inc/modules/admin.php

   1 <?php
   2 /************************************************************************
   3  * Mailer v0.2.1-FINAL                                Start: 08/31/2003 *
   4  * ===================                          Last change: 07/02/2004 *
   5  *                                                                      *
   6  * -------------------------------------------------------------------- *
   7  * File              : admin.php                                        *
   8  * -------------------------------------------------------------------- *
   9  * Short description : Administration module                            *
  10  * -------------------------------------------------------------------- *
  11  * Kurzbeschreibung  : Administrationsmodul                             *
  12  * -------------------------------------------------------------------- *
  13  * $Revision::                                                        $ *
  14  * $Date::                                                            $ *
  15  * $Tag:: 0.2.1-FINAL                                                 $ *
  16  * $Author::                                                          $ *
  17  * -------------------------------------------------------------------- *
  18  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
  19  * Copyright (c) 2009 - 2011 by Mailer Developer Team                   *
  20  * For more information visit: http://www.mxchange.org                  *
  21  *                                                                      *
  22  * This program is free software; you can redistribute it and/or modify *
  23  * it under the terms of the GNU General Public License as published by *
  24  * the Free Software Foundation; either version 2 of the License, or    *
  25  * (at your option) any later version.                                  *
  26  *                                                                      *
  27  * This program is distributed in the hope that it will be useful,      *
  28  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *
  29  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *
  30  * GNU General Public License for more details.                         *
  31  *                                                                      *
  32  * You should have received a copy of the GNU General Public License    *
  33  * along with this program; if not, write to the Free Software          *
  34  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *
  35  * MA  02110-1301  USA                                                  *
  36  ************************************************************************/
  37
  38 // Some security stuff...
  39 if (!defined('__SECURITY')) {
  40         die();
  41 } // END - if
  42
  43 // Load include file
  44 loadIncludeOnce('inc/modules/admin/admin-inc.php');
  45
  46 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)
  47 fixDeletedCookies(array('admin_id', 'admin_md5', 'admin_last'));
  48
  49 // Init return value
  50 $ret = 'init';
  51
  52 // Is no admin registered?
  53 if (!isAdminRegistered()) {
  54         // Admin is not registered so we have to inform the user
  55         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('pass1')) || (strlen(postRequestParameter('pass1')) < 4) || (!isPostRequestParameterSet('pass2')) || (strlen(postRequestParameter('pass2')) < 4) || (postRequestParameter('pass1') != postRequestParameter('pass2')))) {
  56                 setPostRequestParameter('ok', '***');
  57         } // END - if
  58
  59         // Clear error message
  60         $errorMessage = '';
  61
  62         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
  63                 // Hash the password with the old function because we are here in install mode
  64                 $hashedPass = md5(postRequestParameter('pass1'));
  65
  66                 // Kill maybe existing session variables
  67                 destroyAdminSession(false);
  68
  69                 // Do registration
  70                 $ret = addAdminAccount(postRequestParameter('login'), $hashedPass, getWebmaster());
  71
  72                 // Check if registration wents fine
  73                 switch ($ret) {
  74                         case 'done':
  75                                 // Change ADMIN_REGISTERED entry
  76                                 $done = changeDataInInclude(getCachePath() . 'config-local.php', 'ADMIN-SETUP', "setConfigEntry('ADMIN_REGISTERED', '", "');", 'Y', 0);
  77
  78                                 // Was it successfull?
  79                                 if ($done === true) {
  80                                         // Registering is done
  81                                         redirectToUrl('modules.php?module=admin&amp;register=done');
  82                                 } else {
  83                                         // Registration incomplete
  84                                         $errorMessage = '{--ADMIN_CANNOT_COMPLETE--}';
  85
  86                                         // Set this to have our error message displayed
  87                                         setPostRequestParameter('ok', '***');
  88                                 }
  89                                 break;
  90
  91                         case 'failed': // Registration has failed
  92                                 $errorMessage = '{--ADMIN_REGISTER_FAILED--}';
  93
  94                                 // Set this to have our error message displayed
  95                                 setPostRequestParameter('ok', '***');
  96                                 break;
  97
  98                         case 'already': // Admin does already exists!
  99                                 $errorMessage = '{--ADMIN_LOGIN_ALREADY_REG--}';
 100
 101                                 // Set this to have our error message displayed
 102                                 setPostRequestParameter('ok', '***');
 103                                 break;
 104
 105                         default:
 106                                 // Any other kind will be logged
 107                                 $errorMessage = sprintf("Unknown return code %s from ifAdminLoginDataIsValid().", $ret);
 108                                 logDebugMessage(__FILE__, __LINE__, $errorMessage);
 109
 110                                 // Set this to have our error message displayed
 111                                 setPostRequestParameter('ok', '***');
 112                                 break;
 113                 } // END - switch
 114         } // END - if
 115
 116         // Whas that action okay?
 117         if ($ret != 'done') {
 118                 // Init login name
 119                 $content['login'] = '';
 120                 if (isPostRequestParameterSet('login')) {
 121                         $content['login'] = postRequestParameter('login');
 122                 } // END - if
 123
 124                 // Init array elements
 125                 $content['login_message']   = '';
 126                 $content['pass1_message']    = '';
 127                 $content['pass2_message']    = '';
 128
 129                 // Yet-another notice-fix
 130                 if ((isFormSent()) && (postRequestParameter('ok') == '***')) {
 131                         // Init variables
 132                         $loginMessage = '';
 133                         $pass1Message = '';
 134                         $pass2Message = '';
 135
 136                         // No login entered?
 137                         if (empty($content['login'])) $loginMessage = '{--ADMIN_NO_LOGIN--}';
 138
 139                         // An error comes back from registration?
 140                         if ((!empty($ret)) && ($ret != 'init')) $loginMessage = $errorMessage;
 141
 142                         // No password 1 entered or to short?
 143                         if (!isPostRequestParameterSet('pass1')) $pass1Message = '{--ADMIN_NO_PASS1--}';
 144                          elseif (strlen(postRequestParameter('pass1')) < 4) $pass1Message = '{--ADMIN_SHORT_PASS1--}';
 145
 146                         // No password 2 entered or to short?
 147                         if (!isPostRequestParameterSet('pass2')) $pass2Message = '{--ADMIN_NO_PASS2--}';
 148                          elseif (strlen(postRequestParameter('pass2')) < 4) $pass2Message = '{--ADMIN_SHORT_PASS2--}';
 149
 150                         // Both didn't match?
 151                         if (postRequestParameter('pass1') != postRequestParameter('pass2')) {
 152                                 // No match
 153                                 if (empty($pass1Message)) $pass1Message = '{--ADMIN_PASS1_MISMATCH--}';
 154                                 if (empty($pass2Message)) $pass2Message = '{--ADMIN_PASS2_MISMATCH--}';
 155                         } // END - if
 156
 157                         // Output error messages
 158                         $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
 159                         $content['pass1_message'] = loadTemplate('admin_login_msg', true, $pass1Message);
 160                         $content['pass2_message'] = loadTemplate('admin_login_msg', true, $pass2Message);
 161                         $content['error_message'] = loadTemplate('admin_login_msg', true, $errorMessage);
 162                 } // END - if
 163
 164                 // Output message in seperate template
 165                 loadTemplate('admin_settings_saved', false, '{--ADMIN_ACCOUNT_NOT_REGISTERED_YET--}');
 166
 167                 // Load register template
 168                 loadTemplate('admin_reg_form', false, $content);
 169         } // END - if
 170 } elseif (isGetRequestParameterSet('reset_pass')) {
 171         // Is the form submitted?
 172         if ((isPostRequestParameterSet('send_link')) && (isPostRequestParameterSet('email'))) {
 173                 // Output result
 174                 loadTemplate('admin_settings_saved', false, sendAdminPasswordResetLink(postRequestParameter('email')));
 175         } elseif (isGetRequestParameterSet('hash')) {
 176                 // Output form for hash validation
 177                 loadTemplate('admin_validate_reset_hash_form', false, getRequestParameter('hash'));
 178         } elseif ((isPostRequestParameterSet('validate_hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('hash'))) {
 179                 // Validate the login data and hash
 180                 $valid = adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'));
 181
 182                 // Valid?
 183                 if ($valid === true) {
 184                         // Prepare content first
 185                         $content = array(
 186                                 'hash'  => secureString(postRequestParameter('hash')),
 187                                 'login' => secureString(postRequestParameter('login'))
 188                         );
 189
 190                         // Validation okay so display form for final password change
 191                         loadTemplate('form_reset_password_form', false, $content);
 192                 } else {
 193                         // Cannot validate the login data and hash
 194                         loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED--}');
 195                 }
 196         } elseif ((isPostRequestParameterSet('reset_pass')) && (isPostRequestParameterSet('hash')) && (isPostRequestParameterSet('login')) && (isPostRequestParameterSet('pass1')) && (postRequestParameter('pass1') == postRequestParameter('pass2'))) {
 197                 // Okay, we shall the admin password here. So first revalidate the hash
 198                 if (adminResetValidateHashLogin(postRequestParameter('hash'), postRequestParameter('login'))) {
 199                         // Output result
 200                         loadTemplate('form_reset_pass_done', false, doResetAdminPassword(postRequestParameter('login'), postRequestParameter('pass1')));
 201                 } else {
 202                         // Validation failed
 203                         loadTemplate('admin_settings_saved', false, '{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2--}');
 204                 }
 205         } else {
 206                 // Output reset password form
 207                 loadTemplate('admin_send_reset_link');
 208         }
 209 } elseif ((!isSessionVariableSet('admin_id')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last'))) {
 210         // At leat one administrator account was created
 211         if ((isSessionVariableSet('admin_id')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last'))) {
 212                 // Timeout for last login, we have to logout first!
 213                 redirectToUrl('modules.php?module=admin&amp;logout=1');
 214         } // END - if
 215
 216         if (isGetRequestParameterSet('register')) {
 217                 // Registration of first admin is done
 218                 if (getRequestParameter('register') == 'done') {
 219                         // Regisration done!
 220                         loadTemplate('admin_settings_saved', false, '{--ADMIN_REGISTER_DONE--}');
 221                 } // END - if
 222         } // END - if
 223
 224         // Check if the admin has submitted data or not
 225         if ((isFormSent()) && ((!isPostRequestParameterSet('login')) || (!isPostRequestParameterSet('password')) || (strlen(postRequestParameter('password')) < 4))) {
 226                 setPostRequestParameter('ok', '***');
 227         } // END - if
 228
 229         if ((isFormSent()) && (postRequestParameter('ok') != '***')) {
 230                 // All required data was entered so we check his account
 231                 $ret = ifAdminLoginDataIsValid(postRequestParameter('login'), postRequestParameter('password'));
 232
 233                 // Which status do we have?
 234                 switch ($ret) {
 235                         case 'done': // Admin and password are okay, so we log in now
 236                                 // Construct URL and redirect
 237                                 $url = 'modules.php?module=admin&amp;';
 238
 239                                 // Rewrite overview module
 240                                 if (getWhat() == 'overview') {
 241                                         setAction(getActionFromModuleWhat(getModule(), getWhat()));
 242                                 } // END - if
 243
 244                                 // Add data to URL
 245                                 if (isWhatSet()) {
 246                                         $url .= 'what=' . getWhat();
 247                                 } elseif (isActionSet()) {
 248                                         $url .= 'action=' . getAction();
 249                                 } elseif (isGetRequestParameterSet('area')) {
 250                                         $url .= 'area=' . getRequestParameter('area');
 251                                 }
 252
 253                                 // Load URL
 254                                 redirectToUrl($url);
 255                                 break;
 256
 257                         case '404': // Administrator login not found
 258                                 setPostRequestParameter('ok', $ret);
 259                                 $ret = getMaskedMessage('ADMIN_ACCOUNT_404', postRequestParameter('login'));
 260                                 destroyAdminSession();
 261                                 break;
 262
 263                         case 'password': // Wrong password
 264                                 setPostRequestParameter('ok', $ret);
 265                                 $ret = '{--WRONG_PASS--} [<a href="{%url=modules.php?module=admin&amp;reset_pass=1%}">{--ADMIN_RESET_PASS--}</a>]';
 266                                 destroyAdminSession();
 267                                 break;
 268
 269                         default: // Others will be logged
 270                                 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid()", $ret));
 271                                 break;
 272                 } // END - switch
 273         } // END - if
 274
 275         // Error detected?
 276         if ($ret != 'done') {
 277                 $content['login'] = '';
 278                 if (isPostRequestParameterSet('login')) {
 279                         $content['login'] = postRequestParameter('login');
 280                 } // END - if
 281
 282                 // Init array elements
 283                 $content['login_message'] = '';
 284                 $content['pass_message']  = '';
 285
 286                 if (isFormSent()) {
 287                         // Set messages to zero
 288                         $loginMessage = '';
 289                         $passwdMessage = '';
 290
 291                         // No login entered?
 292                         if (!isPostRequestParameterSet('login')) $loginMessage = '{--ADMIN_NO_LOGIN--}';
 293
 294                         // An error comes back from login?
 295                         if ((!empty($ret)) && (postRequestParameter('ok') == '404')) $loginMessage = $ret;
 296
 297                         // No password entered?
 298                         if (!isPostRequestParameterSet('password')) $passwdMessage = '{--ADMIN_NO_PASS--}';
 299
 300                         // Or password too short?
 301                         if (strlen(postRequestParameter('password')) < 4) $passwdMessage = '{--ADMIN_SHORT_PASS--}';
 302
 303                         // An error comes back from login?
 304                         if ((!empty($ret)) && (postRequestParameter('ok') == 'password')) $passwdMessage = $ret;
 305
 306                         // Load message template
 307                         $content['login_message'] = loadTemplate('admin_login_msg', true, $loginMessage);
 308                         $content['pass_message']  = loadTemplate('admin_login_msg', true, $passwdMessage);
 309                 } // END - if
 310
 311                 // Load login form
 312                 if (isWhatSet()) {
 313                         // Restore old what value
 314                         $content = merge_array($content, array('target' => 'what', 'value' => getWhat()));
 315                 } elseif (isActionSet()) {
 316                         if (getAction() != 'logout') {
 317                                 // Restore old action value
 318                                 $content = merge_array($content, array('target' => 'action', 'value' => getAction()));
 319                         } else {
 320                                 // Set default values
 321                                 $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
 322                         }
 323                 } elseif (isGetRequestParameterSet('area')) {
 324                         // Restore old area value
 325                         $content = merge_array(
 326                                 $content,
 327                                 array(
 328                                         'target' => 'area',
 329                                         'value'  => getRequestParameter('area')
 330                                 )
 331                         );
 332                 } else {
 333                         // Set default values
 334                         $content = merge_array($content, array('target' => 'action', 'value' => 'login'));
 335                 }
 336
 337                 // Load login form template
 338                 loadTemplate('admin_login_form', false, $content);
 339         } // END - if
 340 } elseif (isGetRequestParameterSet('logout')) {
 341         // Only try to remove cookies
 342         if (destroyAdminSession()) {
 343                 // Load logout template
 344                 if (isGetRequestParameterSet('register')) {
 345                         // Secure input
 346                         $register = getRequestParameter('register');
 347
 348                         // Special logout redirect for installation of given extension
 349                         loadTemplate(sprintf("admin_logout_%s_install", $register));
 350                 } elseif (isGetRequestParameterSet('remove')) {
 351                         // Secure input
 352                         $remove = getRequestParameter('remove');
 353
 354                         // Special logout redirect for removal of given extension
 355                         loadTemplate(sprintf("admin_logout_%s_remove", $remove));
 356                 } else {
 357                         // Logged out normally
 358                         loadTemplate('admin_logout');
 359                 }
 360         } else {
 361                 // Something went wrong here...
 362                 loadTemplate('admin_settings_unsaved', false, '{--ADMIN_LOGOUT_FAILED--}');
 363
 364                 // Add fatal message
 365                 addFatalMessage(__FILE__, __LINE__, '{--CANNOT_UNREG_SESS--}');
 366         }
 367 } else {
 368         // Maybe an Admin want's to login?
 369         $ret = ifAdminCookiesAreValid(getCurrentAdminId(), getAdminMd5());
 370
 371         // Check status
 372         switch ($ret) {
 373                 case 'done':
 374                         // Check for access control line of current menu entry
 375                         runFilterChain('check_admin_acl');
 376
 377                         // Check for version and switch between old menu system and new intelligent menu system
 378                         if ((adminGetMenuMode() == 'NEW') && (isIncludeReadable('inc/modules/admin/lasys-inc.php'))) {
 379                                 // Default area is the entrance, of course
 380                                 $area = 'entrance';
 381
 382                                 // Check for similar URL variable
 383                                 if (isGetRequestParameterSet('area')) $area = getRequestParameter('area');
 384
 385                                 // Load logical-area menu-system file
 386                                 loadIncludeOnce('inc/modules/admin/lasys-inc.php');
 387
 388                                 // Create new-style menu system will logical areas
 389                                 doAdminLogicalArea($area, $action, getWhat());
 390                         } else {
 391                                 // This little call constructs the whole default old and lacky menu system
 392                                 // on left side. It also renders the content on right side
 393                                 doAdminAction();
 394                         }
 395                         break;
 396
 397                 case '404': // Administrator login not found
 398                         setPostRequestParameter('ok', $ret);
 399                         loadTemplate('admin_settings_saved', false, getMaskedMessage('ADMIN_ACCOUNT_404', getCurrentAdminId()));
 400                         destroyAdminSession();
 401                         break;
 402
 403                 case 'password': // Wrong password
 404                         setPostRequestParameter('ok', $ret);
 405                         loadTemplate('admin_settings_saved', false, '{--WRONG_PASS--}');
 406                         destroyAdminSession();
 407                         break;
 408
 409                 default: // Others will be logged
 410                         logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminCookiesAreValid()", $ret));
 411                         break;
 412         } // END - switch
 413 }
 414
 415 // [EOF]
 416 ?>