$adminId);
// Is the cache valid?
if (isAdminHashSet($admin)) {
// Get password from cache
$data['password'] = getAdminHash($admin);
$ret = 'pass';
incrementStatsEntry('cache_hits');
// Include more admins data?
if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($GLOBALS['cache_array']['admin']['login_failures'][$adminId]))) {
// Load them here
$data['login_failures'] = $GLOBALS['cache_array']['admin']['login_failures'][$adminId];
$data['last_failure'] = $GLOBALS['cache_array']['admin']['last_failure'][$adminId];
} // END - if
} elseif (!isExtensionActive('cache')) {
// Add extra data via filter now
$add = runFilterChain('sql_admin_extra_data');
// Get password from DB
$result = SQL_QUERY_ESC("SELECT `password`" . $add . " FROM `{?_MYSQL_PREFIX?}_admins` WHERE `id`=%s LIMIT 1",
array($adminId), __FUNCTION__, __LINE__);
// Entry found?
if (SQL_NUMROWS($result) == 1) {
// Login password found
$ret = 'pass';
// Fetch data
$data = SQL_FETCHARRAY($result);
} // END - if
// Free result
SQL_FREERESULT($result);
}
//* DEBUG: */ outputHtml("*".$data['password'].'/'.md5($password).'/'.$ret." ");
if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) {
// Generate new hash
$data['password'] = generateHash($password);
// Is the sql_patches not installed, than we cannot have a valid hashed password here!
if (($ret == 'pass') && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) $ret = 'done';
} elseif ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches'))) {
// Old hashing way
return $ret;
} elseif (!isset($data['password'])) {
// Password not found, so no valid login!
return $ret;
}
// Generate salt of password
$salt = substr($data['password'], 0, -40);
// Check if password is same
//* DEBUG: */ outputHtml("*".$ret.','.$data['password'].','.$password.','.$salt."* ");
if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == $password)) {
// Re-hash the plain passord with new random salt
$data['password'] = generateHash($password);
// Do we have 0.7.0 of admins or later?
// Remmeber login failures if available
if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($data['login_failures']))) {
// Store it in session
setSession('mxchange_admin_failures', $data['login_failures']);
setSession('mxchange_admin_last_fail', $data['last_failure']);
// Update password and reset login failures
SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s',`login_failures`=0,`last_failure`='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1",
array($data['password'], $adminId), __FUNCTION__, __LINE__);
} else {
// Update password
SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s' WHERE `id`=%s LIMIT 1",
array($data['password'], $adminId), __FUNCTION__, __LINE__);
}
// Rebuild cache
rebuildCacheFile('admin', 'admin');
// Login has failed by default... ;-)
$ret = 'failed1';
// Password matches so login here
if (doAdminLogin($admin, $data['password'])) {
// All done now
$ret = 'done';
} // END - if
} elseif ((empty($salt)) && ($ret == 'pass')) {
// Something bad went wrong
$ret = 'failed_salt';
} elseif ($ret == 'done') {
// Try to login here if we have the old hashing way (sql_patches not installed?)
if (!doAdminLogin($admin, $data['password'])) {
// Something went wrong
$ret = 'failed2';
} // END - if
}
// Count login failure if admins extension version is 0.7.0+
if (($ret == 'pass') && (getExtensionVersion('admins') >= '0.7.0')) {
// Update counter
SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET login_failures`=`login_failures`+1,`last_failure`=NOW() WHERE `id`=%s LIMIT 1",
array($adminId), __FUNCTION__, __LINE__);
// Rebuild cache
rebuildCacheFile('admin', 'admin');
} // END - if
// Return the result
//* DEBUG: */ die('RETURN=' . $ret);
return $ret;
}
// Try to login the admin by setting some session/cookie variables
function doAdminLogin ($adminLogin, $passHash) {
// Reset failure counter on matching admins version
if ((isExtensionInstalledAndNewer('admins', '0.7.0')) && ((isExtensionOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) {
// Reset counter on out-dated sql_patches version
SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `login_failures`=0, `last_failure`='0000-00-00 00:00:00' WHERE `login`='%s' LIMIT 1",
array($adminLogin), __FUNCTION__, __LINE__);
// Rebuild cache
rebuildCacheFile('admin', 'admin');
} // END - if
// Now set all session variables and return the result
return ((
setSession('admin_md5', generatePassString($passHash))
) && (
setSession('admin_login', $adminLogin)
) && (
setSession('admin_last', time())
) && (
setSession('admin_to', bigintval(postRequestElement('timeout')))
));
}
// Only be executed on cookie checking
function ifAdminCookiesAreValid ($admin, $password) {
// By default no admin cookies are found
$ret = '404';
$pass = '';
// Get hash
$pass = getAdminHash($admin);
if ($pass != '-1') $ret = 'pass';
//* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).") ");
// Check if password matches
if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) {
// Passwords matches!
$ret = 'done';
} // END - if
// Return result
return $ret;
}
// Do an admin action
function doAdminAction ($what) {
//* DEBUG: */ outputHtml(__LINE__."*".$what.'/'.getModule().'/'.getAction().'/'.getWhat()."* ");
// Remove any spaces from variable
if (empty($what)) {
// Default admin action is the overview page
$what = 'overview';
} else {
// Compile out some chars
$what = compileCode($what, false, false, false);
}
// Get action value
$action = getModeAction(getModule(), $what);
// Define admin login name and ID number
$content['login'] = getSession('admin_login');
$content['id'] = getCurrentAdminId();
// Preload templates
if (isExtensionActive('admins')) {
$content['welcome'] = loadTemplate('admin_welcome_admins', true, $content);
} else {
$content['welcome'] = loadTemplate('admin_welcome', true, $content);
}
$content['footer'] = loadTemplate('admin_footer' , true, $content);
$content['menu'] = addAdminMenu($action, $what, true);
// Tableset header
loadTemplate('admin_main_header', false, $content);
// Check if action/what pair is valid
$result_action = SQL_QUERY_ESC("SELECT
`id`
FROM
`{?_MYSQL_PREFIX?}_admin_menu`
WHERE
`action`='%s' AND
(
(
`what`='%s' AND `what` != 'overview'
) OR (
(
`what`='' OR `what` IS NULL
) AND (
'%s'='overview'
)
)
)
LIMIT 1", array($action, $what, $what), __FUNCTION__, __LINE__);
if (SQL_NUMROWS($result_action) == 1) {
// Is valid but does the inlcude file exists?
$inc = sprintf("inc/modules/admin/action-%s.php", $action);
if ((isIncludeReadable($inc)) && (isMenuActionValid('admin', $action, $what)) && ($GLOBALS['acl_allow'] === true)) {
// Ok, we finally load the admin action module
loadInclude($inc);
} elseif ($GLOBALS['acl_allow'] === false) {
// Access denied
loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACCESS_DENIED'), $what));
} else {
// Include file not found! :-(
loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_404'), $action));
}
} else {
// Invalid action/what pair found!
loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_INVALID'), $action.'/'.$what));
}
// Free memory
SQL_FREERESULT($result_action);
// Tableset footer
loadTemplate('admin_main_footer', false, $content);
}
// Adds an admin menu
function addAdminMenu ($action, $what, $return=false) {
// Init variables
$SUB = false;
$OUT = '';
// Menu descriptions
$GLOBALS['menu']['description'] = array();
$GLOBALS['menu']['title'] = array();
// Build main menu
$result_main = SQL_QUERY("SELECT
`action`, `title`, `descr`
FROM
`{?_MYSQL_PREFIX?}_admin_menu`
WHERE
(`what`='' OR `what` IS NULL)
ORDER BY
`sort` ASC,
`id` DESC", __FUNCTION__, __LINE__);
if (SQL_NUMROWS($result_main) > 0) {
$OUT = "
\n";
$OUT .= "
\n";
// @TODO Rewrite this to $content = SQL_FETCHARRAY()
while (list($menu, $title, $descr) = SQL_FETCHROW($result_main)) {
if ((isExtensionActive('admins')) && (getExtensionVersion('admins') > '0.2.0')) {
$ACL = adminsCheckAdminAcl($menu, '');
} else {
// @TODO ACL is 'allow'... hmmm
$ACL = true;
}
if ($ACL === true) {
if ($SUB === false) {
// Insert compiled menu title and description
$GLOBALS['menu']['title'][$menu] = $title;
$GLOBALS['menu']['description'][$menu] = $descr;
}
$OUT .= "
\n";
// Check for menu entries
$result_what = SQL_QUERY_ESC("SELECT
`what`, `title`, `descr`
FROM
`{?_MYSQL_PREFIX?}_admin_menu`
WHERE
`action`='%s' AND
`what` != '' AND
`what` IS NOT NULL
ORDER BY
`sort` ASC,
`id` DESC",
array($menu), __FUNCTION__, __LINE__);
// Remember the count for later checks
setAdminMenuHasEntries($menu, ((SQL_NUMROWS($result_what) > 0) && ($action == $menu)));
// Do we have entries?
if ((ifAdminMenuHasEntries($menu)) && (SQL_NUMROWS($result_what) > 0)) {
$GLOBALS['menu']['description'] = array();
$GLOBALS['menu']['title'] = array(); $SUB = true;
$OUT .= "
\n";
// @TODO Rewrite this to $content = SQL_FETCHARRAY()
while (list($what_sub, $title_what, $desc_what) = SQL_FETCHROW($result_what)) {
// Check for access level
if ((isExtensionActive('admins')) && (getExtensionVersion('admins') > '0.2.0')) {
$ACL = adminsCheckAdminAcl('', $what_sub);
} else {
// @TODO ACL is 'allow'... hmmm
$ACL = true;
}
// Filename
$inc = sprintf("inc/modules/admin/what-%s.php", $what_sub);
// Is the file readable?
$readable = isIncludeReadable($inc);
// Access allowed?
if ($ACL === true) {
// Insert compiled title and description
$GLOBALS['menu']['title'][$what_sub] = $title_what;
$GLOBALS['menu']['description'][$what_sub] = $desc_what;
$OUT .= "
\n";
} // END - if
} // END - while
// Free memory
SQL_FREERESULT($result_what);
$OUT .= "
\n";
} // END - if
$OUT .= "
\n";
} // END - if
} // END - while
// Free memory
SQL_FREERESULT($result_main);
$OUT .= "
\n";
}
// Is there a cache instance again?
// Return or output content?
if ($return === true) {
return $OUT;
} else {
outputHtml($OUT);
}
}
// Create member selection box
function addMemberSelectionBox ($def=0, $add_all=false, $return=false, $none=false, $field='userid') {
// Output selection form with all confirmed user accounts listed
$result = SQL_QUERY("SELECT `userid`, `surname`, `family` FROM `{?_MYSQL_PREFIX?}_user_data` ORDER BY `userid` ASC", __FUNCTION__, __LINE__);
// Default output
$OUT = '';
// USe this only for adding points (e.g. adding refs really makes no sence ;-) )
if ($add_all === true) $OUT = " \n";
elseif ($none === true) $OUT = " \n";
while ($content = SQL_FETCHARRAY($result)) {
$OUT .= "