f0c295eb5fd91bf084153fc9bfddfc7ee84bdca9
[mailer.git] / inc / modules / admin.php
1 <?php
2 /************************************************************************
3  * Mailer v0.2.1-FINAL                                Start: 08/31/2003 *
4  * ===================                          Last change: 07/02/2004 *
5  *                                                                      *
6  * -------------------------------------------------------------------- *
7  * File              : admin.php                                        *
8  * -------------------------------------------------------------------- *
9  * Short description : Administration module                            *
10  * -------------------------------------------------------------------- *
11  * Kurzbeschreibung  : Administrationsmodul                             *
12  * -------------------------------------------------------------------- *
13  * $Revision::                                                        $ *
14  * $Date::                                                            $ *
15  * $Tag:: 0.2.1-FINAL                                                 $ *
16  * $Author::                                                          $ *
17  * -------------------------------------------------------------------- *
18  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
19  * Copyright (c) 2009 - 2011 by Mailer Developer Team                   *
20  * For more information visit: http://www.mxchange.org                  *
21  *                                                                      *
22  * This program is free software; you can redistribute it and/or modify *
23  * it under the terms of the GNU General Public License as published by *
24  * the Free Software Foundation; either version 2 of the License, or    *
25  * (at your option) any later version.                                  *
26  *                                                                      *
27  * This program is distributed in the hope that it will be useful,      *
28  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *
29  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *
30  * GNU General Public License for more details.                         *
31  *                                                                      *
32  * You should have received a copy of the GNU General Public License    *
33  * along with this program; if not, write to the Free Software          *
34  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *
35  * MA  02110-1301  USA                                                  *
36  ************************************************************************/
37
38 // Some security stuff...
39 if (!defined('__SECURITY')) {
40         die();
41 } // END - if
42
43 // Load include file
44 loadIncludeOnce('inc/modules/admin/admin-inc.php');
45
46 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)
47 fixDeletedCookies(array('admin_id', 'admin_md5', 'admin_last'));
48
49 // Init return value
50 $ret = 'init';
51
52 // Is no admin registered?
53 if (!isAdminRegistered()) {
54         // Admin is not registered so we have to inform the user
55         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('pass1')) || (strlen(postRequestParameter('pass1')) < getConfig('minium_admin_pass_length')) || (!isPostRequestParameterSet('pass2')) || (strlen(postRequestParameter('pass2')) < getConfig('minium_admin_pass_length')) || (postRequestParameter('pass1') != postRequestParameter('pass2')))) {
56                 setPostRequestParameter('ok', '***');
57         } // END - if
58
59         // Clear error message
60         $errorMessage = '';
61
62         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
63                 // Hash the password with the old function because we are here in install mode
64                 $hashedPass = md5(postRequestParameter('pass1'));
65
66                 // Kill maybe existing session variables
67                 destroyAdminSession(false);
68
69                 // Do registration
70                 $ret = addAdminAccount(postRequestParameter('login'), $hashedPass, getWebmaster());
71
72                 // Check if registration wents fine
73                 switch ($ret) {
74                         case 'done':
75                                 // Change ADMIN_REGISTERED entry
76                                 $done = changeDataInLocalConfigurationFile('ADMIN-SETUP', "setConfigEntry('ADMIN_REGISTERED', '", "');", 'Y', 0);
77
78                                 // Was it successfull?
79                                 if ($done === true) {
80                                         // Registering is done
81                                         redirectToUrl('modules.php?module=admin&amp;register=done');
82                                 } else {
83                                         // Registration incomplete
84                                         $errorMessage = '{--ADMIN_CANNOT_COMPLETE--}';
85
86                                         // Set this to have our error message displayed
87                                         setPostRequestParameter('ok', '***');
88                                 }
89                                 break;
90
91                         case 'failed': // Registration has failed
92                                 $errorMessage = '{--ADMIN_REGISTER_FAILED--}';
93
94                                 // Set this to have our error message displayed
95                                 setPostRequestParameter('ok', '***');
96                                 break;
97
98                         case 'already': // Admin does already exists!
99                                 $errorMessage = '{--ADMIN_LOGIN_ALREADY_REG--}';
100
101                                 // Set this to have our error message displayed
102                                 setPostRequestParameter('ok', '***');
103                                 break;
104
105                         default:
106                                 // Any other kind will be logged
107                                 $errorMessage = sprintf("Unknown return code %s from ifAdminLoginDataIsValid().", $ret);
108                                 logDebugMessage(__FILE__, __LINE__, $errorMessage);
109
110                                 // Set this to have our error message displayed
111                                 setPostRequestParameter('ok', '***');
112                                 break;
113                 } // END - switch
114         } // END - if
115
116         // Whas that action okay?
117         if ($ret != 'done') {
118                 // Init login name
119                 $content['login'] = '';
120                 if (isPostRequestParameterSet('login')) {
121                         $content['login'] = postRequestParameter('login');
122                 } // END - if
123
124                 // Init array elements
125                 $content['login_message'] = '';
126                 $content['pass1_message'] = '';
127                 $content['pass2_message'] = '';
128                 $content['error_message'] = '';
129
130                 // Yet-another notice-fix
131                 if ((isFormSent()) && (postRequestParameter('ok') == '***')) {
132                         // Init variables
133                         $loginMessage = '';
134                         $pass1Message = '';
135                         $pass2Message = '';
136
137                         // No login entered?
138                         if (empty($content['login'])) {
139                                 $loginMessage = '{--ADMIN_NO_LOGIN--}';
140                         } // END - if
141
142                         // An error comes back from registration?
143                         if ((!empty($ret)) && ($ret != 'init')) {
144                                 $loginMessage = $errorMessage;
145                         } // END - if
146
147                         // No password 1 entered or to short?
148                         if (!isPostRequestParameterSet('pass1')) {
149                                 $pass1Message = '{--ADMIN_NO_PASS1--}';
150                         } elseif (strlen(postRequestParameter('pass1')) < getConfig('minium_admin_pass_length')) {
151                                 $pass1Message = '{--ADMIN_SHORT_PASS1--}';
152                         }
153
154                         // No password 2 entered or to short?
155                         if (!isPostRequestParameterSet('pass2')) {
156                                 $pass2Message = '{--ADMIN_NO_PASS2--}';
157                         } elseif (strlen(postRequestParameter('pass2')) < getConfig('minium_admin_pass_length')) {
158                                 $pass2Message = '{--ADMIN_SHORT_PASS2--}';
159                         }
160
161                         // Both didn't match?
162                         if (postRequestParameter('pass1') != postRequestParameter('pass2')) {
163                                 // No match
164                                 if (empty($pass1Message)) $pass1Message = '{--ADMIN_PASS1_MISMATCH--}';
165                                 if (empty($pass2Message)) $pass2Message = '{--ADMIN_PASS2_MISMATCH--}';
166                         } // END - if
167
168                         // Output error messages
169                         $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
170                         $content['pass1_message'] = loadTemplate('admin_login_msg', true, $pass1Message);
171                         $content['pass2_message'] = loadTemplate('admin_login_msg', true, $pass2Message);
172                         $content['error_message'] = loadTemplate('admin_login_msg', true, $errorMessage);
173                 } // END - if
174
175                 // Output message in seperate template
176                 displayMessage('{--ADMIN_ACCOUNT_NOT_REGISTERED_YET--}');
177
178                 // Load register template
179                 loadTemplate('admin_reg_form', false, $content);
180         } // END - if
181 } elseif (isGetRequestParameterSet('reset_pass')) {
182         // Is the form submitted?
183         if ((isPostRequestParameterSet('send_link')) && (isPostRequestParameterSet('email'))) {
184                 // Output result
185                 displayMessage(sendAdminPasswordResetLink(postRequestParameter('email')));
186         } elseif (isGetRequestParameterSet('hash')) {
187                 // Output form for hash validation
188                 loadTemplate('admin_validate_reset_hash_form', false, getRequestParameter('hash'));
189         } elseif ((isPostRequestParameterSet('validate_hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('hash'))) {
190                 // Validate the login data and hash
191                 $valid = adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'));
192
193                 // Valid?
194                 if ($valid === true) {
195                         // Prepare content first
196                         $content = array(
197                                 'hash'  => postRequestParameter('hash'),
198                                 'login' => postRequestParameter('login')
199                         );
200
201                         // Validation okay so display form for final password change
202                         loadTemplate('admin_reset_password_form', false, $content);
203                 } else {
204                         // Cannot validate the login data and hash
205                         displayMessage('{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED--}');
206                 }
207         } elseif ((isPostRequestParameterSet('reset_pass')) && (isPostRequestParameterSet('hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('pass1')) && (postRequestParameter('pass1') == postRequestParameter('pass2'))) {
208                 // Okay, we shall the admin password here. So first revalidate the hash
209                 if (adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'))) {
210                         // Output result
211                         loadTemplate('admin_reset_password_done', false, doResetAdminPassword(postRequestParameter('login'), postRequestParameter('pass1')));
212                 } else {
213                         // Validation failed
214                         displayMessage('{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2--}');
215                 }
216         } else {
217                 // Output reset password form
218                 loadTemplate('admin_reset_password_send_link');
219         }
220 } elseif ((!isSessionVariableSet('admin_id')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last'))) {
221         // At leat one administrator account was created
222         if ((isSessionVariableSet('admin_id')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last'))) {
223                 // Timeout for last login, we have to logout first!
224                 redirectToUrl('modules.php?module=admin&amp;logout=1');
225         } // END - if
226
227         if (isGetRequestParameterSet('register')) {
228                 // Registration of first admin is done
229                 if (getRequestParameter('register') == 'done') {
230                         // Regisration done!
231                         displayMessage('{--ADMIN_REGISTER_DONE--}');
232                 } // END - if
233         } // END - if
234
235         // Check if the admin has submitted data or not
236         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('password')) || (strlen(postRequestParameter('password')) < getConfig('minium_admin_pass_length')))) {
237                 setPostRequestParameter('ok', '***');
238         } // END - if
239
240         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
241                 // All required data was entered so we check his account
242                 $ret = ifAdminLoginDataIsValid(postRequestParameter('login'), postRequestParameter('password'));
243
244                 // Which status do we have?
245                 switch ($ret) {
246                         case 'done': // Admin and password are okay, so we log in now
247                                 // Construct URL and redirect
248                                 $url = 'modules.php?module=admin&amp;';
249
250                                 // Rewrite overview module
251                                 if (getWhat() == 'overview') {
252                                         setAction(getActionFromModuleWhat(getModule(), getWhat()));
253                                 } // END - if
254
255                                 // Add data to URL
256                                 if (isWhatSet()) {
257                                         $url .= 'what=' . getWhat();
258                                 } elseif (isActionSet()) {
259                                         $url .= 'action=' . getAction();
260                                 } elseif (isGetRequestParameterSet('area')) {
261                                         $url .= 'area=' . getRequestParameter('area');
262                                 }
263
264                                 // Load URL
265                                 redirectToUrl($url);
266                                 break;
267
268                         case '404': // Administrator login not found
269                                 setPostRequestParameter('ok', $ret);
270                                 $ret = getMaskedMessage('ADMIN_ACCOUNT_404', postRequestParameter('login'));
271                                 destroyAdminSession();
272                                 break;
273
274                         case 'password': // Wrong password
275                                 setPostRequestParameter('ok', $ret);
276                                 $ret = '{--WRONG_PASS--} [<a href="{%url=modules.php?module=admin&amp;reset_pass=1%}">{--ADMIN_RESET_PASS--}</a>]';
277                                 destroyAdminSession();
278                                 break;
279
280                         default: // Others will be logged
281                                 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid()", $ret));
282                                 break;
283                 } // END - switch
284         } // END - if
285
286         // Error detected?
287         if ($ret != 'done') {
288                 $content['login'] = '';
289                 if (isPostRequestParameterSet('login')) {
290                         $content['login'] = postRequestParameter('login');
291                 } // END - if
292
293                 // Init array elements
294                 $content['login_message'] = '';
295                 $content['pass_message']  = '';
296
297                 if (isFormSent()) {
298                         // Set messages to zero
299                         $loginMessage = '';
300                         $passwdMessage = '';
301
302                         // Check for login
303                         if (!isPostRequestParameterSet('login')) {
304                                 // No login entered?
305                                 $loginMessage = '{--ADMIN_NO_LOGIN--}';
306                         } elseif ((!empty($ret)) && (postRequestParameter('ok') == '404')) {
307                                 // An error comes back from login?
308                                 $loginMessage = $ret;
309                         }
310
311                         // Check for password
312                         if (!isPostRequestParameterSet('password')) {
313                                 // No password entered?
314                                 $passwdMessage = '{--ADMIN_NO_PASS--}';
315                         } elseif (strlen(postRequestParameter('password')) < getConfig('minium_admin_pass_length')) {
316                                 // Or password too short?
317                                 $passwdMessage = '{--ADMIN_SHORT_PASS--}';
318                         } elseif ((!empty($ret)) && (postRequestParameter('ok') == 'password')) {
319                                 // An error comes back from login?
320                                 $passwdMessage = $ret;
321                         }
322
323                         // Load message templates if the messages have been set
324                         if (!empty($loginMessage)) {
325                                 $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
326                         } // END - if
327                         if (!empty($passwdMessage)) {
328                                 $content['pass_message']  = loadTemplate('admin_login_msg', true, $passwdMessage);
329                         } // END - if
330                 } // END - if
331
332                 // Load login form
333                 if (isWhatSet()) {
334                         // Restore old what value
335                         $content = merge_array($content, array('target' => 'what', 'value' => getWhat()));
336                 } elseif (isActionSet()) {
337                         if (getAction() != 'logout') {
338                                 // Restore old action value
339                                 $content = merge_array($content, array('target' => 'action', 'value' => getAction()));
340                         } else {
341                                 // Set default values
342                                 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
343                         }
344                 } elseif (isGetRequestParameterSet('area')) {
345                         // Restore old area value
346                         $content = merge_array(
347                                 $content,
348                                 array(
349                                         'target' => 'area',
350                                         'value'  => getRequestParameter('area')
351                                 )
352                         );
353                 } else {
354                         // Set default values
355                         $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
356                 }
357
358                 // Load login form template
359                 loadTemplate('admin_login_form', false, $content);
360         } // END - if
361 } elseif (isGetRequestParameterSet('logout')) {
362         // Only try to remove cookies
363         if (destroyAdminSession()) {
364                 // Load logout template
365                 if (isGetRequestParameterSet('register')) {
366                         // Secure input
367                         $register = getRequestParameter('register');
368
369                         // Special logout redirect for installation of given extension
370                         loadTemplate(sprintf("admin_logout_%s_install", $register));
371                 } elseif (isGetRequestParameterSet('remove')) {
372                         // Secure input
373                         $remove = getRequestParameter('remove');
374
375                         // Special logout redirect for removal of given extension
376                         loadTemplate(sprintf("admin_logout_%s_remove", $remove));
377                 } else {
378                         // Logged out normally
379                         loadTemplate('admin_logout');
380                 }
381         } else {
382                 // Something went wrong here...
383                 loadTemplate('admin_settings_unsaved', false, '{--ADMIN_LOGOUT_FAILED--}');
384
385                 // Add fatal message
386                 addFatalMessage(__FILE__, __LINE__, '{--CANNOT_UNREG_SESS--}');
387         }
388 } else {
389         // Maybe an Admin want's to login?
390         $ret = ifAdminCookiesAreValid(getCurrentAdminId(), getAdminMd5());
391
392         // Check status
393         switch ($ret) {
394                 case 'done':
395                         // Check for access control line of current menu entry
396                         runFilterChain('check_admin_acl');
397
398                         // Check for version and switch between old menu system and new intelligent menu system
399                         if ((adminGetMenuMode() == 'NEW') && (isIncludeReadable('inc/modules/admin/lasys-inc.php'))) {
400                                 // Default area is the entrance, of course
401                                 $area = 'entrance';
402
403                                 // Check for similar URL variable
404                                 if (isGetRequestParameterSet('area')) $area = getRequestParameter('area');
405
406                                 // Load logical-area menu-system file
407                                 loadIncludeOnce('inc/modules/admin/lasys-inc.php');
408
409                                 // Create new-style menu system will logical areas
410                                 doAdminLogicalArea($area, $action, getWhat());
411                         } else {
412                                 // This little call constructs the whole default old and lacky menu system
413                                 // on left side. It also renders the content on right side
414                                 doAdminAction();
415                         }
416                         break;
417
418                 case '404': // Administrator login not found
419                         setPostRequestParameter('ok', $ret);
420                         displayMessage(getMaskedMessage('ADMIN_ACCOUNT_404', getCurrentAdminId()));
421                         destroyAdminSession();
422                         break;
423
424                 case 'password': // Wrong password
425                         setPostRequestParameter('ok', $ret);
426                         displayMessage('{--WRONG_PASS--}');
427                         destroyAdminSession();
428                         break;
429
430                 default: // Others will be logged
431                         logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminCookiesAreValid()", $ret));
432                         break;
433         } // END - switch
434 }
435
436 // [EOF]
437 ?>