2 /************************************************************************
3 * Mailer v0.2.1-FINAL Start: 08/31/2003 *
4 * =================== Last change: 07/02/2004 *
6 * -------------------------------------------------------------------- *
8 * -------------------------------------------------------------------- *
9 * Short description : Administration module *
10 * -------------------------------------------------------------------- *
11 * Kurzbeschreibung : Administrationsmodul *
12 * -------------------------------------------------------------------- *
15 * $Tag:: 0.2.1-FINAL $ *
17 * -------------------------------------------------------------------- *
18 * Copyright (c) 2003 - 2009 by Roland Haeder *
19 * Copyright (c) 2009 - 2011 by Mailer Developer Team *
20 * For more information visit: http://www.mxchange.org *
22 * This program is free software; you can redistribute it and/or modify *
23 * it under the terms of the GNU General Public License as published by *
24 * the Free Software Foundation; either version 2 of the License, or *
25 * (at your option) any later version. *
27 * This program is distributed in the hope that it will be useful, *
28 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
29 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
30 * GNU General Public License for more details. *
32 * You should have received a copy of the GNU General Public License *
33 * along with this program; if not, write to the Free Software *
34 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, *
36 ************************************************************************/
38 // Some security stuff...
39 if (!defined('__SECURITY')) {
44 loadIncludeOnce('inc/modules/admin/admin-inc.php');
46 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)
47 fixDeletedCookies(array('admin_id', 'admin_md5', 'admin_last'));
52 // Is no admin registered?
53 if (!isAdminRegistered()) {
54 // Admin is not registered so we have to inform the user
55 if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('pass1')) || (strlen(postRequestParameter('pass1')) < 4) || (!isPostRequestParameterSet('pass2')) || (strlen(postRequestParameter('pass2')) < 4) || (postRequestParameter('pass1') != postRequestParameter('pass2')))) {
56 setPostRequestParameter('ok', '***');
59 // Clear error message
62 if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
63 // Hash the password with the old function because we are here in install mode
64 $hashedPass = md5(postRequestParameter('pass1'));
66 // Kill maybe existing session variables
67 destroyAdminSession(false);
70 $ret = addAdminAccount(postRequestParameter('login'), $hashedPass, getConfig('WEBMASTER'));
72 // Check if registration wents fine
75 $done = changeDataInInclude(getCachePath() . 'config-local.php', 'ADMIN-SETUP', "setConfigEntry('ADMIN_REGISTERED', '", "');", 'Y', 0);
77 // Registering is done
78 redirectToUrl('modules.php?module=admin&register=done');
80 // Registration incomplete
81 $errorMessage = '{--ADMIN_CANNOT_COMPLETE--}';
83 // Set this to have our error message displayed
84 setPostRequestParameter('ok', '***');
88 case 'failed': // Registration has failed
89 $errorMessage = '{--ADMIN_REGISTER_FAILED--}';
91 // Set this to have our error message displayed
92 setPostRequestParameter('ok', '***');
95 case 'already': // Admin does already exists!
96 $errorMessage = '{--ADMIN_LOGIN_ALREADY_REG--}';
98 // Set this to have our error message displayed
99 setPostRequestParameter('ok', '***');
103 // Any other kind will be logged
104 $errorMessage = sprintf("Unknown return code %s from ifAdminLoginDataIsValid().", $ret);
105 logDebugMessage(__FILE__, __LINE__, $errorMessage);
107 // Set this to have our error message displayed
108 setPostRequestParameter('ok', '***');
113 // Whas that action okay?
114 if ($ret != 'done') {
116 $content['login'] = '';
117 if (isPostRequestParameterSet('login')) {
118 $content['login'] = postRequestParameter('login');
121 // Init array elements
122 $content['login_message'] = '';
123 $content['pass1_message'] = '';
124 $content['pass2_message'] = '';
126 // Yet-another notice-fix
127 if ((isFormSent()) && (postRequestParameter('ok') == '***')) {
134 if (empty($content['login'])) $loginMessage = '{--ADMIN_NO_LOGIN--}';
136 // An error comes back from registration?
137 if ((!empty($ret)) && ($ret != 'init')) $loginMessage = $errorMessage;
139 // No password 1 entered or to short?
140 if (!isPostRequestParameterSet('pass1')) $pass1Message = '{--ADMIN_NO_PASS1--}';
141 elseif (strlen(postRequestParameter('pass1')) < 4) $pass1Message = '{--ADMIN_SHORT_PASS1--}';
143 // No password 2 entered or to short?
144 if (!isPostRequestParameterSet('pass2')) $pass2Message = '{--ADMIN_NO_PASS2--}';
145 elseif (strlen(postRequestParameter('pass2')) < 4) $pass2Message = '{--ADMIN_SHORT_PASS2--}';
147 // Both didn't match?
148 if (postRequestParameter('pass1') != postRequestParameter('pass2')) {
150 if (empty($pass1Message)) $pass1Message = '{--ADMIN_PASS1_MISMATCH--}';
151 if (empty($pass2Message)) $pass2Message = '{--ADMIN_PASS2_MISMATCH--}';
154 // Output error messages
155 $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
156 $content['pass1_message'] = loadTemplate('admin_login_msg', true, $pass1Message);
157 $content['pass2_message'] = loadTemplate('admin_login_msg', true, $pass2Message);
160 // Output message in seperate template
161 loadTemplate('admin_settings_saved', false, '{--ADMIN_ACCOUNT_NOT_REGISTERED_YET--}');
163 // Load register template
164 loadTemplate('admin_reg_form', false, $content);
166 } elseif (isGetRequestParameterSet('reset_pass')) {
167 // Is the form submitted?
168 if ((isPostRequestParameterSet('send_link')) && (isPostRequestParameterSet('email'))) {
170 loadTemplate('admin_settings_saved', false, sendAdminPasswordResetLink(postRequestParameter('email')));
171 } elseif (isGetRequestParameterSet('hash')) {
172 // Output form for hash validation
173 loadTemplate('admin_validate_reset_hash_form', false, getRequestParameter('hash'));
174 } elseif ((isPostRequestParameterSet('validate_hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('hash'))) {
175 // Validate the login data and hash
176 $valid = adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'));
179 if ($valid === true) {
180 // Prepare content first
182 'hash' => secureString(postRequestParameter('hash')),
183 'login' => secureString(postRequestParameter('login'))
186 // Validation okay so display form for final password change
187 loadTemplate('form_reset_password_form', false, $content);
189 // Cannot validate the login data and hash
190 loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED--}');
192 } elseif ((isPostRequestParameterSet('reset_pass')) && (isPostRequestParameterSet('hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('pass1')) && (postRequestParameter('pass1') == postRequestParameter('pass2'))) {
193 // Okay, we shall the admin password here. So first revalidate the hash
194 if (adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'))) {
196 loadTemplate('form_reset_pass_done', false, doResetAdminPassword(postRequestParameter('login'), postRequestParameter('pass1')));
199 loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2--}');
202 // Output reset password form
203 loadTemplate('admin_send_reset_link');
205 } elseif ((!isSessionVariableSet('admin_id')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last'))) {
206 // At leat one administrator account was created
207 if ((isSessionVariableSet('admin_id')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last'))) {
208 // Timeout for last login, we have to logout first!
209 redirectToUrl('modules.php?module=admin&logout=1');
212 if (isGetRequestParameterSet('register')) {
213 // Registration of first admin is done
214 if (getRequestParameter('register') == 'done') loadTemplate('admin_settings_saved', false, '{--ADMIN_REGISTER_DONE--}');
217 // Check if the admin has submitted data or not
218 if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('password')) || (strlen(postRequestParameter('password')) < 4))) {
219 setPostRequestParameter('ok', '***');
222 if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
223 // All required data was entered so we check his account
224 $ret = ifAdminLoginDataIsValid(postRequestParameter('login'), postRequestParameter('password'));
226 // Which status do we have?
228 case 'done': // Admin and password are okay, so we log in now
229 // Construct URL and redirect
230 $url = 'modules.php?module=admin&';
232 // Rewrite overview module
233 if (getWhat() == 'overview') {
234 setAction(getActionFromModuleWhat(getModule(), getWhat()));
238 if (isWhatSet()) $url .= 'what='.getWhat();
239 elseif (isActionSet()) $url .= 'action='.getAction();
240 elseif (isGetRequestParameterSet('area')) $url .= 'area='.getRequestParameter('area');
246 case '404': // Administrator login not found
247 setPostRequestParameter('ok', $ret);
248 $ret = getMaskedMessage('ADMIN_ACCOUNT_404', postRequestParameter('login'));
249 destroyAdminSession();
252 case 'password': // Wrong password
253 setPostRequestParameter('ok', $ret);
254 $ret = '{--WRONG_PASS--} [<a href="{%url=modules.php?module=admin&reset_pass=1%}">{--ADMIN_RESET_PASS--}</a>]';
255 destroyAdminSession();
258 default: // Others will be logged
259 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid()", $ret));
265 if ($ret != 'done') {
266 $content['login'] = '';
267 if (isPostRequestParameterSet('login')) {
268 $content['login'] = postRequestParameter('login');
271 // Init array elements
272 $content['login_message'] = '';
273 $content['pass_message'] = '';
276 // Set messages to zero
277 $loginMessage = ''; $passwdMessage = '';
280 if (!isPostRequestParameterSet('login')) $loginMessage = '{--ADMIN_NO_LOGIN--}';
282 // An error comes back from login?
283 if ((!empty($ret)) && (postRequestParameter('ok') == '404')) $loginMessage = $ret;
285 // No password entered?
286 if (!isPostRequestParameterSet('password')) $passwdMessage = '{--ADMIN_NO_PASS--}';
288 // Or password too short?
289 if (strlen(postRequestParameter('password')) < 4) $passwdMessage = '{--ADMIN_SHORT_PASS--}';
291 // An error comes back from login?
292 if ((!empty($ret)) && (postRequestParameter('ok') == 'password')) $passwdMessage = $ret;
294 // Load message template
295 $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
296 $content['pass_message'] = loadTemplate('admin_login_msg', true, $passwdMessage);
301 // Restore old what value
302 $content = merge_array($content, array('target' => 'what', 'value' => getWhat()));
303 } elseif (isActionSet()) {
304 if (getAction() != 'logout') {
305 // Restore old action value
306 $content = merge_array($content, array('target' => 'action', 'value' => getAction()));
308 // Set default values
309 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
311 } elseif (isGetRequestParameterSet('area')) {
312 // Restore old area value
313 $content = merge_array(
317 'value' => getRequestParameter('area')
321 // Set default values
322 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
325 // Load login form template
326 loadTemplate('admin_login_form', false, $content);
328 } elseif (isGetRequestParameterSet('logout')) {
329 // Only try to remove cookies
330 if (destroyAdminSession()) {
331 // Load logout template
332 if (isGetRequestParameterSet('register')) {
334 $register = getRequestParameter('register');
336 // Special logout redirect for installation of given extension
337 loadTemplate(sprintf("admin_logout_%s_install", $register));
338 } elseif (isGetRequestParameterSet('remove')) {
340 $remove = getRequestParameter('remove');
342 // Special logout redirect for removal of given extension
343 loadTemplate(sprintf("admin_logout_%s_remove", $remove));
345 // Logged out normally
346 loadTemplate('admin_logout');
349 // Something went wrong here...
350 loadTemplate('admin_settings_unsaved', false, '{--ADMIN_LOGOUT_FAILED--}');
353 addFatalMessage(__FILE__, __LINE__, '{--CANNOT_UNREG_SESS--}');
356 // Maybe an Admin want's to login?
357 $ret = ifAdminCookiesAreValid(getCurrentAdminId(), getAdminMd5());
362 // Check for access control line of current menu entry
363 runFilterChain('check_admin_acl');
365 // Check for version and switch between old menu system and new intelligent menu system
366 if ((adminGetMenuMode() == 'NEW') && (isIncludeReadable('inc/modules/admin/lasys-inc.php'))) {
367 // Default area is the entrance, of course
370 // Check for similar URL variable
371 if (isGetRequestParameterSet('area')) $area = getRequestParameter('area');
373 // Load logical-area menu-system file
374 loadIncludeOnce('inc/modules/admin/lasys-inc.php');
376 // Create new-style menu system will logical areas
377 doAdminLogicalArea($area, $action, getWhat());
379 // This little call constructs the whole default old and lacky menu system
380 // on left side. It also renders the content on right side
385 case '404': // Administrator login not found
386 setPostRequestParameter('ok', $ret);
387 loadTemplate('admin_settings_saved', false, getMaskedMessage('ADMIN_ACCOUNT_404', getCurrentAdminId()));
388 destroyAdminSession();
391 case 'password': // Wrong password
392 setPostRequestParameter('ok', $ret);
393 loadTemplate('admin_settings_saved', false, '{--WRONG_PASS--}');
394 destroyAdminSession();
397 default: // Others will be logged
398 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminCookiesAreValid()", $ret));