Now all admin functions depend on admin id, before login/aid mixed

[mailer.git] / inc / modules / admin / admin-inc.php

diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php
index c0ba4d31dac08ad8ba0be6c8d4389ccdaa797b46..395bc3e64e50062e582130f7f90849cd89c33f7b 100644 (file)
--- a/inc/modules/admin/admin-inc.php
+++ b/inc/modules/admin/admin-inc.php
@@ -66,18 +66,21 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password)
        $ret = "404";
        $data = array();
 
+       // Get admin id
+       $aid = GET_ADMIN_ID($admin_login);
+
        // Is the cache valid?
-       if (!empty($cacheArray['admins']['password'][$admin_login])) {
+       if (!empty($cacheArray['admins']['password'][$aid])) {
                // Get password from cache
-               $data['password'] = $cacheArray['admins']['password'][$admin_login];
+               $data['password'] = $cacheArray['admins']['password'][$aid];
                $ret = "pass";
                if (isset($_CONFIG['cache_hits'])) { $_CONFIG['cache_hits']++; } else { $_CONFIG['cache_hits'] = 1; }
 
                // Include more admins data?
                if (GET_EXT_VERSION("admins") >= "0.7.0") {
                        // Load them here
-                       $data['login_failtures'] = $cacheArray['admins']['login_failtures'][$admin_login];
-                       $data['last_failture']   = $cacheArray['admins']['last_failture'][$admin_login];
+                       $data['login_failtures'] = $cacheArray['admins']['login_failtures'][$aid];
+                       $data['last_failture']   = $cacheArray['admins']['last_failture'][$aid];
                } // END - if
        } elseif (!EXT_IS_ACTIVE("cache")) {
                $ADD = "";
@@ -87,8 +90,8 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password)
                } // END - if
 
                // Get password from DB
-               $result = SQL_QUERY_ESC("SELECT password".$ADD." FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1",
-                array($admin_login), __FILE__, __LINE__);
+               $result = SQL_QUERY_ESC("SELECT password".$ADD." FROM "._MYSQL_PREFIX."_admins WHERE id=%s LIMIT 1",
+                array($aid), __FILE__, __LINE__);
                if (SQL_NUMROWS($result) == 1) {
                        // Login password found
                        $ret = "pass";
@@ -134,12 +137,12 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password)
                        set_session('mxchange_admin_last_fail', $data['last_failture']);
 
                        // Update password and reset login failtures
-                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s',login_failtures=0,last_failture='0000-00-00 00:00:00' WHERE login='%s' LIMIT 1",
-                               array($data['password'], $admin_login), __FILE__, __LINE__);
+                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s',login_failtures=0,last_failture='0000-00-00 00:00:00' WHERE id=%s LIMIT 1",
+                               array($data['password'], $aid), __FILE__, __LINE__);
                } else {
                        // Update password
-                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s' WHERE login='%s' LIMIT 1",
-                               array($data['password'], $admin_login), __FILE__, __LINE__);
+                       $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s' WHERE id=%s LIMIT 1",
+                               array($data['password'], $aid), __FILE__, __LINE__);
                }
 
                // Rebuild cache
@@ -167,8 +170,8 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password)
        // Count login failture if admins extension version is 0.7.0+
        if (($ret == "pass") && (GET_EXT_VERSION("admins") >= "0.7.0")) {
                // Update counter
-               SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET login_failtures=login_failtures+1,last_failture=NOW() WHERE login='%s' LIMIT 1",
-                       array($admin_login), __FILE__, __LINE__);
+               SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET login_failtures=login_failtures+1,last_failture=NOW() WHERE id=%s LIMIT 1",
+                       array($aid), __FILE__, __LINE__);
 
                // Rebuild cache
                REBUILD_CACHE("admins", "admin");
@@ -213,7 +216,7 @@ function CHECK_ADMIN_COOKIES ($admin_login, $password) {
        $ret = "404"; $pass = "";
 
        // Get hash
-       $pass = GET_ADMIN_HASH($admin_login);
+       $pass = GET_ADMIN_HASH(GET_ADMIN_ID($admin_login));
        if ($pass != "-1") $ret = "pass";
 
        //* DEBUG: */ print __FUNCTION__."(<font color=\"#0000aa\">".__LINE__."</font>):".generatePassString($pass)."(".strlen($pass).")/".$password."(".strlen($password).")<br />\n";
@@ -767,15 +770,18 @@ function ADMIN_CHECK_MENU_MODE() {
        // Set the global mode as the mode for all admins
        $MODE = $_CONFIG['admin_menu']; $ADMIN = $MODE;
 
+       // Get admin id
+       $aid = GET_ADMIN_ID(get_session('admin_login'));
+
        // Check individual settings of current admin
-       if (isset($cacheArray['admins']['la_mode'][get_session('admin_login')])) {
+       if (isset($cacheArray['admins']['la_mode'][$aid])) {
                // Load from cache
-               $ADMIN = $cacheArray['admins']['la_mode'][get_session('admin_login')];
+               $ADMIN = $cacheArray['admins']['la_mode'][$aid];
                if (isset($_CONFIG['cache_hits'])) { $_CONFIG['cache_hits']++; } else { $_CONFIG['cache_hits'] = 1; }
        } elseif (GET_EXT_VERSION("admins") >= "0.6.7") {
                // Load from database when version of "admins" is enough
-               $result = SQL_QUERY_ESC("SELECT la_mode FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1",
-                array(get_session('admin_login')), __FILE__, __LINE__);
+               $result = SQL_QUERY_ESC("SELECT la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%s LIMIT 1",
+                array($aid), __FILE__, __LINE__);
                if (SQL_NUMROWS($result) == 1) {
                        // Load data
                        list($ADMIN) = SQL_FETCHROW($result);