inc/modules/admin.php

   1 <?php
   2 /************************************************************************
   3  * Mailer v0.2.1-FINAL                                Start: 08/31/2003 *
   4  * ===================                          Last change: 07/02/2004 *
   5  *                                                                      *
   6  * -------------------------------------------------------------------- *
   7  * File              : admin.php                                        *
   8  * -------------------------------------------------------------------- *
   9  * Short description : Administration module                            *
  10  * -------------------------------------------------------------------- *
  11  * Kurzbeschreibung  : Administrationsmodul                             *
  12  * -------------------------------------------------------------------- *
  13  * $Revision::                                                        $ *
  14  * $Date::                                                            $ *
  15  * $Tag:: 0.2.1-FINAL                                                 $ *
  16  * $Author::                                                          $ *
  17  * Needs to be in all Files and every File needs "svn propset           *
  18  * svn:keywords Date Revision" (autoprobset!) at least!!!!!!            *
  19  * -------------------------------------------------------------------- *
  20  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
  21  * Copyright (c) 2009, 2010 by Mailer Developer Team                    *
  22  * For more information visit: http://www.mxchange.org                  *
  23  *                                                                      *
  24  * This program is free software; you can redistribute it and/or modify *
  25  * it under the terms of the GNU General Public License as published by *
  26  * the Free Software Foundation; either version 2 of the License, or    *
  27  * (at your option) any later version.                                  *
  28  *                                                                      *
  29  * This program is distributed in the hope that it will be useful,      *
  30  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *
  31  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *
  32  * GNU General Public License for more details.                         *
  33  *                                                                      *
  34  * You should have received a copy of the GNU General Public License    *
  35  * along with this program; if not, write to the Free Software          *
  36  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *
  37  * MA  02110-1301  USA                                                  *
  38  ************************************************************************/
  39
  40 // Some security stuff...
  41 if (!defined('__SECURITY')) {
  42         die();
  43 } // END - if
  44
  45 // Load include file
  46 loadIncludeOnce('inc/modules/admin/admin-inc.php');
  47
  48 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)
  49 fixDeletedCookies(array('admin_login', 'admin_md5', 'admin_last'));
  50
  51 // Init return value
  52 $ret = 'init';
  53
  54 // Is no admin registered?
  55 if (!isAdminRegistered()) {
  56         // Admin is not registered so we have to inform the user
  57         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('pass1')) || (strlen(postRequestParameter('pass1')) < 4) || (!isPostRequestParameterSet('pass2')) || (strlen(postRequestParameter('pass2')) < 4) || (postRequestParameter('pass1') != postRequestParameter('pass2')))) {
  58                 setPostRequestParameter('ok', '***');
  59         } // END - if
  60
  61         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
  62                 // Hash the password with the old function because we are here in install mode
  63                 $hashedPass = md5(postRequestParameter('pass1'));
  64
  65                 // Kill maybe existing session variables
  66                 destroyAdminSession(false);
  67
  68                 // Do registration
  69                 $ret = addAdminAccount(postRequestParameter('login'), $hashedPass, getConfig('WEBMASTER'));
  70
  71                 // Check if registration wents fine
  72                 switch ($ret) {
  73                         case 'done':
  74                                 $done = changeDataInFile(getConfig('CACHE_PATH') . 'config-local.php', 'ADMIN-SETUP', "setConfigEntry('ADMIN_REGISTERED', '", "');", 'Y', 0);
  75                                 if ($done === true) {
  76                                         // Registering is done
  77                                         redirectToUrl('modules.php?module=admin&amp;register=done');
  78                                 } else {
  79                                         $ret = getMessage('ADMIN_CANNOT_COMPLETE');
  80                                 }
  81                                 break;
  82
  83                         case 'failed': // Registration has failed
  84                                 $ret = getMessage('ADMIN_REGISTER_FAILED');
  85                                 break;
  86
  87                         case 'already': // Admin does already exists!
  88                                 $ret = getMessage('ADMIN_LOGIN_ALREADY_REG');
  89                                 break;
  90
  91                         default:
  92                                 // Any other kind will be logged
  93                                 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid().", $ret));
  94                                 break;
  95                 } // END - switch
  96         } // END - if
  97
  98         // Whas that action okay?
  99         if ($ret != 'done') {
 100                 // Init login name
 101                 $content['login'] = '';
 102                 if (isPostRequestParameterSet('login')) {
 103                         $content['login'] = postRequestParameter('login');
 104                 } // END - if
 105
 106                 // Init array elements
 107                 $content['login_message']   = '';
 108                 $content['pass1_message']    = '';
 109                 $content['pass2_message']    = '';
 110
 111                 // Yet-another notice-fix
 112                 if ((isFormSent()) && (postRequestParameter('ok') == '***')) {
 113                         // Init variables
 114                         $loginMessage = '';
 115                         $pass1Message = '';
 116                         $pass2Message = '';
 117
 118                         // No login entered?
 119                         if (empty($content['login'])) $loginMessage = getMessage('ADMIN_NO_LOGIN');
 120
 121                         // An error comes back from registration?
 122                         if ((!empty($ret)) && ($ret != 'init')) $loginMessage = $ret;
 123
 124                         // No password 1 entered or to short?
 125                         if (!isPostRequestParameterSet('pass1')) $pass1Message = getMessage('ADMIN_NO_PASS1');
 126                          elseif (strlen(postRequestParameter('pass1')) < 4) $pass1Message = getMessage('ADMIN_SHORT_PASS1');
 127
 128                         // No password 2 entered or to short?
 129                         if (!isPostRequestParameterSet('pass2')) $pass2Message = getMessage('ADMIN_NO_PASS2');
 130                          elseif (strlen(postRequestParameter('pass2')) < 4) $pass2Message = getMessage('ADMIN_SHORT_PASS2');
 131
 132                         // Both didn't match?
 133                         if (postRequestParameter('pass1') != postRequestParameter('pass2')) {
 134                                 // No match
 135                                 if (empty($pass1Message)) $pass1Message = getMessage('ADMIN_PASS1_MISMATCH');
 136                                 if (empty($pass2Message)) $pass2Message = getMessage('ADMIN_PASS2_MISMATCH');
 137                         } // END - if
 138
 139                         // Output error messages
 140                         $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
 141                         $content['pass1_message'] = loadTemplate('admin_login_msg', true, $pass1Message);
 142                         $content['pass2_message'] = loadTemplate('admin_login_msg', true, $pass2Message);
 143                 } // END - if
 144
 145                 // Output message in seperate template
 146                 loadTemplate('admin_settings_saved', false, getMessage('ADMIN_NOT_REGISTERED'));
 147
 148                 // Load register template
 149                 loadTemplate('admin_reg_form', false, $content);
 150         }
 151 } elseif (isGetRequestParameterSet('reset_pass')) {
 152         // Is the form submitted?
 153         if ((isPostRequestParameterSet('send_link')) && (isPostRequestParameterSet('email'))) {
 154                 // Output result
 155                 loadTemplate('admin_settings_saved', false, sendAdminPasswordResetLink(postRequestParameter('email')));
 156         } elseif (isGetRequestParameterSet('hash')) {
 157                 // Output form for hash validation
 158                 loadTemplate('admin_validate_reset_hash_form', false, getRequestParameter('hash'));
 159         } elseif ((isPostRequestParameterSet('validate_hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('hash'))) {
 160                 // Validate the login data and hash
 161                 $valid = adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'));
 162
 163                 // Valid?
 164                 if ($valid === true) {
 165                         // Prepare content first
 166                         $content = array(
 167                                 'hash'  => secureString(postRequestParameter('hash')),
 168                                 'login' => secureString(postRequestParameter('login'))
 169                         );
 170
 171                         // Validation okay so display form for final password change
 172                         loadTemplate('admin_reset_password_form', false, $content);
 173                 } else {
 174                         // Cannot validate the login data and hash
 175                         loadTemplate('admin_settings_saved', false, getMessage('ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED'));
 176                 }
 177         } elseif ((isPostRequestParameterSet('reset_pass')) && (isPostRequestParameterSet('hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('pass1')) && (postRequestParameter('pass1') == postRequestParameter('pass2'))) {
 178                 // Okay, we shall the admin password here. So first revalidate the hash
 179                 if (adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'))) {
 180                         // Output result
 181                         loadTemplate('admin_reset_pass_done', false, doResetAdminPassword(postRequestParameter('login'), postRequestParameter('pass1')));
 182                 } else {
 183                         // Validation failed
 184                         loadTemplate('admin_settings_saved', false, getMessage('ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2'));
 185                 }
 186         } else {
 187                 // Output reset password form
 188                 loadTemplate('admin_send_reset_link');
 189         }
 190 } elseif ((!isSessionVariableSet('admin_login')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last'))) {
 191         // At leat one administrator account was created
 192         if ((isSessionVariableSet('admin_login')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last'))) {
 193                 // Timeout for last login, we have to logout first!
 194                 redirectToUrl('modules.php?module=admin&amp;logout=1');
 195         } // END - if
 196
 197         if (isGetRequestParameterSet('register')) {
 198                 // Registration of first admin is done
 199                 if (getRequestParameter('register') == 'done') loadTemplate('admin_settings_saved', false, getMessage('ADMIN_REGISTER_DONE'));
 200         } // END - if
 201
 202         // Check if the admin has submitted data or not
 203         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('pass')) || (strlen(postRequestParameter('pass')) < 4))) {
 204                 setPostRequestParameter('ok', '***');
 205         } // END - if
 206
 207         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
 208                 // All required data was entered so we check his account
 209                 $ret = ifAdminLoginDataIsValid(postRequestParameter('login'), postRequestParameter('pass'));
 210
 211                 // Which status do we have?
 212                 switch ($ret) {
 213                         case 'done': // Admin and password are okay, so we log in now
 214                                 // Construct URL and redirect
 215                                 $URL = 'modules.php?module=admin&amp;';
 216
 217                                 // Rewrite overview module
 218                                 if (getWhat() == 'overview') {
 219                                         setAction(getActionFromModuleWhat(getModule(), getWhat()));
 220                                 } // END - if
 221
 222                                 // Add data to URL
 223                                 if (isWhatSet())        $URL .= 'what='.getWhat();
 224                                  elseif (isActionSet()) $URL .= 'action='.getAction();
 225                                  elseif (isGetRequestParameterSet('area'))  $URL .= 'area='.getRequestParameter('area');
 226
 227                          // Load URL
 228                          redirectToUrl($URL);
 229                          break;
 230
 231                         case '404': // Administrator login not found
 232                                 setPostRequestParameter('ok', $ret);
 233                                 $ret = getMaskedMessage('ADMIN_404', postRequestParameter('login'));
 234                                 destroyAdminSession();
 235                                 break;
 236
 237                         case 'pass': // Wrong password
 238                                 setPostRequestParameter('ok', $ret);
 239                                 $ret = '{--WRONG_PASS--} [<a href="{%url=modules.php?module=admin&amp;reset_pass=1%}">{--ADMIN_RESET_PASS--}</a>]';
 240                                 destroyAdminSession();
 241                                 break;
 242
 243                         default: // Others will be logged
 244                                 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid()", $ret));
 245                                 break;
 246                 } // END - switch
 247         } // END - if
 248
 249         // Error detected?
 250         if ($ret != 'done') {
 251                 $content['login'] = '';
 252                 if (isPostRequestParameterSet('login')) {
 253                         $content['login'] = postRequestParameter('login');
 254                 } // END - if
 255
 256                 // Init array elements
 257                 $content['login_message'] = '';
 258                 $content['pass_message']  = '';
 259
 260                 if (isFormSent()) {
 261                         // Set messages to zero
 262                         $loginMessage = ''; $passwdMessage = '';
 263
 264                         // No login entered?
 265                         if (!isPostRequestParameterSet('login')) $loginMessage = getMessage('ADMIN_NO_LOGIN');
 266
 267                         // An error comes back from login?
 268                         if ((!empty($ret)) && (postRequestParameter('ok') == '404')) $loginMessage = $ret;
 269
 270                         // No password entered?
 271                         if (!isPostRequestParameterSet('pass')) $passwdMessage = getMessage('ADMIN_NO_PASS');
 272
 273                         // Or password too short?
 274                         if (strlen(postRequestParameter('pass')) < 4) $passwdMessage = getMessage('ADMIN_SHORT_PASS');
 275
 276                         // An error comes back from login?
 277                         if ((!empty($ret)) && (postRequestParameter('ok') == 'pass')) $passwdMessage = $ret;
 278
 279                         // Load message template
 280                         $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
 281                         $content['pass_message']  = loadTemplate('admin_login_msg', true, $passwdMessage);
 282                 } // END - if
 283
 284                 // Load login form
 285                 if (isWhatSet()) {
 286                         // Restore old what value
 287                         $content = merge_array($content, array('target' => 'what', 'value' => getWhat()));
 288                 } elseif (isActionSet()) {
 289                         if (getAction() != 'logout') {
 290                                 // Restore old action value
 291                                 $content = merge_array($content, array('target' => 'action', 'value' => getAction()));
 292                         } else {
 293                                 // Set default values
 294                                 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
 295                         }
 296                 } elseif (isGetRequestParameterSet('area')) {
 297                         // Restore old area value
 298                         $content = merge_array($content, array('target' => 'area', 'value' => getRequestParameter('area')));
 299                 } else {
 300                         // Set default values
 301                         $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
 302                 }
 303
 304                 // Load login form template
 305                 loadTemplate('admin_login_form', false, $content);
 306         } // END - if
 307 } elseif (isGetRequestParameterSet('logout')) {
 308         // Only try to remove cookies
 309         if (destroyAdminSession()) {
 310                 // Load logout template
 311                 if (isGetRequestParameterSet('register')) {
 312                         // Secure input
 313                         $register = getRequestParameter('register');
 314
 315                         // Special logout redirect for installation of given extension
 316                         loadTemplate(sprintf("admin_logout_%s_install", $register));
 317                 } elseif (isGetRequestParameterSet('remove')) {
 318                         // Secure input
 319                         $remove = getRequestParameter('remove');
 320
 321                         // Special logout redirect for removal of given extension
 322                         loadTemplate(sprintf("admin_logout_%s_remove", $remove));
 323                 } else {
 324                         // Logged out normally
 325                         loadTemplate('admin_logout');
 326                 }
 327         } else {
 328                 // Something went wrong here...
 329                 loadTemplate('admin_settings_saved', false, '<div class="admin_fatal">{--ADMIN_LOGOUT_FAILED--}</div>');
 330
 331                 // Add fatal message
 332                 addFatalMessage(__FILE__, __LINE__, getMessage('CANNOT_UNREG_SESS'));
 333         }
 334 } else {
 335         // Maybe an Admin want's to login?
 336         $ret = ifAdminCookiesAreValid(getSession('admin_login'), getSession('admin_md5'));
 337
 338         // Check status
 339         switch ($ret) {
 340                 case 'done':
 341                         // Check for access control line of current menu entry
 342                         runFilterChain('check_admin_acl');
 343
 344                         // When type of admin menu is not set fallback to old menu system
 345                         if (!isConfigEntrySet('admin_menu')) setConfigEntry('admin_menu', 'OLD');
 346
 347                         // Check for version and switch between old menu system and new intelligent menu system
 348                         if ((adminGetMenuMode() == 'NEW') && (isIncludeReadable('inc/modules/admin/lasys-inc.php'))) {
 349                                 // Default area is the entrance, of course
 350                                 $area = 'entrance';
 351
 352                                 // Check for similar URL variable
 353                                 if (isGetRequestParameterSet('area')) $area = getRequestParameter('area');
 354
 355                                 // Load logical-area menu-system file
 356                                 loadIncludeOnce('inc/modules/admin/lasys-inc.php');
 357
 358                                 // Create new-style menu system will logical areas
 359                                 doAdminLogicalArea($area, $action, getWhat());
 360                         } else {
 361                                 // This little call constructs the whole default old and lacky menu system
 362                                 // on left side. It also renders the content on right side
 363                                 doAdminAction();
 364                         }
 365                         break;
 366
 367                 case '404': // Administrator login not found
 368                         setPostRequestParameter('ok', $ret);
 369                         loadTemplate('admin_settings_saved', false, getMaskedMessage('ADMIN_404', getSession('admin_login')));
 370                         destroyAdminSession();
 371                         break;
 372
 373                 case 'pass': // Wrong password
 374                         setPostRequestParameter('ok', $ret);
 375                         loadTemplate('admin_settings_saved', false, getMessage('WRONG_PASS'));
 376                         destroyAdminSession();
 377                         break;
 378
 379                 default: // Others will be logged
 380                         logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminCookiesAreValid()", $ret));
 381                         break;
 382         } // END - switch
 383 }
 384
 385 // [EOF]
 386 ?>