$aid); // Is the cache valid? if (isset($GLOBALS['cache_array']['admins']['password'][$aid])) { // Get password from cache $data['password'] = $GLOBALS['cache_array']['admins']['password'][$aid]; $ret = 'pass'; incrementConfigEntry('cache_hits'); // Include more admins data? if (GET_EXT_VERSION('admins') >= '0.7.2') { // Load them here $data['login_failures'] = $GLOBALS['cache_array']['admins']['login_failures'][$aid]; $data['last_failure'] = $GLOBALS['cache_array']['admins']['last_failure'][$aid]; } // END - if } elseif (!EXT_IS_ACTIVE('cache')) { // Add extra data via filter now $add = runFilterChain('sql_admin_extra_data'); // Get password from DB $result = SQL_QUERY_ESC("SELECT `password`" . $add . " FROM `{!_MYSQL_PREFIX!}_admins` WHERE `id`=%s LIMIT 1", array($aid), __FUNCTION__, __LINE__); // Entry found? if (SQL_NUMROWS($result) == 1) { // Login password found $ret = 'pass'; // Fetch data $data = SQL_FETCHARRAY($result); } // END - if // Free result SQL_FREERESULT($result); } //* DEBUG: */ echo "*".$data['password'].'/'.md5($password).'/'.$ret."
"; if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) { // Generate new hash $data['password'] = generateHash($password); // Is the sql_patches not installed, than we cannot have a valid hashed password here! if (($ret == 'pass') && ((EXT_VERSION_IS_OLDER('sql_patches', '0.3.6')) || (GET_EXT_VERSION('sql_patches') == ''))) $ret = 'done'; } elseif ((EXT_VERSION_IS_OLDER('sql_patches', '0.3.6')) || (GET_EXT_VERSION('sql_patches') == '')) { // Old hashing way return $ret; } elseif (!isset($data['password'])) { // Password not found, so no valid login! return $ret; } // Generate salt of password define('__SALT', substr($data['password'], 0, -40)); $salt = __SALT; // Check if password is same //* DEBUG: */ echo "*".$ret.','.$data['password'].','.$password.','.$salt."*
\n"; if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == $password)) { // Re-hash the plain passord with new random salt $data['password'] = generateHash($password); // Do we have 0.7.0 of admins or later? // Remmeber login failures if available if (GET_EXT_VERSION('admins') >= '0.7.2') { // Store it in session setSession('mxchange_admin_failures', $data['login_failures']); setSession('mxchange_admin_last_fail', $data['last_failure']); // Update password and reset login failures SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET password='%s',login_failures=0,last_failure='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", array($data['password'], $aid), __FUNCTION__, __LINE__); } else { // Update password SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET password='%s' WHERE `id`=%s LIMIT 1", array($data['password'], $aid), __FUNCTION__, __LINE__); } // Rebuild cache rebuildCacheFiles('admins', 'admin'); // Login has failed by default... ;-) $ret = 'failed'; // Password matches so login here if (LOGIN_ADMIN($admin_login, $data['password'])) { // All done now $ret = 'done'; } // END - if } elseif ((empty($salt)) && ($ret == 'pass')) { // Something bad went wrong $ret = 'failed'; } elseif ($ret == 'done') { // Try to login here if we have the old hashing way (sql_patches not installed?) if (!LOGIN_ADMIN($admin_login, $data['password'])) { // Something went wrong $ret = 'failed'; } // END - if } // Count login failure if admins extension version is 0.7.0+ if (($ret == 'pass') && (GET_EXT_VERSION('admins') >= '0.7.0')) { // Update counter SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET login_failures=login_failures+1,last_failure=NOW() WHERE `id`=%s LIMIT 1", array($aid), __FUNCTION__, __LINE__); // Rebuild cache rebuildCacheFiles('admins', 'admin'); } // END - if // Return the result //* DEBUG: */ die("RETURN=".$ret); return $ret; } // Try to login the admin by setting some session/cookie variables function LOGIN_ADMIN ($adminLogin, $passHash) { // Reset failure counter on matching admins version if ((GET_EXT_VERSION('admins') >= '0.7.0') && ((EXT_VERSION_IS_OLDER('sql_patches', '0.3.6')) || (GET_EXT_VERSION('sql_patches') == ''))) { // Reset counter on out-dated sql_patches version SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET login_failures=0,last_failure='0000-00-00 00:00:00' WHERE login='%s' LIMIT 1", array($adminLogin), __FUNCTION__, __LINE__); // Rebuild cache rebuildCacheFiles('admins', 'admin'); } // END - if // Now set all session variables and return the result return (( setSession('admin_md5', generatePassString($passHash)) ) && ( setSession('admin_login', $adminLogin) ) && ( setSession('admin_last', time()) ) && ( setSession('admin_to', bigintval(REQUEST_POST('timeout'))) )); } // Only be executed on cookie checking function CHECK_ADMIN_COOKIES ($admin_login, $password) { // By default no admin cookies are found $ret = '404'; $pass = ''; // Get hash $pass = GET_ADMIN_HASH(GET_ADMIN_ID($admin_login)); if ($pass != '-1') $ret = 'pass'; //* DEBUG: */ print __FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).")
\n"; // Check if password matches if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) { // Passwords matches! $ret = 'done'; } // END - if // Return result return $ret; } // function ADMIN_DO_ACTION ($wht) { global $DATA; //* DEBUG: */ echo __LINE__."*".$wht.'/'.getModule().'/'.getAction().'/'.getWhat()."*
\n"; // Remove any spaces from variable if (empty($wht)) { // Default admin action is the overview page $wht = 'overview'; } else { // Compile out some chars $wht = COMPILE_CODE($wht, false, false, false); } // Get action value $act = getModeAction(getModule(), $wht); // Define admin login name and ID number define('__ADMIN_LOGIN', getSession('admin_login')); define('__ADMIN_ID' , getCurrentAdminId()); // Preload templates if (EXT_IS_ACTIVE('admins')) { define('__ADMIN_WELCOME', LOAD_TEMPLATE('admin_welcome_admins', true)); } else { define('__ADMIN_WELCOME', LOAD_TEMPLATE('admin_welcome', true)); } define('__ADMIN_FOOTER' , LOAD_TEMPLATE('admin_footer' , true)); define('__ADMIN_MENU' , ADD_ADMIN_MENU($act, $wht, true)); // Tableset header LOAD_TEMPLATE('admin_main_header'); // Check if action/what pair is valid $result_action = SQL_QUERY_ESC("SELECT `id` FROM `{!_MYSQL_PREFIX!}_admin_menu` WHERE `action`='%s' AND ((`what`='%s' AND what != 'overview') OR ((`what`='' OR `what` IS NULL) AND '%s'='overview')) LIMIT 1", array($act, $wht, $wht), __FUNCTION__, __LINE__); if (SQL_NUMROWS($result_action) == 1) { // Is valid but does the inlcude file exists? $INC = sprintf("inc/modules/admin/action-%s.php", $act); if ((isIncludeReadable($INC)) && (isMenuActionValid('admin', $act, $wht)) && ($GLOBALS['acl_allow'] === true)) { // Ok, we finally load the admin action module loadInclude($INC); } elseif ($GLOBALS['acl_allow'] === false) { // Access denied LOAD_TEMPLATE('admin_menu_failed', false, getMessage('ADMIN_ACCESS_DENIED')); addFatalMessage(__FUNCTION__, __LINE__, getMessage('ADMIN_ACCESS_DENIED')); } else { // Include file not found! :-( LOAD_TEMPLATE('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_404'), $act)); addFatalMessage(__FUNCTION__, __LINE__, getMessage('ADMIN_ACTION_404'), $act); } } else { // Invalid action/what pair found! LOAD_TEMPLATE('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_INVALID'), $act.'/'.$wht)); addFatalMessage(__FUNCTION__, __LINE__, getMessage('ADMIN_ACTION_INVALID'), $act.'/'.$wht); } // Free memory SQL_FREERESULT($result_action); // Tableset footer LOAD_TEMPLATE('admin_main_footer'); } // function ADD_ADMIN_MENU ($act, $wht, $return=false) { // Init variables $SUB = false; $OUT = ''; // Menu descriptions $GLOBALS['menu']['description'] = array(); $GLOBALS['menu']['title'] = array(); // Is there a cache instance? if ((isCacheInstanceValid()) && (getConfig('cache_admin_menu') == 'Y')) { // Create cache name $cacheName = 'admin_' . $act . '_' . $wht . '_' . getLanguage() . '_' . strtolower(getSession('admin_login')); // Is that cache there? if ($GLOBALS['cache_instance']->loadCacheFile($cacheName)) { // Then load it $data = $GLOBALS['cache_instance']->getArrayFromCache(); // Extract all parts $OUT = base64_decode($data['output'][0]); $GLOBALS['menu']['title'] = unserialize(base64_decode($data['title'][0])); $GLOBALS['menu']['description'] = unserialize(base64_decode($data['descr'][0])); // Return or output content? if ($return === true) { return $OUT; } else { OUTPUT_HTML($OUT); } } // END - if } // END - if // Build main menu $result_main = SQL_QUERY("SELECT action, title, descr FROM `{!_MYSQL_PREFIX!}_admin_menu` WHERE (`what`='' OR `what` IS NULL) ORDER BY `sort`, id DESC", __FUNCTION__, __LINE__); if (SQL_NUMROWS($result_main) > 0) { $OUT = "
 
\n"; $OUT .= "\n"; } // Is there a cache instance again? if ((isCacheInstanceValid()) && (getConfig('cache_admin_menu') == 'Y')) { // Init cache $GLOBALS['cache_instance']->init($cacheName); // Prepare cache data $data = array( 'output' => base64_encode($OUT), 'title' => $GLOBALS['menu']['title'], 'descr' => $GLOBALS['menu']['description'] ); // Write the data away $GLOBALS['cache_instance']->addRow($data); // Close cache $GLOBALS['cache_instance']->finalize(); } // END - if // Return or output content? if ($return === true) { return $OUT; } else { OUTPUT_HTML($OUT); } } // Create member selection box function ADD_MEMBER_SELECTION_BOX ($def='0', $add_all=false, $return=false, $none=false, $field='userid') { // Output selection form with all confirmed user accounts listed $result = SQL_QUERY("SELECT userid, surname, family FROM `{!_MYSQL_PREFIX!}_user_data` ORDER BY `userid` ASC", __FUNCTION__, __LINE__); // Default output $OUT = ''; // USe this only for adding points (e.g. adding refs really makes no sence ;-) ) if ($add_all === true) $OUT = " \n"; elseif ($none === true) $OUT = " \n"; while ($content = SQL_FETCHARRAY($result)) { $OUT .= "