X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=6b22d9ba5d27b5e164dedcc90a79a449e0fca28c;hp=be8b8c1eb63b62b77d96a6c06354f133bf323cb3;hb=c45b1827a16928c65ecc1aea6a9d7a504c4874d4;hpb=dbd1bc95c8f89024118791dc3fb3633a90afa9cf diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index be8b8c1eb6..6b22d9ba5d 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -39,20 +39,17 @@ if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) } // -function REGISTER_ADMIN ($user, $md5) +function REGISTER_ADMIN ($user, $md5, $email=WEBMASTER) { $ret = "failed"; $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", array($user), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 0) - { + if (SQL_NUMROWS($result) == 0) { // Ok, let's create the admin login - $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_admins (login, password, email) VALUES('%s', '%s', '".WEBMASTER."')", - array($user, $md5), __FILE__, __LINE__); + $result = SQL_QUERY_ESC("INSERT INTO "._MYSQL_PREFIX."_admins (login, password, email) VALUES('%s', '%s', '%s')", + array($user, $md5, $email), __FILE__, __LINE__); $ret = "done"; - } - else - { + } else { // Free memory SQL_FREERESULT($result); @@ -64,37 +61,32 @@ function REGISTER_ADMIN ($user, $md5) // Only be executed on login procedure! function CHECK_ADMIN_LOGIN ($admin_login, $password) { - global $ADMINS, $CONFIG, $CACHE; + global $cacheArray, $_CONFIG, $cacheInstance; $ret = "404"; $pass = ""; - if (!empty($ADMINS['aid'][$admin_login])) - { + if (!empty($cacheArray['admins']['aid'][$admin_login])) { // Get password from cache - $pass = $ADMINS['password'][$admin_login]; + $pass = $cacheArray['admins']['password'][$admin_login]; $ret = "pass"; - $CONFIG['cache_hits']++; - } - else - { + $_CONFIG['cache_hits']++; + } else { // Get password from DB $result = SQL_QUERY_ESC("SELECT password FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", array($admin_login), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { $ret = "pass"; list($pass) = SQL_FETCHROW($result); SQL_FREERESULT($result); } } - //* DEBUG: */ echo "*".$pass."/".$password."/".$ret."
"; - if ((strlen($pass) == 32) && ($pass == md5($password))) - { + //* DEBUG: */ echo "*".$pass."/".md5($password)."/".$ret."
"; + if ((strlen($pass) == 32) && ($pass == md5($password))) { // Generate new hash $pass = generateHash($password); - if (($ret == "pass") && (GET_EXT_VERSION("sql_patches") < "0.3.6")) $ret = "done"; - } - elseif ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == "")) - { + + // Is the sql_patches not installed, than we cannot have a valid hashed password here! + if (($ret == "pass") && ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == ""))) $ret = "done"; + } elseif ((GET_EXT_VERSION("sql_patches") < "0.3.6") || (GET_EXT_VERSION("sql_patches") == "")) { // Old hashing way return $ret; } @@ -104,133 +96,175 @@ function CHECK_ADMIN_LOGIN ($admin_login, $password) $salt = __SALT; // Check if password is same - if (($ret == "pass") && ($pass == generateHash($password, $salt)) && (!empty($salt))) - { + //* DEBUG: */ echo "*".$ret.",".$pass.",".$password.",".$salt."*
\n"; + if (($ret == "pass") && ($pass == generateHash($password, $salt)) && (!empty($salt))) { + // Change the passord hash here + $pass = generateHash($password); + // Update password $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET password='%s' WHERE login='%s' LIMIT 1", array($pass, $admin_login), __FILE__, __LINE__); // Shall I remove the cache file? - if ((EXT_IS_ACTIVE("cache")) && ($CACHE != false)) - { - if ($CACHE->cache_file("admins", true)) $CACHE->cache_destroy(); + if ((EXT_IS_ACTIVE("cache")) && ($cacheInstance != false)) { + if ($cacheInstance->cache_file("admins", true)) $cacheInstance->cache_destroy(); } - // Password matches! - $ret = "done"; - } - elseif ((empty($salt)) && ($ret == "pass")) - { + // Login has failed by default... ;-) + $ret = "failed"; + + // Password matches so login here + if (LOGIN_ADMIN($admin_login, $pass)) { + // All done now + $ret = "done"; + } + } elseif ((empty($salt)) && ($ret == "pass")) { // Something bad went wrong $ret = "failed"; + } elseif ($ret == "done") { + // Try to login here if we have the old hashing way (sql_patches not installed?) + if (!LOGIN_ADMIN($admin_login, $pass)) { + // Something went wrong + $ret = "failed"; + } } + + // Return the result + //* DEBUG: */ die("RETURN=".$ret); return $ret; } + +// Try to login the admin by setting some session/cookie variables +function LOGIN_ADMIN ($adminLogin, $passHash) { + // Now set all session variables and return the result + return ( + ( + set_session("admin_md5", generatePassString($passHash)) + ) && ( + set_session("admin_login", $adminLogin) + ) && ( + set_session("admin_last", time()) + ) && ( + set_session("admin_to", $_POST['timeout']) + ) + ); +} + // Only be executed on cookie checking -function CHECK_ADMIN_COOKIES ($admin_login, $password) -{ - global $ADMINS, $CONFIG; +function CHECK_ADMIN_COOKIES ($admin_login, $password) { + global $cacheArray, $_CONFIG; $ret = "404"; $pass = ""; - if (!empty($ADMINS['aid'][$admin_login])) - { + if (!empty($cacheArray['admins']['aid'][$admin_login])) { // Get password from cache - $pass = $ADMINS['password'][$admin_login]; + $pass = $cacheArray['admins']['password'][$admin_login]; $ret = "pass"; - $CONFIG['cache_hits']++; - } - else - { + $_CONFIG['cache_hits']++; + } else { // Get password from DB $result = SQL_QUERY_ESC("SELECT password FROM "._MYSQL_PREFIX."_admins WHERE login='%s' LIMIT 1", array($admin_login), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + if (SQL_NUMROWS($result) == 1) { + // Entry found $ret = "pass"; + + // Fetch password list($pass) = SQL_FETCHROW($result); - SQL_FREERESULT($result); } + + // Free result + SQL_FREERESULT($result); } - //* DEBUG: */ echo "*".$pass."/".$password."
"; + //* DEBUG: */ echo __FUNCTION__.":".$pass."(".strlen($pass).")/".$password."(".strlen($password).")
\n"; // Check if password matches - if (($ret == "pass") && ((generatePassString($pass) == $password) || ($pass == $password))) - { + if (($ret == "pass") && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass)))) { // Passwords matches! $ret = "done"; } + + // Return result return $ret; } // -function admin_WriteData ($file, $COMMENT, $PREFIX, $SUFFIX, $DATA, $SEEK=0) -{ - $DONE = false; $SEEK++; $found = false; - if (file_exists($file)) - { - $search = "CFG: ".$COMMENT; +function admin_WriteData ($file, $comment, $prefix, $suffix, $DATA, $seek=0) { + // Initialize some variables + $done = false; + $seek++; + $found = false; + + // Is the file there and read-/write-able? + if ((file_exists($file)) && (is_readable($file)) && (is_writeable($file))) { + $search = "CFG: ".$comment; $tmp = $file.".tmp"; - $fp = fopen($file, 'r') or OUTPUT_HTML ("READ: ".$file."
"); - if ($fp) - { - $fp_tmp = fopen($tmp, 'w') or OUTPUT_HTML ("WRITE: ".$tmp."
"); - if ($fp_tmp) - { - while (! feof($fp)) - { + + // Open the source file + $fp = @fopen($file, 'r') or OUTPUT_HTML("READ: ".$file."
"); + + // Is the resource valid? + if (is_resource($fp)) { + // Open temporary file + $fp_tmp = @fopen($tmp, 'w') or OUTPUT_HTML("WRITE: ".$tmp."
"); + + // Is the resource again valid? + if (is_resource($fp_tmp)) { + while (!feof($fp)) { + // Read from source file $line = fgets ($fp, 1024); + if (strpos($line, $search) > -1) { $next = 0; $found = true; } - if ($next > -1) - { - if ($next == $SEEK) - { + + if ($next > -1) { + if ($next == $seek) { $next = -1; - $line = $PREFIX.$DATA.$SUFFIX."\n"; - } - else - { + $line = $prefix . $DATA . $suffix."\n"; + } else { $next++; } } + + // Write to temp file fputs($fp_tmp, $line); } + + // Close temp file fclose($fp_tmp); + // Finished writing tmp file - $DONE = true; + $done = true; } + + // Close source file fclose($fp); - if (($DONE) && ($found)) - { + + if (($done) && ($found)) { // Copy back tmp file and delete tmp :-) @copy($tmp, $file); @unlink($tmp); - define ('_FATAL', false); - } - elseif (!$found) - { - OUTPUT_HTML ("CHANGE: 404!"); - define ('_FATAL', true); - } - else - { - OUTPUT_HTML ("TMP: UNDONE!"); - define ('_FATAL', true); + define('_FATAL', false); + } elseif (!$found) { + OUTPUT_HTML("CHANGE: 404!"); + define('_FATAL', true); + } else { + OUTPUT_HTML("TMP: UNDONE!"); + define('_FATAL', true); } } - } - else - { - OUTPUT_HTML ("404: ".$file."
"); + } else { + // File not found, not readable or writeable + OUTPUT_HTML("404: ".$file."
"); } } + // function ADMIN_DO_ACTION($wht) { - global $menuDesription, $MTITLE, $CONFIG, $EXTENSIONS, $link, $DATA; + global $menuDesription, $menuTitle, $_CONFIG, $cacheArray, $link, $DATA, $DEPTH; //* DEBUG: */ echo __LINE__."*".$wht."/".$GLOBALS['module']."/".$GLOBALS['action']."/".$GLOBALS['what']."*
\n"; if (EXT_IS_ACTIVE("cache")) { // Include cache instance - global $CACHE; + global $cacheInstance; } // Remove any spaces from variable @@ -249,8 +283,8 @@ function ADMIN_DO_ACTION($wht) $act = GET_ACTION($GLOBALS['module'], $wht); // Define admin login name and ID number - define('__ADMIN_LOGIN', SQL_ESCAPE($_COOKIE['admin_login'])); - define('__ADMIN_ID' , GET_ADMIN_ID($_COOKIE['admin_login'])); + define('__ADMIN_LOGIN', get_session('admin_login')); + define('__ADMIN_ID' , GET_ADMIN_ID(get_session('admin_login'))); // Preload templates if (EXT_IS_ACTIVE("admins")) { @@ -266,7 +300,7 @@ function ADMIN_DO_ACTION($wht) // Check if action/what pair is valid $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_admin_menu -WHERE action='%s' AND ((what='%s' AND what != 'overview') OR (what='' AND '%s'='overview')) +WHERE action='%s' AND ((what='%s' AND what != 'overview') OR ((what='' OR what IS NULL) AND '%s'='overview')) LIMIT 1", array($act, $wht, $wht), __FILE__, __LINE__); if (SQL_NUMROWS($result) == 1) { @@ -274,7 +308,7 @@ LIMIT 1", array($act, $wht, $wht), __FILE__, __LINE__); SQL_FREERESULT($result); // Is valid but does the inlcude file exists? - $INC = sprintf(PATH."inc/modules/admin/action-%s.php", $act); + $INC = sprintf("%sinc/modules/admin/action-%s.php", PATH, $act); if ((file_exists($INC)) && (is_readable($INC)) && (VALIDATE_MENU_ACTION("admin", $act, $wht)) && (__ACL_ALLOW == true)) { // Ok, we finally load the admin action module @@ -304,15 +338,15 @@ LIMIT 1", array($act, $wht, $wht), __FILE__, __LINE__); // function ADD_ADMIN_MENU($act, $wht,$return=false) { - global $_GET, $menuDesription, $MTITLE, $link; + global $menuDesription, $menuTitle, $link; $SUB = false; // Menu descriptions $menuDesription = array(); - $MTITLE = array(); + $menuTitle = array(); // Build main menu - $result_main = SQL_QUERY("SELECT action, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE what='' ORDER BY sort, id DESC", __FILE__, __LINE__); + $result_main = SQL_QUERY("SELECT action, title, descr FROM "._MYSQL_PREFIX."_admin_menu WHERE (what='' OR what IS NULL) ORDER BY sort, id DESC", __FILE__, __LINE__); $OUT = ""; if (SQL_NUMROWS($result_main) > 0) { @@ -334,28 +368,28 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) if (!$SUB) { // Insert compiled menu title and description - $MTITLE[$menu] = $title; + $menuTitle[$menu] = $title; $menuDesription[$menu] = $descr; } $OUT .= " - -  · "; - if (($menu == $act) && (empty($wht))) + +  · "; + if (($menu == $act) && (empty($wht))) { $OUT .= ""; } else { - $OUT .= "[ "; + $OUT .= "["; } $OUT .= $title; - if (($menu == $act) && (empty($wht))) + if (($menu == $act) && (empty($wht))) { $OUT .= ""; } else { - $OUT .= " ]"; + $OUT .= "]"; } $OUT .= " \n"; @@ -364,15 +398,15 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) if ((SQL_NUMROWS($result_what) > 0) && ($act == $menu)) { $menuDesription = array(); - $MTITLE = array(); $SUB = true; + $menuTitle = array(); $SUB = true; $OUT .= " -   - - \n"; - while (list($wht_sub, $title_what, $desc_what) = SQL_FETCHROW($result_what)) + + + \n"; } $OUT .= "\n"; @@ -451,13 +485,12 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) if ($return) { return $OUT; } else { - OUTPUT_HTML ($OUT); + OUTPUT_HTML($OUT); } } // function ADD_MEMBER_SELECTION_BOX($add_all = false, $return = false, $none = false, $def = "0") { - global $_GET; // Output selection form with all confirmed user accounts listed $result = SQL_QUERY("SELECT userid, surname, family FROM "._MYSQL_PREFIX."_user_data ORDER BY userid", __FILE__, __LINE__); $OUT = ""; @@ -478,8 +511,7 @@ function ADD_MEMBER_SELECTION_BOX($add_all = false, $return = false, $none = fal // Remeber options in constant define('_MEMBER_SELECTION', $OUT); - if (!$return) - { + if (!$return) { // Display selection box define('__LANG_VALUE', GET_LANGUAGE()); @@ -488,10 +520,9 @@ function ADD_MEMBER_SELECTION_BOX($add_all = false, $return = false, $none = fal } } // -function ADMIN_MENU_SELECTION($MODE, $default="", $defid="") -{ +function ADMIN_MENU_SELECTION($MODE, $default="", $defid="") { $wht = "what != ''"; - if ($MODE == "action") $wht = "what='' AND action !='login'"; + if ($MODE == "action") $wht = "(what='' OR what IS NULL) AND action !='login'"; $result = SQL_QUERY_ESC("SELECT %s, title FROM "._MYSQL_PREFIX."_admin_menu WHERE ".$wht." ORDER BY sort", array($MODE), __FILE__, __LINE__); if (SQL_NUMROWS($result) > 0) @@ -500,7 +531,7 @@ function ADMIN_MENU_SELECTION($MODE, $default="", $defid="") $OUT = "\n \n"; - - // Open the requested menu directory - $handle = opendir(PATH."inc/modules/".$menu."/") or mxchange_die("Cannot load menu ".$menu."!"); + // Walk through all files while ($file = readdir($handle)) { // Is this a PHP script? if (($file != ".") && ($file != "..") && ($file != "lost+found") && (strpos($file, "".$type."-") > -1) && (strpos($file, ".php") > 0)) { // Then test if the file is readable - $test = PATH."inc/modules/".$menu."/".$file; - if (is_readable($test)) { + $test = sprintf("%sinc/modules/%s/%s", PATH, $menu, $file); + if ((is_file($test)) && (is_readable($test))) { // Extract the value for what=xxx $part = substr($file, (strlen($type) + 1)); $part = substr($part, 0, strpos($part, ".php")); @@ -654,9 +686,9 @@ function ADMIN_MAKE_MENU_SELECTION($menu, $type, $name, $default="") { $OUT .= "
  + \n"; + while (list($wht_sub, $title_what, $desc_what) = SQL_FETCHROW($result_what)) { // Filename - $INC = sprintf(PATH."inc/modules/admin/what-%s.php", $wht_sub); + $INC = sprintf("%sinc/modules/admin/what-%s.php", PATH, $wht_sub); if ((EXT_IS_ACTIVE("admins")) && (GET_EXT_VERSION("admins") > "0.2")) { $ACL = ADMINS_CHECK_ACL("", $wht_sub); @@ -386,11 +420,11 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) if ($ACL) { // Insert compiled title and description - $MTITLE[$wht_sub] = $title_what; + $menuTitle[$wht_sub] = $title_what; $menuDesription[$wht_sub] = $desc_what; $OUT .= " -
-  --> "; + +  --> "; if ($readable) { if ($wht == $wht_sub) @@ -399,7 +433,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) } else { - $OUT .= "[ "; + $OUT .= "["; } } else @@ -415,7 +449,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) } else { - $OUT .= " ]"; + $OUT .= "]"; } } else @@ -430,7 +464,7 @@ function ADD_ADMIN_MENU($act, $wht,$return=false) // Free memory SQL_FREERESULT($result_what); $OUT .= "
-