inc/modules/admin.php

   1 <?php
   2 /************************************************************************
   3  * Mailer v0.2.1-FINAL                                Start: 08/31/2003 *
   4  * ===================                          Last change: 07/02/2004 *
   5  *                                                                      *
   6  * -------------------------------------------------------------------- *
   7  * File              : admin.php                                        *
   8  * -------------------------------------------------------------------- *
   9  * Short description : Administration module                            *
  10  * -------------------------------------------------------------------- *
  11  * Kurzbeschreibung  : Administrationsmodul                             *
  12  * -------------------------------------------------------------------- *
  13  * $Revision::                                                        $ *
  14  * $Date::                                                            $ *
  15  * $Tag:: 0.2.1-FINAL                                                 $ *
  16  * $Author::                                                          $ *
  17  * -------------------------------------------------------------------- *
  18  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
  19  * Copyright (c) 2009 - 2012 by Mailer Developer Team                   *
  20  * For more information visit: http://mxchange.org                      *
  21  *                                                                      *
  22  * This program is free software; you can redistribute it and/or modify *
  23  * it under the terms of the GNU General Public License as published by *
  24  * the Free Software Foundation; either version 2 of the License, or    *
  25  * (at your option) any later version.                                  *
  26  *                                                                      *
  27  * This program is distributed in the hope that it will be useful,      *
  28  * but WITHOUT ANY WARRANTY; without even the implied warranty of       *
  29  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        *
  30  * GNU General Public License for more details.                         *
  31  *                                                                      *
  32  * You should have received a copy of the GNU General Public License    *
  33  * along with this program; if not, write to the Free Software          *
  34  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,               *
  35  * MA  02110-1301  USA                                                  *
  36  ************************************************************************/
  37
  38 // Some security stuff...
  39 if (!defined('__SECURITY')) {
  40         exit();
  41 } // END - if
  42
  43 // Load include file
  44 loadIncludeOnce('inc/modules/admin/admin-inc.php');
  45
  46 // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!)
  47 fixDeletedCookies(array('admin_id', 'admin_md5', 'admin_last'));
  48
  49 // Init return value
  50 $ret = 'init';
  51
  52 // Is no admin registered?
  53 if (!isAdminRegistered()) {
  54         // Admin is not registered so we have to inform the user
  55         if ((isFormSent()) && ((!isPostRequestElementSet('admin_login')) || (!isPostRequestElementSet('admin_pass1')) || (strlen(postRequestElement('admin_pass1')) < getConfig('minium_admin_pass_length')) || (!isPostRequestElementSet('admin_pass2')) || (strlen(postRequestElement('admin_pass2')) < getConfig('minium_admin_pass_length')) || (postRequestElement('admin_pass1') != postRequestElement('admin_pass2')))) {
  56                 setPostRequestElement('ok', '***');
  57         } // END - if
  58
  59         // Clear error message
  60         $errorMessage = '';
  61
  62         if ((isFormSent()) && (postRequestElement('ok') != '***')) {
  63                 // Hash the password with the old function because we are here in install mode
  64                 $hashedPass = md5(postRequestElement('admin_pass1'));
  65
  66                 // Kill maybe existing session variables
  67                 destroyAdminSession(FALSE);
  68
  69                 // Do registration
  70                 $ret = addAdminAccount(postRequestElement('admin_login'), $hashedPass, getWebmaster());
  71
  72                 // Check if registration wents fine
  73                 switch ($ret) {
  74                         case 'done':
  75                                 // Change ADMIN_REGISTERED entry
  76                                 $done = changeDataInLocalConfigurationFile('ADMIN-SETUP', "setConfigEntry('ADMIN_REGISTERED', '", "');", 'Y', 0);
  77
  78                                 // Was it successfull?
  79                                 if ($done === TRUE) {
  80                                         // Registering is done
  81                                         redirectToUrl('modules.php?module=admin&amp;register=done');
  82                                 } else {
  83                                         // Registration incomplete
  84                                         $errorMessage = '{--ADMIN_CANNOT_COMPLETE--}';
  85
  86                                         // Set this to have our error message displayed
  87                                         setPostRequestElement('ok', '***');
  88                                 }
  89                                 break;
  90
  91                         case 'failed': // Registration has failed
  92                                 $errorMessage = '{--ADMIN_REGISTER_FAILED--}';
  93
  94                                 // Set this to have our error message displayed
  95                                 setPostRequestElement('ok', '***');
  96                                 break;
  97
  98                         case 'already': // Admin does already exists!
  99                                 $errorMessage = '{--ADMIN_LOGIN_ALREADY_REG--}';
 100
 101                                 // Set this to have our error message displayed
 102                                 setPostRequestElement('ok', '***');
 103                                 break;
 104
 105                         default:
 106                                 // Any other kind will be logged
 107                                 $errorMessage = sprintf("Unknown return code %s from ifAdminLoginDataIsValid().", $ret);
 108                                 logDebugMessage(__FILE__, __LINE__, $errorMessage);
 109
 110                                 // Set this to have our error message displayed
 111                                 setPostRequestElement('ok', '***');
 112                                 break;
 113                 } // END - switch
 114         } // END - if
 115
 116         // Whas that action okay?
 117         if ($ret != 'done') {
 118                 // Init login name
 119                 $content['admin_login'] = '';
 120                 if (isPostRequestElementSet('admin_login')) {
 121                         $content['admin_login'] = postRequestElement('admin_login');
 122                 } // END - if
 123
 124                 // Init array elements
 125                 $content['login_message'] = '';
 126                 $content['pass1_message'] = '';
 127                 $content['pass2_message'] = '';
 128                 $content['error_message'] = '';
 129
 130                 // Yet-another notice-fix
 131                 if ((isFormSent()) && (postRequestElement('ok') == '***')) {
 132                         // Init variables
 133                         $loginMessage = '';
 134                         $pass1Message = '';
 135                         $pass2Message = '';
 136
 137                         // No login entered?
 138                         if (empty($content['admin_login'])) {
 139                                 $loginMessage = '{--ADMIN_NO_LOGIN--}';
 140                         } // END - if
 141
 142                         // An error comes back from registration?
 143                         if ((!empty($ret)) && ($ret != 'init')) {
 144                                 $loginMessage = $errorMessage;
 145                         } // END - if
 146
 147                         // No password 1 entered or to short?
 148                         if (!isPostRequestElementSet('admin_pass1')) {
 149                                 $pass1Message = '{--ADMIN_NO_PASSWORD1--}';
 150                         } elseif (strlen(postRequestElement('admin_pass1')) < getConfig('minium_admin_pass_length')) {
 151                                 $pass1Message = '{--ADMIN_SHORT_PASSWORD1--}';
 152                         }
 153
 154                         // No password 2 entered or to short?
 155                         if (!isPostRequestElementSet('admin_pass2')) {
 156                                 $pass2Message = '{--ADMIN_NO_PASSWORD2--}';
 157                         } elseif (strlen(postRequestElement('admin_pass2')) < getConfig('minium_admin_pass_length')) {
 158                                 $pass2Message = '{--ADMIN_SHORT_PASSWORD2--}';
 159                         }
 160
 161                         // Both didn't match?
 162                         if (postRequestElement('admin_pass1') != postRequestElement('admin_pass2')) {
 163                                 // No match
 164                                 if (empty($pass1Message)) $pass1Message = '{--ADMIN_PASSWORD1_MISMATCH--}';
 165                                 if (empty($pass2Message)) $pass2Message = '{--ADMIN_PASSWORD2_MISMATCH--}';
 166                         } // END - if
 167
 168                         // Output error messages
 169                         $content['login_message'] = loadTemplate('admin_login_msg', TRUE, $loginMessage);
 170                         $content['pass1_message'] = loadTemplate('admin_login_msg', TRUE, $pass1Message);
 171                         $content['pass2_message'] = loadTemplate('admin_login_msg', TRUE, $pass2Message);
 172                         $content['error_message'] = loadTemplate('admin_login_msg', TRUE, $errorMessage);
 173                 } // END - if
 174
 175                 // Output message in seperate template
 176                 displayMessage('{--ADMIN_ACCOUNT_NOT_REGISTERED_YET--}');
 177
 178                 // Load register template
 179                 loadTemplate('admin_reg_form', FALSE, $content);
 180         } // END - if
 181 } elseif (isGetRequestElementSet('reset_pass')) {
 182         // Is the form submitted?
 183         if ((isPostRequestElementSet('send_link')) && (isPostRequestElementSet('email'))) {
 184                 // Output result
 185                 displayMessage(sendAdminPasswordResetLink(postRequestElement('email')));
 186         } elseif (isGetRequestElementSet('hash')) {
 187                 // Output form for hash validation
 188                 loadTemplate('admin_validate_reset_hash_form', FALSE, getRequestElement('hash'));
 189         } elseif ((isPostRequestElementSet('validate_hash')) && (isPostRequestElementSet('admin_login')) && (isPostRequestElementSet('hash'))) {
 190                 // Validate the login data and hash
 191                 $valid = adminResetValidateHashLogin(postRequestElement('hash'), postRequestElement('admin_login'));
 192
 193                 // Valid?
 194                 if ($valid === TRUE) {
 195                         // Prepare content first
 196                         $content = array(
 197                                 'hash'        => postRequestElement('hash'),
 198                                 'admin_login' => postRequestElement('admin_login')
 199                         );
 200
 201                         // Validation okay so display form for final password change
 202                         loadTemplate('admin_reset_password_form', FALSE, $content);
 203                 } else {
 204                         // Cannot validate the login data and hash
 205                         displayMessage('{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED--}');
 206                 }
 207         } elseif ((isPostRequestElementSet('reset_pass')) && (isPostRequestElementSet('hash')) && (isPostRequestElementSet('admin_login')) && (isPostRequestElementSet('admin_pass1')) && (postRequestElement('admin_pass1') == postRequestElement('admin_pass2'))) {
 208                 // Okay, we shall the admin password here. So first revalidate the hash
 209                 if (adminResetValidateHashLogin(postRequestElement('hash'), postRequestElement('admin_login'))) {
 210                         // Output result
 211                         loadTemplate('admin_reset_password_done', FALSE, doResetAdminPassword(postRequestElement('admin_login'), postRequestElement('admin_pass1')));
 212                 } else {
 213                         // Validation failed
 214                         displayMessage('{--ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2--}');
 215                 }
 216         } else {
 217                 // Output reset password form
 218                 loadTemplate('admin_reset_password_send_link');
 219         }
 220 } elseif ((!isSessionVariableSet('admin_id')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last'))) {
 221         // At leat one administrator account was created
 222         if ((isSessionVariableSet('admin_id')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last'))) {
 223                 // Timeout for last login, we have to logout first!
 224                 redirectToUrl('modules.php?module=admin&amp;logout=1');
 225         } // END - if
 226
 227         if (isGetRequestElementSet('register')) {
 228                 // Registration of first admin is done
 229                 if (getRequestElement('register') == 'done') {
 230                         // Regisration done!
 231                         displayMessage('{--ADMIN_REGISTER_DONE--}');
 232                 } // END - if
 233         } // END - if
 234
 235         // Check if the admin has submitted data or not
 236         if ((isFormSent()) && ((!isPostRequestElementSet('admin_login')) || (!isPostRequestElementSet('admin_password')) || (strlen(postRequestElement('admin_password')) < getConfig('minium_admin_pass_length')))) {
 237                 setPostRequestElement('login', '***');
 238         } // END - if
 239
 240         if ((isFormSent('login')) && (postRequestElement('login') != '***')) {
 241                 // All required data was entered so we check his account
 242                 $ret = ifAdminLoginDataIsValid(postRequestElement('admin_login'), postRequestElement('admin_password'));
 243
 244                 // Which status do we have?
 245                 switch ($ret) {
 246                         case 'done': // Admin and password are okay, so we log in now
 247                                 // Load URL
 248                                 redirectToUrl('modules.php?' . addAllGetRequestParameters());
 249                                 break;
 250
 251                         case '404': // Administrator login not found
 252                                 setPostRequestElement('login', $ret);
 253                                 $ret = '{%message,ADMIN_ACCOUNT_404=' . postRequestElement('admin_login') . '%}';
 254                                 destroyAdminSession();
 255                                 break;
 256
 257                         case 'password': // Wrong password
 258                                 setPostRequestElement('login', $ret);
 259                                 $ret = '{--WRONG_PASS--} [<a href="{%url=modules.php?module=admin&amp;reset_pass=1%}">{--ADMIN_RESET_PASS--}</a>]';
 260                                 destroyAdminSession();
 261                                 break;
 262
 263                         default: // Others will be logged
 264                                 logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminLoginDataIsValid()", $ret));
 265                                 break;
 266                 } // END - switch
 267         } // END - if
 268
 269         // Error detected?
 270         if ($ret != 'done') {
 271                 $content['admin_login'] = '';
 272                 if (isPostRequestElementSet('admin_login')) {
 273                         $content['admin_login'] = postRequestElement('admin_login');
 274                 } // END - if
 275
 276                 // Init array elements
 277                 $content['login_message'] = '';
 278                 $content['pass_message']  = '';
 279
 280                 if (isFormSent('login')) {
 281                         // Set messages to zero
 282                         $loginMessage = '';
 283                         $passwdMessage = '';
 284
 285                         // Check for login
 286                         if (!isPostRequestElementSet('admin_login')) {
 287                                 // No login entered?
 288                                 $loginMessage = '{--ADMIN_NO_LOGIN--}';
 289                         } elseif ((!empty($ret)) && (postRequestElement('login') == '404')) {
 290                                 // An error comes back from login?
 291                                 $loginMessage = $ret;
 292                         }
 293
 294                         // Check for password
 295                         if (!isPostRequestElementSet('admin_password')) {
 296                                 // No password entered?
 297                                 $passwdMessage = '{--ADMIN_NO_PASS--}';
 298                         } elseif (strlen(postRequestElement('admin_password')) < getConfig('minium_admin_pass_length')) {
 299                                 // Or password too short?
 300                                 $passwdMessage = '{--ADMIN_SHORT_PASS--}';
 301                         } elseif ((!empty($ret)) && (postRequestElement('login') == 'password')) {
 302                                 // An error comes back from login?
 303                                 $passwdMessage = $ret;
 304                         }
 305
 306                         // Load message templates if the messages have been set
 307                         if (!empty($loginMessage)) {
 308                                 $content['login_message'] = loadTemplate('admin_login_msg', TRUE, $loginMessage);
 309                         } // END - if
 310                         if (!empty($passwdMessage)) {
 311                                 $content['pass_message']  = loadTemplate('admin_login_msg', TRUE, $passwdMessage);
 312                         } // END - if
 313                 } // END - if
 314
 315                 // Add all parameter
 316                 $content['all_parameter'] = addAllGetRequestParameters();
 317
 318                 // Load login form template
 319                 loadTemplate('admin_login_form', FALSE, $content);
 320         } // END - if
 321 } elseif (isGetRequestElementSet('logout')) {
 322         // Only try to remove cookies
 323         if (destroyAdminSession()) {
 324                 // Load logout template
 325                 if (isGetRequestElementSet('register')) {
 326                         // Secure input
 327                         $register = getRequestElement('register');
 328
 329                         // Special logout redirect for installation of given extension
 330                         loadTemplate(sprintf("admin_logout_%s_install", $register));
 331                 } elseif (isGetRequestElementSet('remove')) {
 332                         // Secure input
 333                         $remove = getRequestElement('remove');
 334
 335                         // Special logout redirect for removal of given extension
 336                         loadTemplate(sprintf("admin_logout_%s_remove", $remove));
 337                 } else {
 338                         // Logged out normally
 339                         loadTemplate('admin_logout');
 340                 }
 341         } else {
 342                 // Something went wrong here...
 343                 loadTemplate('admin_settings_unsaved', FALSE, '{--ADMIN_LOGOUT_FAILED--}');
 344
 345                 // Add fatal message
 346                 addFatalMessage(__FILE__, __LINE__, '{--CANNOT_UNREG_SESS--}');
 347         }
 348 } else {
 349         // Maybe an Admin want's to login?
 350         $ret = ifAdminCookiesAreValid(getCurrentAdminId(), getAdminMd5());
 351
 352         // Check status
 353         switch ($ret) {
 354                 case 'done':
 355                         // Check for access control line of current menu entry
 356                         runFilterChain('check_admin_acl');
 357
 358                         // Check for version and switch between old menu system and new intelligent menu system
 359                         if (adminGetMenuMode() == 'NEW') {
 360                                 // Load include for admin AJAX
 361                                 loadIncludeOnce('inc/ajax/ajax_admin.php');
 362
 363                                 // Load main template
 364                                 loadTemplate('admin_ajax_main');
 365                         } else {
 366                                 /*
 367                                  * This little call constructs the whole default old and lacky menu system
 368                                  * on left side. It also renders the content on right side
 369                                  */
 370                                 doAdminAction();
 371                         }
 372                         break;
 373
 374                 case '404': // Administrator login not found
 375                         setPostRequestElement('login', $ret);
 376                         displayMessage('{%message,ADMIN_ACCOUNT_404=' . getCurrentAdminId() . '%}');
 377                         destroyAdminSession();
 378                         break;
 379
 380                 case 'password': // Wrong password
 381                         setPostRequestElement('login', $ret);
 382                         displayMessage('{--WRONG_PASS--}');
 383                         destroyAdminSession();
 384                         break;
 385
 386                 case 'session': // Invalid admin session
 387                         setPostRequestElement('login', $ret);
 388                         displayMessage('{--INVALID_ADMIN_SESSION--}');
 389                         destroyAdminSession();
 390                         break;
 391
 392                 default: // Others will be logged
 393                         logDebugMessage(__FILE__, __LINE__, sprintf("Unknown return code %s from ifAdminCookiesAreValid()", $ret));
 394                         break;
 395         } // END - switch
 396 }
 397
 398 // [EOF]
 399 ?>