Security line in all includes changed

[mailer.git] / inc / libs / admins_functions.php

diff --git a/inc/libs/admins_functions.php b/inc/libs/admins_functions.php
index d4ced65b01a0e87bb6b2b575251a1fec9b6dc33f..b77ee5259a592a2fb2d8046279659f7bae0f5ab6 100644 (file)
--- a/inc/libs/admins_functions.php
+++ b/inc/libs/admins_functions.php
@@ -32,8 +32,7 @@
  ************************************************************************/
 
 // Some security stuff...
-if (ereg(basename(__FILE__), $_SERVER['PHP_SELF']))
-{
+if (!defined('__SECURITY')) {
        $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php";
        require($INC);
 }
@@ -49,22 +48,22 @@ function ADMINS_CHECK_ACL($act, $wht) {
        $ret = false;
 
        // Get admin's defult access right
-       if (!empty($cacheArray['admins']['def_acl'][$_SESSION['admin_login']])) {
+       if (!empty($cacheArray['admins']['def_acl'][get_session('admin_login')])) {
                // Load from cache
-               $default = $cacheArray['admins']['def_acl'][$_SESSION['admin_login']];
+               $default = $cacheArray['admins']['def_acl'][get_session('admin_login')];
 
                // Count cache hits
                $_CONFIG['cache_hits']++;
        } elseif (!is_object($cacheInstance)) {
                // Load from database
                $result = SQL_QUERY_ESC("SELECT default_acl FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1",
-                array($_SESSION['admin_login']), __FILE__, __LINE__);
+                array(get_session('admin_login')), __FILE__, __LINE__);
                list($default) = SQL_FETCHROW($result);
                SQL_FREERESULT($result);
        }
 
        // Get admin's ID
-       $aid = GET_ADMIN_ID($_SESSION['admin_login']);
+       $aid = GET_ADMIN_ID(get_session('admin_login'));
 
        if (!empty($wht)) {
                // Check for parent menu:
@@ -84,7 +83,7 @@ function ADMINS_CHECK_ACL($act, $wht) {
                // Load only from array when there are lines!
                if ((isset($cacheArray['admin_acls'])) && (is_array($cacheArray['admin_acls'])) && (count($cacheArray['admin_acls']) > 0)) {
                        // Load ACL from array
-                       foreach ($cacheArray['admin_acls']['admin_id'] as $id=>$aid_acls) {
+                       foreach ($cacheArray['admin_acls']['admin_id'] as $id => $aid_acls) {
                                if ($aid == $aid_acls) {
                                        // Okay, one line was found!
                                        if ((!empty($act)) && ($cacheArray['admin_acls']['action_menu'][$id] == $act)) {
@@ -119,11 +118,11 @@ function ADMINS_CHECK_ACL($act, $wht) {
                if (!empty($act))
                {
                        // Main menu
-                       $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%d AND action_menu='%s' LIMIT 1",
+                       $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%s AND action_menu='%s' LIMIT 1",
                         array(bigintval($aid), $act), __FILE__, __LINE__);
                } elseif (!empty($wht)) {
                        // Sub menu
-                       $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%d AND what_menu='%s' LIMIT 1",
+                       $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%s AND what_menu='%s' LIMIT 1",
                         array(bigintval($aid), $wht), __FILE__, __LINE__);
                }
 
@@ -178,15 +177,15 @@ function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) {
        global $cacheInstance;
 
        // Begin the update
-       $cacheInstance_UPDATE = "0";
-       foreach ($POST['login'] as $id=>$login) {
+       $cache_update = 0;
+       foreach ($POST['login'] as $id => $login) {
                // Secure ID number
                $id = bigintval($id);
 
                // When both passwords match update admin account
                if ($POST['pass1'][$id] == $POST['pass2'][$id]) {
                        // Save only when both passwords are the same (also when they are empty)
-                       $ADD = ""; $cacheInstance_UPDATE = "1";
+                       $ADD = ""; $cache_update = "1";
 
                        // Generate hash
                        $hash = generateHash($POST['pass1'][$id]);
@@ -195,21 +194,21 @@ function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) {
                        if (!empty($POST['pass1'][$id])) $ADD = sprintf(", password='%s'", SQL_ESCAPE($hash));
 
                        // Get admin's ID
-                       $salt = substr(GET_ADMIN_HASH($_SESSION['admin_login']), 0, -40);
-                       $aid = GET_ADMIN_ID($_SESSION['admin_login']);
+                       $salt = substr(GET_ADMIN_HASH(get_session('admin_login')), 0, -40);
+                       $aid = GET_ADMIN_ID(get_session('admin_login'));
 
                        // Rewrite cookie when it's own account
                        if ($aid == $id) {
                                // Set timeout cookie
                                set_session("admin_last", time());
 
-                               if ($login != $_SESSION['admin_login']) {
+                               if ($login != get_session('admin_login')) {
                                        // Update login cookie
                                        set_session("admin_login", $login);
 
                                        // Update password cookie as well?
                                        if (!empty($ADD)) set_session("admin_md5", $hash);
-                               } elseif (generateHash($POST['pass1'][$id], $salt) != $_SESSION['admin_md5']) {
+                               } elseif (generateHash($POST['pass1'][$id], $salt) != get_session('admin_md5')) {
                                        // Update password cookie
                                        set_session("admin_md5", $hash);
                                }
@@ -218,7 +217,7 @@ function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) {
 
                        // Get default ACL from admin to check if we can allow him to change the default ACL
                        $result = SQL_QUERY_ESC("SELECT default_acl FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1",
-                        array($_SESSION['admin_login']), __FILE__, __LINE__);
+                        array(get_session('admin_login')), __FILE__, __LINE__);
                        list($default) = SQL_FETCHROW($result);
 
                        // Free result
@@ -232,7 +231,7 @@ login='%s'".$ADD.",
 email='%s',
 default_acl='%s',
 la_mode='%s'
-WHERE id=%d LIMIT 1",
+WHERE id=%s LIMIT 1",
  array(
        $login,
        $POST['email'][$id],
@@ -246,7 +245,7 @@ WHERE id=%d LIMIT 1",
 login='%s'".$ADD.",
 email='%s',
 la_mode='%s'
-WHERE id=%d LIMIT 1",
+WHERE id=%s LIMIT 1",
  array(
        $login,
        $POST['email'][$id],
@@ -255,6 +254,9 @@ WHERE id=%d LIMIT 1",
 ), __FILE__, __LINE__);
                        }
 
+                       // Purge cache
+                       CACHE_PURGE_ADMIN_MENU($id);
+
                        // Admin account saved
                        $MSG = ADMIN_ACCOUNT_SAVED;
                } else {
@@ -269,7 +271,7 @@ WHERE id=%d LIMIT 1",
        }
 
        // Remove cache file
-       if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance_UPDATE == "1")) {
+       if ((EXT_IS_ACTIVE("cache")) && ($cache_update == "1")) {
                if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy();
        }
 }
@@ -278,12 +280,12 @@ WHERE id=%d LIMIT 1",
 function ADMINS_EDIT_ADMIN_ACCOUNTS ($POST) {
        // Begin the edit loop
        $SW = 2; $OUT = "";
-       foreach ($POST['sel'] as $id=>$sel) {
+       foreach ($POST['sel'] as $id => $sel) {
                // Secure ID number
                $id = bigintval($id);
 
                // Get the admin's data
-               $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1",
+               $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%s LIMIT 1",
                 array($id), __FILE__, __LINE__);
                if ((SQL_NUMROWS($result) == 1) && ($sel == 1)) {
                        // Entry found
@@ -291,8 +293,8 @@ function ADMINS_EDIT_ADMIN_ACCOUNTS ($POST) {
                        SQL_FREERESULT($result);
 
                        // Prepare some more data for the template
-                       $content['sw']          = $SW;
-                       $content['id']          = $id;
+                       $content['sw'] = $SW;
+                       $content['id'] = $id;
 
                        // Shall we allow changing default ACL?
                        if ($content['mode'] == "allow") {
@@ -324,12 +326,12 @@ function ADMINS_DELETE_ADMIN_ACCOUNTS ($POST) {
        if ($accounts > 1) {
                // Delete accounts
                $SW = 2; $OUT = "";
-               foreach ($POST['sel'] as $id=>$sel) {
+               foreach ($POST['sel'] as $id => $sel) {
                        // Secure ID number
                        $id = bigintval($id);
 
                        // Get the admin's data
-                       $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1",
+                       $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%s LIMIT 1",
                         array($id), __FILE__, __LINE__);
                        if (SQL_NUMROWS($result) == 1) {
                                // Entry found
@@ -362,27 +364,29 @@ function ADMINS_DELETE_ADMIN_ACCOUNTS ($POST) {
 // Remove the given accounts
 function ADMINS_REMOVE_ADMIN_ACCOUNTS ($POST) {
        // Begin removal
-       $cacheInstance_UPDATE = "0";
-       foreach ($POST['sel'] as $id=>$del) {
+       $cache_update = 0;
+       foreach ($POST['sel'] as $id => $del) {
                // Secure ID number
                $id = bigintval($id);
 
                // Delete only when it's not your own account!
-               if (($del == 1) && (GET_ADMIN_ID($_SESSION['admin_login']) != $id)) {
+               if (($del == 1) && (GET_ADMIN_ID(get_session('admin_login')) != $id)) {
                        // Rewrite his tasks to all admins
-                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin='0' WHERE assigned_admin='%s'",
+                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin=0 WHERE assigned_admin=%s",
                         array($id), __FILE__, __LINE__);
 
                        // Remove account
-                       $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1",
+                       $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_admins WHERE id=%s LIMIT 1",
                         array($id), __FILE__, __LINE__);
 
-                       $cacheInstance_UPDATE = "1";
+                       // Purge cache
+                       CACHE_PURGE_ADMIN_MENU($id);
+                       $cache_update = "1";
                }
        }
 
        // Remove cache if cache system is activated
-       if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance_UPDATE == "1")) {
+       if ((EXT_IS_ACTIVE("cache")) && ($cache_update == "1")) {
                if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy();
        }
 }