X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Flibs%2Fadmins_functions.php;h=2d143e482410a1ec0a442506d1fcffb05244e4bb;hb=63d14ce28ba29ba7f176f7aefa78c7c2b96ab5f1;hp=dd0b4422ca6e45d4bd7a5ce9eb041f88382e342a;hpb=b5912168d72ae511eb623c3d92540c82d31b93c5;p=mailer.git diff --git a/inc/libs/admins_functions.php b/inc/libs/admins_functions.php index dd0b4422ca..2d143e4824 100644 --- a/inc/libs/admins_functions.php +++ b/inc/libs/admins_functions.php @@ -10,7 +10,12 @@ * -------------------------------------------------------------------- * * Kurzbeschreibung : Funktionen fuer die admins-Erweiterung * * -------------------------------------------------------------------- * - * * + * $Revision:: $ * + * $Date:: $ * + * $Tag:: 0.2.1-FINAL $ * + * $Author:: $ * + * Needs to be in all Files and every File needs "svn propset * + * svn:keywords Date Revision" (autoprobset!) at least!!!!!! * * -------------------------------------------------------------------- * * Copyright (c) 2003 - 2008 by Roland Haeder * * For more information visit: http://www.mxchange.org * @@ -32,164 +37,363 @@ ************************************************************************/ // Some security stuff... -if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) -{ - $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php"; +if (!defined('__SECURITY')) { + $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), '/inc') + 4) . '/security.php'; require($INC); } -// -function ADMINS_CHECK_ACL($act, $wht) -{ - global $ADMINS, $ADMINS_ACLS, $_CONFIG, $CACHE; + +// Check ACL for menu combination +function adminsCheckAdminAcl ($act, $wht) { // If action is login or logout allow allways! - $default = "allow"; - if (($act == "login") || ($act == "logout")) return true; + $default = 'allow'; + if (($act == 'login') || ($act == 'logout')) return true; // Default is deny $ret = false; - // Get admin's defult access right - if (!empty($ADMINS['def_acl'][$_SESSION['admin_login']])) { - // Load from cache - $default = $ADMINS['def_acl'][$_SESSION['admin_login']]; - - // Count cache hits - $_CONFIG['cache_hits']++; - } elseif (!is_object($CACHE)) { - // Load from database - $result = SQL_QUERY_ESC("SELECT default_acl FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", - array($_SESSION['admin_login']), __FILE__, __LINE__); - list($default) = SQL_FETCHROW($result); - SQL_FREERESULT($result); - } - // Get admin's ID - $aid = GET_ADMIN_ID($_SESSION['admin_login']); + $aid = getCurrentAdminId(); + + // Get admin's defult access right + $default = getAdminDefaultAcl($aid); - if (!empty($wht)) - { + if (!empty($wht)) { // Check for parent menu: // First get it's action value - $parent_action = GET_ACTION("admin", $wht); + $parent_action = getModeAction('admin', $wht); // Check with this function... - $parent = ADMINS_CHECK_ACL($parent_action, ""); - } - else - { + $parent = adminsCheckAdminAcl($parent_action, ''); + } else { // Anything else is true! $parent = false; } // Shall I test for a main or sub menu? (action or what?) - $lines = 0; $acl_mode = "failed"; - if (GET_EXT_VERSION("cache") >= "0.1.2") - { - // Load only from array when there are lines! - if (count($ADMINS_ACLS) > 0) - { - // Load ACL from array - foreach ($ADMINS_ACLS['admin_id'] as $id=>$aid_acls) - { - if ($aid == $aid_acls) - { - // Okay, one line was found! - if ((!empty($act)) && ($ADMINS_ACLS['action_menu'][$id] == $act)) - { - // Main menu line found - $acl_mode = $ADMINS_ACLS['access_mode'][$id]; - $lines = 1; - } - elseif ((!empty($wht)) && ($ADMINS_ACLS['what_menu'][$id] == $wht)) - { - // Check sub menu - $acl_mode = $ADMINS_ACLS['access_mode'][$id]; - $lines = 1; - } - if ($lines == 1) - { - // Count cache hits - $_CONFIG['cache_hits']++; - break; - } - } - } + $acl_mode = 'failed'; + if ((GET_EXT_VERSION('cache') >= '0.1.2') && (count($GLOBALS['cache_array']['admin_acls']) > 0)) { + // Lookup in cache + if ((!empty($act)) && (isset($GLOBALS['cache_array']['admin_acls']['action_menu'][$aid])) & ($GLOBALS['cache_array']['admin_acls']['action_menu'][$aid] == $act)) { + // Main menu line found + $acl_mode = $GLOBALS['cache_array']['admin_acls']['access_mode'][$aid]; - // No ACL found? - if ($acl_mode == "failed") - { - $acl_mode = ""; - $lines = 0; - } - } - else - { - // No lines here - $lines = 0; + // Count cache hits + incrementConfigEntry('cache_hits'); + } elseif ((!empty($wht)) && (isset($GLOBALS['cache_array']['admin_acls']['what_menu'][$aid])) && ($GLOBALS['cache_array']['admin_acls']['what_menu'][$aid] == $wht)) { + // Check sub menu + $acl_mode = $GLOBALS['cache_array']['admin_acls']['access_mode'][$aid]; + + // Count cache hits + incrementConfigEntry('cache_hits'); } - } - else - { + } elseif (!EXT_IS_ACTIVE('cache')) { // Old version, so load it from database - if (!empty($act)) - { + if (!empty($act)) { // Main menu - $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%d AND action_menu='%s' LIMIT 1", - array(bigintval($aid), $act), __FILE__, __LINE__); - } - elseif (!empty($wht)) - { + $result = SQL_QUERY_ESC("SELECT access_mode FROM `{!_MYSQL_PREFIX!}_admins_acls` WHERE admin_id=%s AND action_menu='%s' LIMIT 1", + array(bigintval($aid), $act), __FUNCTION__, __LINE__); + } elseif (!empty($wht)) { // Sub menu - $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%d AND what_menu='%s' LIMIT 1", - array(bigintval($aid), $wht), __FILE__, __LINE__); + $result = SQL_QUERY_ESC("SELECT access_mode FROM `{!_MYSQL_PREFIX!}_admins_acls` WHERE admin_id=%s AND what_menu='%s' LIMIT 1", + array(bigintval($aid), $wht), __FUNCTION__, __LINE__); } - // Get number of lines - $lines = SQL_NUMROWS($result); + // Is an entry found? + if (SQL_NUMROWS($result) == 1) { + // Load ACL + list($acl_mode) = SQL_FETCHROW($result); + } // END - if - // Load ACL - list($acl_mode) = SQL_FETCHROW($result); + // Free memory SQL_FREERESULT($result); } // Check ACL and (maybe) allow - if ((($default == "allow") && ($lines == 0)) || (($default == "deny") && ($lines == "1") && ($acl_mode == "allow")) || (($lines == 0) && ($parent))) $ret = true; + if (($default == 'allow') || (($default == 'deny') && ($acl_mode == 'allow')) || ($parent === true)) { + // Access is granted + $ret = true; + } // END - if // Return value + //* DEBUG: */ print __FUNCTION__."[".__LINE__."]:act={$act},wht={$wht},default={$default},acl_mode={$acl_mode}
\n"; return $ret; } + // Create email link to admins's account -function ADMINS_CREATE_EMAIL_LINK($email, $mod="admin") -{ - $locked = " AND status='CONFIRMED'"; - if (IS_ADMIN()) $locked = ""; - if (strpos("@", $email) > 0) - { +function adminsCreateEmailLink ($email, $mod='admin') { + // Is it an email? + if (strpos($email, "@") !== false) { // Create email link - $result = SQL_QUERY_ESC("SELECT id -FROM "._MYSQL_PREFIX."_admins -WHERE email='%s'".$locked." LIMIT 1", - array($email), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + $result = SQL_QUERY_ESC("SELECT `id` +FROM `{!_MYSQL_PREFIX!}_admins` +WHERE `email`='%s' LIMIT 1", + array($email), __FUNCTION__, __LINE__); + + // Is there an entry? + if (SQL_NUMROWS($result) == 1) { // Load userid - list($uid) = SQL_FETCHROW($result); + list($aid) = SQL_FETCHROW($result); // Rewrite email address to contact link - $email = URL."/modules.php?module=".$mod."&what=user_contct&u_id=".bigintval($uid); - } + $email = "{!URL!}/modules.php?module=".$mod."&what=admins_contct&admin=".bigintval($aid); + } // END - if // Free memory SQL_FREERESULT($result); - } - elseif (bigintval($email) > 0) - { + } elseif ((is_int($email)) && ($email > 0)) { // Direct ID given - $email = URL."/modules.php?module=".$mod."&what=admins_contct&admin=".bigintval($email); + $email = "{!URL!}/modules.php?module=".$mod."&what=admins_contct&admin=".bigintval($email); } // Return rewritten (?) email address return $email; } + +// Change a lot admin account +function adminsChangeAdminAccount ($POST) { + // Begin the update + $cache_update = 0; + foreach ($POST['login'] as $id => $login) { + // Secure ID number + $id = bigintval($id); + + // When both passwords match update admin account + if ($POST['pass1'][$id] == $POST['pass2'][$id]) { + // Save only when both passwords are the same (also when they are empty) + $add = ''; $cache_update = '1'; + + // Generate hash + $hash = generateHash($POST['pass1'][$id]); + + // Save password when set + if (!empty($POST['pass1'][$id])) $add = sprintf(", password='%s'", SQL_ESCAPE($hash)); + + // Get admin's ID + $aid = getCurrentAdminId(); + $salt = substr(GET_ADMIN_HASH($aid), 0, -40); + + // Rewrite cookie when it's own account + if ($aid == $id) { + // Set timeout cookie + setSession('admin_last', time()); + + if ($login != getSession('admin_login')) { + // Update login cookie + setSession('admin_login', $login); + + // Update password cookie as well? + if (!empty($add)) setSession('admin_md5', $hash); + } elseif (generateHash($POST['pass1'][$id], $salt) != getSession('admin_md5')) { + // Update password cookie + setSession('admin_md5', $hash); + } + } // END - if + + // Get default ACL from admin to check if we can allow him to change the default ACL + $default = getAdminDefaultAcl(getCurrentAdminId()); + + // Update admin account + if ($default == 'allow') { + // Allow changing default ACL + SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET +login='%s'".$add.", +email='%s', +default_acl='%s', +la_mode='%s' +WHERE `id`=%s LIMIT 1", + array( + $login, + $POST['email'][$id], + $POST['mode'][$id], + $POST['la_mode'][$id], + $id + ), __FUNCTION__, __LINE__); + } else { + // Do not allow it here + SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET +login='%s'".$add.", +email='%s', +la_mode='%s' +WHERE `id`=%s LIMIT 1", + array( + $login, + $POST['email'][$id], + $POST['la_mode'][$id], + $id + ), __FUNCTION__, __LINE__); + } + + // Purge cache + cachePurgeAdminMenu($id); + + // Admin account saved + $message = ADMIN_ACCOUNT_SAVED; + } else { + // Passwords did not match + $message = ADMINS_ERROR_PASS_MISMATCH; + } + + // Display message + if (!empty($message)) { + LOAD_TEMPLATE('admin_settings_saved', false, $message); + } + } + + // Remove cache file + runFilterChain('post_admin_edited', REQUEST_POST_ARRAY()); +} + +// Make admin accounts editable +function adminsEditAdminAccount ($POST) { + // "Resolve" current's admin access mode + $currMode = getAdminDefaultAcl(getCurrentAdminId()); + + // Begin the edit loop + $OUT = ''; $SW = 2; + foreach ($POST['sel'] as $id => $selected) { + // Secure ID number + $id = bigintval($id); + + // Get the admin's data + $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM `{!_MYSQL_PREFIX!}_admins` WHERE `id`=%s LIMIT 1", + array($id), __FUNCTION__, __LINE__); + if ((SQL_NUMROWS($result) == 1) && ($selected == 1)) { + // Entry found + $content = SQL_FETCHARRAY($result); + SQL_FREERESULT($result); + + // Prepare some more data for the template + $content['sw'] = $SW; + $content['id'] = $id; + + // Shall we allow changing default ACL? + if ($currMode == 'allow') { + // Allow chaning it + $content['mode'] = generateOptionList('/ARRAY/', array('allow', 'deny'), array(constant('ADMINS_ALLOW_MODE'), constant('ADMINS_DENY_MODE')), $content['mode']); + } else { + // Don't allow it + $content['mode'] = ' '; + } + $content['la_mode'] = generateOptionList('/ARRAY/', array('global', 'OLD', 'NEW'), array(ADMINS_GLOBAL_LA_SETTING, ADMINS_OLD_LA_SETTING, ADMINS_NEW_LA_SETTING), $content['la_mode']); + + // Load row template and switch color + $OUT .= LOAD_TEMPLATE('admin_edit_admins_row', true, $content); + $SW = 3 - $SW; + } + } + define('__ADMINS_ROWS', $OUT); + + // Load template + LOAD_TEMPLATE('admin_edit_admins'); +} + +// Delete given admin accounts +function adminsDeleteAdminAccount ($POST) { + // Check if this account is the last one which cannot be deleted... + $result_main = SQL_QUERY("SELECT `id` FROM `{!_MYSQL_PREFIX!}_admins`", __FUNCTION__, __LINE__); + $accounts = SQL_NUMROWS($result_main); + SQL_FREERESULT($result_main); + if ($accounts > 1) { + // Delete accounts + $OUT = ''; $SW = 2; + foreach ($POST['sel'] as $id => $selected) { + // Secure ID number + $id = bigintval($id); + + // Get the admin's data + $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM `{!_MYSQL_PREFIX!}_admins` WHERE `id`=%s LIMIT 1", + array($id), __FUNCTION__, __LINE__); + if (SQL_NUMROWS($result) == 1) { + // Entry found + $content = SQL_FETCHARRAY($result); + SQL_FREERESULT($result); + $content['mode'] = constant('ADMINS_'.strtoupper($content['mode']).'_MODE'); + $content['la_mode'] = constant('ADMINS_'.strtoupper($content['la_mode']).'_LA_SETTING'); + + // Prepare some more data + $content['sw'] = $SW; + $content['id'] = $id; + + // Load row template and switch color + $OUT .= LOAD_TEMPLATE('admin_del_admins_row', true, $content); + $SW = 3 - $SW; + } + } + define('__ADMINS_ROWS', $OUT); + + // Load template + LOAD_TEMPLATE('admin_del_admins'); + } else { + // Cannot delete last account! + LOAD_TEMPLATE('admin_settings_saved', false, getMessage('ADMIN_ADMINS_CANNOT_DELETE_LAST')); + } +} + +// Remove the given accounts +function adminsRemoveAdminAccount ($POST) { + // Begin removal + $cache_update = 0; + foreach ($POST['sel'] as $id => $del) { + // Secure ID number + $id = bigintval($id); + + // Delete only when it's not your own account! + if (($del == 1) && (getCurrentAdminId() != $id)) { + // Rewrite his tasks to all admins + SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_task_system` SET `assigned_admin`=0 WHERE `assigned_admin`=%s", + array($id), __FUNCTION__, __LINE__); + + // Remove account + SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM `{!_MYSQL_PREFIX!}_admins` WHERE `id`=%s LIMIT 1", + array($id), __FUNCTION__, __LINE__); + + // Purge cache + cachePurgeAdminMenu($id); + $cache_update = '1'; + } + } + + // Remove cache if cache system is activated + runFilterChain('post_admin_deleted', REQUEST_POST_ARRAY()); +} + +// List all admin accounts +function adminsListAdminAccounts() { + // Select all admin accounts + $result = SQL_QUERY("SELECT id, login, email, default_acl AS mode, la_mode FROM `{!_MYSQL_PREFIX!}_admins` ORDER BY login ASC", __FUNCTION__, __LINE__); + $OUT = ''; $SW = 2; + while ($content = SQL_FETCHARRAY($result)) { + // Compile some variables + $content['mode'] = constant('ADMINS_'.strtoupper($content['mode']).'_MODE'); + $content['la_mode'] = constant('ADMINS_'.strtoupper($content['la_mode']).'_LA_SETTING'); + + // Prepare some more data + $content['sw'] = $SW; + $content['email_link'] = generateMemberEmailLink($content['id']); + + // Load row template and switch color + $OUT .= LOAD_TEMPLATE('admin_list_admins_row', true, $content); + $SW = 3 - $SW; + } + + // Free memory + SQL_FREERESULT($result); + define('__ADMINS_ROWS', $OUT); + + // Load template + LOAD_TEMPLATE('admin_list_admins'); +} + +// Filter for adding extra data to the query +function FILTER_ADD_EXTRA_SQL_DATA ($add = '') { + // Is the admins extension updated? (should be!) + if (GET_EXT_VERSION('admins') >= '0.3.0') $add .= ", default_acl AS def_acl"; + if (GET_EXT_VERSION('admins') >= '0.6.7') $add .= ", la_mode"; + if (GET_EXT_VERSION('admins') >= '0.7.2') $add .= ", login_failures, UNIX_TIMESTAMP(last_failure) AS last_failure"; + + // Return it + return $add; +} + // ?>