inc/modules/admin.php

   1 <?php
   2 /************************************************************************
   3  * Mailer v0.2.1-FINAL                                Start: 08/31/2003 *
   4  * ===================                          Last change: 07/02/2004 *
   5  *                                                                      *
   6  * -------------------------------------------------------------------- *
   7  * File              : admin.php                                        *
   8  * -------------------------------------------------------------------- *
   9  * Short description : Administration module                            *
  10  * -------------------------------------------------------------------- *
  11  * Kurzbeschreibung  : Administrationsmodul                             *
  12  * -------------------------------------------------------------------- *
  13  * $Revision::                                                        $ *
  14  * $Date::                                                            $ *
  15  * $Tag:: 0.2.1-FINAL                                                 $ *
  16  * $Author::                                                          $ *
  17  * -------------------------------------------------------------------- *
  18  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
  19  * Copyright (c) 2009, 2010 by Mailer Developer Team                    *
  20  * For more information visit: http://www.mxchange.org                  *
  21  *                                                                      *
  22  * This program is free software; you can redistribute it and/or modify *
  23  * it under the terms of the GNU General Public License as published by *
  24  * the Free Software Foundation; either version 2 of the License, or    *
  25  * (at your option) any later version.                                  *
  26  *                                                                      *
  27  * This program is distributed in the hope that it will be useful,      *
  28  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *
  29  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *
  30  * GNU General Public License for more details.                         *
  31  *                                                                      *
  32  * You should have received a copy of the GNU General Public License    *
  33  * along with this program; if not, write to the Free Software          *
  34  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *
  35  * MA  02110-1301  USA                                                  *
  36  ************************************************************************/
  37
  38 // Some security stuff...
  39 if (!defined('__SECURITY')) {
  40         die();
  41 } // END - if
  42
  43 // Load include file
  44 loadIncludeOnce('inc/modules/admin/admin-inc.php');
  45
  46 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)
  47 fixDeletedCookies(array('admin_id', 'admin_md5', 'admin_last'));
  48
  49 // Init return value
  50 $ret = 'init';
  51
  52 // Is no admin registered?
  53 if (!isAdminRegistered()) {
  54         // Admin is not registered so we have to inform the user
  55         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('pass1')) || (strlen(postRequestParameter('pass1')) < 4) || (!isPostRequestParameterSet('pass2')) || (strlen(postRequestParameter('pass2')) < 4) || (postRequestParameter('pass1') != postRequestParameter('pass2')))) {
  56                 setPostRequestParameter('ok', '***');
  57         } // END - if
  58
  59         // Clear error message
  60         $errorMessage = '';
  61
  62         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
  63                 // Hash the password with the old function because we are here in install mode
  64                 $hashedPass = md5(postRequestParameter('pass1'));
  65
  66                 // Kill maybe existing session variables
  67                 destroyAdminSession(false);
  68
  69                 // Do registration
  70                 $ret = addAdminAccount(postRequestParameter('login'), $hashedPass, getConfig('WEBMASTER'));
  71
  72                 // Check if registration wents fine
  73                 switch ($ret) {
  74                         case 'done':
  75                                 $done = changeDataInFile(getCachePath() . 'config-local.php', 'ADMIN-SETUP', "setConfigEntry('ADMIN_REGISTERED', '", "');", 'Y', 0);
  76                                 if ($done === true) {
  77                                         // Registering is done
  78                                         redirectToUrl('modules.php?module=admin&amp;register=done');
  79                                 } else {
  80                                         // Registration incomplete
  81                                         $errorMessage = '{--ADMIN_CANNOT_COMPLETE--}';
  82
  83                                         // Set this to have our error message displayed
  84                                         setPostRequestParameter('ok', '***');
  85                                 }
  86                                 break;
  87
  88                         case 'failed': // Registration has failed
  89                                 $errorMessage = '{--ADMIN_REGISTER_FAILED--}';
  90
  91                                 // Set this to have our error message displayed
  92                                 setPostRequestParameter('ok', '***');
  93                                 break;
  94
  95                         case 'already': // Admin does already exists!
  96                                 $errorMessage = '{--ADMIN_LOGIN_ALREADY_REG--}';
  97
  98                                 // Set this to have our error message displayed
  99                                 setPostRequestParameter('ok', '***');
 100                                 break;
 101
 102                         default:
 103                                 // Any other kind will be logged
 104                                 $errorMessage = sprintf("Unknown return code %s from ifAdminLoginDataIsValid().", $ret);
 105                                 logDebugMessage(__FILE__, __LINE__, $errorMessage);
 106
 107                                 // Set this to have our error message displayed
 108                                 setPostRequestParameter('ok', '***');
 109                                 break;
 110                 } // END - switch
 111         } // END - if
 112
 113         // Whas that action okay?
 114         if ($ret != 'done') {
 115                 // Init login name
 116                 $content['login'] = '';
 117                 if (isPostRequestParameterSet('login')) {
 118                         $content['login'] = postRequestParameter('login');
 119                 } // END - if
 120
 121                 // Init array elements
 122                 $content['login_message']   = '';
 123                 $content['pass1_message']    = '';
 124                 $content['pass2_message']    = '';
 125
 126                 // Yet-another notice-fix
 127                 if ((isFormSent()) && (postRequestParameter('ok') == '***')) {
 128                         // Init variables
 129                         $loginMessage = '';
 130                         $pass1Message = '';
 131                         $pass2Message = '';
 132
 133                         // No login entered?
 134                         if (empty($content['login'])) $loginMessage = '{--ADMIN_NO_LOGIN--}';
 135
 136                         // An error comes back from registration?
 137                         if ((!empty($ret)) && ($ret != 'init')) $loginMessage = $errorMessage;
 138
 139                         // No password 1 entered or to short?
 140                         if (!isPostRequestParameterSet('pass1')) $pass1Message = '{--ADMIN_NO_PASS1--}';
 141                          elseif (strlen(postRequestParameter('pass1')) < 4) $pass1Message = '{--ADMIN_SHORT_PASS1--}';
 142
 143                         // No password 2 entered or to short?
 144                         if (!isPostRequestParameterSet('pass2')) $pass2Message = '{--ADMIN_NO_PASS2--}';
 145                          elseif (strlen(postRequestParameter('pass2')) < 4) $pass2Message = '{--ADMIN_SHORT_PASS2--}';
 146
 147                         // Both didn't match?
 148                         if (postRequestParameter('pass1') != postRequestParameter('pass2')) {
 149                                 // No match
 150                                 if (empty($pass1Message)) $pass1Message = '{--ADMIN_PASS1_MISMATCH--}';
 151                                 if (empty($pass2Message)) $pass2Message = '{--ADMIN_PASS2_MISMATCH--}';
 152                         } // END - if
 153
 154                         // Output error messages
 155                         $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
 156                         $content['pass1_message'] = loadTemplate('admin_login_msg', true, $pass1Message);
 157                         $content['pass2_message'] = loadTemplate('admin_login_msg', true, $pass2Message);
 158                 } // END - if
 159
 160                 // Output message in seperate template
 161                 loadTemplate('admin_settings_saved', false, '{--ADMIN_ACCOUNT_NOT_REGISTERED_YET--}');
 162
 163                 // Load register template
 164                 loadTemplate('admin_reg_form', false, $content);
 165         } // END - if
 166 } elseif (isGetRequestParameterSet('reset_pass')) {
 167         // Is the form submitted?
 168         if ((isPostRequestParameterSet('send_link')) && (isPostRequestParameterSet('email'))) {
 169                 // Output result
 170                 loadTemplate('admin_settings_saved', false, sendAdminPasswordResetLink(postRequestParameter('email')));
 171         } elseif (isGetRequestParameterSet('hash')) {
 172                 // Output form for hash validation
 173                 loadTemplate('admin_validate_reset_hash_form', false, getRequestParameter('hash'));
 174         } elseif ((isPostRequestParameterSet('validate_hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('hash'))) {
 175                 // Validate the login data and hash
 176                 $valid = adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'));
 177
 178                 // Valid?
 179                 if ($valid === true) {
 180                         // Prepare content first
 181                         $content = array(
 182                                 'hash'  => secureString(postRequestParameter('hash')),
 183                                 'login' => secureString(postRequestParameter('login'))
 184                         );
 185
 186                         // Validation okay so display form for final password change
 187                         loadTemplate('form_reset_password_form', false, $content);
 188                 } else {
 189                         // Cannot validate the login data and hash
 190                         loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED--}');
 191                 }
 192         } elseif ((isPostRequestParameterSet('reset_pass')) && (isPostRequestParameterSet('hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('pass1')) && (postRequestParameter('pass1') == postRequestParameter('pass2'))) {
 193                 // Okay, we shall the admin password here. So first revalidate the hash
 194                 if (adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'))) {
 195                         // Output result
 196                         loadTemplate('form_reset_pass_done', false, doResetAdminPassword(postRequestParameter('login'), postRequestParameter('pass1')));
 197                 } else {
 198                         // Validation failed
 199                         loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2--}');
 200                 }
 201         } else {
 202                 // Output reset password form
 203                 loadTemplate('admin_send_reset_link');
 204         }
 205 } elseif ((!isSessionVariableSet('admin_id')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last'))) {
 206         // At leat one administrator account was created
 207         if ((isSessionVariableSet('admin_id')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last'))) {
 208                 // Timeout for last login, we have to logout first!
 209                 redirectToUrl('modules.php?module=admin&amp;logout=1');
 210         } // END - if
 211
 212         if (isGetRequestParameterSet('register')) {
 213                 // Registration of first admin is done
 214                 if (getRequestParameter('register') == 'done') loadTemplate('admin_settings_saved', false, '{--ADMIN_REGISTER_DONE--}');
 215         } // END - if
 216
 217         // Check if the admin has submitted data or not
 218         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('password')) || (strlen(postRequestParameter('password')) < 4))) {
 219                 setPostRequestParameter('ok', '***');
 220         } // END - if
 221
 222         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
 223                 // All required data was entered so we check his account
 224                 $ret = ifAdminLoginDataIsValid(postRequestParameter('login'), postRequestParameter('password'));
 225
 226                 // Which status do we have?
 227                 switch ($ret) {
 228                         case 'done': // Admin and password are okay, so we log in now
 229                                 // Construct URL and redirect
 230                                 $url = 'modules.php?module=admin&amp;';
 231
 232                                 // Rewrite overview module
 233                                 if (getWhat() == 'overview') {
 234                                         setAction(getActionFromModuleWhat(getModule(), getWhat()));
 235                                 } // END - if
 236
 237                                 // Add data to URL
 238                                 if (isWhatSet())        $url .= 'what='.getWhat();
 239                                  elseif (isActionSet()) $url .= 'action='.getAction();
 240                                  elseif (isGetRequestParameterSet('area'))  $url .= 'area='.getRequestParameter('area');
 241
 242                          // Load URL
 243                          redirectToUrl($url);
 244                          break;
 245
 246                         case '404': // Administrator login not found
 247                                 setPostRequestParameter('ok', $ret);
 248                                 $ret = getMaskedMessage('ADMIN_ACCOUNT_404', postRequestParameter('login'));
 249                                 destroyAdminSession();
 250                                 break;
 251
 252                         case 'password': // Wrong password
 253                                 setPostRequestParameter('ok', $ret);
 254                                 $ret = '{--WRONG_PASS--} [<a href="{%url=modules.php?module=admin&amp;reset_pass=1%}">{--ADMIN_RESET_PASS--}</a>]';
 255                                 destroyAdminSession();
 256                                 break;
 257
 258                         default: // Others will be logged
 259                                 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid()", $ret));
 260                                 break;
 261                 } // END - switch
 262         } // END - if
 263
 264         // Error detected?
 265         if ($ret != 'done') {
 266                 $content['login'] = '';
 267                 if (isPostRequestParameterSet('login')) {
 268                         $content['login'] = postRequestParameter('login');
 269                 } // END - if
 270
 271                 // Init array elements
 272                 $content['login_message'] = '';
 273                 $content['pass_message']  = '';
 274
 275                 if (isFormSent()) {
 276                         // Set messages to zero
 277                         $loginMessage = ''; $passwdMessage = '';
 278
 279                         // No login entered?
 280                         if (!isPostRequestParameterSet('login')) $loginMessage = '{--ADMIN_NO_LOGIN--}';
 281
 282                         // An error comes back from login?
 283                         if ((!empty($ret)) && (postRequestParameter('ok') == '404')) $loginMessage = $ret;
 284
 285                         // No password entered?
 286                         if (!isPostRequestParameterSet('password')) $passwdMessage = '{--ADMIN_NO_PASS--}';
 287
 288                         // Or password too short?
 289                         if (strlen(postRequestParameter('password')) < 4) $passwdMessage = '{--ADMIN_SHORT_PASS--}';
 290
 291                         // An error comes back from login?
 292                         if ((!empty($ret)) && (postRequestParameter('ok') == 'password')) $passwdMessage = $ret;
 293
 294                         // Load message template
 295                         $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
 296                         $content['pass_message']  = loadTemplate('admin_login_msg', true, $passwdMessage);
 297                 } // END - if
 298
 299                 // Load login form
 300                 if (isWhatSet()) {
 301                         // Restore old what value
 302                         $content = merge_array($content, array('target' => 'what', 'value' => getWhat()));
 303                 } elseif (isActionSet()) {
 304                         if (getAction() != 'logout') {
 305                                 // Restore old action value
 306                                 $content = merge_array($content, array('target' => 'action', 'value' => getAction()));
 307                         } else {
 308                                 // Set default values
 309                                 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
 310                         }
 311                 } elseif (isGetRequestParameterSet('area')) {
 312                         // Restore old area value
 313                         $content = merge_array(
 314                                 $content,
 315                                 array(
 316                                         'target' => 'area',
 317                                         'value'  => getRequestParameter('area')
 318                                 )
 319                         );
 320                 } else {
 321                         // Set default values
 322                         $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
 323                 }
 324
 325                 // Load login form template
 326                 loadTemplate('admin_login_form', false, $content);
 327         } // END - if
 328 } elseif (isGetRequestParameterSet('logout')) {
 329         // Only try to remove cookies
 330         if (destroyAdminSession()) {
 331                 // Load logout template
 332                 if (isGetRequestParameterSet('register')) {
 333                         // Secure input
 334                         $register = getRequestParameter('register');
 335
 336                         // Special logout redirect for installation of given extension
 337                         loadTemplate(sprintf("admin_logout_%s_install", $register));
 338                 } elseif (isGetRequestParameterSet('remove')) {
 339                         // Secure input
 340                         $remove = getRequestParameter('remove');
 341
 342                         // Special logout redirect for removal of given extension
 343                         loadTemplate(sprintf("admin_logout_%s_remove", $remove));
 344                 } else {
 345                         // Logged out normally
 346                         loadTemplate('admin_logout');
 347                 }
 348         } else {
 349                 // Something went wrong here...
 350                 loadTemplate('admin_settings_unsaved', false, '{--ADMIN_LOGOUT_FAILED--}');
 351
 352                 // Add fatal message
 353                 addFatalMessage(__FILE__, __LINE__, '{--CANNOT_UNREG_SESS--}');
 354         }
 355 } else {
 356         // Maybe an Admin want's to login?
 357         $ret = ifAdminCookiesAreValid(getSession('admin_id'), getSession('admin_md5'));
 358
 359         // Check status
 360         switch ($ret) {
 361                 case 'done':
 362                         // Check for access control line of current menu entry
 363                         runFilterChain('check_admin_acl');
 364
 365                         // When type of admin menu is not set fallback to old menu system
 366                         if (!isConfigEntrySet('admin_menu')) setConfigEntry('admin_menu', 'OLD');
 367
 368                         // Check for version and switch between old menu system and new intelligent menu system
 369                         if ((adminGetMenuMode() == 'NEW') && (isIncludeReadable('inc/modules/admin/lasys-inc.php'))) {
 370                                 // Default area is the entrance, of course
 371                                 $area = 'entrance';
 372
 373                                 // Check for similar URL variable
 374                                 if (isGetRequestParameterSet('area')) $area = getRequestParameter('area');
 375
 376                                 // Load logical-area menu-system file
 377                                 loadIncludeOnce('inc/modules/admin/lasys-inc.php');
 378
 379                                 // Create new-style menu system will logical areas
 380                                 doAdminLogicalArea($area, $action, getWhat());
 381                         } else {
 382                                 // This little call constructs the whole default old and lacky menu system
 383                                 // on left side. It also renders the content on right side
 384                                 doAdminAction();
 385                         }
 386                         break;
 387
 388                 case '404': // Administrator login not found
 389                         setPostRequestParameter('ok', $ret);
 390                         loadTemplate('admin_settings_saved', false, getMaskedMessage('ADMIN_ACCOUNT_404', getSession('admin_id')));
 391                         destroyAdminSession();
 392                         break;
 393
 394                 case 'password': // Wrong password
 395                         setPostRequestParameter('ok', $ret);
 396                         loadTemplate('admin_settings_saved', false, '{--WRONG_PASS--}');
 397                         destroyAdminSession();
 398                         break;
 399
 400                 default: // Others will be logged
 401                         logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminCookiesAreValid()", $ret));
 402                         break;
 403         } // END - switch
 404 }
 405
 406 // [EOF]
 407 ?>