X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=cf76c3b12c0d4daee8bd01f4ef451f511a4abb1b;hb=61621983cc6d7195fcc7eab29b5f6080ff283b34;hp=66a7223bd4abd1192e01dc9b0a51f277f56943e7;hpb=9eb4caf6c374ebfb37b73e4549ef6fba9462dcee;p=mailer.git diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index 66a7223bd4..a18dd7f49f 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -1,7 +1,7 @@ $adminId); - - // Is the cache valid? - if (isAdminHashSet($admin)) { - // Get password from cache - $data['password'] = getAdminHash($admin); - $ret = 'pass'; - incrementStatsEntry('cache_hits'); - - // Include more admins data? - if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($GLOBALS['cache_array']['admin']['login_failures'][$adminId]))) { - // Load them here - $data['login_failures'] = $GLOBALS['cache_array']['admin']['login_failures'][$adminId]; - $data['last_failure'] = $GLOBALS['cache_array']['admin']['last_failure'][$adminId]; - } // END - if - } elseif (!isExtensionActive('cache')) { - // Add extra data via filter now - $add = runFilterChain('sql_admin_extra_data'); - - // Get password from DB - $result = SQL_QUERY_ESC("SELECT `password`" . $add . " FROM `{?_MYSQL_PREFIX?}_admins` WHERE `id`=%s LIMIT 1", - array($adminId), __FUNCTION__, __LINE__); - - // Entry found? - if (SQL_NUMROWS($result) == 1) { - // Login password found - $ret = 'pass'; - - // Fetch data - $data = SQL_FETCHARRAY($result); - } // END - if + // Get admin id from login + $adminId = getAdminId($adminLogin); - // Free result - SQL_FREERESULT($result); - } - - //* DEBUG: */ outputHtml("*".$data['password'].'/'.md5($password).'/'.$ret."
"); - if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) { - // Generate new hash - $data['password'] = generateHash($password); - - // Is the sql_patches not installed, than we cannot have a valid hashed password here! - if (($ret == 'pass') && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) $ret = 'done'; - } elseif ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches'))) { - // Old hashing way - return $ret; - } elseif (!isset($data['password'])) { - // Password not found, so no valid login! - return $ret; - } - - // Generate salt of password - $salt = substr($data['password'], 0, -40); - - // Check if password is same - //* DEBUG: */ outputHtml("*".$ret.','.$data['password'].','.$password.','.$salt."*
"); - if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == $password)) { - // Re-hash the plain passord with new random salt - $data['password'] = generateHash($password); - - // Do we have 0.7.0 of admins or later? - // Remmeber login failures if available - if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($data['login_failures']))) { - // Store it in session - setSession('mxchange_admin_failures', $data['login_failures']); - setSession('mxchange_admin_last_fail', $data['last_failure']); - - // Update password and reset login failures - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s',`login_failures`=0,`last_failure`='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", - array($data['password'], $adminId), __FUNCTION__, __LINE__); - } else { - // Update password - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s' WHERE `id`=%s LIMIT 1", - array($data['password'], $adminId), __FUNCTION__, __LINE__); - } + // Continue only with found admin ids + if (isValidId($adminId)) { + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminId); - // Rebuild cache - rebuildCacheFile('admin', 'admin'); + // If this is fine, we can continue + if ($adminHash != '-1') { + // Get admin id and set it as current + setCurrentAdminId($adminId); - // Login has failed by default... ;-) - $ret = 'failed1'; + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = generateHash($adminPassword, $adminHash); - // Password matches so login here - if (doAdminLogin($admin, $data['password'])) { - // All done now - $ret = 'done'; - } // END - if - } elseif ((empty($salt)) && ($ret == 'pass')) { - // Something bad went wrong - $ret = 'failed_salt'; - } elseif ($ret == 'done') { - // Try to login here if we have the old hashing way (sql_patches not installed?) - if (!doAdminLogin($admin, $data['password'])) { - // Something went wrong - $ret = 'failed2'; + // If they both match, the login data is valid + if ($testHash == $adminHash) { + // All fine + $ret = 'done'; + } else { + // Did not match! + $ret = 'password'; + } } // END - if - } - - // Count login failure if admins extension version is 0.7.0+ - if (($ret == 'pass') && (getExtensionVersion('admins') >= '0.7.0')) { - // Update counter - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET login_failures`=`login_failures`+1,`last_failure`=NOW() WHERE `id`=%s LIMIT 1", - array($adminId), __FUNCTION__, __LINE__); - - // Rebuild cache - rebuildCacheFile('admin', 'admin'); } // END - if - // Return the result - //* DEBUG: */ die('RETURN=' . $ret); - return $ret; -} - -// Try to login the admin by setting some session/cookie variables -function doAdminLogin ($adminLogin, $passHash) { - // Reset failure counter on matching admins version - if ((isExtensionInstalledAndNewer('admins', '0.7.0')) && ((isExtensionOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) { - // Reset counter on out-dated sql_patches version - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `login_failures`=0, `last_failure`='0000-00-00 00:00:00' WHERE `login`='%s' LIMIT 1", - array($adminLogin), __FUNCTION__, __LINE__); + // Prepare data array + $data = array( + 'id' => $adminId, + 'login' => $adminLogin, + 'plain_pass' => $adminPassword, + 'pass_hash' => $adminHash + ); - // Rebuild cache - rebuildCacheFile('admin', 'admin'); - } // END - if + // Run a special filter + runFilterChain('do_admin_login_' . $ret, $data); - // Now set all session variables and return the result - return (( - setSession('admin_md5', generatePassString($passHash)) - ) && ( - setSession('admin_login', $adminLogin) - ) && ( - setSession('admin_last', time()) - ) && ( - setSession('admin_to', bigintval(postRequestElement('timeout'))) - )); + // Return status + return $ret; } // Only be executed on cookie checking -function ifAdminCookiesAreValid ($admin, $password) { - // By default no admin cookies are found - $ret = '404'; - $pass = ''; - - // Get hash - $pass = getAdminHash($admin); - if ($pass != '-1') $ret = 'pass'; +function ifAdminCookiesAreValid ($adminLogin, $passHash) { + //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'adminLogin=' . $adminLogin . ',passHash=' . $passHash . ' - CALLED!'); - //* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).")
"); + // First of all, no admin login is found + $ret = '404'; - // Check if password matches - if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass))) && (isAdmin())) { - // Passwords matches! - $ret = 'done'; + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminLogin); + + // If this is fine, we can continue + if ($adminHash != '-1') { + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = encodeHashForCookie($adminHash); + //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'adminLogin=' . $adminLogin . ',passHash='.$passHash.',adminHash='.$adminHash.',testHash='.$testHash); + + // If they both match, the login data is valid + if ($testHash != $passHash) { + // Passwords don't match + $ret = 'password'; + } elseif (!isAdmin()) { + // Is not valid session + $ret = 'session'; + } else { + // All fine + $ret = 'done'; + } } // END - if - // Return result + // Return status + //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, 'ret=' . $ret . ' - EXIT!'); return $ret; } // Do an admin action function doAdminAction () { - // Get default what - $what = getWhat(); - - //* DEBUG: */ outputHtml(__LINE__."*".$what.'/'.getModule().'/'.getAction().'/'.getWhat()."*
"); - - // Remove any spaces from variable - if (empty($what)) { - // Default admin action is the overview page - $what = 'overview'; - } else { - // Compile out some chars - $what = compileCode($what, false, false, false); - } + // Determine correct 'what' value + $what = determineWhat(); // Get action value - $action = getModeAction(getModule(), $what); - - // Define admin login name and ID number - $content['login'] = getSession('admin_login'); - $content['id'] = getCurrentAdminId(); + $action = getActionFromModuleWhat(getModule(), $what); - // Preload templates + // Load welcome template if (isExtensionActive('admins')) { - $content['welcome'] = loadTemplate('admin_welcome_admins', true, $content); + // @TODO This and the next getCurrentAdminId() call might be moved into the templates? + $content['welcome'] = loadTemplate('admin_welcome_admins', TRUE, getCurrentAdminId()); } else { - $content['welcome'] = loadTemplate('admin_welcome', true, $content); + $content['welcome'] = loadTemplate('admin_welcome', TRUE, getCurrentAdminId()); } - $content['footer'] = loadTemplate('admin_footer' , true, $content); - $content['menu'] = addAdminMenu($action, $what, true); - // Tableset header - loadTemplate('admin_main_header', false, $content); + // Load header, footer, render menu + $content['header'] = loadTemplate('admin_header' , TRUE, $content); + $content['footer'] = loadTemplate('admin_footer' , TRUE, $content); + $content['menu'] = addAdminMenu($action, $what); - // Is sql_patches not yet installed? - if (!isExtensionInstalled('sql_patches')) { - // Output warning - loadTemplate('admin_settings_saved', false, getMessage('ADMIN_WARNING_SQL_PATCHES_MISSING')); - } // END - if + // Load main template + loadTemplate('admin_main', FALSE, $content); // Check if action/what pair is valid - $result_action = SQL_QUERY_ESC("SELECT + $result_action = sqlQueryEscaped("SELECT `id` FROM `{?_MYSQL_PREFIX?}_admin_menu` @@ -287,55 +200,79 @@ WHERE `action`='%s' AND ( ( - `what`='%s' AND `what` != 'overview' + `what`='%s' AND `what` != 'welcome' ) OR ( ( `what`='' OR `what` IS NULL ) AND ( - '%s'='overview' + '%s'='welcome' ) ) ) LIMIT 1", - array($action, $what, $what), __FUNCTION__, __LINE__); - if (SQL_NUMROWS($result_action) == 1) { + array( + $action, + $what, + $what + ), __FUNCTION__, __LINE__); + + // Is there an entry? + if (sqlNumRows($result_action) == 1) { // Is valid but does the inlcude file exists? - $inc = sprintf("inc/modules/admin/action-%s.php", $action); - if ((isIncludeReadable($inc)) && (isMenuActionValid('admin', $action, $what)) && ($GLOBALS['acl_allow'] === true)) { + $inc = sprintf('inc/modules/admin/action-%s.php', $action); + if ((isIncludeReadable($inc)) && (isMenuActionValid('admin', $action, $what)) && ($GLOBALS['acl_allow'] === TRUE)) { // Ok, we finally load the admin action module loadInclude($inc); - } elseif ($GLOBALS['acl_allow'] === false) { + } elseif ($GLOBALS['acl_allow'] === FALSE) { // Access denied - loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACCESS_DENIED'), $what)); + loadTemplate('admin_menu_failed', FALSE, '{%message,ADMIN_ACCESS_DENIED=' . $what . '%}'); } else { - // Include file not found! :-( - loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_404'), $action)); + // Include file not found :-( + loadTemplate('admin_menu_failed', FALSE, '{%message,ADMIN_ACTION_404=' . $action . '%}'); } } else { - // Invalid action/what pair found! - loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_INVALID'), $action.'/'.$what)); + // Invalid action/what pair found + loadTemplate('admin_menu_failed', FALSE, '{%message,ADMIN_ACTION_INVALID=' . $action . '/' . $what . '%}'); } // Free memory - SQL_FREERESULT($result_action); + sqlFreeResult($result_action); // Tableset footer - loadTemplate('admin_main_footer', false, $content); + loadTemplate('admin_main_footer', FALSE, $content); +} + +/** + * Checks whether current admin is allowed to access given action/what + * combination (only one is allowed to be null!). + */ +function isAdminAllowedAccessMenu ($action, $what = NULL) { + // Is there cache? + if (!isset($GLOBALS[__FUNCTION__][$action][$what])) { + // ACL is always 'allow' when no ext-admins is installed + // @TODO This can be rewritten into a filter + $GLOBALS[__FUNCTION__][$action][$what] = ((!isExtensionInstalledAndNewer('admins', '0.2.0')) || ((isExtensionActive('admins')) && (isAdminsAllowedByAcl($action, $what)))); + } // END - if + + // Return the cached value + return $GLOBALS[__FUNCTION__][$action][$what]; } // Adds an admin menu -function addAdminMenu ($action, $what, $return=false) { +function addAdminMenu ($action, $what) { // Init variables - $SUB = false; + $SUB = FALSE; $OUT = ''; // Menu descriptions $GLOBALS['menu']['description'] = array(); - $GLOBALS['menu']['title'] = array(); + $GLOBALS['menu']['title'] = array(); // Build main menu - $result_main = SQL_QUERY("SELECT - `action`, `title`, `descr` + $result_main = sqlQuery("SELECT + `action` AS `main_action`, + `title` AS `main_title`, + `descr` AS `main_descr` FROM `{?_MYSQL_PREFIX?}_admin_menu` WHERE @@ -343,47 +280,79 @@ WHERE ORDER BY `sort` ASC, `id` DESC", __FUNCTION__, __LINE__); - if (SQL_NUMROWS($result_main) > 0) { - $OUT = "
 
\n"; - $OUT .= "\n"; - } + sqlFreeResult($result_what); + } // END - if - // Is there a cache instance again? - // Return or output content? - if ($return === true) { - return $OUT; - } else { - outputHtml($OUT); - } + // Close li-tag + $OUT .= ''; + + // Return content + return $OUT; +} + +// Create an admin selection box form +function addAdminSelectionBox ($adminId = NULL, $special = '') { + // Default is email as "special column" + $ADD = ',`email` AS `special`'; + + // Is a special column given? + if (!empty($special)) { + // Additional column for SQL query + $ADD = ',`' . $special . '` AS `special`'; + } // END - if + + // Query all entries + $result = sqlQuery('SELECT + `id`, + `login` + ' . $ADD . ' +FROM + `{?_MYSQL_PREFIX?}_admins` +ORDER BY + `login` ASC', __FUNCTION__, __LINE__); + + // Init output + $OUT = ''; + + // Load all entries + while ($content = sqlFetchArray($result)) { + // Default is none + $content['default'] = ''; + + // Is the id the same? + if ($content['id'] == $adminId) { + // Set this as default + $content['default'] = ' selected="selected"'; + } // END - if + + // Add the entry + $OUT .= loadTemplate('select_admins_option', TRUE, $content); + } // END - if + + // Free memory + sqlFreeResult($result); + + // Add form to content + $content['form_selection'] = $OUT; + + // Output form + loadTemplate('select_admins_box', FALSE, $content); } -// Create member selection box -function addMemberSelectionBox ($def=0, $add_all=false, $return=false, $none=false, $field='userid') { +// Create a member selection box +function addMemberSelectionBox ($userid = NULL, $add_all = FALSE, $return = FALSE, $none = FALSE, $field = 'userid', $whereStatement = " WHERE `surname` NOT LIKE '{?tester_user_surname_prefix?}%'") { // Output selection form with all confirmed user accounts listed - $result = SQL_QUERY("SELECT `userid`, `surname`, `family` FROM `{?_MYSQL_PREFIX?}_user_data` ORDER BY `userid` ASC", __FUNCTION__, __LINE__); + $result = sqlQuery('SELECT + `userid`, + `surname`, + `family` +FROM + `{?_MYSQL_PREFIX?}_user_data` +' . $whereStatement . ' +ORDER BY + `userid` ASC', __FUNCTION__, __LINE__); // Default output $OUT = ''; // USe this only for adding points (e.g. adding refs really makes no sence ;-) ) - if ($add_all === true) $OUT = " \n"; - elseif ($none === true) $OUT = " \n"; + if ($add_all === TRUE) { + $OUT = ' '; + } elseif ($none === TRUE) { + $OUT = ' '; + } - while ($content = SQL_FETCHARRAY($result)) { - $OUT .= " '; + // Load all entries + while ($content = sqlFetchArray($result)) { + $OUT .= ''; // Walk through all files foreach ($menuArray as $file) { // Is this a PHP script? - if ((!isDirectory($file)) && (strpos($file, "".$type.'-') > -1) && (strpos($file, '.php') > 0)) { + if ((!isDirectory($file)) && (isInString('' . $type . '-', $file)) && (isInString('.php', $file))) { // Then test if the file is readable - $test = sprintf("inc/modules/%s/%s", $menu, $file); + $test = sprintf('inc/modules/%s/%s', $menu, $file); // Is the file there? if (isIncludeReadable($test)) { @@ -672,49 +719,80 @@ function adminAddMenuSelectionBox ($menu, $type, $name, $default = '') { $part = substr($part, 0, -4); // Is that part different from the overview? - if ($part != 'overview') { - $OUT .= "