2 /************************************************************************
3 * Mailer v0.2.1-FINAL Start: 08/31/2003 *
4 * =================== Last change: 07/02/2004 *
6 * -------------------------------------------------------------------- *
8 * -------------------------------------------------------------------- *
9 * Short description : Administration module *
10 * -------------------------------------------------------------------- *
11 * Kurzbeschreibung : Administrationsmodul *
12 * -------------------------------------------------------------------- *
15 * $Tag:: 0.2.1-FINAL $ *
17 * -------------------------------------------------------------------- *
18 * Copyright (c) 2003 - 2009 by Roland Haeder *
19 * Copyright (c) 2009 - 2011 by Mailer Developer Team *
20 * For more information visit: http://www.mxchange.org *
22 * This program is free software; you can redistribute it and/or modify *
23 * it under the terms of the GNU General Public License as published by *
24 * the Free Software Foundation; either version 2 of the License, or *
25 * (at your option) any later version. *
27 * This program is distributed in the hope that it will be useful, *
28 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
29 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
30 * GNU General Public License for more details. *
32 * You should have received a copy of the GNU General Public License *
33 * along with this program; if not, write to the Free Software *
34 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, *
36 ************************************************************************/
38 // Some security stuff...
39 if (!defined('__SECURITY')) {
44 loadIncludeOnce('inc/modules/admin/admin-inc.php');
46 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)
47 fixDeletedCookies(array('admin_id', 'admin_md5', 'admin_last'));
52 // Is no admin registered?
53 if (!isAdminRegistered()) {
54 // Admin is not registered so we have to inform the user
55 if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('pass1')) || (strlen(postRequestParameter('pass1')) < 4) || (!isPostRequestParameterSet('pass2')) || (strlen(postRequestParameter('pass2')) < 4) || (postRequestParameter('pass1') != postRequestParameter('pass2')))) {
56 setPostRequestParameter('ok', '***');
59 // Clear error message
62 if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
63 // Hash the password with the old function because we are here in install mode
64 $hashedPass = md5(postRequestParameter('pass1'));
66 // Kill maybe existing session variables
67 destroyAdminSession(false);
70 $ret = addAdminAccount(postRequestParameter('login'), $hashedPass, getWebmaster());
72 // Check if registration wents fine
75 // Change ADMIN_REGISTERED entry
76 $done = changeDataInInclude(getCachePath() . 'config-local.php', 'ADMIN-SETUP', "setConfigEntry('ADMIN_REGISTERED', '", "');", 'Y', 0);
78 // Was it successfull?
80 // Registering is done
81 redirectToUrl('modules.php?module=admin&register=done');
83 // Registration incomplete
84 $errorMessage = '{--ADMIN_CANNOT_COMPLETE--}';
86 // Set this to have our error message displayed
87 setPostRequestParameter('ok', '***');
91 case 'failed': // Registration has failed
92 $errorMessage = '{--ADMIN_REGISTER_FAILED--}';
94 // Set this to have our error message displayed
95 setPostRequestParameter('ok', '***');
98 case 'already': // Admin does already exists!
99 $errorMessage = '{--ADMIN_LOGIN_ALREADY_REG--}';
101 // Set this to have our error message displayed
102 setPostRequestParameter('ok', '***');
106 // Any other kind will be logged
107 $errorMessage = sprintf("Unknown return code %s from ifAdminLoginDataIsValid().", $ret);
108 logDebugMessage(__FILE__, __LINE__, $errorMessage);
110 // Set this to have our error message displayed
111 setPostRequestParameter('ok', '***');
116 // Whas that action okay?
117 if ($ret != 'done') {
119 $content['login'] = '';
120 if (isPostRequestParameterSet('login')) {
121 $content['login'] = postRequestParameter('login');
124 // Init array elements
125 $content['login_message'] = '';
126 $content['pass1_message'] = '';
127 $content['pass2_message'] = '';
129 // Yet-another notice-fix
130 if ((isFormSent()) && (postRequestParameter('ok') == '***')) {
137 if (empty($content['login'])) $loginMessage = '{--ADMIN_NO_LOGIN--}';
139 // An error comes back from registration?
140 if ((!empty($ret)) && ($ret != 'init')) $loginMessage = $errorMessage;
142 // No password 1 entered or to short?
143 if (!isPostRequestParameterSet('pass1')) $pass1Message = '{--ADMIN_NO_PASS1--}';
144 elseif (strlen(postRequestParameter('pass1')) < 4) $pass1Message = '{--ADMIN_SHORT_PASS1--}';
146 // No password 2 entered or to short?
147 if (!isPostRequestParameterSet('pass2')) $pass2Message = '{--ADMIN_NO_PASS2--}';
148 elseif (strlen(postRequestParameter('pass2')) < 4) $pass2Message = '{--ADMIN_SHORT_PASS2--}';
150 // Both didn't match?
151 if (postRequestParameter('pass1') != postRequestParameter('pass2')) {
153 if (empty($pass1Message)) $pass1Message = '{--ADMIN_PASS1_MISMATCH--}';
154 if (empty($pass2Message)) $pass2Message = '{--ADMIN_PASS2_MISMATCH--}';
157 // Output error messages
158 $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
159 $content['pass1_message'] = loadTemplate('admin_login_msg', true, $pass1Message);
160 $content['pass2_message'] = loadTemplate('admin_login_msg', true, $pass2Message);
161 $content['error_message'] = loadTemplate('admin_login_msg', true, $errorMessage);
164 // Output message in seperate template
165 loadTemplate('admin_settings_saved', false, '{--ADMIN_ACCOUNT_NOT_REGISTERED_YET--}');
167 // Load register template
168 loadTemplate('admin_reg_form', false, $content);
170 } elseif (isGetRequestParameterSet('reset_pass')) {
171 // Is the form submitted?
172 if ((isPostRequestParameterSet('send_link')) && (isPostRequestParameterSet('email'))) {
174 loadTemplate('admin_settings_saved', false, sendAdminPasswordResetLink(postRequestParameter('email')));
175 } elseif (isGetRequestParameterSet('hash')) {
176 // Output form for hash validation
177 loadTemplate('admin_validate_reset_hash_form', false, getRequestParameter('hash'));
178 } elseif ((isPostRequestParameterSet('validate_hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('hash'))) {
179 // Validate the login data and hash
180 $valid = adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'));
183 if ($valid === true) {
184 // Prepare content first
186 'hash' => secureString(postRequestParameter('hash')),
187 'login' => secureString(postRequestParameter('login'))
190 // Validation okay so display form for final password change
191 loadTemplate('form_reset_password_form', false, $content);
193 // Cannot validate the login data and hash
194 loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED--}');
196 } elseif ((isPostRequestParameterSet('reset_pass')) && (isPostRequestParameterSet('hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('pass1')) && (postRequestParameter('pass1') == postRequestParameter('pass2'))) {
197 // Okay, we shall the admin password here. So first revalidate the hash
198 if (adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'))) {
200 loadTemplate('form_reset_pass_done', false, doResetAdminPassword(postRequestParameter('login'), postRequestParameter('pass1')));
203 loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2--}');
206 // Output reset password form
207 loadTemplate('admin_send_reset_link');
209 } elseif ((!isSessionVariableSet('admin_id')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last'))) {
210 // At leat one administrator account was created
211 if ((isSessionVariableSet('admin_id')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last'))) {
212 // Timeout for last login, we have to logout first!
213 redirectToUrl('modules.php?module=admin&logout=1');
216 if (isGetRequestParameterSet('register')) {
217 // Registration of first admin is done
218 if (getRequestParameter('register') == 'done') {
220 loadTemplate('admin_settings_saved', false, '{--ADMIN_REGISTER_DONE--}');
224 // Check if the admin has submitted data or not
225 if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('password')) || (strlen(postRequestParameter('password')) < 4))) {
226 setPostRequestParameter('ok', '***');
229 if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
230 // All required data was entered so we check his account
231 $ret = ifAdminLoginDataIsValid(postRequestParameter('login'), postRequestParameter('password'));
233 // Which status do we have?
235 case 'done': // Admin and password are okay, so we log in now
236 // Construct URL and redirect
237 $url = 'modules.php?module=admin&';
239 // Rewrite overview module
240 if (getWhat() == 'overview') {
241 setAction(getActionFromModuleWhat(getModule(), getWhat()));
246 $url .= 'what=' . getWhat();
247 } elseif (isActionSet()) {
248 $url .= 'action=' . getAction();
249 } elseif (isGetRequestParameterSet('area')) {
250 $url .= 'area=' . getRequestParameter('area');
257 case '404': // Administrator login not found
258 setPostRequestParameter('ok', $ret);
259 $ret = getMaskedMessage('ADMIN_ACCOUNT_404', postRequestParameter('login'));
260 destroyAdminSession();
263 case 'password': // Wrong password
264 setPostRequestParameter('ok', $ret);
265 $ret = '{--WRONG_PASS--} [<a href="{%url=modules.php?module=admin&reset_pass=1%}">{--ADMIN_RESET_PASS--}</a>]';
266 destroyAdminSession();
269 default: // Others will be logged
270 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid()", $ret));
276 if ($ret != 'done') {
277 $content['login'] = '';
278 if (isPostRequestParameterSet('login')) {
279 $content['login'] = postRequestParameter('login');
282 // Init array elements
283 $content['login_message'] = '';
284 $content['pass_message'] = '';
287 // Set messages to zero
292 if (!isPostRequestParameterSet('login')) $loginMessage = '{--ADMIN_NO_LOGIN--}';
294 // An error comes back from login?
295 if ((!empty($ret)) && (postRequestParameter('ok') == '404')) $loginMessage = $ret;
297 // No password entered?
298 if (!isPostRequestParameterSet('password')) $passwdMessage = '{--ADMIN_NO_PASS--}';
300 // Or password too short?
301 if (strlen(postRequestParameter('password')) < 4) $passwdMessage = '{--ADMIN_SHORT_PASS--}';
303 // An error comes back from login?
304 if ((!empty($ret)) && (postRequestParameter('ok') == 'password')) $passwdMessage = $ret;
306 // Load message template
307 $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
308 $content['pass_message'] = loadTemplate('admin_login_msg', true, $passwdMessage);
313 // Restore old what value
314 $content = merge_array($content, array('target' => 'what', 'value' => getWhat()));
315 } elseif (isActionSet()) {
316 if (getAction() != 'logout') {
317 // Restore old action value
318 $content = merge_array($content, array('target' => 'action', 'value' => getAction()));
320 // Set default values
321 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
323 } elseif (isGetRequestParameterSet('area')) {
324 // Restore old area value
325 $content = merge_array(
329 'value' => getRequestParameter('area')
333 // Set default values
334 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
337 // Load login form template
338 loadTemplate('admin_login_form', false, $content);
340 } elseif (isGetRequestParameterSet('logout')) {
341 // Only try to remove cookies
342 if (destroyAdminSession()) {
343 // Load logout template
344 if (isGetRequestParameterSet('register')) {
346 $register = getRequestParameter('register');
348 // Special logout redirect for installation of given extension
349 loadTemplate(sprintf("admin_logout_%s_install", $register));
350 } elseif (isGetRequestParameterSet('remove')) {
352 $remove = getRequestParameter('remove');
354 // Special logout redirect for removal of given extension
355 loadTemplate(sprintf("admin_logout_%s_remove", $remove));
357 // Logged out normally
358 loadTemplate('admin_logout');
361 // Something went wrong here...
362 loadTemplate('admin_settings_unsaved', false, '{--ADMIN_LOGOUT_FAILED--}');
365 addFatalMessage(__FILE__, __LINE__, '{--CANNOT_UNREG_SESS--}');
368 // Maybe an Admin want's to login?
369 $ret = ifAdminCookiesAreValid(getCurrentAdminId(), getAdminMd5());
374 // Check for access control line of current menu entry
375 runFilterChain('check_admin_acl');
377 // Check for version and switch between old menu system and new intelligent menu system
378 if ((adminGetMenuMode() == 'NEW') && (isIncludeReadable('inc/modules/admin/lasys-inc.php'))) {
379 // Default area is the entrance, of course
382 // Check for similar URL variable
383 if (isGetRequestParameterSet('area')) $area = getRequestParameter('area');
385 // Load logical-area menu-system file
386 loadIncludeOnce('inc/modules/admin/lasys-inc.php');
388 // Create new-style menu system will logical areas
389 doAdminLogicalArea($area, $action, getWhat());
391 // This little call constructs the whole default old and lacky menu system
392 // on left side. It also renders the content on right side
397 case '404': // Administrator login not found
398 setPostRequestParameter('ok', $ret);
399 loadTemplate('admin_settings_saved', false, getMaskedMessage('ADMIN_ACCOUNT_404', getCurrentAdminId()));
400 destroyAdminSession();
403 case 'password': // Wrong password
404 setPostRequestParameter('ok', $ret);
405 loadTemplate('admin_settings_saved', false, '{--WRONG_PASS--}');
406 destroyAdminSession();
409 default: // Others will be logged
410 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminCookiesAreValid()", $ret));