X-Git-Url: https://git.mxchange.org/?p=mailer.git;a=blobdiff_plain;f=inc%2Fmodules%2Fadmin%2Fadmin-inc.php;h=df9eeac2674c86c6f08e0f03b12cc46d9daf16ff;hp=76499f3675ce018c631fd1f9acf8d12575b24bd4;hb=0533bba499e23b91209b91f40737058a36f40ffe;hpb=b38e97d5419a80763653dc2cd61f0c418f2a8177 diff --git a/inc/modules/admin/admin-inc.php b/inc/modules/admin/admin-inc.php index 76499f3675..df9eeac267 100644 --- a/inc/modules/admin/admin-inc.php +++ b/inc/modules/admin/admin-inc.php @@ -14,10 +14,9 @@ * $Date:: $ * * $Tag:: 0.2.1-FINAL $ * * $Author:: $ * - * Needs to be in all Files and every File needs "svn propset * - * svn:keywords Date Revision" (autoprobset!) at least!!!!!! * * -------------------------------------------------------------------- * * Copyright (c) 2003 - 2009 by Roland Haeder * + * Copyright (c) 2009 - 2011 by Mailer Developer Team * * For more information visit: http://www.mxchange.org * * * * This program is free software; you can redistribute it and/or modify * @@ -42,22 +41,22 @@ if (!defined('__SECURITY')) { } // END - if // Register an administrator account -function addAdminAccount ($user, $md5, $email) { +function addAdminAccount ($adminLogin, $passHash, $adminEmail) { // Login does already exist $ret = 'already'; // Lookup the admin $result = SQL_QUERY_ESC("SELECT `id` FROM `{?_MYSQL_PREFIX?}_admins` WHERE `login`='%s' LIMIT 1", - array($user), __FUNCTION__, __LINE__); + array($adminLogin), __FUNCTION__, __LINE__); // Is the entry there? - if (SQL_NUMROWS($result) == '0') { + if (SQL_HASZERONUMS($result)) { // Ok, let's create the admin login SQL_QUERY_ESC("INSERT INTO `{?_MYSQL_PREFIX?}_admins` (`login`, `password`, `email`) VALUES ('%s', '%s', '%s')", array( - $user, - $md5, - $email + $adminLogin, + $passHash, + $adminEmail ), __FUNCTION__, __LINE__); // All done @@ -71,170 +70,80 @@ function addAdminAccount ($user, $md5, $email) { return $ret; } -// Only be executed on login procedure! -function ifAdminLoginDataIsValid ($admin, $password) { - // By default no admin is found +// This function will be executed when the admin is not logged in and has submitted his login data +function ifAdminLoginDataIsValid ($adminLogin, $adminPassword) { + // First of all, no admin login is found, so the admin hash is null $ret = '404'; + $adminHash = null; - // Get admin id - $adminId = getAdminId($admin); - - // Init array with admin id by default - $data = array('admin_id' => $adminId); - - // Is the cache valid? - if (isAdminHashSet($admin)) { - // Get password from cache - $data['password'] = getAdminHash($admin); - $ret = 'pass'; - incrementStatsEntry('cache_hits'); - - // Include more admins data? - if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($GLOBALS['cache_array']['admin']['login_failures'][$adminId]))) { - // Load them here - $data['login_failures'] = $GLOBALS['cache_array']['admin']['login_failures'][$adminId]; - $data['last_failure'] = $GLOBALS['cache_array']['admin']['last_failure'][$adminId]; - } // END - if - } elseif (!isExtensionActive('cache')) { - // Add extra data via filter now - $add = runFilterChain('sql_admin_extra_data'); - - // Get password from DB - $result = SQL_QUERY_ESC("SELECT `password`" . $add . " FROM `{?_MYSQL_PREFIX?}_admins` WHERE `id`=%s LIMIT 1", - array($adminId), __FUNCTION__, __LINE__); - - // Entry found? - if (SQL_NUMROWS($result) == 1) { - // Login password found - $ret = 'pass'; - - // Fetch data - $data = SQL_FETCHARRAY($result); - } // END - if - - // Free result - SQL_FREERESULT($result); - } - - //* DEBUG: */ outputHtml('*' . $data['password'] . '/' . md5($password) .'/' . $ret . '*
'); - if ((isset($data['password'])) && (strlen($data['password']) == 32) && ($data['password'] == md5($password))) { - // Generate new hash - $data['password'] = generateHash($password); - - // Is the sql_patches not installed, than we cannot have a valid hashed password here! - //* DEBUG: */ outputHtml($ret . ',' . intval(isExtensionInstalledAndOlder('sql_patches', '0.3.6')) . '/' . intval(!isExtensionInstalled('sql_patches')).'
'); - if (($ret == 'pass') && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) $ret = 'done'; - } elseif ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches'))) { - // Old hashing way - return $ret; - } elseif (!isset($data['password'])) { - // Password not found, so no valid login! - return $ret; - } + // Get admin id from login + $adminId = getAdminId($adminLogin); - // Generate salt of password - $salt = substr($data['password'], 0, -40); - - // Check if password is same - //* DEBUG: */ outputHtml('*' . $ret . ',' . $data['password'] . ',' . $password . ',' . $salt . '*
'); - if (($ret == 'pass') && ($data['password'] == generateHash($password, $salt)) && ((!empty($salt))) || ($data['password'] == md5($password))) { - // Re-hash the plain passord with new random salt - $data['password'] = generateHash($password); - - // Do we have 0.7.0 of admins or later? - // Remmeber login failures if available - if ((isExtensionInstalledAndNewer('admins', '0.7.2')) && (isset($data['login_failures']))) { - // Store it in session - setSession('mxchange_admin_failures', $data['login_failures']); - setSession('mxchange_admin_last_fail', $data['last_failure']); - - // Update password and reset login failures - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s',`login_failures`=0,`last_failure`='0000-00-00 00:00:00' WHERE `id`=%s LIMIT 1", - array($data['password'], $adminId), __FUNCTION__, __LINE__); - } else { - // Update password - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `password`='%s' WHERE `id`=%s LIMIT 1", - array($data['password'], $adminId), __FUNCTION__, __LINE__); - } + // Continue only with found admin ids + if ($adminId > 0) { + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminId); - // Rebuild cache - rebuildCacheFile('admin', 'admin'); + // If this is fine, we can continue + if ($adminHash != '-1') { + // Get admin id and set it as current + setCurrentAdminId($adminId); - // Login has failed by default... ;-) - $ret = 'failed1'; + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = generateHash($adminPassword, $adminHash); - // Password matches so login here - if (doAdminLogin($admin, $data['password'])) { - // All done now - $ret = 'done'; - } // END - if - } elseif ((empty($salt)) && ($ret == 'pass')) { - // Something bad went wrong - $ret = 'failed_salt'; - } elseif ($ret == 'done') { - // Try to login here if we have the old hashing way (sql_patches not installed?) - if (!doAdminLogin($admin, $data['password'])) { - // Something went wrong - $ret = 'failed2'; + // If they both match, the login data is valid + if ($testHash == $adminHash) { + // All fine + $ret = 'done'; + } else { + // Set status + $ret = 'password'; + } } // END - if - } - - // Count login failure if admins extension version is 0.7.0+ - if (($ret == 'pass') && (getExtensionVersion('admins') >= '0.7.0')) { - // Update counter - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET login_failures`=`login_failures`+1,`last_failure`=NOW() WHERE `id`=%s LIMIT 1", - array($adminId), __FUNCTION__, __LINE__); - - // Rebuild cache - rebuildCacheFile('admin', 'admin'); } // END - if - // Return the result - //* DEBUG: */ die('RETURN=' . $ret); - return $ret; -} - -// Try to login the admin by setting some session/cookie variables -function doAdminLogin ($adminLogin, $passHash) { - // Reset failure counter on matching admins version - if ((isExtensionInstalledAndNewer('admins', '0.7.0')) && ((isExtensionInstalledAndOlder('sql_patches', '0.3.6')) || (!isExtensionInstalled('sql_patches')))) { - // Reset counter on out-dated sql_patches version - SQL_QUERY_ESC("UPDATE `{?_MYSQL_PREFIX?}_admins` SET `login_failures`=0, `last_failure`='0000-00-00 00:00:00' WHERE `login`='%s' LIMIT 1", - array($adminLogin), __FUNCTION__, __LINE__); + // Prepare data array + $data = array( + 'id' => $adminId, + 'login' => $adminLogin, + 'plain_pass' => $adminPassword, + 'pass_hash' => $adminHash + ); - // Rebuild cache - rebuildCacheFile('admin', 'admin'); - } // END - if + // Run a special filter + runFilterChain('do_admin_login_' . $ret, $data); - // Now set all session variables and return the result - return (( - setSession('admin_md5', generatePassString($passHash)) - ) && ( - setSession('admin_login', $adminLogin) - ) && ( - setSession('admin_last', time()) - )); + // Return status + return $ret; } // Only be executed on cookie checking -function ifAdminCookiesAreValid ($admin, $password) { - // By default no admin cookies are found - $ret = '404'; - $pass = ''; +function ifAdminCookiesAreValid ($adminLogin, $passHash) { + // First of all, no admin login is found + $ret = '404'; - // Get hash - $pass = getAdminHash($admin); - if ($pass != '-1') $ret = 'pass'; + // Then we need to lookup the login name by getting the admin hash + $adminHash = getAdminHash($adminLogin); - //* DEBUG: */ outputHtml(__FUNCTION__."(".__LINE__."):".generatePassString($pass).'('.strlen($pass).")/".$password.'('.strlen($password).")
"); + // If this is fine, we can continue + if ($adminHash != '-1') { + // Now, we need to encode the password in the same way the one is encoded in database + $testHash = encodeHashForCookie($adminHash); + //* DEBUG: */ debugOutput('adminLogin=' . $adminLogin . ',passHash='.$passHash.',adminHash='.$adminHash.',testHash='.$testHash); - // Check if password matches - if (($ret == 'pass') && ((generatePassString($pass) == $password) || ($pass == $password) || ((strlen($pass) == 32) && (md5($password) == $pass))) && (isAdmin())) { - // Passwords matches! - $ret = 'done'; + // If they both match, the login data is valid + if ($testHash == $passHash) { + // All fine + $ret = 'done'; + } else { + // Set status + $ret = 'password'; + } } // END - if - // Return result + // Return status + //* DEBUG: */ debugOutput('ret='.$ret); return $ret; } @@ -243,7 +152,7 @@ function doAdminAction () { // Get default what $what = getWhat(); - //* DEBUG: */ outputHtml(__LINE__."*".$what.'/'.getModule().'/'.getAction().'/'.getWhat()."*
"); + //* DEBUG: */ debugOutput(__LINE__.'*'.$what.'/'.getModule().'/'.getAction().'/'.getWhat().'*'); // Remove any spaces from variable if (empty($what)) { @@ -255,18 +164,18 @@ function doAdminAction () { } // Get action value - $action = getModeAction(getModule(), $what); - - // Define admin login name and id number - $content['login'] = getSession('admin_login'); - $content['id'] = getCurrentAdminId(); + $action = getActionFromModuleWhat(getModule(), $what); - // Preload templates + // Load welcome template if (isExtensionActive('admins')) { - $content['welcome'] = loadTemplate('admin_welcome_admins', true, $content); + // @TODO This and the next getCurrentAdminId() call might be moved into the templates? + $content['welcome'] = loadTemplate('admin_welcome_admins', true, getCurrentAdminId()); } else { - $content['welcome'] = loadTemplate('admin_welcome', true, $content); + $content['welcome'] = loadTemplate('admin_welcome', true, getCurrentAdminId()); } + + // Load header, footer, render menu + $content['header'] = loadTemplate('admin_header' , true, $content); $content['footer'] = loadTemplate('admin_footer' , true, $content); $content['menu'] = addAdminMenu($action, $what, true); @@ -309,11 +218,11 @@ LIMIT 1", // Access denied loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACCESS_DENIED', $what)); } else { - // Include file not found! :-( + // Include file not found :-( loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_404', $action)); } } else { - // Invalid action/what pair found! + // Invalid action/what pair found loadTemplate('admin_menu_failed', false, getMaskedMessage('ADMIN_ACTION_INVALID', $action . '/' . $what)); } @@ -324,8 +233,22 @@ LIMIT 1", loadTemplate('admin_main_footer', false, $content); } +// Checks wether current admin is allowed to access given action/what combination +// (only one is allowed to be null!) +function isAdminAllowedAccessMenu ($action, $what = null) { + // Do we have cache? + if (!isset($GLOBALS[__FUNCTION__][$action][$what])) { + // ACL is always 'allow' when no ext-admins is installed + // @TODO This can be rewritten into a filter + $GLOBALS[__FUNCTION__][$action][$what] = ((!isExtensionInstalledAndNewer('admins', '0.2.0')) || (adminsCheckAdminAcl($action, $what))); + } // END - if + + // Return the cached value + return $GLOBALS[__FUNCTION__][$action][$what]; +} + // Adds an admin menu -function addAdminMenu ($action, $what, $return=false) { +function addAdminMenu ($action, $what, $return = false) { // Init variables $SUB = false; $OUT = ''; @@ -346,30 +269,23 @@ ORDER BY `id` DESC", __FUNCTION__, __LINE__); // Do we have entries? - if (SQL_NUMROWS($result_main) > 0) { - $OUT = '
 
'; + if (!SQL_HASZERONUMS($result_main)) { $OUT .= '