X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=505bcc0f82e90b90a9bd1a9ae52b4d4f9834a475;hb=c25f923b9006723f30055e6bd7145d6aaa8cee42;hp=ae6191a043e05021fe8b47ddbc5d7d0f1266c32a;hpb=486544503c2e517dc5c399308fdf43c8e35ff102;p=mailer.git diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index ae6191a043..505bcc0f82 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -16,7 +16,7 @@ * $Author:: $ * * -------------------------------------------------------------------- * * Copyright (c) 2003 - 2009 by Roland Haeder * - * Copyright (c) 2009 - 2011 by Mailer Developer Team * + * Copyright (c) 2009 - 2012 by Mailer Developer Team * * For more information visit: http://mxchange.org * * * * This program is free software; you can redistribute it and/or modify * @@ -52,7 +52,7 @@ function addAdminAccount ($adminLogin, $passHash, $adminEmail) { // Is the entry there? if (SQL_HASZERONUMS($result)) { // Ok, let's create the admin login - SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (`login`,`password`,`email`) VALUES ('%s', '%s', '%s')", + SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (`login`, `password`, `email`) VALUES ('%s', '%s', '%s')", array( $adminLogin, $passHash, @@ -130,38 +130,30 @@ function ifAdminCookiesAreValid ($adminLogin, $passHash) { if ($adminHash != '-1') { // Now, we need to encode the password in the same way the one is encoded in database $testHash = encodeHashForCookie($adminHash); - //* DEBUG: */ debugOutput('adminLogin=' . $adminLogin . ',passHash='.$passHash.',adminHash='.$adminHash.',testHash='.$testHash); + //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'adminLogin=' . $adminLogin . ',passHash='.$passHash.',adminHash='.$adminHash.',testHash='.$testHash); // If they both match, the login data is valid - if ($testHash == $passHash) { + if ($testHash != $passHash) { + // Passwords don't match + $ret = 'password'; + } elseif (!isAdmin()) { + // Is not valid session + $ret = 'session'; + } else { // All fine $ret = 'done'; - } else { - // Set status - $ret = 'password'; } } // END - if // Return status - //* DEBUG: */ debugOutput('ret='.$ret); + //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'ret='.$ret); return $ret; } // Do an admin action function doAdminAction () { - // Get default what - $what = getWhat(); - - //* DEBUG: */ debugOutput(__LINE__.'*'.$what.'/'.getModule().'/'.getAction().'/'.getWhat().'*'); - - // Remove any spaces from variable - if (empty($what)) { - // Default admin action is the overview page - $what = 'overview'; - } else { - // Secure it - $what = secureString($what); - } + // Determine correct 'what' value + $what = determineWhat(); // Get action value $action = getActionFromModuleWhat(getModule(), $what); @@ -169,18 +161,18 @@ function doAdminAction () { // Load welcome template if (isExtensionActive('admins')) { // @TODO This and the next getCurrentAdminId() call might be moved into the templates? - $content['welcome'] = loadTemplate('admin_welcome_admins', true, getCurrentAdminId()); + $content['welcome'] = loadTemplate('admin_welcome_admins', TRUE, getCurrentAdminId()); } else { - $content['welcome'] = loadTemplate('admin_welcome', true, getCurrentAdminId()); + $content['welcome'] = loadTemplate('admin_welcome', TRUE, getCurrentAdminId()); } // Load header, footer, render menu - $content['header'] = loadTemplate('admin_header' , true, $content); - $content['footer'] = loadTemplate('admin_footer' , true, $content); + $content['header'] = loadTemplate('admin_header' , TRUE, $content); + $content['footer'] = loadTemplate('admin_footer' , TRUE, $content); $content['menu'] = addAdminMenu($action, $what); // Load main template - loadTemplate('admin_main', false, $content); + loadTemplate('admin_main', FALSE, $content); // Check if action/what pair is valid $result_action = SQL_QUERY_ESC("SELECT @@ -191,12 +183,12 @@ WHERE `action`='%s' AND ( ( - `what`='%s' AND `what` != 'overview' + `what`='%s' AND `what` != 'welcome' ) OR ( ( `what`='' OR `what` IS NULL ) AND ( - '%s'='overview' + '%s'='welcome' ) ) ) @@ -207,40 +199,42 @@ LIMIT 1", $what ), __FUNCTION__, __LINE__); - // Do we have an entry? + // Is there an entry? if (SQL_NUMROWS($result_action) == 1) { // Is valid but does the inlcude file exists? $inc = sprintf("inc/modules/admin/action-%s.php", $action); - if ((isIncludeReadable($inc)) && (isMenuActionValid('admin', $action, $what)) && ($GLOBALS['acl_allow'] === true)) { + if ((isIncludeReadable($inc)) && (isMenuActionValid('admin', $action, $what)) && ($GLOBALS['acl_allow'] === TRUE)) { // Ok, we finally load the admin action module loadInclude($inc); - } elseif ($GLOBALS['acl_allow'] === false) { + } elseif ($GLOBALS['acl_allow'] === FALSE) { // Access denied - loadTemplate('admin_menu_failed', false, '{%message,ADMIN_ACCESS_DENIED=' . $what . '%}'); + loadTemplate('admin_menu_failed', FALSE, '{%message,ADMIN_ACCESS_DENIED=' . $what . '%}'); } else { // Include file not found :-( - loadTemplate('admin_menu_failed', false, '{%message,ADMIN_ACTION_404=' . $action . '%}'); + loadTemplate('admin_menu_failed', FALSE, '{%message,ADMIN_ACTION_404=' . $action . '%}'); } } else { // Invalid action/what pair found - loadTemplate('admin_menu_failed', false, '{%message,ADMIN_ACTION_INVALID=' . $action . '/' . $what . '%}'); + loadTemplate('admin_menu_failed', FALSE, '{%message,ADMIN_ACTION_INVALID=' . $action . '/' . $what . '%}'); } // Free memory SQL_FREERESULT($result_action); // Tableset footer - loadTemplate('admin_main_footer', false, $content); + loadTemplate('admin_main_footer', FALSE, $content); } -// Checks wether current admin is allowed to access given action/what combination -// (only one is allowed to be null!) +/** + * Checks whether current admin is allowed to access given action/what + * combination (only one is allowed to be null!). + */ function isAdminAllowedAccessMenu ($action, $what = NULL) { - // Do we have cache? + // Is there cache? if (!isset($GLOBALS[__FUNCTION__][$action][$what])) { // ACL is always 'allow' when no ext-admins is installed // @TODO This can be rewritten into a filter - $GLOBALS[__FUNCTION__][$action][$what] = ((!isExtensionInstalledAndNewer('admins', '0.2.0')) || (isAdminsAllowedByAcl($action, $what))); + $GLOBALS[__FUNCTION__][$action][$what] = ((!isExtensionInstalledAndNewer('admins', '0.2.0')) || ((isExtensionActive('admins')) && (isAdminsAllowedByAcl($action, $what)))); } // END - if // Return the cached value @@ -250,7 +244,7 @@ function isAdminAllowedAccessMenu ($action, $what = NULL) { // Adds an admin menu function addAdminMenu ($action, $what) { // Init variables - $SUB = false; + $SUB = FALSE; $OUT = ''; // Menu descriptions @@ -270,7 +264,7 @@ ORDER BY `sort` ASC, `id` DESC", __FUNCTION__, __LINE__); - // Do we have entries? + // Are there entries? if (!SQL_HASZERONUMS($result_main)) { $OUT .= '