X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=66e71dc1597fabab8b6131b71bebfce077362659;hp=a9d93afa433b7fa6d07da999d942f9d0abe444e4;hb=57227d33e870ec5cd271209c4a978a52b45c2dd6;hpb=706f3b7d03e9bd0f241aa7ee7d2eaa0b2e2869c2 diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index a9d93afa43..66e71dc159 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -1,7 +1,7 @@ $aid); + $data = array('admin_id' => $adminId); // Is the cache valid? - if (isset($GLOBALS['cache_array']['admins']['password'][$aid])) { + if (isAdminHashSet($admin)) { // Get password from cache - $data['password'] = $GLOBALS['cache_array']['admins']['password'][$aid]; + $data['password'] = getAdminHash($admin); $ret = 'pass'; - incrementConfigEntry('cache_hits'); + incrementStatsEntry('cache_hits'); // Include more admins data? - if (GET_EXT_VERSION('admins') >= '0.7.2') { + if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($GLOBALS['cache_array']['admin']['login_failures'][$adminId]))) { // Load them here - $data['login_failures'] = $GLOBALS['cache_array']['admins']['login_failures'][$aid]; - $data['last_failure'] = $GLOBALS['cache_array']['admins']['last_failure'][$aid]; + $data['login_failures'] = $GLOBALS['cache_array']['admin']['login_failures'][$adminId]; + $data['last_failure'] = $GLOBALS['cache_array']['admin']['last_failure'][$adminId]; } // END - if - } elseif (!EXT_IS_ACTIVE('cache')) { + } elseif (!isExtensionActive('cache')) { // Add extra data via filter now $add = runFilterChain('sql_admin_extra_data'); // Get password from DB - $result = SQL_QUERY_ESC("SELECT `password`" . $add . " FROM `{!_MYSQL_PREFIX!}_admins` WHERE `id`=%s LIMIT 1", - array($aid), __FUNCTION__, __LINE__); + $result = SQL_QUERY_ESC("SELECT `password`" . $add . " FROM `{?_MYSQL_PREFIX?}_admins` WHERE `id`=%s LIMIT 1", + array($adminId), __FUNCTION__, __LINE__); // Entry found? if (SQL_NUMROWS($result) == 1) { @@ -111,14 +116,15 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password) { SQL_FREERESULT($result); } - //* DEBUG: */ OUTPUT_HTML("*".$data['password'].'/'.md5($password).'/'.$ret."
"); + //* DEBUG: */ outputHtml('*' . $data['password'] . '/' . md5($password) .'/' . $ret . '*
'); if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) { // Generate new hash $data['password'] = generateHash($password); // Is the sql_patches not installed, than we cannot have a valid hashed password here! - if (($ret == 'pass') && ((EXT_VERSION_IS_OLDER('sql_patches', '0.3.6')) || (GET_EXT_VERSION('sql_patches') == ''))) $ret = 'done'; - } elseif ((EXT_VERSION_IS_OLDER('sql_patches', '0.3.6')) || (GET_EXT_VERSION('sql_patches') == '')) { + //* DEBUG: */ outputHtml($ret . ',' . intval(isExtensionInstalledAndOlder('sql_patches', '0.3.6')) . '/' . intval(!isExtensionInstalled('sql_patches')).'
'); + if (($ret == 'pass') && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) $ret = 'done'; + } elseif ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches'))) { // Old hashing way return $ret; } elseif (!isset($data['password'])) { @@ -127,78 +133,77 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password) { } // Generate salt of password - define('__SALT', substr($data['password'], 0, -40)); - $salt = __SALT; + $salt = substr($data['password'], 0, -40); // Check if password is same - //* DEBUG: */ OUTPUT_HTML("*".$ret.','.$data['password'].','.$password.','.$salt."*
"); - if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == $password)) { + //* DEBUG: */ outputHtml('*' . $ret . ',' . $data['password'] . ',' . $password . ',' . $salt . '*
'); + if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == md5($password))) { // Re-hash the plain passord with new random salt $data['password'] = generateHash($password); // Do we have 0.7.0 of admins or later? // Remmeber login failures if available - if (GET_EXT_VERSION('admins') >= '0.7.2') { + if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($data['login_failures']))) { // Store it in session setSession('mxchange_admin_failures', $data['login_failures']); setSession('mxchange_admin_last_fail', $data['last_failure']); // Update password and reset login failures - SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET password='%s',login_failures=0,last_failure='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", - array($data['password'], $aid), __FUNCTION__, __LINE__); + SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s',`login_failures`=0,`last_failure`='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", + array($data['password'], $adminId), __FUNCTION__, __LINE__); } else { // Update password - SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET password='%s' WHERE `id`=%s LIMIT 1", - array($data['password'], $aid), __FUNCTION__, __LINE__); + SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s' WHERE `id`=%s LIMIT 1", + array($data['password'], $adminId), __FUNCTION__, __LINE__); } // Rebuild cache - rebuildCacheFiles('admins', 'admin'); + rebuildCacheFile('admin', 'admin'); // Login has failed by default... ;-) - $ret = 'failed'; + $ret = 'failed1'; // Password matches so login here - if (LOGIN_ADMIN($admin_login, $data['password'])) { + if (doAdminLogin($admin, $data['password'])) { // All done now $ret = 'done'; } // END - if } elseif ((empty($salt)) && ($ret == 'pass')) { // Something bad went wrong - $ret = 'failed'; + $ret = 'failed_salt'; } elseif ($ret == 'done') { // Try to login here if we have the old hashing way (sql_patches not installed?) - if (!LOGIN_ADMIN($admin_login, $data['password'])) { + if (!doAdminLogin($admin, $data['password'])) { // Something went wrong - $ret = 'failed'; + $ret = 'failed2'; } // END - if } // Count login failure if admins extension version is 0.7.0+ - if (($ret == 'pass') && (GET_EXT_VERSION('admins') >= '0.7.0')) { + if (($ret == 'pass') && (getExtensionVersion('admins') >= '0.7.0')) { // Update counter - SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET login_failures=login_failures+1,last_failure=NOW() WHERE `id`=%s LIMIT 1", - array($aid), __FUNCTION__, __LINE__); + SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET login_failures`=`login_failures`+1,`last_failure`=NOW() WHERE `id`=%s LIMIT 1", + array($adminId), __FUNCTION__, __LINE__); // Rebuild cache - rebuildCacheFiles('admins', 'admin'); + rebuildCacheFile('admin', 'admin'); } // END - if // Return the result - //* DEBUG: */ die("RETURN=".$ret); + //* DEBUG: */ die('RETURN=' . $ret); return $ret; } // Try to login the admin by setting some session/cookie variables -function LOGIN_ADMIN ($adminLogin, $passHash) { +function doAdminLogin ($adminLogin, $passHash) { // Reset failure counter on matching admins version - if ((GET_EXT_VERSION('admins') >= '0.7.0') && ((EXT_VERSION_IS_OLDER('sql_patches', '0.3.6')) || (GET_EXT_VERSION('sql_patches') == ''))) { + if ((isExtensionInstalledAndNewer('admins', '0.7.0')) && ((isExtensionOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) { // Reset counter on out-dated sql_patches version - SQL_QUERY_ESC("UPDATE `{!_MYSQL_PREFIX!}_admins` SET login_failures=0,last_failure='0000-00-00 00:00:00' WHERE login='%s' LIMIT 1", + SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `login_failures`=0, `last_failure`='0000-00-00 00:00:00' WHERE `login`='%s' LIMIT 1", array($adminLogin), __FUNCTION__, __LINE__); // Rebuild cache - rebuildCacheFiles('admins', 'admin'); + rebuildCacheFile('admin', 'admin'); } // END - if // Now set all session variables and return the result @@ -208,25 +213,23 @@ function LOGIN_ADMIN ($adminLogin, $passHash) { setSession('admin_login', $adminLogin) ) && ( setSession('admin_last', time()) - ) && ( - setSession('admin_to', bigintval(REQUEST_POST('timeout'))) )); } // Only be executed on cookie checking -function CHECK_ADMIN_COOKIES ($admin_login, $password) { +function ifAdminCookiesAreValid ($admin, $password) { // By default no admin cookies are found $ret = '404'; $pass = ''; // Get hash - $pass = GET_ADMIN_HASH(GET_ADMIN_ID($admin_login)); + $pass = getAdminHash($admin); if ($pass != '-1') $ret = 'pass'; - //* DEBUG: */ OUTPUT_HTML(__FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).")
"); + //* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).")
"); // Check if password matches - if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) { + if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass))) && (isAdmin())) { // Passwords matches! $ret = 'done'; } // END - if @@ -235,73 +238,94 @@ function CHECK_ADMIN_COOKIES ($admin_login, $password) { return $ret; } -// -function ADMIN_DO_ACTION ($wht) { - global $DATA; - //* DEBUG: */ OUTPUT_HTML(__LINE__."*".$wht.'/'.getModule().'/'.getAction().'/'.getWhat()."*
"); +// Do an admin action +function doAdminAction () { + // Get default what + $what = getWhat(); + + //* DEBUG: */ outputHtml(__LINE__."*".$what.'/'.getModule().'/'.getAction().'/'.getWhat()."*
"); // Remove any spaces from variable - if (empty($wht)) { + if (empty($what)) { // Default admin action is the overview page - $wht = 'overview'; + $what = 'overview'; } else { - // Compile out some chars - $wht = COMPILE_CODE($wht, false, false, false); + // Secure it + $what = secureString($what); } // Get action value - $act = getModeAction(getModule(), $wht); + $action = getModeAction(getModule(), $what); - // Define admin login name and ID number + // Define admin login name and id number $content['login'] = getSession('admin_login'); $content['id'] = getCurrentAdminId(); // Preload templates - if (EXT_IS_ACTIVE('admins')) { - $content['welcome'] = LOAD_TEMPLATE('admin_welcome_admins', true, $content); + if (isExtensionActive('admins')) { + $content['welcome'] = loadTemplate('admin_welcome_admins', true, $content); } else { - $content['welcome'] = LOAD_TEMPLATE('admin_welcome', true, $content); + $content['welcome'] = loadTemplate('admin_welcome', true, $content); } - $content['footer'] = LOAD_TEMPLATE('admin_footer' , true, $content); - $content['menu'] = ADD_ADMIN_MENU($act, $wht, true, $content); + $content['footer'] = loadTemplate('admin_footer' , true, $content); + $content['menu'] = addAdminMenu($action, $what, true); // Tableset header - LOAD_TEMPLATE('admin_main_header', false, $content); + loadTemplate('admin_main_header', false, $content); // Check if action/what pair is valid - $result_action = SQL_QUERY_ESC("SELECT `id` FROM `{!_MYSQL_PREFIX!}_admin_menu` -WHERE `action`='%s' AND ((`what`='%s' AND what != 'overview') OR ((`what`='' OR `what` IS NULL) AND '%s'='overview')) -LIMIT 1", array($act, $wht, $wht), __FUNCTION__, __LINE__); + $result_action = SQL_QUERY_ESC("SELECT + `id` +FROM + `{?_MYSQL_PREFIX?}_admin_menu` +WHERE + `action`='%s' AND + ( + ( + `what`='%s' AND `what` != 'overview' + ) OR ( + ( + `what`='' OR `what` IS NULL + ) AND ( + '%s'='overview' + ) + ) + ) +LIMIT 1", + array( + $action, + $what, + $what + ), __FUNCTION__, __LINE__); + + // Do we have an entry? if (SQL_NUMROWS($result_action) == 1) { // Is valid but does the inlcude file exists? - $INC = sprintf("inc/modules/admin/action-%s.php", $act); - if ((isIncludeReadable($INC)) && (isMenuActionValid('admin', $act, $wht)) && ($GLOBALS['acl_allow'] === true)) { + $inc = sprintf("inc/modules/admin/action-%s.php", $action); + if ((isIncludeReadable($inc)) && (isMenuActionValid('admin', $action, $what)) && ($GLOBALS['acl_allow'] === true)) { // Ok, we finally load the admin action module - loadInclude($INC); + loadInclude($inc); } elseif ($GLOBALS['acl_allow'] === false) { // Access denied - LOAD_TEMPLATE('admin_menu_failed', false, getMessage('ADMIN_ACCESS_DENIED')); - addFatalMessage(__FUNCTION__, __LINE__, getMessage('ADMIN_ACCESS_DENIED')); + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACCESS_DENIED', $what)); } else { // Include file not found! :-( - LOAD_TEMPLATE('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_404'), $act)); - addFatalMessage(__FUNCTION__, __LINE__, getMessage('ADMIN_ACTION_404'), $act); + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_404', $action)); } } else { // Invalid action/what pair found! - LOAD_TEMPLATE('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_INVALID'), $act.'/'.$wht)); - addFatalMessage(__FUNCTION__, __LINE__, getMessage('ADMIN_ACTION_INVALID'), $act.'/'.$wht); + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_INVALID', $action . '/' . $what)); } // Free memory SQL_FREERESULT($result_action); // Tableset footer - LOAD_TEMPLATE('admin_main_footer', false, $content); + loadTemplate('admin_main_footer', false, $content); } -// -function ADD_ADMIN_MENU ($act, $wht, $return=false) { +// Adds an admin menu +function addAdminMenu ($action, $what, $return=false) { // Init variables $SUB = false; $OUT = ''; @@ -310,216 +334,208 @@ function ADD_ADMIN_MENU ($act, $wht, $return=false) { $GLOBALS['menu']['description'] = array(); $GLOBALS['menu']['title'] = array(); - // Is there a cache instance? - if ((isCacheInstanceValid()) && (getConfig('cache_admin_menu') == 'Y')) { - // Create cache name - $cacheName = 'admin_' . $act . '_' . $wht . '_' . getLanguage() . '_' . strtolower(getSession('admin_login')); - - // Is that cache there? - if ($GLOBALS['cache_instance']->loadCacheFile($cacheName)) { - // Then load it - $data = $GLOBALS['cache_instance']->getArrayFromCache(); - - // Extract all parts - $OUT = base64_decode($data['output'][0]); - $GLOBALS['menu']['title'] = unserialize(base64_decode($data['title'][0])); - $GLOBALS['menu']['description'] = unserialize(base64_decode($data['descr'][0])); - - // Return or output content? - if ($return === true) { - return $OUT; - } else { - OUTPUT_HTML($OUT); - } - } // END - if - } // END - if - // Build main menu - $result_main = SQL_QUERY("SELECT action, title, descr FROM `{!_MYSQL_PREFIX!}_admin_menu` WHERE (`what`='' OR `what` IS NULL) ORDER BY `sort`, id DESC", __FUNCTION__, __LINE__); + $result_main = SQL_QUERY("SELECT + `action`, `title`, `descr` +FROM + `{?_MYSQL_PREFIX?}_admin_menu` +WHERE + (`what`='' OR `what` IS NULL) +ORDER BY + `sort` ASC, + `id` DESC", __FUNCTION__, __LINE__); + + // Do we have entries? if (SQL_NUMROWS($result_main) > 0) { - $OUT = "
 
\n"; - $OUT .= "'; } // Is there a cache instance again? - if ((isCacheInstanceValid()) && (getConfig('cache_admin_menu') == 'Y')) { - // Init cache - $GLOBALS['cache_instance']->init($cacheName); - - // Prepare cache data - $data = array( - 'output' => base64_encode($OUT), - 'title' => $GLOBALS['menu']['title'], - 'descr' => $GLOBALS['menu']['description'] - ); - - // Write the data away - $GLOBALS['cache_instance']->addRow($data); - - // Close cache - $GLOBALS['cache_instance']->finalize(); - } // END - if - // Return or output content? if ($return === true) { return $OUT; } else { - OUTPUT_HTML($OUT); + outputHtml($OUT); } } // Create member selection box -function ADD_MEMBER_SELECTION_BOX ($def='0', $add_all=false, $return=false, $none=false, $field='userid') { +function addMemberSelectionBox ($def=0, $add_all=false, $return=false, $none=false, $field='userid') { // Output selection form with all confirmed user accounts listed - $result = SQL_QUERY("SELECT userid, surname, family FROM `{!_MYSQL_PREFIX!}_user_data` ORDER BY `userid` ASC", __FUNCTION__, __LINE__); + $result = SQL_QUERY("SELECT `userid`, `surname`, `family` FROM `{?_MYSQL_PREFIX?}_user_data` ORDER BY `userid` ASC", __FUNCTION__, __LINE__); // Default output $OUT = ''; // USe this only for adding points (e.g. adding refs really makes no sence ;-) ) - if ($add_all === true) $OUT = " \n"; - elseif ($none === true) $OUT = " \n"; + if ($add_all === true) $OUT = ' '; + elseif ($none === true) $OUT = ' '; while ($content = SQL_FETCHARRAY($result)) { - $OUT .= " '; } // END - while // Free memory SQL_FREERESULT($result); - if (!$return) { + if ($return === false) { // Remeber options in constant - // @TODO Rewrite these both constants - define('_MEMBER_SELECTION', $OUT); - - // Display selection box - define('__LANG_VALUE', getLanguage()); + $content['member_selection'] = $OUT; + $content['what'] = getWhat(); // Load template - LOAD_TEMPLATE('admin_member_selection_box', false, getWhat()); + loadTemplate('admin_member_selection_box', false, $content); } else { // Return content in selection frame - return "\n"; + return ''; } } // Create a menu selection box for given menu system -function ADMIN_MENU_SELECTION ($mode, $default = '', $defid = '') { - $wht = "`what` != ''"; - if ($mode == 'action') $wht = "(`what`='' OR `what` IS NULL) AND action !='login'"; - $result = SQL_QUERY_ESC("SELECT %s, title FROM `{!_MYSQL_PREFIX!}_admin_menu` WHERE ".$wht." ORDER BY `sort`", - array($mode), __FUNCTION__, __LINE__); +// @TODO Try to rewrite this to adminAddMenuSelectionBox() +// @DEPRECATED +function adminMenuSelectionBox_DEPRECATED ($mode, $default = '', $defid = '') { + $what = "`what` != ''"; + if ($mode == 'action') $what = "(`what`='' OR `what` IS NULL) AND `action` !='login'"; + + $result = SQL_QUERY_ESC("SELECT %s, `title` FROM `{?_MYSQL_PREFIX?}_admin_menu` WHERE ".$what." ORDER BY `sort` ASC", + array($mode), __FUNCTION__, __LINE__); if (SQL_NUMROWS($result) > 0) { // Load menu as selection $OUT = "