"; if ((strlen($pass) == 32) && ($pass == md5($password))) { // Generate new hash $pass = generateHash($password); // Is the sql_patches not installed, than we cannot have a valid hashed password here! if (($ret == "pass") && ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == ""))) $ret = "done"; } elseif ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == "")) { // Old hashing way return $ret; } // Generate salt of password define('__SALT', substr($pass, 0, -40)); $salt = __SALT; // Check if password is same //* DEBUG: */ echo "*".$ret.",".$pass.",".$password.",".$salt."*
\n"; if (($ret == "pass") && ($pass == generateHash($password, $salt)) && (!empty($salt))) { // Change the passord hash here $pass = generateHash($password); // Update password $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s' WHERE login='%s' LIMIT 1", array($pass, $admin_login), __FILE__, __LINE__); // Shall I remove the cache file? if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance != false)) { if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy(); } // Login has failed by default... ;-) $ret = "failed"; // Password matches so login here if (LOGIN_ADMIN($admin_login, $pass)) { // All done now $ret = "done"; } } elseif ((empty($salt)) && ($ret == "pass")) { // Something bad went wrong $ret = "failed"; } elseif ($ret == "done") { // Try to login here if we have the old hashing way (sql_patches not installed?) if (!LOGIN_ADMIN($admin_login, $pass)) { // Something went wrong $ret = "failed"; } } // Return the result //* DEBUG: */ die("RETURN=".$ret); return $ret; } // Try to login the admin by setting some session/cookie variables function LOGIN_ADMIN ($adminLogin, $passHash) { // Now set all session variables and return the result return ( ( set_session("admin_md5", generatePassString($passHash)) ) && ( set_session("admin_login", $adminLogin) ) && ( set_session("admin_last", time()) ) && ( set_session("admin_to", $_POST['timeout']) ) ); } // Only be executed on cookie checking function CHECK_ADMIN_COOKIES ($admin_login, $password) { global $cacheArray, $_CONFIG; $ret = "404"; $pass = ""; if (!empty($cacheArray['admins']['aid'][$admin_login])) { // Get password from cache $pass = $cacheArray['admins']['password'][$admin_login]; $ret = "pass"; $_CONFIG['cache_hits']++; } else { // Get password from DB $result = SQL_QUERY_ESC("SELECT password FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", array($admin_login), __FILE__, __LINE__); if (SQL_NUMROWS($result) == 1) { // Entry found $ret = "pass"; // Fetch password list($pass) = SQL_FETCHROW($result); } // Free result SQL_FREERESULT($result); } //* DEBUG: */ echo __FUNCTION__.":".$pass."(".strlen($pass).")/".$password."(".strlen($password).")
\n"; // Check if password matches if (($ret == "pass") && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) { // Passwords matches! $ret = "done"; } // Return result return $ret; } // function admin_WriteData ($file, $comment, $prefix, $suffix, $DATA, $seek=0) { // Initialize some variables $done = false; $seek++; $found = false; // Is the file there and read-/write-able? if ((file_exists($file)) && (is_readable($file)) && (is_writeable($file))) { $search = "CFG: ".$comment; $tmp = $file.".tmp"; // Open the source file $fp = @fopen($file, 'r') or OUTPUT_HTML("READ: ".$file."
"); // Is the resource valid? if (is_resource($fp)) { // Open temporary file $fp_tmp = @fopen($tmp, 'w') or OUTPUT_HTML("WRITE: ".$tmp."
"); // Is the resource again valid? if (is_resource($fp_tmp)) { while (!feof($fp)) { // Read from source file $line = fgets ($fp, 1024); if (strpos($line, $search) > -1) { $next = 0; $found = true; } if ($next > -1) { if ($next == $seek) { $next = -1; $line = $prefix . $DATA . $suffix."\n"; } else { $next++; } } // Write to temp file fputs($fp_tmp, $line); } // Close temp file fclose($fp_tmp); // Finished writing tmp file $done = true; } // Close source file fclose($fp); if (($done) && ($found)) { // Copy back tmp file and delete tmp :-) @copy($tmp, $file); @unlink($tmp); define('_FATAL', false); } elseif (!$found) { OUTPUT_HTML("CHANGE: 404!"); define('_FATAL', true); } else { OUTPUT_HTML("TMP: UNDONE!"); define('_FATAL', true); } } } else { // File not found, not readable or writeable OUTPUT_HTML("404: ".$file."
"); } } // function ADMIN_DO_ACTION($wht) { global $menuDesription, $menuTitle, $_CONFIG, $cacheArray, $link, $DATA, $DEPTH; //* DEBUG: */ echo __LINE__."*".$wht."/".$GLOBALS['module']."/".$GLOBALS['action']."/".$GLOBALS['what']."*
\n"; if (EXT_IS_ACTIVE("cache")) { // Include cache instance global $cacheInstance; } // Remove any spaces from variable if (empty($wht)) { // Default admin action is the overview page $wht = "overview"; } else { // Compile out some chars $wht = COMPILE_CODE($wht, false, false, false); } // Get action value $act = GET_ACTION($GLOBALS['module'], $wht); // Define admin login name and ID number define('__ADMIN_LOGIN', SQL_ESCAPE(get_session('admin_login'))); define('__ADMIN_ID' , GET_ADMIN_ID(get_session('admin_login'))); // Preload templates if (EXT_IS_ACTIVE("admins")) { define('__ADMIN_WELCOME', LOAD_TEMPLATE("admin_welcome_admins", true)); } else { define('__ADMIN_WELCOME', LOAD_TEMPLATE("admin_welcome", true)); } define('__ADMIN_FOOTER' , LOAD_TEMPLATE("admin_footer" , true)); define('__ADMIN_MENU' , ADD_ADMIN_MENU($act, $wht, true)); // Tableset header LOAD_TEMPLATE("admin_main_header"); // Check if action/what pair is valid $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_admin_menu WHERE action='%s' AND ((what='%s' AND what != 'overview') OR ((what='' OR what IS NULL) AND '%s'='overview')) LIMIT 1", array($act, $wht, $wht), __FILE__, __LINE__); if (SQL_NUMROWS($result) == 1) { // Free memory SQL_FREERESULT($result); // Is valid but does the inlcude file exists? $INC = sprintf("%sinc/modules/admin/action-%s.php", PATH, $act); if ((file_exists($INC)) && (is_readable($INC)) && (VALIDATE_MENU_ACTION("admin", $act, $wht)) && (__ACL_ALLOW == true)) { // Ok, we finally load the admin action module include($INC); } elseif (__ACL_ALLOW == false) { // Access denied LOAD_TEMPLATE("admin_menu_failed", false, ADMINS_ACCESS_DENIED); ADD_FATAL(ADMINS_ACCESS_DENIED); } else { // Include file not found! :-( LOAD_TEMPLATE("admin_menu_failed", false, ADMIN_404_ACTION); ADD_FATAL(ADMIN_404_ACTION_1.$act.ADMIN_404_ACTION_2); } } else { // Invalid action/what pair found! LOAD_TEMPLATE("admin_menu_failed", false, ADMIN_INVALID_ACTION); ADD_FATAL(ADMIN_INVALID_ACTION_1.$act."/".$wht.ADMIN_INVALID_ACTION_2); } // Tableset footer LOAD_TEMPLATE("admin_main_footer"); } // function ADD_ADMIN_MENU($act, $wht,$return=false) { global $menuDesription, $menuTitle, $link; $SUB = false; // Menu descriptions $menuDesription = array(); $menuTitle = array(); // Build main menu $result_main = SQL_QUERY("SELECT action, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE (what='' OR what IS NULL) ORDER BY sort, id DESC", __FILE__, __LINE__); $OUT = ""; if (SQL_NUMROWS($result_main) > 0) { $OUT = "\n"; while (list($menu, $title, $descr) = SQL_FETCHROW($result_main)) { if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) { $ACL = ADMINS_CHECK_ACL($menu, ""); } else { // ACL is "allow"... hmmm $ACL = true; } if ($ACL) { if (!$SUB) { // Insert compiled menu title and description $menuTitle[$menu] = $title; $menuDesription[$menu] = $descr; } $OUT .= "\n"; $result_what = SQL_QUERY_ESC("SELECT what, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE action='%s' AND what != '' ORDER BY sort, id DESC", array($menu), __FILE__, __LINE__); if ((SQL_NUMROWS($result_what) > 0) && ($act == $menu)) { $menuDesription = array(); $menuTitle = array(); $SUB = true; $OUT .= "\n"; } $OUT .= "\n"; } } // Free memory SQL_FREERESULT($result_main); $OUT .= "
 
 · "; if (($menu == $act) && (empty($wht))) { $OUT .= ""; } else { $OUT .= "["; } $OUT .= $title; if (($menu == $act) && (empty($wht))) { $OUT .= ""; } else { $OUT .= "]"; } $OUT .= "
  \n"; while (list($wht_sub, $title_what, $desc_what) = SQL_FETCHROW($result_what)) { // Filename $INC = sprintf("%sinc/modules/admin/what-%s.php", PATH, $wht_sub); if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) { $ACL = ADMINS_CHECK_ACL("", $wht_sub); } else { // ACL is "allow"... hmmm $ACL = true; } $readable = ((file_exists($INC)) && (is_readable($INC))); if ($ACL) { // Insert compiled title and description $menuTitle[$wht_sub] = $title_what; $menuDesription[$wht_sub] = $desc_what; $OUT .= "\n"; } } // Free memory SQL_FREERESULT($result_what); $OUT .= "
 --> "; if ($readable) { if ($wht == $wht_sub) { $OUT .= ""; } else { $OUT .= "["; } } else { $OUT .= ""; } $OUT .= $title_what; if ($readable) { if ($wht == $wht_sub) { $OUT .= ""; } else { $OUT .= "]"; } } else { $OUT .= ""; } $OUT .= "
\n"; } // Compile and run the code here. This inserts all constants into the // HTML output. Costs me some time to figure this out... *sigh* Quix0r $eval = "\$OUT = \"".COMPILE_CODE(addslashes($OUT))."\";"; eval($eval); // Return or output content? if ($return) { return $OUT; } else { OUTPUT_HTML($OUT); } } // function ADD_MEMBER_SELECTION_BOX($add_all = false, $return = false, $none = false, $def = "0") { // Output selection form with all confirmed user accounts listed $result = SQL_QUERY("SELECT userid, surname, family FROM "._MYSQL_PREFIX."_user_data ORDER BY userid", __FILE__, __LINE__); $OUT = ""; // USe this only for adding points (e.g. adding refs really makes no sence ;-) ) if ($add_all) $OUT = " \n"; elseif ($none) $OUT = " \n"; while (list($id, $sname, $fname) = SQL_FETCHROW($result)) { $OUT .= "