X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=6a726a464d0147e080a948ddb609fa64719f7b6b;hp=426440e50d6ffc9673a842aee76af5068e03d0d6;hb=de5910b8e5deb9285a7ac57c26ebd894f4e1afbf;hpb=5567f0a4ba3e655d5ae53b518e86ad9737faad79 diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index 426440e50d..6a726a464d 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -1,7 +1,7 @@ $adminId); - - // Is the cache valid? - if (isAdminHashSet($admin)) { - // Get password from cache - $data['password'] = getAdminHash($admin); - $ret = 'pass'; - incrementStatsEntry('cache_hits'); - - // Include more admins data? - if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($GLOBALS['cache_array']['admin']['login_failures'][$adminId]))) { - // Load them here - $data['login_failures'] = $GLOBALS['cache_array']['admin']['login_failures'][$adminId]; - $data['last_failure'] = $GLOBALS['cache_array']['admin']['last_failure'][$adminId]; - } // END - if - } elseif (!isExtensionActive('cache')) { - // Add extra data via filter now - $add = runFilterChain('sql_admin_extra_data'); + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminLogin); - // Get password from DB - $result = SQL_QUERY_ESC("SELECT `password`" . $add . " FROM `{?_MYSQL_PREFIX?}_admins` WHERE `id`=%s LIMIT 1", - array($adminId), __FUNCTION__, __LINE__); + // If this is fine, we can continue + if ($adminHash != '-1') { + // Get admin id and set it as current + setCurrentAdminId(getAdminId($adminLogin)); - // Entry found? - if (SQL_NUMROWS($result) == 1) { - // Login password found - $ret = 'pass'; + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = generateHash($adminPassword, $adminHash); - // Fetch data - $data = SQL_FETCHARRAY($result); - } // END - if - - // Free result - SQL_FREERESULT($result); - } - - //* DEBUG: */ outputHtml("*".$data['password'].'/'.md5($password).'/'.$ret."
"); - if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) { - // Generate new hash - $data['password'] = generateHash($password); - - // Is the sql_patches not installed, than we cannot have a valid hashed password here! - if (($ret == 'pass') && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) $ret = 'done'; - } elseif ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches'))) { - // Old hashing way - return $ret; - } elseif (!isset($data['password'])) { - // Password not found, so no valid login! - return $ret; - } - - // Generate salt of password - $salt = substr($data['password'], 0, -40); - - // Check if password is same - //* DEBUG: */ outputHtml("*".$ret.','.$data['password'].','.$password.','.$salt."*
"); - if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == $password)) { - // Re-hash the plain passord with new random salt - $data['password'] = generateHash($password); - - // Do we have 0.7.0 of admins or later? - // Remmeber login failures if available - if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($data['login_failures']))) { - // Store it in session - setSession('mxchange_admin_failures', $data['login_failures']); - setSession('mxchange_admin_last_fail', $data['last_failure']); - - // Update password and reset login failures - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s',`login_failures`=0,`last_failure`='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", - array($data['password'], $adminId), __FUNCTION__, __LINE__); + // If they both match, the login data is valid + if ($testHash == $adminHash) { + // All fine + $ret = 'done'; } else { - // Update password - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s' WHERE `id`=%s LIMIT 1", - array($data['password'], $adminId), __FUNCTION__, __LINE__); + // Set status + $ret = 'pass'; } - - // Rebuild cache - rebuildCacheFile('admin', 'admin'); - - // Login has failed by default... ;-) - $ret = 'failed1'; - - // Password matches so login here - if (doAdminLogin($admin, $data['password'])) { - // All done now - $ret = 'done'; - } // END - if - } elseif ((empty($salt)) && ($ret == 'pass')) { - // Something bad went wrong - $ret = 'failed_salt'; - } elseif ($ret == 'done') { - // Try to login here if we have the old hashing way (sql_patches not installed?) - if (!doAdminLogin($admin, $data['password'])) { - // Something went wrong - $ret = 'failed2'; - } // END - if - } - - // Count login failure if admins extension version is 0.7.0+ - if (($ret == 'pass') && (getExtensionVersion('admins') >= '0.7.0')) { - // Update counter - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET login_failures`=`login_failures`+1,`last_failure`=NOW() WHERE `id`=%s LIMIT 1", - array($adminId), __FUNCTION__, __LINE__); - - // Rebuild cache - rebuildCacheFile('admin', 'admin'); } // END - if - // Return the result - //* DEBUG: */ die('RETURN=' . $ret); - return $ret; -} + // Prepare data array + $data = array( + 'login' => $adminLogin, + 'plain_pass' => $adminPassword, + 'pass_hash' => $adminHash + ); -// Try to login the admin by setting some session/cookie variables -function doAdminLogin ($adminLogin, $passHash) { - // Reset failure counter on matching admins version - if ((isExtensionInstalledAndNewer('admins', '0.7.0')) && ((isExtensionOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) { - // Reset counter on out-dated sql_patches version - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `login_failures`=0, `last_failure`='0000-00-00 00:00:00' WHERE `login`='%s' LIMIT 1", - array($adminLogin), __FUNCTION__, __LINE__); + // Run a special filter + runFilterChain('do_admin_login_' . $ret, $data); - // Rebuild cache - rebuildCacheFile('admin', 'admin'); - } // END - if - - // Now set all session variables and return the result - return (( - setSession('admin_md5', generatePassString($passHash)) - ) && ( - setSession('admin_login', $adminLogin) - ) && ( - setSession('admin_last', time()) - ) && ( - setSession('admin_to', bigintval(postRequestElement('timeout'))) - )); + // Return status + return $ret; } // Only be executed on cookie checking -function ifAdminCookiesAreValid ($admin, $password) { - // By default no admin cookies are found - $ret = '404'; - $pass = ''; +function ifAdminCookiesAreValid ($adminLogin, $passHash) { + // First of all, no admin login is found + $ret = '404'; - // Get hash - $pass = getAdminHash($admin); - if ($pass != '-1') $ret = 'pass'; + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminLogin); - //* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).")
"); + // If this is fine, we can continue + if ($adminHash != '-1') { + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = encodeHashForCookie($adminHash); + //* DEBUG: */ outputHtml('adminLogin='.$adminLogin.',
passHash='.$passHash.',
adminHash='.$adminHash.',
testHash='.$testHash.'
'); - // Check if password matches - if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass))) && (isAdmin())) { - // Passwords matches! - $ret = 'done'; + // If they both match, the login data is valid + if ($testHash == $passHash) { + // All fine + $ret = 'done'; + } else { + // Set status + $ret = 'pass'; + } } // END - if - // Return result + // Return status + //* DEBUG: */ outputHtml('ret='.$ret); return $ret; } @@ -242,7 +145,7 @@ function doAdminAction () { // Get default what $what = getWhat(); - //* DEBUG: */ outputHtml(__LINE__."*".$what.'/'.getModule().'/'.getAction().'/'.getWhat()."*
"); + //* DEBUG: */ outputHtml(__LINE__.'*'.$what.'/'.getModule().'/'.getAction().'/'.getWhat().'*
'); // Remove any spaces from variable if (empty($what)) { @@ -254,7 +157,7 @@ function doAdminAction () { } // Get action value - $action = getModeAction(getModule(), $what); + $action = getActionFromModuleWhat(getModule(), $what); // Define admin login name and id number $content['login'] = getSession('admin_login'); @@ -272,12 +175,6 @@ function doAdminAction () { // Tableset header loadTemplate('admin_main_header', false, $content); - // Is sql_patches not yet installed? - if (!isExtensionInstalled('sql_patches')) { - // Output warning - loadTemplate('admin_settings_saved', false, getMessage('ADMIN_WARNING_SQL_PATCHES_MISSING')); - } // END - if - // Check if action/what pair is valid $result_action = SQL_QUERY_ESC("SELECT `id` @@ -297,7 +194,13 @@ WHERE ) ) LIMIT 1", - array($action, $what, $what), __FUNCTION__, __LINE__); + array( + $action, + $what, + $what + ), __FUNCTION__, __LINE__); + + // Do we have an entry? if (SQL_NUMROWS($result_action) == 1) { // Is valid but does the inlcude file exists? $inc = sprintf("inc/modules/admin/action-%s.php", $action); @@ -306,14 +209,14 @@ LIMIT 1", loadInclude($inc); } elseif ($GLOBALS['acl_allow'] === false) { // Access denied - loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACCESS_DENIED'), $what)); + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACCESS_DENIED', $what)); } else { // Include file not found! :-( - loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_404'), $action)); + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_404', $action)); } } else { // Invalid action/what pair found! - loadTemplate('admin_menu_failed', false, sprintf(getMessage('ADMIN_ACTION_INVALID'), $action.'/'.$what)); + loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_INVALID', $action . '/' . $what)); } // Free memory @@ -346,8 +249,7 @@ ORDER BY // Do we have entries? if (SQL_NUMROWS($result_main) > 0) { - $OUT = "
 
\n"; - $OUT .= "'; } // Is there a cache instance again? @@ -501,13 +401,13 @@ function addMemberSelectionBox ($def=0, $add_all=false, $return=false, $none=fal $OUT = ''; // USe this only for adding points (e.g. adding refs really makes no sence ;-) ) - if ($add_all === true) $OUT = " \n"; - elseif ($none === true) $OUT = " \n"; + if ($add_all === true) $OUT = ' '; + elseif ($none === true) $OUT = ' '; while ($content = SQL_FETCHARRAY($result)) { - $OUT .= " '; } // END - while // Free memory @@ -522,7 +422,7 @@ function addMemberSelectionBox ($def=0, $add_all=false, $return=false, $none=fal loadTemplate('admin_member_selection_box', false, $content); } else { // Return content in selection frame - return "\n"; + return ''; } } @@ -531,13 +431,14 @@ function addMemberSelectionBox ($def=0, $add_all=false, $return=false, $none=fal // @DEPRECATED function adminMenuSelectionBox_DEPRECATED ($mode, $default = '', $defid = '') { $what = "`what` != ''"; - if ($mode == 'action') $what = "(`what`='' OR `what` IS NULL) AND action !='login'"; - $result = SQL_QUERY_ESC("SELECT %s, title FROM `{?_MYSQL_PREFIX?}_admin_menu` WHERE ".$what." ORDER BY `sort`", + if ($mode == 'action') $what = "(`what`='' OR `what` IS NULL) AND `action` !='login'"; + + $result = SQL_QUERY_ESC("SELECT %s, `title` FROM `{?_MYSQL_PREFIX?}_admin_menu` WHERE ".$what." ORDER BY `sort` ASC", array($mode), __FUNCTION__, __LINE__); if (SQL_NUMROWS($result) > 0) { // Load menu as selection $OUT = "