Changeset 2577

Timestamp:

03/12/10 10:58:51 (5 months ago)

Author:

JensDiemer

Message:

• better log() message in sha_form.html
• add a "self test" for sha.js
• add a cnonce generation part. But not used, yet.
• hide "password reset", TODO: reimplement it!
• don't hide page_msg if it's not a ajax request
• update sha.js by Paul Johnston from v2.1a to v2.2
• some code cleanup

Location:

branches/0.9/pylucid_project

Files:

• media/PyLucid/sha.js (modified) (8 diffs)
• media/PyLucid/shared_sha_tools.js (modified) (1 diff)
• pylucid_plugins/auth/templates/auth/sha_form.html (modified) (13 diffs)
• pylucid_plugins/auth/views.py (modified) (5 diffs)

branches/0.9/pylucid_project/media/PyLucid/sha.js

@@ -1 +1 @@
 /*
  * A JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined
- * in FIPS PUB 180-1
- * Version 2.1a Copyright Paul Johnston 2000 - 2002.
+ * in FIPS 180-1
+ * Version 2.2 Copyright Paul Johnston 2000 - 2009.
  * Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
  * Distributed under the BSD License
@@ -14 +14 @@
 var hexcase = 0;  /* hex output format. 0 - lowercase; 1 - uppercase        */
 var b64pad  = ""; /* base-64 pad character. "=" for strict RFC compliance   */
-var chrsz   = 8;  /* bits per input character. 8 - ASCII; 16 - Unicode      */
 
 /*
@@ -20 +19 @@
  * They take string arguments and return either hex or base-64 encoded strings
  */
-function hex_sha1(s){return binb2hex(core_sha1(str2binb(s),s.length * chrsz));}
-function b64_sha1(s){return binb2b64(core_sha1(str2binb(s),s.length * chrsz));}
-function str_sha1(s){return binb2str(core_sha1(str2binb(s),s.length * chrsz));}
-function hex_hmac_sha1(key, data){ return binb2hex(core_hmac_sha1(key, data));}
-function b64_hmac_sha1(key, data){ return binb2b64(core_hmac_sha1(key, data));}
-function str_hmac_sha1(key, data){ return binb2str(core_hmac_sha1(key, data));}
+function hex_sha1(s)    { return rstr2hex(rstr_sha1(str2rstr_utf8(s))); }
+function b64_sha1(s)    { return rstr2b64(rstr_sha1(str2rstr_utf8(s))); }
+function any_sha1(s, e) { return rstr2any(rstr_sha1(str2rstr_utf8(s)), e); }
+function hex_hmac_sha1(k, d)
+  { return rstr2hex(rstr_hmac_sha1(str2rstr_utf8(k), str2rstr_utf8(d))); }
+function b64_hmac_sha1(k, d)
+  { return rstr2b64(rstr_hmac_sha1(str2rstr_utf8(k), str2rstr_utf8(d))); }
+function any_hmac_sha1(k, d, e)
+  { return rstr2any(rstr_hmac_sha1(str2rstr_utf8(k), str2rstr_utf8(d)), e); }
 
 /*
@@ -32 +34 @@
 function sha1_vm_test()
 {
-  return hex_sha1("abc") == "a9993e364706816aba3e25717850c26c9cd0d89d";
+  return hex_sha1("abc").toLowerCase() == "a9993e364706816aba3e25717850c26c9cd0d89d";
+}
+
+/*
+ * Calculate the SHA1 of a raw string
+ */
+function rstr_sha1(s)
+{
+  return binb2rstr(binb_sha1(rstr2binb(s), s.length * 8));
+}
+
+/*
+ * Calculate the HMAC-SHA1 of a key and some data (raw strings)
+ */
+function rstr_hmac_sha1(key, data)
+{
+  var bkey = rstr2binb(key);
+  if(bkey.length > 16) bkey = binb_sha1(bkey, key.length * 8);
+
+  var ipad = Array(16), opad = Array(16);
+  for(var i = 0; i < 16; i++)
+  {
+    ipad[i] = bkey[i] ^ 0x36363636;
+    opad[i] = bkey[i] ^ 0x5C5C5C5C;
+  }
+
+  var hash = binb_sha1(ipad.concat(rstr2binb(data)), 512 + data.length * 8);
+  return binb2rstr(binb_sha1(opad.concat(hash), 512 + 160));
+}
+
+/*
+ * Convert a raw string to a hex string
+ */
+function rstr2hex(input)
+{
+  try { hexcase } catch(e) { hexcase=0; }
+  var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
+  var output = "";
+  var x;
+  for(var i = 0; i < input.length; i++)
+  {
+    x = input.charCodeAt(i);
+    output += hex_tab.charAt((x >>> 4) & 0x0F)
+           +  hex_tab.charAt( x        & 0x0F);
+  }
+  return output;
+}
+
+/*
+ * Convert a raw string to a base-64 string
+ */
+function rstr2b64(input)
+{
+  try { b64pad } catch(e) { b64pad=''; }
+  var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+  var output = "";
+  var len = input.length;
+  for(var i = 0; i < len; i += 3)
+  {
+    var triplet = (input.charCodeAt(i) << 16)
+                | (i + 1 < len ? input.charCodeAt(i+1) << 8 : 0)
+                | (i + 2 < len ? input.charCodeAt(i+2)      : 0);
+    for(var j = 0; j < 4; j++)
+    {
+      if(i * 8 + j * 6 > input.length * 8) output += b64pad;
+      else output += tab.charAt((triplet >>> 6*(3-j)) & 0x3F);
+    }
+  }
+  return output;
+}
+
+/*
+ * Convert a raw string to an arbitrary string encoding
+ */
+function rstr2any(input, encoding)
+{
+  var divisor = encoding.length;
+  var remainders = Array();
+  var i, q, x, quotient;
+
+  /* Convert to an array of 16-bit big-endian values, forming the dividend */
+  var dividend = Array(Math.ceil(input.length / 2));
+  for(i = 0; i < dividend.length; i++)
+  {
+    dividend[i] = (input.charCodeAt(i * 2) << 8) | input.charCodeAt(i * 2 + 1);
+  }
+
+  /*
+   * Repeatedly perform a long division. The binary array forms the dividend,
+   * the length of the encoding is the divisor. Once computed, the quotient
+   * forms the dividend for the next step. We stop when the dividend is zero.
+   * All remainders are stored for later use.
+   */
+  while(dividend.length > 0)
+  {
+    quotient = Array();
+    x = 0;
+    for(i = 0; i < dividend.length; i++)
+    {
+      x = (x << 16) + dividend[i];
+      q = Math.floor(x / divisor);
+      x -= q * divisor;
+      if(quotient.length > 0 || q > 0)
+        quotient[quotient.length] = q;
+    }
+    remainders[remainders.length] = x;
+    dividend = quotient;
+  }
+
+  /* Convert the remainders to the output string */
+  var output = "";
+  for(i = remainders.length - 1; i >= 0; i--)
+    output += encoding.charAt(remainders[i]);
+
+  /* Append leading zero equivalents */
+  var full_length = Math.ceil(input.length * 8 /
+                                    (Math.log(encoding.length) / Math.log(2)))
+  for(i = output.length; i < full_length; i++)
+    output = encoding[0] + output;
+
+  return output;
+}
+
+/*
+ * Encode a string as utf-8.
+ * For efficiency, this assumes the input is valid utf-16.
+ */
+function str2rstr_utf8(input)
+{
+  var output = "";
+  var i = -1;
+  var x, y;
+
+  while(++i < input.length)
+  {
+    /* Decode utf-16 surrogate pairs */
+    x = input.charCodeAt(i);
+    y = i + 1 < input.length ? input.charCodeAt(i + 1) : 0;
+    if(0xD800 <= x && x <= 0xDBFF && 0xDC00 <= y && y <= 0xDFFF)
+    {
+      x = 0x10000 + ((x & 0x03FF) << 10) + (y & 0x03FF);
+      i++;
+    }
+
+    /* Encode output as utf-8 */
+    if(x <= 0x7F)
+      output += String.fromCharCode(x);
+    else if(x <= 0x7FF)
+      output += String.fromCharCode(0xC0 | ((x >>> 6 ) & 0x1F),
+                                    0x80 | ( x         & 0x3F));
+    else if(x <= 0xFFFF)
+      output += String.fromCharCode(0xE0 | ((x >>> 12) & 0x0F),
+                                    0x80 | ((x >>> 6 ) & 0x3F),
+                                    0x80 | ( x         & 0x3F));
+    else if(x <= 0x1FFFFF)
+      output += String.fromCharCode(0xF0 | ((x >>> 18) & 0x07),
+                                    0x80 | ((x >>> 12) & 0x3F),
+                                    0x80 | ((x >>> 6 ) & 0x3F),
+                                    0x80 | ( x         & 0x3F));
+  }
+  return output;
+}
+
+/*
+ * Encode a string as utf-16
+ */
+function str2rstr_utf16le(input)
+{
+  var output = "";
+  for(var i = 0; i < input.length; i++)
+    output += String.fromCharCode( input.charCodeAt(i)        & 0xFF,
+                                  (input.charCodeAt(i) >>> 8) & 0xFF);
+  return output;
+}
+
+function str2rstr_utf16be(input)
+{
+  var output = "";
+  for(var i = 0; i < input.length; i++)
+    output += String.fromCharCode((input.charCodeAt(i) >>> 8) & 0xFF,
+                                   input.charCodeAt(i)        & 0xFF);
+  return output;
+}
+
+/*
+ * Convert a raw string to an array of big-endian words
+ * Characters >255 have their high-byte silently ignored.
+ */
+function rstr2binb(input)
+{
+  var output = Array(input.length >> 2);
+  for(var i = 0; i < output.length; i++)
+    output[i] = 0;
+  for(var i = 0; i < input.length * 8; i += 8)
+    output[i>>5] |= (input.charCodeAt(i / 8) & 0xFF) << (24 - i % 32);
+  return output;
+}
+
+/*
+ * Convert an array of big-endian words to a string
+ */
+function binb2rstr(input)
+{
+  var output = "";
+  for(var i = 0; i < input.length * 32; i += 8)
+    output += String.fromCharCode((input[i>>5] >>> (24 - i % 32)) & 0xFF);
+  return output;
 }
 
@@ -38 +246 @@
  * Calculate the SHA-1 of an array of big-endian words, and a bit length
  */
-function core_sha1(x, len)
+function binb_sha1(x, len)
 {
   /* append padding */
@@ -62 +270 @@
     {
       if(j < 16) w[j] = x[i + j];
-      else w[j] = rol(w[j-3] ^ w[j-8] ^ w[j-14] ^ w[j-16], 1);
-      var t = safe_add(safe_add(rol(a, 5), sha1_ft(j, b, c, d)),
+      else w[j] = bit_rol(w[j-3] ^ w[j-8] ^ w[j-14] ^ w[j-16], 1);
+      var t = safe_add(safe_add(bit_rol(a, 5), sha1_ft(j, b, c, d)),
                        safe_add(safe_add(e, w[j]), sha1_kt(j)));
       e = d;
       d = c;
-      c = rol(b, 30);
+      c = bit_rol(b, 30);
       b = a;
       a = t;
@@ -104 +312 @@
 
 /*
- * Calculate the HMAC-SHA1 of a key and some data
- */
-function core_hmac_sha1(key, data)
-{
-  var bkey = str2binb(key);
-  if(bkey.length > 16) bkey = core_sha1(bkey, key.length * chrsz);
-
-  var ipad = Array(16), opad = Array(16);
-  for(var i = 0; i < 16; i++)
-  {
-    ipad[i] = bkey[i] ^ 0x36363636;
-    opad[i] = bkey[i] ^ 0x5C5C5C5C;
-  }
-
-  var hash = core_sha1(ipad.concat(str2binb(data)), 512 + data.length * chrsz);
-  return core_sha1(opad.concat(hash), 512 + 160);
-}
-
-/*
  * Add integers, wrapping at 2^32. This uses 16-bit operations internally
  * to work around bugs in some JS interpreters.
@@ -136 +325 @@
  * Bitwise rotate a 32-bit number to the left.
  */
-function rol(num, cnt)
+function bit_rol(num, cnt)
 {
   return (num << cnt) | (num >>> (32 - cnt));
 }
-
-/*
- * Convert an 8-bit or 16-bit string to an array of big-endian words
- * In 8-bit function, characters >255 have their hi-byte silently ignored.
- */
-function str2binb(str)
-{
-  var bin = Array();
-  var mask = (1 << chrsz) - 1;
-  for(var i = 0; i < str.length * chrsz; i += chrsz)
-    bin[i>>5] |= (str.charCodeAt(i / chrsz) & mask) << (32 - chrsz - i%32);
-  return bin;
-}
-
-/*
- * Convert an array of big-endian words to a string
- */
-function binb2str(bin)
-{
-  var str = "";
-  var mask = (1 << chrsz) - 1;
-  for(var i = 0; i < bin.length * 32; i += chrsz)
-    str += String.fromCharCode((bin[i>>5] >>> (32 - chrsz - i%32)) & mask);
-  return str;
-}
-
-/*
- * Convert an array of big-endian words to a hex string.
- */
-function binb2hex(binarray)
-{
-  var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
-  var str = "";
-  for(var i = 0; i < binarray.length * 4; i++)
-  {
-    str += hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8+4)) & 0xF) +
-           hex_tab.charAt((binarray[i>>2] >> ((3 - i%4)*8  )) & 0xF);
-  }
-  return str;
-}
-
-/*
- * Convert an array of big-endian words to a base-64 string
- */
-function binb2b64(binarray)
-{
-  var tab = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-  var str = "";
-  for(var i = 0; i < binarray.length * 4; i += 3)
-  {
-    var triplet = (((binarray[i   >> 2] >> 8 * (3 -  i   %4)) & 0xFF) << 16)
-                | (((binarray[i+1 >> 2] >> 8 * (3 - (i+1)%4)) & 0xFF) << 8 )
-                |  ((binarray[i+2 >> 2] >> 8 * (3 - (i+2)%4)) & 0xFF);
-    for(var j = 0; j < 4; j++)
-    {
-      if(i * 8 + j * 6 > binarray.length * 32) str += b64pad;
-      else str += tab.charAt((triplet >> 6*(3-j)) & 0x3F);
-    }
-  }
-  return str;
-}

branches/0.9/pylucid_project/media/PyLucid/shared_sha_tools.js

@@ -16 +16 @@
     // build the SHA hexdigest from the given string. Return false is anything is wrong.
     try {
-        log("sha_hexdigest(" + txt + "):");
+        log("sha_hexdigest('" + txt + "'):");
         SHA_hexdigest = hex_sha1(txt); // from: sha.js
         len = SHA_hexdigest.length;

branches/0.9/pylucid_project/pylucid_plugins/auth/templates/auth/sha_form.html

@@ -17 +17 @@
 var SALT_LEN={{ salt_len }};
 var HASH_LEN={{ hash_len }};
-var salt="";
-var challenge="{{ challenge }}";
-        
+var challenge="{{ challenge }}"; // changed via ajax, after wrong login
+var salt=""; // get via ajax
+
 try {
     jQuery(document);
@@ -31 +31 @@
         return false;
     }
-        if (!hex_sha1) {
-           alert("sha.js not loaded.\n(hex_sha1 not defined)");
-           return false;
-        }
-        if (!sha_hexdigest) {
-           alert("Wrong shared_sha_tools.js loaded! Please update your media files\n(sha_hexdigest not defined)");
-           return false;
-        }
-        
+    if (!hex_sha1) {
+        alert("sha.js not loaded.\n(hex_sha1 not defined)");
+        return false;
+    }
+    if (!sha_hexdigest) {
+        alert("Wrong shared_sha_tools.js loaded! Please update your media files\n(sha_hexdigest not defined)");
+        return false;
+    }
+
     // unhide form
     $("#login_form").css("display", "block").slideDown();
-        
+        $("#load_info").slideUp();
+
     $("#id_username").focus();
-        
-        // TODO: Add a client side random value???
-        // Math.random();
-        // http://docs.jquery.com/Tutorials:Mouse_Position
-        
+
         // remove old page_msg, if exist
-        $("#page_msg").slideUp();
-        
+        log("is_ajax: '{{ is_ajax }}'");
+        if ("{{ is_ajax }}" == "True") {
+                $("#page_msg").slideUp();
+        }
+
         $("#id_username").change(function() {
                 // if the username change, we must get a new salt from server.
@@ -60 +60 @@
                 return false;
         });
-        
+
     $("#id_password").change(function() {
         $("#js_page_msg").slideUp(); // hide old messages
     });
-        
+
         $("#login_form").submit(function() {
                 log("check login form.");
-            try {                       
+            try {
                         var username = $("#id_username").val();
                         log("username:" + username);
-        
+
                 if (username.length<2) {
                     log("username to short, current len:" + username.length);
@@ -77 +77 @@
                     return false;
                 }
-        
+
                 var password = $("#id_password").val();
                 log("password:" + password);
-                        
+
                 if (password.length<8) {
                                 log("password to short, current len:" + password.length);
@@ -91 +91 @@
                             return false;
                         }
-                        
+
                         if (salt=="") {
                                 page_msg_info("{% trans 'Get the hash salt value from server...' %}");
+                var post_data = {"username": username};
+                log("get user salt from server, send POST:" + $.param(post_data));
                                 response = $.ajax({
                                         async: false,
                                         type: "POST",
                                         url: "{{ get_salt_url }}",
-                                        data: {"username": username},
+                                        data: post_data,
                                         dataType: "text",
                                         success: function(data, textStatus, XMLHttpRequest){
@@ -114 +116 @@
                         return false;
                     }
-                        
+
+            log("shapass = sha_hexdigest(salt + password):");
                     shapass = sha_hexdigest(salt + password);
-                    log("shapass - sha_hexdigest(salt + password):" + shapass);
                         if (shapass == false) { return false; }
                     if (shapass.length!=HASH_LEN) {
@@ -122 +124 @@
                         return false;
                     }
-                
+
                     // split SHA-Passwort
                     sha_a = shapass.substr(0, HASH_LEN/2); // sha_a never send to the server
                     sha_b = shapass.substr(HASH_LEN/2, HASH_LEN/2);
                     log("substr: sha_a:|"+sha_a+"| sha_b:|"+sha_b+"|");
-                
-                    // build SHA-1 from challenge and sha_a
-                    sha_a2 = sha_hexdigest(challenge + sha_a)
-                    log("sha_a2 - sha_hexdigest(challenge '"+challenge+"' + sha_a): " + sha_a2);
+
+//            // Generate 'cnonce' a client side random value
+//            var cnonce = "";
+//            cnonce += new Date().getTime();
+//            cnonce += Math.random();
+//            cnonce += $(window).height();
+//            cnonce += $(window).width();
+//            log("generated cnonce:");
+//            cnonce = sha_hexdigest(cnonce);
+
+            log("sha_a2 = sha_hexdigest(challenge + sha_a):");
+                    sha_a2 = sha_hexdigest(challenge + sha_a);
                         if (sha_a2 == false) { return false; }
-                
+
                     // display SHA values
                         $("#sha_values_block").css("display", "block").slideDown();
-            $("#id_password").val(""); // 'delete' plaintext password                   
+            $("#id_password").val(""); // 'delete' plaintext password
                         $("#password_block").slideUp();
                     $("#id_sha_a2").val(sha_a2);
             $("#id_sha_b").val(sha_b);
-                        
+
+                        var post_data = {"username": username, "sha_a2": sha_a2, "sha_b": sha_b}
+                        log("auth user, send POST:" + $.param(post_data));
                         page_msg_info("{% trans 'Send SHA-1 values to the server...' %}");
             response = $.ajax({
@@ -145 +157 @@
                 type: "POST",
                 url: "{{ sha_auth_url }}",
-                data: {"username": username, "sha_a2": sha_a2, "sha_b": sha_b},
+                data: post_data,
                 dataType: "text",
                 success: function(data, textStatus, XMLHttpRequest){
@@ -170 +182 @@
                                 return false
                         }
-                        
+
                         // we get a new challenge and a error message from server
                         challenge = msg.substr(0, msg.indexOf(";"));
                         msg = msg.substr(msg.indexOf(";")+1);
-                        
+
                         log("new challenge:" + challenge);
                         page_msg_error(msg);
-                        
+
             $("#password_block").css("display", "block").slideDown();
             $("#sha_values_block").slideUp("slow");
@@ -183 +195 @@
             $("#id_sha_b").val("");
                         $("#id_password").focus();
-                        
+
                     return false;
         } catch (e) {
@@ -191 +203 @@
         }
         });
+        
+    log("test sha.js");
+    var digits="0123456789";
+    var ascii_lowercase = "abcdefghijklmnopqrstuvwxyz".toLowerCase();
+    var ascii_uppercase = ascii_lowercase.toUpperCase();
+    var test_string = " " + digits + ascii_lowercase + ascii_uppercase;
+    var test_sha = sha_hexdigest(test_string);
+        var should_be = "5b415e2e5421a30b798c9b46638fcd7b58ff4d53".toLowerCase()
+    if (test_sha != should_be) {
+                var msg = "sha.js test failed!\n'" + test_sha + "' != '" + should_be + "'";
+                log(msg);
+        alert("Internal Error:\n" + msg);
+        return false;
+    }
+        log("sha.js is ok");
 });
 </script>
@@ -205 +232 @@
     </fieldset>
 </noscript>
+
+<p id="load_info">loading...</p>
 
 <form method="post" action="" name="login" id="login_form">
@@ -223 +252 @@
   <input id="submit_button" type="submit" value="{% trans 'Log in' %}" />
 </form>
+{% comment %}
+TODO: Reimplement the passwort reset
 {% if pass_reset_link %}
   <a href="{{ pass_reset_link }}">{% trans 'Request a password reset.' %}</a>
 {% endif %}
+{% endcomment %}
 </fieldset>
 {% endblock %}

branches/0.9/pylucid_project/pylucid_plugins/auth/views.py

@@ -20 +20 @@
 from django.conf import settings
 from django.template import RequestContext
-from django.contrib.sites.models import Site
 from django.http import HttpResponse, HttpResponseRedirect, HttpResponseBadRequest
 from django.utils.translation import ugettext as _
 from django.template.loader import render_to_string
-from django.core.exceptions import ObjectDoesNotExist
-
 
 from pylucid_project.apps.pylucid.shortcuts import render_pylucid_response
-from pylucid_project.apps.pylucid.models import LogEntry, BanEntry, UserProfile
-
+from pylucid_project.apps.pylucid.models import LogEntry
 from pylucid_project.utils import crypt
 
-from pylucid_project.pylucid_plugins.auth.forms import WrongUserError, UsernameForm, ShaLoginForm
-from pylucid_plugins.auth.preference_forms import AuthPreferencesForm
-
-
-# DEBUG is usefull for debugging password reset. It send no email, it puts the
-# email text direclty into the CMS page.
+# auth own stuff
+from forms import WrongUserError, UsernameForm, ShaLoginForm
+from preference_forms import AuthPreferencesForm
+
+
+# DEBUG is usefull for debugging. It send always the same challenge "12345" 
 #DEBUG = True
 DEBUG = False
-# IMPORTANT:
-# Should realy only use for debugging!!!
+# IMPORTANT: Should really only use for debugging!!!
 if DEBUG:
     import warnings
-    warnings.warn("Debug mode in auth plugin is on!", UserWarning)
+    warnings.warn("Debug mode in auth plugin is on! print statements would be used!")
 
 
 def _get_challenge(request):
     """ create a new challenge, add it to session and return it"""
-    # Create a new random salt value for the password challenge:
-    challenge = crypt.get_new_salt()
+    if DEBUG:
+        challenge = "12345"
+        print("use DEBUG challenge: %r" % challenge)
+    else:
+        # Create a new random salt value for the password challenge:
+        challenge = crypt.get_new_salt()
 
     # For later comparing with form data
@@ -168 +167 @@
     sha_b = form.cleaned_data["sha_b"]
 
+    if DEBUG:
+        print(
+            "authenticate %r with: challenge: %r, sha_checksum: %r, sha_a2: %r, sha_b: %r" % (
+                user1, challenge, sha_checksum, sha_a2, sha_b
+            )
+        )
+
     # authenticate with:
     # pylucid.system.auth_backends.SiteSHALoginAuthBackend
@@ -202 +208 @@
             user_profile = form.get_user_profile()
         except WrongUserError, err:
+            msg = "can't get userprofile: %s" % err
+            if DEBUG:
+                print(msg)
             if settings.DEBUG:
-                request.page_msg.error(err)
+                request.page_msg.error(msg)
 
     if user_profile is None: # Wrong user?
         username = request.POST["username"]
+        msg = "Username %r is wrong: %r" % (username, form.errors)
+        if DEBUG:
+            print(msg)
         if settings.DEBUG:
-            request.page_msg.error("Wrong user %r !" % username)
+            request.page_msg.error(msg)
         salt = crypt.get_pseudo_salt(username)
     else:
         salt = user_profile.sha_login_salt
 
+    if DEBUG:
+        print("send salt %r to client." % salt)
+
     return HttpResponse(salt, content_type="text/plain")
 
 
 def _login_view(request, next_url):
+    if DEBUG:
+        print("auth debug mode is on!")
+
     if request.method != 'GET':
         debug_msg = "request method %r wrong, only GET allowed" % request.method
@@ -232 +250 @@
 
     context = {
+        "is_ajax": request.is_ajax(),
         "challenge": challenge,
         "salt_len": crypt.SALT_LEN,
@@ -258 +277 @@
     """
     action = request.GET["auth"]
-
-
-
-
 
     if action == "login":