X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fadmin.php;h=36a322a0c9e6a579d0797fb8b37197563f4ff308;hp=ad94f73f267ba03ca83d9788381c53f0ecf0c27e;hb=254afbdb1fa4699a98667bad4e792ad803a0d535;hpb=9f56d65b934a055f2157a3eb0dd98f91fd47498c diff --git a/inc/modules/admin.php b/inc/modules/admin.php index ad94f73f26..36a322a0c9 100644 --- a/inc/modules/admin.php +++ b/inc/modules/admin.php @@ -32,7 +32,7 @@ ************************************************************************/ // Some security stuff... -if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) { +if (!defined('__SECURITY')) { $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php"; require($INC); } @@ -49,7 +49,7 @@ require_once(PATH."inc/modules/admin/admin-inc.php"); // Fix "deleted" cookies in PHP4 (PHP5 does remove them, PHP4 sets them to deleted!) FIX_DELETED_COOKIES(array('admin_login', 'admin_md5', 'admin_last', 'admin_to')); -if (!isBooleanConstantAndTrue('admin_registered')) { +if (!defined('admin_registered')) { // Admin is not registered so we have to inform the user if ((isset($_POST['ok'])) && ((empty($_POST['login'])) || (empty($_POST['pass'])) || (strlen($_POST['pass']) < 4))) $_POST['ok'] = "***"; if ((isset($_POST['ok'])) && ($_POST['ok'] != "***")) { @@ -90,7 +90,7 @@ if (!isBooleanConstantAndTrue('admin_registered')) { $ret = "done"; } - if (!isBooleanConstantAndTrue('admin_registered')) { + if (!defined('admin_registered')) { // Write to config that registration is done admin_WriteData(PATH."inc/config.php", "ADMIN-SETUP", "define('admin_registered', ", ");", "true", 0); @@ -140,6 +140,51 @@ if (!isBooleanConstantAndTrue('admin_registered')) { // Load register template LOAD_TEMPLATE("admin_reg_form"); } +} elseif (isset($_GET['reset_pass'])) { + // Is the form submitted? + if ((isset($_POST['send_link'])) && (!empty($_POST['email']))) { + // Try to send the link out + $OUT = ADMIN_SEND_PASSWORD_RESET_LINK($_POST['email']); + + // Output result + LOAD_TEMPLATE("admin_settings_saved", false, $OUT); + } elseif (!empty($_GET['hash'])) { + // Output form for hash validation + LOAD_TEMPLATE("admin_validate_reset_hash_form", false, $_GET['hash']); + } elseif ((isset($_POST['validate_hash'])) && (!empty($_POST['login'])) && (!empty($_POST['hash']))) { + // Validate the login data and hash + $valid = ADMIN_VALIDATE_RESET_LINK_HASH_LOGIN($_POST['hash'], $_POST['login']); + + // Valid? + if ($valid) { + // Prepare content first + $content = array( + 'hash' => SQL_ESCAPE($_POST['hash']), + 'login' => SQL_ESCAPE($_POST['login']) + ); + + // Validation okay so display form for final password change + LOAD_TEMPLATE("admin_reset_password_form", false, $content); + } else { + // Cannot validate the login data and hash + LOAD_TEMPLATE("admin_settings_saved", false, ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED); + } + } elseif ((isset($_POST['reset_pass'])) && (!empty($_POST['hash'])) && (!empty($_POST['login'])) && (!empty($_POST['pass1'])) && ($_POST['pass1'] == $_POST['pass2'])) { + // Okay, we shall the admin password here. So first revalidate the hash + if (ADMIN_VALIDATE_RESET_LINK_HASH_LOGIN($_POST['hash'], $_POST['login'])) { + // Set the password now + $OUT = ADMIN_RESET_PASSWORD($_POST['login'], $_POST['pass1']); + + // Output result + LOAD_TEMPLATE("admin_reset_pass_done", false, $OUT); + } else { + // Validation failed + LOAD_TEMPLATE("admin_settings_saved", false, ADMIN_VALIDATION_RESET_LOGIN_HASH_FAILED2); + } + } else { + // Output reset password form + LOAD_TEMPLATE("admin_send_reset_link"); + } } elseif ((!isSessionVariableSet('admin_login')) || (!isSessionVariableSet('admin_md5')) || (!isSessionVariableSet('admin_last')) || (!isSessionVariableSet('admin_to')) || ((get_session('admin_last') + bigintval(get_session('admin_to')) * 3600 * 24) < time())) { // At leat one administrator account was created if ((isSessionVariableSet('admin_login')) && (isSessionVariableSet('admin_md5')) && (isSessionVariableSet('admin_last')) && (isSessionVariableSet('admin_to'))) { @@ -150,7 +195,7 @@ if (!isBooleanConstantAndTrue('admin_registered')) { if (!empty($_GET['register'])) { // Registration of first admin is done if ($_GET['register'] == "done") OUTPUT_HTML("".ADMIN_REGISTER_DONE.""); - } + } // END - if // Check if the admin has submitted data or not $ret = ""; @@ -161,27 +206,21 @@ if (!isBooleanConstantAndTrue('admin_registered')) { switch ($ret) { case "done": // Admin and password are okay, so we log in now - // Try to register the session variables - if ((set_session("admin_md5", generatePassString(generateHash($_POST['pass'], __SALT)))) && (set_session("admin_login", $_POST['login'])) && (set_session("admin_last", time())) && (set_session("admin_to", $_POST['timeout']))) { - // Construct URL and redirect - $URL = URL."/modules.php?module=admin&"; - - // Rewrite overview module - if ($GLOBALS['what'] == "overview") { - $GLOBALS['action'] = GET_ACTION($GLOBALS['module'], $GLOBALS['what']); - } - - // Add data to URL - if (!empty($GLOBALS['what'])) $URL .= "what=".$GLOBALS['what']; - elseif (!empty($GLOBALS['action'])) $URL .= "action=".$GLOBALS['action']; - elseif (!empty($_GET['area'])) $URL .= "area=".$_GET['area']; + // Construct URL and redirect + $URL = URL."/modules.php?module=admin&"; - // Load URL - LOAD_URL($URL); - } else { - OUTPUT_HTML("".ADMIN_LOGIN_FAILED.""); - ADD_FATAL(CANNOT_REGISTER_SESS); + // Rewrite overview module + if ($GLOBALS['what'] == "overview") { + $GLOBALS['action'] = GET_ACTION($GLOBALS['module'], $GLOBALS['what']); } + + // Add data to URL + if (!empty($GLOBALS['what'])) $URL .= "what=".$GLOBALS['what']; + elseif (!empty($GLOBALS['action'])) $URL .= "action=".$GLOBALS['action']; + elseif (!empty($_GET['area'])) $URL .= "area=".$_GET['area']; + + // Load URL + LOAD_URL($URL); break; case "404": // Administrator login not found @@ -191,7 +230,7 @@ if (!isBooleanConstantAndTrue('admin_registered')) { case "pass": // Wrong password $_POST['ok'] = $ret; - $ret = WRONG_PASS; + $ret = WRONG_PASS." [".ADMIN_RESET_PASS."]\n"; break; } } @@ -260,18 +299,27 @@ if (!isBooleanConstantAndTrue('admin_registered')) { // Only try to remove cookies if (set_session("admin_login", "") && set_session("admin_md5", "") && set_session("admin_last", "") && set_session("admin_to", "")) { // Also remove array elements - set_session('admin_login' , ""); - set_session('admin_md5' , ""); - set_session('admin_last' , ""); - set_session('admin_to' , ""); + set_session('admin_login', ""); + set_session('admin_md5' , ""); + set_session('admin_last' , ""); + set_session('admin_to' , ""); // Destroy session @session_destroy(); // Load logout template - if (isset($_GET['sql_patches'])) { - // Special logout redirect for sql_patchrs - LOAD_TEMPLATE("admin_logout_sql_patches"); + if (isset($_GET['register'])) { + // Secure input + $register = SQL_ESCAPE($_GET['register']); + + // Special logout redirect for installation of given extension + LOAD_TEMPLATE(sprintf("admin_logout_%s_install", $register)); + } elseif (isset($_GET['remove'])) { + // Secure input + $remove = SQL_ESCAPE($_GET['remove']); + + // Special logout redirect for removal of given extension + LOAD_TEMPLATE(sprintf("admin_logout_%s_remove", $remove)); } else { // Logged out normally LOAD_TEMPLATE("admin_logout"); @@ -285,12 +333,12 @@ if (!isBooleanConstantAndTrue('admin_registered')) { } } else { // Maybe an Admin want's to login? - $ret = CHECK_ADMIN_COOKIES(SQL_ESCAPE(get_session('admin_login')), SQL_ESCAPE(get_session('admin_md5'))); + $ret = CHECK_ADMIN_COOKIES(get_session('admin_login'), get_session('admin_md5')); switch ($ret) { case "done": // Cookie-Data accepted - if ((set_session("admin_md5", SQL_ESCAPE(get_session('admin_md5')))) && (set_session("admin_login", SQL_ESCAPE(get_session('admin_login')))) && (set_session("admin_last", time())) && (set_session("admin_to", bigintval(get_session('admin_to'))))) { + if ((set_session("admin_md5", get_session('admin_md5'))) && (set_session("admin_login", get_session('admin_login'))) && (set_session("admin_last", time())) && (set_session("admin_to", bigintval(get_session('admin_to'))))) { // Ok, Cookie-Update done if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) { // Check if action GET variable was set @@ -311,7 +359,7 @@ if (!isBooleanConstantAndTrue('admin_registered')) { if (empty($_CONFIG['admin_menu'])) $_CONFIG['admin_menu'] = "OLD"; // Check for version and switch between old menu system and new "intelligent menu system" - if ((ADMIN_CHECK_MENU_MODE() == "NEW") && (file_exists(PATH."inc/modules/admin/la_sys-inc.php"))) { + if ((ADMIN_CHECK_MENU_MODE() == "NEW") && (FILE_READABLE(PATH."inc/modules/admin/la_sys-inc.php"))) { // Default area is the entrance, of course $area = "entrance"; @@ -347,11 +395,10 @@ if (!isBooleanConstantAndTrue('admin_registered')) { } } -if (isBooleanConstantAndTrue('admin_registered')) -{ +if (isBooleanConstantAndTrue('admin_registered')) { // Check config.php and inc directory for right access rights - if (is_INCWritable("config")) ADD_FATAL(FATAL_CONFIG_WRITABLE); - if (is_INCWritable("dummy")) ADD_FATAL(FATAL_INC_WRITABLE); + // DEPRECATED: if (is_INCWritable("config")) ADD_FATAL(FATAL_CONFIG_WRITABLE); + // DEPRECATED: if (is_INCWritable("dummy")) ADD_FATAL(FATAL_INC_WRITABLE); } // ?>