$not_secure = ui_tag('span', $warning,
-		{ class => 'not-secure', title => $description });
-	}
+my $not_secure = &get_login_http_warning(\%miniserv);
 
 print &ui_table_start($text{'session_header'} . $not_secure,
 		      "width=40% class='loginform'", 2);