From bf4a6fc9c7c58ce2a650b65e1ce3144672468d0c Mon Sep 17 00:00:00 2001
From: itsupport <itsupport@santropolroulant.org>
Date: Fri, 1 Jun 2018 19:52:38 -0400
Subject: [PATCH 1/2] Read access token from a secure file.

This is safer than pasting it into the script because it means the script can be shared
and modified independently without worrying about leaking tokens, and updates to the script
don't require re-inserting the token.
---
 do_dns_update.sh | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/do_dns_update.sh b/do_dns_update.sh
index 9b18f22..d41eff1 100644
--- a/do_dns_update.sh
+++ b/do_dns_update.sh
@@ -1,8 +1,9 @@
 #!/bin/bash
-# @requires awk, curl, grep, mktemp, sed, tr.
+# @requires awk, curl, grep, mktemp, sed, tr, stat.
 
-## START EDIT HERE.
-do_access_token="";  # paste your DO Personal Access Token here.
+: ${XDG_CONFIG_DIRS:=~/.config}
+
+do_access_token="${XDG_CONFIG_DIRS}"/do_dns_update/access_token
 curl_timeout="15";
 loop_max_records="50";
 url_do_api="https://api.digitalocean.com/v2";
@@ -48,11 +49,29 @@ do_domain="$2";
 if [ $# -lt 2 ] || [ -z "$do_record" ] || [ -z "$do_domain" ] ; then
   echo "Missing required arguments. (See -h for help)";
   exit 1;
-elif [ -z "$do_access_token" ] ; then
-  echo "Missing token. Please edit this script and add your access token first.";
-  exit 1;
+elif [ ! -r "$do_access_token" ]; then
+  echo "Missing token. Please paste it into $do_access_token first."
+  exit 1
+# insist on secure permissions: only the owner of the file should be able to read or write it.
+# we do a bitwise AND to mask out the g=rw and o=rw bits from the permissions;
+# if masking those out gives 0, then we're good
+# note the leading 0s! That makes these numbers octal!
+# XXX if we're concerned about writes then this also needs to check permissions on all parent directories too.
+elif [ $(($(stat -c "%#0a" $do_access_token) & 0066)) -ne 0 ]; then
+  echo "Error: $do_access_token has insecure permissions."
+  exit 1
 fi
 
+# read in access token
+strip_comments()
+{
+  sed 's/#.*//' |  # strip comments
+  sed 's/^\s*//' |    # strip leading whitespace
+  sed 's/\s*$//' |    # strip trailing whitespace
+  sed '/^$/d'  # strip empty lines -- which, after stripping leading/trailing whitespace, covers blank lines too
+}
+do_access_token="$(cat $do_access_token | strip_comments | head -n 1)";
+
 echov()
 {
   if [ $verbose == true ] ; then

From 55b08385750640b32cb4a18aeb7a3e2142fa8a6d Mon Sep 17 00:00:00 2001
From: itsupport <itsupport@santropolroulant.org>
Date: Fri, 1 Jun 2018 20:57:39 -0400
Subject: [PATCH 2/2] Update docs

---
 README.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 59ecdf1..03c7b0b 100644
--- a/README.md
+++ b/README.md
@@ -9,9 +9,11 @@ My use case: *Connect to home server that is on a dynamic IP via a fixed domain
 
 1. Generate [Personal Access Token](https://cloud.digitalocean.com/settings/applications) from your Digital Ocean account.
 
-2. Modify the script to add `access token` and set script permission to `755`.
+2. Place the token in ~/.config/do_dns_update/access_token
 
-		chmod 755 /path/to/file/do_dns_update.sh
+3. Make script runnable.
+
+		chmod +x /path/to/file/do_dns_update.sh
 
 3. [Cron](http://en.wikipedia.org/wiki/Cron#Predefined_scheduling_definitions) the script to update Digital Ocean's DNS at desired frequency. (Note: *API rate limit is currently 1200 /hr. Script run uses 2.*)
 
@@ -41,4 +43,4 @@ My use case: *Connect to home server that is on a dynamic IP via a fixed domain
 
 ## License
 
-The MIT License (MIT).
\ No newline at end of file
+The MIT License (MIT).