X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=426440e50d6ffc9673a842aee76af5068e03d0d6;hb=501a861954273a54a21b714587fc33b57322d8e4;hp=e8778670dd68e3641742ab9eec8a57e2c5b2e8a6;hpb=1ebf518b9552f71ee95de6f4b80e6de3a27716d1;p=mailer.git diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index e8778670dd..426440e50d 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -39,7 +39,7 @@ // Some security stuff... if (!defined('__SECURITY')) { die(); -} +} // END - if // Register an administrator account function addAdminAccount ($user, $md5, $email) { @@ -53,8 +53,12 @@ function addAdminAccount ($user, $md5, $email) { // Is the entry there? if (SQL_NUMROWS($result) == 0) { // Ok, let's create the admin login - SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (login, password, email) VALUES ('%s', '%s', '%s')", - array($user, $md5, $email), __FUNCTION__, __LINE__); + SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (`login`, `password`, `email`) VALUES ('%s', '%s', '%s')", + array( + $user, + $md5, + $email + ), __FUNCTION__, __LINE__); $ret = 'done'; } // END - if @@ -66,28 +70,28 @@ function addAdminAccount ($user, $md5, $email) { } // Only be executed on login procedure! -function ifAdminLoginDataIsValid ($admin_login, $password) { +function ifAdminLoginDataIsValid ($admin, $password) { // By default no admin is found $ret = '404'; // Get admin id - $adminId = getAdminId($admin_login); + $adminId = getAdminId($admin); // Init array with admin id by default $data = array('admin_id' => $adminId); // Is the cache valid? - if (isset($GLOBALS['cache_array']['admins']['password'][$adminId])) { + if (isAdminHashSet($admin)) { // Get password from cache - $data['password'] = $GLOBALS['cache_array']['admins']['password'][$adminId]; + $data['password'] = getAdminHash($admin); $ret = 'pass'; incrementStatsEntry('cache_hits'); // Include more admins data? - if (isExtensionInstalledAndNewer('admins', '0.7.2')) { + if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($GLOBALS['cache_array']['admin']['login_failures'][$adminId]))) { // Load them here - $data['login_failures'] = $GLOBALS['cache_array']['admins']['login_failures'][$adminId]; - $data['last_failure'] = $GLOBALS['cache_array']['admins']['last_failure'][$adminId]; + $data['login_failures'] = $GLOBALS['cache_array']['admin']['login_failures'][$adminId]; + $data['last_failure'] = $GLOBALS['cache_array']['admin']['last_failure'][$adminId]; } // END - if } elseif (!isExtensionActive('cache')) { // Add extra data via filter now @@ -136,28 +140,28 @@ function ifAdminLoginDataIsValid ($admin_login, $password) { // Do we have 0.7.0 of admins or later? // Remmeber login failures if available - if (isExtensionInstalledAndNewer('admins', '0.7.2')) { + if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($data['login_failures']))) { // Store it in session setSession('mxchange_admin_failures', $data['login_failures']); setSession('mxchange_admin_last_fail', $data['last_failure']); // Update password and reset login failures - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET password='%s',login_failures=0,last_failure='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", + SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s',`login_failures`=0,`last_failure`='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", array($data['password'], $adminId), __FUNCTION__, __LINE__); } else { // Update password - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET password='%s' WHERE `id`=%s LIMIT 1", + SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s' WHERE `id`=%s LIMIT 1", array($data['password'], $adminId), __FUNCTION__, __LINE__); } // Rebuild cache - rebuildCacheFile('admins', 'admin'); + rebuildCacheFile('admin', 'admin'); // Login has failed by default... ;-) $ret = 'failed1'; // Password matches so login here - if (doAdminLogin($admin_login, $data['password'])) { + if (doAdminLogin($admin, $data['password'])) { // All done now $ret = 'done'; } // END - if @@ -166,7 +170,7 @@ function ifAdminLoginDataIsValid ($admin_login, $password) { $ret = 'failed_salt'; } elseif ($ret == 'done') { // Try to login here if we have the old hashing way (sql_patches not installed?) - if (!doAdminLogin($admin_login, $data['password'])) { + if (!doAdminLogin($admin, $data['password'])) { // Something went wrong $ret = 'failed2'; } // END - if @@ -175,15 +179,15 @@ function ifAdminLoginDataIsValid ($admin_login, $password) { // Count login failure if admins extension version is 0.7.0+ if (($ret == 'pass') && (getExtensionVersion('admins') >= '0.7.0')) { // Update counter - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET login_failures=login_failures+1,last_failure=NOW() WHERE `id`=%s LIMIT 1", - array($adminId), __FUNCTION__, __LINE__); + SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET login_failures`=`login_failures`+1,`last_failure`=NOW() WHERE `id`=%s LIMIT 1", + array($adminId), __FUNCTION__, __LINE__); // Rebuild cache - rebuildCacheFile('admins', 'admin'); + rebuildCacheFile('admin', 'admin'); } // END - if // Return the result - //* DEBUG: */ die("RETURN=".$ret); + //* DEBUG: */ die('RETURN=' . $ret); return $ret; } @@ -196,7 +200,7 @@ function doAdminLogin ($adminLogin, $passHash) { array($adminLogin), __FUNCTION__, __LINE__); // Rebuild cache - rebuildCacheFile('admins', 'admin'); + rebuildCacheFile('admin', 'admin'); } // END - if // Now set all session variables and return the result @@ -212,19 +216,19 @@ function doAdminLogin ($adminLogin, $passHash) { } // Only be executed on cookie checking -function ifAdminCookiesAreValid ($admin_login, $password) { +function ifAdminCookiesAreValid ($admin, $password) { // By default no admin cookies are found $ret = '404'; $pass = ''; // Get hash - $pass = getAdminHash(getAdminId($admin_login)); + $pass = getAdminHash($admin); if ($pass != '-1') $ret = 'pass'; //* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).")
"); // Check if password matches - if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) { + if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass))) && (isAdmin())) { // Passwords matches! $ret = 'done'; } // END - if @@ -234,7 +238,10 @@ function ifAdminCookiesAreValid ($admin_login, $password) { } // Do an admin action -function doAdminAction ($what) { +function doAdminAction () { + // Get default what + $what = getWhat(); + //* DEBUG: */ outputHtml(__LINE__."*".$what.'/'.getModule().'/'.getAction().'/'.getWhat()."*
"); // Remove any spaces from variable @@ -242,14 +249,14 @@ function doAdminAction ($what) { // Default admin action is the overview page $what = 'overview'; } else { - // Compile out some chars - $what = compileCode($what, false, false, false); + // Secure it + $what = secureString($what); } // Get action value $action = getModeAction(getModule(), $what); - // Define admin login name and ID number + // Define admin login name and id number $content['login'] = getSession('admin_login'); $content['id'] = getCurrentAdminId(); @@ -265,6 +272,12 @@ function doAdminAction ($what) { // Tableset header loadTemplate('admin_main_header', false, $content); + // Is sql_patches not yet installed? + if (!isExtensionInstalled('sql_patches')) { + // Output warning + loadTemplate('admin_settings_saved', false, getMessage('ADMIN_WARNING_SQL_PATCHES_MISSING')); + } // END - if + // Check if action/what pair is valid $result_action = SQL_QUERY_ESC("SELECT `id` @@ -283,7 +296,8 @@ WHERE ) ) ) -LIMIT 1", array($action, $what, $what), __FUNCTION__, __LINE__); +LIMIT 1", + array($action, $what, $what), __FUNCTION__, __LINE__); if (SQL_NUMROWS($result_action) == 1) { // Is valid but does the inlcude file exists? $inc = sprintf("inc/modules/admin/action-%s.php", $action); @@ -329,6 +343,8 @@ WHERE ORDER BY `sort` ASC, `id` DESC", __FUNCTION__, __LINE__); + + // Do we have entries? if (SQL_NUMROWS($result_main) > 0) { $OUT = "
 
\n"; $OUT .= "