X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;ds=sidebyside;f=inc%2Fmodules%2Fadmin.php;h=c0e1fdf48a4c581180ac6f9475013f3f86d9121d;hb=3aeddfb08e3fa6c1bfbd54084523eaa3e06175ba;hp=058b1f8f0ef42e08344990ab2f7b616a23624a8f;hpb=b5912168d72ae511eb623c3d92540c82d31b93c5;p=mailer.git diff --git a/inc/modules/admin.php b/inc/modules/admin.php index 058b1f8f0e..c0e1fdf48a 100644 --- a/inc/modules/admin.php +++ b/inc/modules/admin.php @@ -32,15 +32,13 @@ ************************************************************************/ // Some security stuff... -if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) -{ +if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) { $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php"; require($INC); } // Login is default -if ((empty($GLOBALS['action'])) && ($check == "admin_only")) -{ +if ((empty($GLOBALS['action'])) && ($check == "admin_only")) { // Redirect to right URL LOAD_URL("modules.php?module=admin&action=login"); } @@ -54,32 +52,23 @@ FIX_DELETED_COOKIES(array('admin_login', 'admin_md5', 'admin_last', 'admin_to')) // Is the logout empty? if (empty($_GET['logout'])) $_GET['logout'] = ""; -if (!admin_registered) -{ +if (!isBooleanConstantAndTrue('admin_registered')) { // Admin is not registered so we have to inform the user if ((isset($_POST['ok'])) && ((empty($_POST['login'])) || (empty($_POST['pass'])) || (strlen($_POST['pass']) < 4))) $_POST['ok'] = "***"; - if ((isset($_POST['ok'])) && ($_POST['ok'] != "***")) - { - // Hash the password with our new generateHash() function - $hashedPass = generateHash($_POST['pass']); - - // If the password has not been hashed we have to fall-back to md5() - if ($hashedPass == $_POST['pass']) $hashedPass = md5($hashedPass); + if ((isset($_POST['ok'])) && ($_POST['ok'] != "***")) { + // Hash the password with the old function because we are here in install mode + $hashedPass = md5($hashedPass); // Do registration $ret = REGISTER_ADMIN($_POST['login'], $hashedPass); switch ($ret) { case "done": - admin_WriteData(PATH."inc/config.php", "ADMIN-SETUP", "define ('admin_registered', ", ");", "true", 0); - if (!_FATAL) - { - $URL = URL."/modules.php?module=admin&action=login®ister=done"; - LOAD_URL($URL); - die($URL); - } - else - { + admin_WriteData(PATH."inc/config.php", "ADMIN-SETUP", "define('admin_registered', ", ");", "true", 0); + if (!_FATAL) { + // Registering is done + LOAD_URL(URL."/modules.php?module=admin&action=login®ister=done"); + } else { $ret = ADMIN_CANNOT_COMPLETE; } break; @@ -90,20 +79,16 @@ if (!admin_registered) case "already": default: - if ($ret == "already") - { + if ($ret == "already") { // Admin does already exists! $ret = ADMIN_LOGIN_ALREADY_REG; - } - else - { + } else { // Any other kind $ret = "done"; } - if (!admin_registered) - { + if (!isBooleanConstantAndTrue('admin_registered')) { // Write to config that registration is done - admin_WriteData(PATH."inc/config.php", "ADMIN-SETUP", "define ('admin_registered', ", ");", "true", 0); + admin_WriteData(PATH."inc/config.php", "ADMIN-SETUP", "define('admin_registered', ", ");", "true", 0); // Load URL for login $URL = URL."/modules.php?module=admin&action=login"; @@ -112,8 +97,7 @@ if (!admin_registered) break; } } - if ($ret != "done") - { + if ($ret != "done") { // Fixes another "Notice" if (!empty($_POST['login'])) { define('__LOGIN_VALUE', $_POST['login']); @@ -122,8 +106,7 @@ if (!admin_registered) } // Yet-another "Notice" fix - if ((!empty($_POST['ok'])) && ($_POST['ok'] == "***")) - { + if ((!empty($_POST['ok'])) && ($_POST['ok'] == "***")) { // No login entered? if (empty($_POST['login'])) $MSG1 = ADMIN_NO_LOGIN; @@ -142,9 +125,7 @@ if (!admin_registered) // Reset variables $MSG1 = ""; $MSG2 = ""; - } - else - { + } else { // Reset values to nothing define('__MSG_LOGIN', ""); define('__MSG_PASS' , ""); @@ -153,18 +134,14 @@ if (!admin_registered) // Load register template LOAD_TEMPLATE("admin_reg_form"); } -} - elseif ((empty($_SESSION['admin_login'])) || (empty($_SESSION['admin_md5'])) || (empty($_SESSION['admin_last'])) || (empty($_SESSION['admin_to'])) || (($_SESSION['admin_last'] + bigintval($_SESSION['admin_to']) * 3600 * 24) < time())) -{ +} elseif ((!isSessionVariableSet('admin_login')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last')) || (!isSessionVariableSet('admin_to')) || ((get_session('admin_last') + bigintval(get_session('admin_to')) * 3600 * 24) < time())) { // At leat one administrator account was created - if ((!empty($_SESSION['admin_login'])) && (!empty($_SESSION['admin_md5'])) && (!empty($_SESSION['admin_last'])) && (!empty($_SESSION['admin_to']))) - { + if ((isSessionVariableSet('admin_login')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last')) && (isSessionVariableSet('admin_to'))) { // Timeout for last login, we have to logout first! $URL = URL."/modules.php?module=admin&action=login&logout=1"; LOAD_URL($URL); } - if (!empty($_GET['register'])) - { + if (!empty($_GET['register'])) { // Registration of first admin is done if ($_GET['register'] == "done") OUTPUT_HTML("".ADMIN_REGISTER_DONE.""); } @@ -172,16 +149,14 @@ if (!admin_registered) // Check if the admin has submitted data or not $ret = ""; if ((isset($_POST['ok'])) && ((empty($_POST['login'])) || (empty($_POST['pass'])) || (strlen($_POST['pass']) < 4))) $_POST['ok'] = "***"; - if ((isset($_POST['ok'])) && ($_POST['ok'] != "***")) - { + if ((isset($_POST['ok'])) && ($_POST['ok'] != "***")) { // All required data was entered so we check his account $ret = CHECK_ADMIN_LOGIN($_POST['login'], $_POST['pass']); switch ($ret) { case "done": // Admin and password are okay, so we log in now - $TIMEOUT = time() + (3600 * 24 * $_POST['timeout']); - if ((set_session("admin_md5", generatePassString(generateHash($_POST['pass'], __SALT)), $TIMEOUT, COOKIE_PATH)) && (set_session("admin_login", $_POST['login'], $TIMEOUT, COOKIE_PATH)) && (set_session("admin_last", time(), $TIMEOUT, COOKIE_PATH)) && (set_session("admin_to", $_POST['timeout'], $TIMEOUT, COOKIE_PATH))) - { + // Try to register the session variables + if ((set_session("admin_md5", generatePassString(generateHash($_POST['pass'], __SALT)))) && (set_session("admin_login", $_POST['login'])) && (set_session("admin_last", time())) && (set_session("admin_to", $_POST['timeout']))) { // Construct URL and redirect $URL = URL."/modules.php?module=admin&"; @@ -197,9 +172,7 @@ if (!admin_registered) // Load URL LOAD_URL($URL); - } - else - { + } else { OUTPUT_HTML("".ADMIN_LOGIN_FAILED.""); ADD_FATAL(CANNOT_REGISTER_SESS); } @@ -216,19 +189,14 @@ if (!admin_registered) break; } } - if ($ret != "done") - { - if (!empty($_POST['login'])) - { + if ($ret != "done") { + if (!empty($_POST['login'])) { define('__LOGIN_VALUE', $_POST['login']); - } - else - { + } else { define('__LOGIN_VALUE', ""); } - if (isset($_POST['ok'])) - { + if (isset($_POST['ok'])) { // Set messages to zero $MSG1 = ""; $MSG2 = ""; @@ -253,40 +221,28 @@ if (!admin_registered) // Reset variables $MSG1 = ""; $MSG2 = ""; - } - else - { + } else { // Set constants to empty for hiding them define('__MSG_LOGIN', ""); define('__MSG_PASS' , ""); } // Load login form - if (!empty($GLOBALS['what'])) - { + if (!empty($GLOBALS['what'])) { // Restore old what value $content = array('target' => "what", 'value' => $GLOBALS['what']); - } - elseif (!empty($GLOBALS['action'])) - { - if ($GLOBALS['action'] != "logout") - { + } elseif (!empty($GLOBALS['action'])) { + if ($GLOBALS['action'] != "logout") { // Restore old action value $content = array('target' => "action", 'value' => $GLOBALS['action']); - } - else - { + } else { // Set default values $content = array('target' => "action", 'value' => "login"); } - } - elseif (!empty($_GET['area'])) - { + } elseif (!empty($_GET['area'])) { // Restore old area value $content = array('target' => "area", 'value' => $_GET['area']); - } - else - { + } else { // Set default values $content = array('target' => "action", 'value' => "login"); } @@ -294,47 +250,36 @@ if (!admin_registered) // Load login form template LOAD_TEMPLATE("admin_login_form", false, $content); } -} - elseif ($_GET['logout'] == "1") -{ +} elseif ($_GET['logout'] == "1") { // Only try to remove cookies - if (set_session("admin_login", "", (time() - 3600), COOKIE_PATH) && set_session("admin_md5", "", (time() - 3600), COOKIE_PATH) && set_session("admin_last", "", (time() - 3600), COOKIE_PATH) && set_session("admin_to", "", (time() - 3600), COOKIE_PATH)) - { + if (set_session("admin_login", "") && set_session("admin_md5", "") && set_session("admin_last", "") && set_session("admin_to", "")) { // Also remove array elements - unset($_SESSION['admin_login']); - unset($_SESSION['admin_md5']); - unset($_SESSION['admin_last']); - unset($_SESSION['admin_to']); + set_session('admin_login' , ""); + set_session('admin_md5' , ""); + set_session('admin_last' , ""); + set_session('admin_to' , ""); // Destroy session @session_destroy(); // Load logout template LOAD_TEMPLATE("admin_logout"); - } - else - { + } else { // Something went wrong here... OUTPUT_HTML("".ADMIN_LOGOUT_FAILED.""); // Add fatal message ADD_FATAL(CANNOT_UNREG_SESS); } -} - else -{ +} else { // Maybe an Admin want's to login? - $ret = CHECK_ADMIN_COOKIES(SQL_ESCAPE($_SESSION['admin_login']), SQL_ESCAPE($_SESSION['admin_md5'])); - switch ($ret) - { + $ret = CHECK_ADMIN_COOKIES(SQL_ESCAPE(get_session('admin_login')), SQL_ESCAPE(get_session('admin_md5'))); + switch ($ret) { case "done": // Cookie-Data accepted - $TIMEOUT = time() + bigintval($_SESSION['admin_to']); - if ((set_session("admin_md5", SQL_ESCAPE($_SESSION['admin_md5']), $TIMEOUT, COOKIE_PATH)) && (set_session("admin_login", SQL_ESCAPE($_SESSION['admin_login']), $TIMEOUT, COOKIE_PATH)) && (set_session("admin_last", time(), $TIMEOUT, COOKIE_PATH)) && (set_session("admin_to", bigintval($_SESSION['admin_to']), $TIMEOUT, COOKIE_PATH))) - { + if ((set_session("admin_md5", SQL_ESCAPE(get_session('admin_md5')))) && (set_session("admin_login", SQL_ESCAPE(get_session('admin_login')))) && (set_session("admin_last", time())) && (set_session("admin_to", bigintval(get_session('admin_to'))))) { // Ok, Cookie-Update done - if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) - { + if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) { // Check if action GET variable was set $act = SQL_ESCAPE($GLOBALS['action']); if (!empty($GLOBALS['what'])) { @@ -344,9 +289,7 @@ if (!admin_registered) // Check for access control line of current menu entry define('__ACL_ALLOW', ADMINS_CHECK_ACL($act, $GLOBALS['what'])); - } - else - { + } else { // Extension not installed so it's always allowed to access everywhere! define('__ACL_ALLOW', true); } @@ -355,8 +298,7 @@ if (!admin_registered) if (empty($_CONFIG['admin_menu'])) $_CONFIG['admin_menu'] = "OLD"; // Check for version and switch between old menu system and new "intelligent menu system" - if ((ADMIN_CHECK_MENU_MODE() == "NEW") && (file_exists(PATH."inc/modules/admin/la_sys-inc.php"))) - { + if ((ADMIN_CHECK_MENU_MODE() == "NEW") && (file_exists(PATH."inc/modules/admin/la_sys-inc.php"))) { // Default area is the entrance, of course $area = "entrance"; @@ -368,16 +310,12 @@ if (!admin_registered) // Create new-style menu system will "logical areas" ADMIN_LOGICAL_AREA_SYSTEM($area, $act, $GLOBALS['what']); - } - else - { + } else { // This little call constructs the whole default old and lacky menu system // on left side ADMIN_DO_ACTION($GLOBALS['what']); } - } - else - { + } else { // Login failed (cookies enabled?) OUTPUT_HTML("".ADMIN_LOGIN_FAILED.""); ADD_FATAL(CANNOT_RE_REGISTER_SESS); @@ -396,7 +334,7 @@ if (!admin_registered) } } -if (admin_registered) +if (isBooleanConstantAndTrue('admin_registered')) { // Check config.php and inc directory for right access rights if (is_INCWritable("config")) ADD_FATAL(FATAL_CONFIG_WRITABLE);