0.2.1/inc/modules/admin.php

   1 <?php\r
   2 /************************************************************************\r
   3  * MXChange v0.2.1                                    Start: 08/31/2003 *\r
   4  * ===============                              Last change: 07/02/2004 *\r
   5  *                                                                      *\r
   6  * -------------------------------------------------------------------- *\r
   7  * File              : admin.php                                        *\r
   8  * -------------------------------------------------------------------- *\r
   9  * Short description : Administration module                            *\r
  10  * -------------------------------------------------------------------- *\r
  11  * Kurzbeschreibung  : Administrationsmodul                             *\r
  12  * -------------------------------------------------------------------- *\r
  13  *                                                                      *\r
  14  * -------------------------------------------------------------------- *\r
  15  * Copyright (c) 2003 - 2007 by Roland Haeder                           *\r
  16  * For more information visit: http://www.mxchange.org                  *\r
  17  *                                                                      *\r
  18  * This program is free software; you can redistribute it and/or modify *\r
  19  * it under the terms of the GNU General Public License as published by *\r
  20  * the Free Software Foundation; either version 2 of the License, or    *\r
  21  * (at your option) any later version.                                  *\r
  22  *                                                                      *\r
  23  * This program is distributed in the hope that it will be useful,      *\r
  24  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *\r
  25  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *\r
  26  * GNU General Public License for more details.                         *\r
  27  *                                                                      *\r
  28  * You should have received a copy of the GNU General Public License    *\r
  29  * along with this program; if not, write to the Free Software          *\r
  30  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *\r
  31  * MA  02110-1301  USA                                                  *\r
  32  ************************************************************************/\r
  33 \r
  34 // Some security stuff...\r
  35 if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))\r
  36 {\r
  37         $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4)."/security.php";\r
  38         require($INC);\r
  39 }\r
  40 \r
  41 // Login is default\r
  42 if ((empty($GLOBALS['action'])) && ($check == "admin_only"))\r
  43 {\r
  44         // Redirect to right URL\r
  45         LOAD_URL(URL."/modules.php?module=admin&amp;action=login");\r
  46 }\r
  47 \r
  48 // Load include file\r
  49 require_once(PATH."inc/modules/admin/admin-inc.php");\r
  50 \r
  51 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)\r
  52 FIX_DELETED_COOKIES(array('admin_login', 'admin_md5', 'admin_last', 'admin_to'));\r
  53 \r
  54 // Is the logout empty?\r
  55 if (empty($_GET['logout'])) $_GET['logout'] = "";\r
  56 \r
  57 if (!admin_registered)\r
  58 {\r
  59         // Admin is not registered so we have to inform the user\r
  60         if ((isset($_POST['ok'])) && ((empty($_POST['login'])) || (empty($_POST['pass'])) || (strlen($_POST['pass']) < 4))) $_POST['ok'] = "***";\r
  61         if ((isset($_POST['ok'])) && ($_POST['ok'] != "***"))\r
  62         {\r
  63                 // Hash the password with our new generateHash() function\r
  64                 $hashedPass = generateHash($_POST['pass']);\r
  65 \r
  66                 // If the password has not been hashed we have to fall-back to md5()\r
  67                 if ($hashedPass == $_POST['pass']) $hashedPass = md5($hashedPass);\r
  68 \r
  69                 // Do registration\r
  70                 $ret = REGISTER_ADMIN($_POST['login'], $hashedPass);\r
  71                 switch ($ret)\r
  72                 {\r
  73                 case "done":\r
  74                         admin_WriteData(PATH."inc/config.php", "ADMIN-SETUP", "define ('admin_registered', ", ");", "true", 0);\r
  75                         if (!_FATAL)\r
  76                         {\r
  77                                 $URL = URL."/modules.php?module=admin&amp;action=login&register=done";\r
  78                                 LOAD_URL($URL);\r
  79                                 die($URL);\r
  80                         }\r
  81                          else\r
  82                         {\r
  83                                 $ret = ADMIN_CANNOT_COMPLETE;\r
  84                         }\r
  85                         break;\r
  86 \r
  87                 case "failed":\r
  88                         $ret = ADMIN_REGISTER_FAILED;\r
  89                         break;\r
  90 \r
  91                 case "already":\r
  92                 default:\r
  93                         if ($ret == "already")\r
  94                         {\r
  95                                 // Admin does already exists!\r
  96                                 $ret = ADMIN_LOGIN_ALREADY_REG;\r
  97                         }\r
  98                          else\r
  99                         {\r
 100                                 // Any other kind\r
 101                                 $ret = "done";\r
 102                         }\r
 103                         if (!admin_registered)\r
 104                         {\r
 105                                 // Write to config that registration is done\r
 106                                 admin_WriteData(PATH."inc/config.php", "ADMIN-SETUP", "define ('admin_registered', ", ");", "true", 0);\r
 107 \r
 108                                 // Load URL for login\r
 109                                 $URL = URL."/modules.php?module=admin&amp;action=login";\r
 110                                 LOAD_URL($URL);\r
 111                         }\r
 112                         break;\r
 113                 }\r
 114         }\r
 115         if ($ret != "done")\r
 116         {\r
 117                 // Fixes another "Notice"\r
 118                 if (!empty($_POST['login'])) {\r
 119                         define('__LOGIN_VALUE', $_POST['login']);\r
 120                 } else {\r
 121                         define('__LOGIN_VALUE', "");\r
 122                 }\r
 123 \r
 124                 // Yet-another "Notice" fix\r
 125                 if ((!empty($_POST['ok'])) && ($_POST['ok'] == "***"))\r
 126                 {\r
 127                         // No login entered?\r
 128                         if (empty($_POST['login'])) $MSG1 = ADMIN_NO_LOGIN;\r
 129 \r
 130                         // An error comes back from registration?\r
 131                         if (!empty($ret)) $MSG1 = $ret;\r
 132 \r
 133                         // No password entered?\r
 134                         if (empty($_POST['pass'])) $MSG2 = ADMIN_NO_PASS;\r
 135 \r
 136                         // Or password too short?\r
 137                         if (strlen($_POST['pass']) < 4) $MSG2 = ADMIN_SHORT_PASS;\r
 138 \r
 139                         // Output error messages\r
 140                         define('__MSG_LOGIN', LOAD_TEMPLATE("admin_login_msg", true, $MSG1));\r
 141                         define('__MSG_PASS',  LOAD_TEMPLATE("admin_login_msg", true, $MSG2));\r
 142 \r
 143                         // Reset variables\r
 144                         $MSG1 = ""; $MSG2 = "";\r
 145                 }\r
 146                  else\r
 147                 {\r
 148                         // Reset values to nothing\r
 149                         define('__MSG_LOGIN', "");\r
 150                         define('__MSG_PASS' , "");\r
 151                 }\r
 152 \r
 153                 // Load register template\r
 154                 LOAD_TEMPLATE("admin_reg_form");\r
 155         }\r
 156 }\r
 157  elseif ((empty($_COOKIE['admin_login'])) || (empty($_COOKIE['admin_md5'])) || (empty($_COOKIE['admin_last'])) || (empty($_COOKIE['admin_to'])) || (($_COOKIE['admin_last'] + bigintval($_COOKIE['admin_to']) * 3600 * 24) < time()))\r
 158 {\r
 159         // At leat one administrator account was created\r
 160         if ((!empty($_COOKIE['admin_login'])) && (!empty($_COOKIE['admin_md5'])) && (!empty($_COOKIE['admin_last'])) && (!empty($_COOKIE['admin_to'])))\r
 161         {\r
 162                 // Timeout for last login, we have to logout first!\r
 163                 $URL = URL."/modules.php?module=admin&amp;action=login&amp;logout=1";\r
 164                 LOAD_URL($URL);\r
 165         }\r
 166         if (!empty($_GET['register']))\r
 167         {\r
 168                 // Registration of first admin is done\r
 169                 if ($_GET['register'] == "done") OUTPUT_HTML ("<STRONG class=\"admin\">".ADMIN_REGISTER_DONE."</STRONG>");\r
 170         }\r
 171 \r
 172         // Check if the admin has submitted data or not\r
 173         $ret = "";\r
 174         if ((isset($_POST['ok'])) && ((empty($_POST['login'])) || (empty($_POST['pass'])) || (strlen($_POST['pass']) < 4))) $_POST['ok'] = "***";\r
 175         if ((isset($_POST['ok'])) && ($_POST['ok'] != "***"))\r
 176         {\r
 177                 // All required data was entered so we check his account\r
 178                 $ret = CHECK_ADMIN_LOGIN($_POST['login'], $_POST['pass']);\r
 179                 switch ($ret)\r
 180                 {\r
 181                 case "done": // Admin and password are okay, so we log in now\r
 182                         $TIMEOUT = time() + (3600 * 24 * $_POST['timeout']);\r
 183                         if ((@setcookie("admin_md5", generatePassString(generateHash($_POST['pass'], __SALT)), $TIMEOUT, COOKIE_PATH)) && (@setcookie("admin_login", $_POST['login'], $TIMEOUT, COOKIE_PATH)) && (@setcookie("admin_last", time(), $TIMEOUT, COOKIE_PATH)) && (@setcookie("admin_to", $_POST['timeout'], $TIMEOUT, COOKIE_PATH)))\r
 184                         {\r
 185                                 // Construct URL and redirect\r
 186                                 $URL = URL."/modules.php?module=admin&amp;";\r
 187 \r
 188                                 // Rewrite overview module\r
 189                                 if ($GLOBALS['what'] == "overview") {\r
 190                                         $GLOBALS['action'] = GET_ACTION($GLOBALS['module'], $GLOBALS['what']);\r
 191                                 }\r
 192 \r
 193                                 // Add data to URL\r
 194                                 if (!empty($GLOBALS['what'])) $URL .= "what=".$GLOBALS['what'];\r
 195                                  elseif (!empty($GLOBALS['action'])) $URL .= "action=".$GLOBALS['action'];\r
 196                                  elseif (!empty($_GET['area'])) $URL .= "area=".$_GET['area'];\r
 197 \r
 198                                 // Load URL\r
 199                                 LOAD_URL($URL);\r
 200                         }\r
 201                          else\r
 202                         {\r
 203                                 OUTPUT_HTML ("<STRONG class=\"admin_fatal\">".ADMIN_LOGIN_FAILED."</STRONG>");\r
 204                                 ADD_FATAL(CANNOT_REGISTER_SESS);\r
 205                         }\r
 206                         break;\r
 207 \r
 208                 case "404": // Administrator login not found\r
 209                         $_POST['ok'] = $ret;\r
 210                         $ret = ADMIN_NOT_FOUND;\r
 211                         break;\r
 212 \r
 213                 case "pass": // Wrong password\r
 214                         $_POST['ok'] = $ret;\r
 215                         $ret = WRONG_PASS;\r
 216                         break;\r
 217                 }\r
 218         }\r
 219         if ($ret != "done")\r
 220         {\r
 221                 if (!empty($_POST['login']))\r
 222                 {\r
 223                         define('__LOGIN_VALUE', $_POST['login']);\r
 224                 }\r
 225                  else\r
 226                 {\r
 227                         define('__LOGIN_VALUE', "");\r
 228                 }\r
 229 \r
 230                 if (isset($_POST['ok']))\r
 231                 {\r
 232                         // Set messages to zero\r
 233 \r
 234                         $MSG1 = ""; $MSG2 = "";\r
 235                         // No login entered?\r
 236                         if (empty($_POST['login'])) $MSG1 = ADMIN_NO_LOGIN;\r
 237 \r
 238                         // An error comes back from login?\r
 239                         if ((!empty($ret)) && ($_POST['ok'] == "404")) $MSG1 = $ret;\r
 240 \r
 241                         // No password entered?\r
 242                         if (empty($_POST['pass'])) $MSG2 = ADMIN_NO_PASS;\r
 243 \r
 244                         // Or password too short?\r
 245                         if (strlen($_POST['pass']) < 4) $MSG2 = ADMIN_SHORT_PASS;\r
 246 \r
 247                         // An error comes back from login?\r
 248                         if ((!empty($ret)) && ($_POST['ok'] == "pass")) $MSG2 = $ret;\r
 249 \r
 250                         // Load message template\r
 251                         define('__MSG_LOGIN', LOAD_TEMPLATE("admin_login_msg", true, $MSG1));\r
 252                         define('__MSG_PASS' , LOAD_TEMPLATE("admin_login_msg", true, $MSG2));\r
 253 \r
 254                         // Reset variables\r
 255                         $MSG1 = ""; $MSG2 = "";\r
 256                 }\r
 257                  else\r
 258                 {\r
 259                         // Set constants to empty for hiding them\r
 260                         define('__MSG_LOGIN', "");\r
 261                         define('__MSG_PASS' , "");\r
 262                 }\r
 263 \r
 264                 // Load login form\r
 265                 if (!empty($GLOBALS['what']))\r
 266                 {\r
 267                         // Restore old what value\r
 268                         $content = array('target' => "what", 'value' => $GLOBALS['what']);\r
 269                 }\r
 270                  elseif (!empty($GLOBALS['action']))\r
 271                 {\r
 272                         if ($GLOBALS['action'] != "logout")\r
 273                         {\r
 274                                 // Restore old action value\r
 275                                 $content = array('target' => "action", 'value' => $GLOBALS['action']);\r
 276                         }\r
 277                          else\r
 278                         {\r
 279                                 // Set default values\r
 280                                 $content = array('target' => "action", 'value' => "login");\r
 281                         }\r
 282                 }\r
 283                  elseif (!empty($_GET['area']))\r
 284                 {\r
 285                         // Restore old area value\r
 286                         $content = array('target' => "area", 'value' => $_GET['area']);\r
 287                 }\r
 288                  else\r
 289                 {\r
 290                         // Set default values\r
 291                         $content = array('target' => "action", 'value' => "login");\r
 292                 }\r
 293 \r
 294                 // Load login form template\r
 295                 LOAD_TEMPLATE("admin_login_form", false, $content);\r
 296         }\r
 297 }\r
 298  elseif ($_GET['logout'] == "1")\r
 299 {\r
 300         // Only try to remove cookies\r
 301         if (@setcookie("admin_login", "", (time() - 3600), COOKIE_PATH) && @setcookie("admin_md5", "", (time() - 3600), COOKIE_PATH) && @setcookie("admin_last", "", (time() - 3600), COOKIE_PATH) && @setcookie("admin_to", "", (time() - 3600), COOKIE_PATH))\r
 302         {\r
 303                 // Also remove array elements\r
 304                 unset($_COOKIE['admin_login']);\r
 305                 unset($_COOKIE['admin_md5']);\r
 306                 unset($_COOKIE['admin_last']);\r
 307                 unset($_COOKIE['admin_to']);\r
 308 \r
 309                 // Destroy session\r
 310                 @session_destroy();\r
 311 \r
 312                 // Load logout template\r
 313                 LOAD_TEMPLATE("admin_logout");\r
 314         }\r
 315          else\r
 316         {\r
 317                 // Something went wrong here...\r
 318                 OUTPUT_HTML ("<STRONG class=\"admin_fatal\">".ADMIN_LOGOUT_FAILED."</STRONG>");\r
 319 \r
 320                 // Add fatal message\r
 321                 ADD_FATAL(CANNOT_UNREG_SESS);\r
 322         }\r
 323 }\r
 324  else\r
 325 {\r
 326         // Maybe an Admin want's to login?\r
 327         $ret = CHECK_ADMIN_COOKIES(SQL_ESCAPE($_COOKIE['admin_login']), SQL_ESCAPE($_COOKIE['admin_md5']));\r
 328         switch ($ret)\r
 329         {\r
 330         case "done":\r
 331                 // Cookie-Data accepted\r
 332                 $TIMEOUT = time() + bigintval($_COOKIE['admin_to']);\r
 333                 if ((@setcookie("admin_md5", SQL_ESCAPE($_COOKIE['admin_md5']), $TIMEOUT, COOKIE_PATH)) && (@setcookie("admin_login", SQL_ESCAPE($_COOKIE['admin_login']), $TIMEOUT, COOKIE_PATH)) && (@setcookie("admin_last", time(), $TIMEOUT, COOKIE_PATH)) && (@setcookie("admin_to", bigintval($_COOKIE['admin_to']), $TIMEOUT, COOKIE_PATH)))\r
 334                 {\r
 335                         // Ok, Cookie-Update done\r
 336                         if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2"))\r
 337                         {\r
 338                                 // Check if action GET variable was set\r
 339                                 $act = SQL_ESCAPE($GLOBALS['action']);\r
 340                                 if (!empty($GLOBALS['what'])) {\r
 341                                         // Get action value by what-value\r
 342                                         $act = GET_ACTION("admin", $GLOBALS['what']);\r
 343                                 }\r
 344 \r
 345                                 // Check for access control line of current menu entry\r
 346                                 define('__ACL_ALLOW', ADMINS_CHECK_ACL($act, $GLOBALS['what']));\r
 347                         }\r
 348                          else\r
 349                         {\r
 350                                 // Extension not installed so it's always allowed to access everywhere!\r
 351                                 define('__ACL_ALLOW', true);\r
 352                         }\r
 353 \r
 354                         // When type of admin menu is not set fallback to old menu system\r
 355                         if (empty($CONFIG['admin_menu'])) $CONFIG['admin_menu'] = "OLD";\r
 356 \r
 357                         // Check for version and switch between old menu system and new "intelligent menu system"\r
 358                         if ((ADMIN_CHECK_MENU_MODE() == "NEW") && (file_exists(PATH."inc/modules/admin/la_sys-inc.php")))\r
 359                         {\r
 360                                 // Default area is the entrance, of course\r
 361                                 $area = "entrance";\r
 362 \r
 363                                 // Check for similar URL variable\r
 364                                 if (!empty($_GET['area'])) $area = $_GET['area'];\r
 365 \r
 366                                 // Load "logical-area menu-system" file\r
 367                                 require_once(PATH."inc/modules/admin/la_sys-inc.php");\r
 368 \r
 369                                 // Create new-style menu system will "logical areas"\r
 370                                 ADMIN_LOGICAL_AREA_SYSTEM($area, $act, $GLOBALS['what']);\r
 371                         }\r
 372                          else\r
 373                         {\r
 374                                 // This little call constructs the whole default old and lacky menu system\r
 375                                 // on left side\r
 376                                 ADMIN_DO_ACTION($GLOBALS['what']);\r
 377                         }\r
 378                 }\r
 379                  else\r
 380                 {\r
 381                         // Login failed (cookies enabled?)\r
 382                         OUTPUT_HTML ("<STRONG class=\"admin_fatal\">".ADMIN_LOGIN_FAILED."</STRONG>");\r
 383                         ADD_FATAL(CANNOT_RE_REGISTER_SESS);\r
 384                 }\r
 385                 break;\r
 386 \r
 387         case "404": // Administrator login not found\r
 388                 $_POST['ok'] = $ret;\r
 389                 ADD_FATAL(ADMIN_NOT_FOUND);\r
 390                 break;\r
 391 \r
 392         case "pass": // Wrong password\r
 393                 $_POST['ok'] = $ret;\r
 394                 ADD_FATAL(WRONG_PASS);\r
 395                 break;\r
 396         }\r
 397 }\r
 398 \r
 399 if (admin_registered)\r
 400 {\r
 401         // Check config.php and inc directory for right access rights\r
 402         if (is_INCWritable("config"))     ADD_FATAL(FATAL_CONFIG_WRITABLE);\r
 403         if (is_INCWritable("dummy"))      ADD_FATAL(FATAL_INC_WRITABLE);\r
 404 }\r
 405 //\r
 406 ?>\r