X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=7ef2e0aa551460bf65d5528565237463dca36aba;hb=a1ef1533f17e1ca5db81a9912632491e72626694;hp=6aba44b39868759a95758024e8c5e40a381b0600;hpb=7c971b2eac943d888a2c26dce573b41a48466c70;p=mailer.git diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index 6aba44b398..7ef2e0aa55 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -39,20 +39,17 @@ if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) } // -function REGISTER_ADMIN ($user, $md5) +function REGISTER_ADMIN ($user, $md5, $email=WEBMASTER) { $ret = "failed"; $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", array($user), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 0) - { + if (SQL_NUMROWS($result) == 0) { // Ok, let's create the admin login - $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_admins (login, password, email) VALUES('%s', '%s', '".WEBMASTER."')", - array($user, $md5), __FILE__, __LINE__); + $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_admins (login, password, email) VALUES('%s', '%s', '%s')", + array($user, $md5, $email), __FILE__, __LINE__); $ret = "done"; - } - else - { + } else { // Free memory SQL_FREERESULT($result); @@ -66,35 +63,30 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password) { global $cacheArray, $_CONFIG, $cacheInstance; $ret = "404"; $pass = ""; - if (!empty($cacheArray['admins']['aid'][$admin_login])) - { + if (!empty($cacheArray['admins']['aid'][$admin_login])) { // Get password from cache $pass = $cacheArray['admins']['password'][$admin_login]; $ret = "pass"; $_CONFIG['cache_hits']++; - } - else - { + } else { // Get password from DB $result = SQL_QUERY_ESC("SELECT password FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", array($admin_login), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { $ret = "pass"; list($pass) = SQL_FETCHROW($result); SQL_FREERESULT($result); } } - //* DEBUG: */ echo "*".$pass."/".$password."/".$ret."
"; - if ((strlen($pass) == 32) && ($pass == md5($password))) - { + //* DEBUG: */ echo "*".$pass."/".md5($password)."/".$ret."
"; + if ((strlen($pass) == 32) && ($pass == md5($password))) { // Generate new hash $pass = generateHash($password); - if (($ret == "pass") && (GET_EXT_VERSION("sql_patches") < "0.3.6")) $ret = "done"; - } - elseif ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == "")) - { + + // Is the sql_patches not installed, than we cannot have a valid hashed password here! + if (($ret == "pass") && ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == ""))) $ret = "done"; + } elseif ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == "")) { // Old hashing way return $ret; } @@ -104,28 +96,60 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password) $salt = __SALT; // Check if password is same - if (($ret == "pass") && ($pass == generateHash($password, $salt)) && (!empty($salt))) - { + //* DEBUG: */ echo "*".$ret.",".$pass.",".$password.",".$salt."*
\n"; + if (($ret == "pass") && ($pass == generateHash($password, $salt)) && (!empty($salt))) { + // Change the passord hash here + $pass = generateHash($password); + // Update password $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s' WHERE login='%s' LIMIT 1", array($pass, $admin_login), __FILE__, __LINE__); // Shall I remove the cache file? - if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance != false)) - { + if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance != false)) { if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy(); } - // Password matches! - $ret = "done"; - } - elseif ((empty($salt)) && ($ret == "pass")) - { + // Login has failed by default... ;-) + $ret = "failed"; + + // Password matches so login here + if (LOGIN_ADMIN($admin_login, $pass)) { + // All done now + $ret = "done"; + } + } elseif ((empty($salt)) && ($ret == "pass")) { // Something bad went wrong $ret = "failed"; + } elseif ($ret == "done") { + // Try to login here if we have the old hashing way (sql_patches not installed?) + if (!LOGIN_ADMIN($admin_login, $pass)) { + // Something went wrong + $ret = "failed"; + } } + + // Return the result + //* DEBUG: */ die("RETURN=".$ret); return $ret; } + +// Try to login the admin by setting some session/cookie variables +function LOGIN_ADMIN ($adminLogin, $passHash) { + // Now set all session variables and return the result + return ( + ( + set_session("admin_md5", generatePassString($passHash)) + ) && ( + set_session("admin_login", $adminLogin) + ) && ( + set_session("admin_last", time()) + ) && ( + set_session("admin_to", $_POST['timeout']) + ) + ); +} + // Only be executed on cookie checking function CHECK_ADMIN_COOKIES ($admin_login, $password) { global $cacheArray, $_CONFIG; @@ -140,16 +164,21 @@ function CHECK_ADMIN_COOKIES ($admin_login, $password) { $result = SQL_QUERY_ESC("SELECT password FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", array($admin_login), __FILE__, __LINE__); if (SQL_NUMROWS($result) == 1) { + // Entry found $ret = "pass"; + + // Fetch password list($pass) = SQL_FETCHROW($result); - SQL_FREERESULT($result); } + + // Free result + SQL_FREERESULT($result); } - //* DEBUG: */ echo "*".$pass."/".$password."
"; + //* DEBUG: */ echo __FUNCTION__.":".$pass."(".strlen($pass).")/".$password."(".strlen($password).")
\n"; // Check if password matches - if (($ret == "pass") && ((generatePassString($pass) == $password) || ($pass == $password))) { + if (($ret == "pass") && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) { // Passwords matches! $ret = "done"; } @@ -158,70 +187,79 @@ function CHECK_ADMIN_COOKIES ($admin_login, $password) { return $ret; } // -function admin_WriteData ($file, $comment, $prefix, $suffix, $DATA, $seek=0) -{ - $done = false; $seek++; $found = false; - if (file_exists($file)) - { +function admin_WriteData ($file, $comment, $prefix, $suffix, $DATA, $seek=0) { + // Initialize some variables + $done = false; + $seek++; + $found = false; + + // Is the file there and read-/write-able? + if ((file_exists($file)) && (is_readable($file)) && (is_writeable($file))) { $search = "CFG: ".$comment; $tmp = $file.".tmp"; - $fp = fopen($file, 'r') or OUTPUT_HTML("READ: ".$file."
"); - if ($fp) - { - $fp_tmp = fopen($tmp, 'w') or OUTPUT_HTML("WRITE: ".$tmp."
"); - if ($fp_tmp) - { - while (! feof($fp)) - { + + // Open the source file + $fp = @fopen($file, 'r') or OUTPUT_HTML("READ: ".$file."
"); + + // Is the resource valid? + if (is_resource($fp)) { + // Open temporary file + $fp_tmp = @fopen($tmp, 'w') or OUTPUT_HTML("WRITE: ".$tmp."
"); + + // Is the resource again valid? + if (is_resource($fp_tmp)) { + while (!feof($fp)) { + // Read from source file $line = fgets ($fp, 1024); + if (strpos($line, $search) > -1) { $next = 0; $found = true; } - if ($next > -1) - { - if ($next == $seek) - { + + if ($next > -1) { + if ($next == $seek) { $next = -1; $line = $prefix . $DATA . $suffix."\n"; - } - else - { + } else { $next++; } } + + // Write to temp file fputs($fp_tmp, $line); } + + // Close temp file fclose($fp_tmp); + // Finished writing tmp file $done = true; } + + // Close source file fclose($fp); - if (($done) && ($found)) - { + + if (($done) && ($found)) { // Copy back tmp file and delete tmp :-) @copy($tmp, $file); @unlink($tmp); define('_FATAL', false); - } - elseif (!$found) - { + } elseif (!$found) { OUTPUT_HTML("CHANGE: 404!"); define('_FATAL', true); - } - else - { + } else { OUTPUT_HTML("TMP: UNDONE!"); define('_FATAL', true); } } - } - else - { + } else { + // File not found, not readable or writeable OUTPUT_HTML("404: ".$file."
"); } } + // function ADMIN_DO_ACTION($wht) { - global $menuDesription, $menuTitle, $_CONFIG, $cacheArray, $link, $DATA; + global $menuDesription, $menuTitle, $_CONFIG, $cacheArray, $link, $DATA, $DEPTH; //* DEBUG: */ echo __LINE__."*".$wht."/".$GLOBALS['module']."/".$GLOBALS['action']."/".$GLOBALS['what']."*
\n"; if (EXT_IS_ACTIVE("cache")) { @@ -262,7 +300,7 @@ function ADMIN_DO_ACTION($wht) // Check if action/what pair is valid $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_admin_menu -WHERE action='%s' AND ((what='%s' AND what != 'overview') OR (what='' AND '%s'='overview')) +WHERE action='%s' AND ((what='%s' AND what != 'overview') OR ((what='' OR what IS NULL) AND '%s'='overview')) LIMIT 1", array($act, $wht, $wht), __FILE__, __LINE__); if (SQL_NUMROWS($result) == 1) { @@ -270,7 +308,7 @@ LIMIT 1", array($act, $wht, $wht), __FILE__, __LINE__); SQL_FREERESULT($result); // Is valid but does the inlcude file exists? - $INC = sprintf(PATH."inc/modules/admin/action-%s.php", $act); + $INC = sprintf("%sinc/modules/admin/action-%s.php", PATH, $act); if ((file_exists($INC)) && (is_readable($INC)) && (VALIDATE_MENU_ACTION("admin", $act, $wht)) && (__ACL_ALLOW == true)) { // Ok, we finally load the admin action module @@ -308,7 +346,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) $menuTitle = array(); // Build main menu - $result_main = SQL_QUERY("SELECT action, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE what='' ORDER BY sort, id DESC", __FILE__, __LINE__); + $result_main = SQL_QUERY("SELECT action, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE (what='' OR what IS NULL) ORDER BY sort, id DESC", __FILE__, __LINE__); $OUT = ""; if (SQL_NUMROWS($result_main) > 0) { @@ -342,7 +380,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) } else { - $OUT .= "[ "; + $OUT .= "["; } $OUT .= $title; if (($menu == $act) && (empty($wht))) @@ -351,7 +389,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) } else { - $OUT .= " ]"; + $OUT .= "]"; } $OUT .= " \n"; @@ -368,7 +406,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) while (list($wht_sub, $title_what, $desc_what) = SQL_FETCHROW($result_what)) { // Filename - $INC = sprintf(PATH."inc/modules/admin/what-%s.php", $wht_sub); + $INC = sprintf("%sinc/modules/admin/what-%s.php", PATH, $wht_sub); if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) { $ACL = ADMINS_CHECK_ACL("", $wht_sub); @@ -395,7 +433,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) } else { - $OUT .= "[ "; + $OUT .= "["; } } else @@ -411,7 +449,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) } else { - $OUT .= " ]"; + $OUT .= "]"; } } else @@ -484,7 +522,7 @@ function ADD_MEMBER_SELECTION_BOX($add_all = false, $return = false, $none = fal // function ADMIN_MENU_SELECTION($MODE, $default="", $defid="") { $wht = "what != ''"; - if ($MODE == "action") $wht = "what='' AND action !='login'"; + if ($MODE == "action") $wht = "(what='' OR what IS NULL) AND action !='login'"; $result = SQL_QUERY_ESC("SELECT %s, title FROM "._MYSQL_PREFIX."_admin_menu WHERE ".$wht." ORDER BY sort", array($MODE), __FILE__, __LINE__); if (SQL_NUMROWS($result) > 0) @@ -628,17 +666,18 @@ function ADMIN_SAVE_SETTINGS (&$POST, $tableName="_config", $whereStatement="con } // function ADMIN_MAKE_MENU_SELECTION($menu, $type, $name, $default="") { + // Open the requested menu directory + $handle = opendir(sprintf("%sinc/modules/%s/", PATH, $menu)) or mxchange_die("Cannot load menu ".$menu."!"); + // Init the selection box $OUT = "\n"; @@ -708,7 +747,7 @@ function ADMIN_CHECK_MENU_MODE() // Change activation status function ADMIN_CHANGE_ACTIVATION_STATUS ($IDs, $table, $row, $idRow = "id") { global $_CONFIG; - $cnt = 0; $newStatus = 'Y'; + $cnt = 0; $newStatus = "Y"; if ((is_array($IDs)) && (count($IDs) > 0)) { // "Walk" all through and count them foreach ($IDs as $id=>$selected) { @@ -718,17 +757,17 @@ function ADMIN_CHANGE_ACTIVATION_STATUS ($IDs, $table, $row, $idRow = "id") { // Should always be 1 ;-) if ($selected == 1) { // Determine new status - $result = SQL_QUERY_ESC("SELECT %s FROM "._MYSQL_PREFIX."_%s WHERE %s=%d LIMIT 1", + $result = SQL_QUERY_ESC("SELECT %s FROM "._MYSQL_PREFIX."_%s WHERE %s=%s LIMIT 1", array($row, $table, $idRow, $id), __FILE__, __LINE__); // Row found? if (SQL_NUMROWS($result) == 1) { // Load the status list($currStatus) = SQL_FETCHROW($result); - if ($currStatus == 'Y') $newStatus='N'; else $newStatus = 'Y'; + if ($currStatus == "Y") $newStatus='N'; else $newStatus = "Y"; // Change this status - SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_%s SET %s='%s' WHERE %s=%d LIMIT 1", + SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_%s SET %s='%s' WHERE %s=%s LIMIT 1", array($table, $row, $newStatus, $idRow, $id), __FILE__, __LINE__); // Count up affected rows @@ -755,9 +794,10 @@ function ADMIN_DELETE_ENTRIES_CONFIRM ($IDs, $table, $row, $columns = array(), $ // "Walk" through all entries and count them if ($deleteNow) { // Delete them + die("DELETE!"); } else { // List for confirmation - foreach ($IDs as $id=>$selected) { + foreach ($IDs as $id => $selected) { // Secure ID number $id = bigintval($id); @@ -799,5 +839,168 @@ function ADMIN_DELETE_ENTRIES_CONFIRM ($IDs, $table, $row, $columns = array(), $ } } } +// Edit rows by given ID numbers +function ADMIN_EDIT_ENTRIES_CONFIRM ($IDs, $table, $row, $columns = array(), $filterFunctions = array(), $editNow=false, $idRow="id") { + global $_CONFIG; + $OUT = ""; $SW = 2; + if ((is_array($IDs)) && (count($IDs) > 0)) { + // "Walk" through all entries and count them + if ($editNow) { + // Delete them + die("EDIT!"); + } else { + // List for confirmation + foreach ($IDs as $id => $selected) { + // Secure ID number + $id = bigintval($id); + + // Will always be 1 ;-) + if ($selected == 1) { + // Get result from a given column array and table name + $result = SQL_RESULT_FROM_ARRAY($table, $columns, $idRow, $id); + + // Is there one entry? + if (SQL_NUMROWS($result) == 1) { + // Load all data + $content = SQL_FETCHARRAY($result); + + // Filter all data + foreach ($content as $key=>$value) { + // Is a filter function set? + $idx = array_search($key, $columns, true); + if (!empty($filterFunctions[$idx])) { + // Then call it! + $content[$key] = call_user_func($filterFunctions[$idx], $value); + } + } + + // Add color switching + $content['sw'] = $SW; + + // Then list it again... + $OUT .= LOAD_TEMPLATE("admin_edit_".$table."_row", true, $content); + $SW = 3 - $SW; + } + + // Free the result + SQL_FREERESULT($result); + } + } + + // Load master template + LOAD_TEMPLATE("admin_edit_".$table."", false, $OUT); + } + } +} +// Checks proxy settins by fetching check-updates2.php from www.mxchange.org +function ADMIN_TEST_PROXY_SETTINGS ($settingsArray) { + global $_CONFIG; + // By default they are invalid + $valid = false; + + // Set temporary the new settings + $_CONFIG = array_merge($_CONFIG, $settingsArray); + + // Now get the test URL + $content = MXCHANGE_OPEN("check-updates2.php"); + + // Is the first line with "200 OK"? + $valid = eregi("200 OK", $content[0]); + + // Return result + return $valid; +} +// Sends out a link to the given email adress so the admin can reset his/her password +function ADMIN_SEND_PASSWORD_RESET_LINK ($email) { + global $_CONFIG; + // Init output + $OUT = ""; + + // Compile out security characters (must be for looking up!) + $email = COMPILE_CODE($email); + + // Look up administator login + $result = SQL_QUERY_ESC("SELECT id, login, password FROM "._MYSQL_PREFIX."_admins WHERE email='%s' LIMIT 1", + array($email), __FILE__, __LINE__); + + // Is there an account? + if (SQL_NUMROWS($result) == 0) { + // No account found! + return ADMIN_NO_LOGIN_WITH_EMAIL; + } // END - if + + // Load all data + $content = SQL_FETCHARRAY($result); + + // Free result + SQL_FREERESULT($result); + + // Generate hash for reset link + $content['hash'] = generateHash(URL.":".$content['id'].":".$content['login'].":".$content['password'], substr($content['password'], 10)); + + // Remove some data + unset($content['id']); + unset($content['password']); + + // Prepare email + $mailText = LOAD_EMAIL_TEMPLATE("admin_reset_password", $content); + + // Send it out + SEND_EMAIL($email, ADMIN_RESET_PASS_LINK_SUBJ, $mailText); + + // Prepare output + return ADMIN_RESET_LINK_SENT; +} +// Validate hash and login for password reset +function ADMIN_VALIDATE_RESET_LINK_HASH_LOGIN ($hash, $login) { + // By default nothing validates... ;) + $valid = false; + + // Compile the login for lookup + $login = COMPILE_CODE($login); + + // Then try to find that user + $result = SQL_QUERY_ESC("SELECT id, password, email FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", + array($login), __FILE__, __LINE__); + + // Is an account here? + if (SQL_NUMROWS($result) == 1) { + // Load all data + $content = SQL_FETCHARRAY($result); + + // Generate hash again + $hashFromData = generateHash(URL.":".$content['id'].":".$login.":".$content['password'], substr($content['password'], 10)); + + // Does both match? + $valid = ($hash == $hashFromData); + } // END - if + + // Free result + SQL_FREERESULT($result); + + // Return result + return $valid; +} +// Reset the password for the login. Do NOT call this function without calling above function first! +function ADMIN_RESET_PASSWORD ($login, $password) { + // Init hash + $passHash = ""; + + // Now check if we have sql_patches installed + if (GET_EXT_VERSION("sql_patches") >= "0.3.6") { + // Use new way of hashing + $passHash = generateHash($password); + } else { + // Old MD5 method + $passHash = md5($password); + } + + // Update database + SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s' WHERE login='%s' LIMIT 1", + array($passHash, $login), __FILE__, __LINE__); + + // Return output + return ADMIN_PASSWORD_RESET_DONE; +} // ?>