From 14ae8b40cb632b2135707bd21f599a2bc8a4afdc Mon Sep 17 00:00:00 2001 From: =?utf8?q?Roland=20H=C3=A4der?= Date: Mon, 18 Feb 2008 19:28:27 +0000 Subject: [PATCH] admins extension in admin area rewritten --- inc/libs/admins_functions.php | 280 +++++++++++++++++++++---- inc/modules/admin/what-admins_edit.php | 226 ++------------------ 2 files changed, 251 insertions(+), 255 deletions(-) diff --git a/inc/libs/admins_functions.php b/inc/libs/admins_functions.php index dd0b4422ca..c930c48184 100644 --- a/inc/libs/admins_functions.php +++ b/inc/libs/admins_functions.php @@ -37,9 +37,9 @@ if (ereg(basename(__FILE__), $_SERVER['PHP_SELF'])) $INC = substr(dirname(__FILE__), 0, strpos(dirname(__FILE__), "/inc") + 4) . "/security.php"; require($INC); } -// -function ADMINS_CHECK_ACL($act, $wht) -{ + +// Check ACL for menu combination +function ADMINS_CHECK_ACL($act, $wht) { global $ADMINS, $ADMINS_ACLS, $_CONFIG, $CACHE; // If action is login or logout allow allways! $default = "allow"; @@ -66,48 +66,38 @@ function ADMINS_CHECK_ACL($act, $wht) // Get admin's ID $aid = GET_ADMIN_ID($_SESSION['admin_login']); - if (!empty($wht)) - { + if (!empty($wht)) { // Check for parent menu: // First get it's action value $parent_action = GET_ACTION("admin", $wht); // Check with this function... $parent = ADMINS_CHECK_ACL($parent_action, ""); - } - else - { + } else { // Anything else is true! $parent = false; } // Shall I test for a main or sub menu? (action or what?) $lines = 0; $acl_mode = "failed"; - if (GET_EXT_VERSION("cache") >= "0.1.2") - { + if (GET_EXT_VERSION("cache") >= "0.1.2") { // Load only from array when there are lines! - if (count($ADMINS_ACLS) > 0) - { + if (count($ADMINS_ACLS) > 0) { // Load ACL from array - foreach ($ADMINS_ACLS['admin_id'] as $id=>$aid_acls) - { - if ($aid == $aid_acls) - { + foreach ($ADMINS_ACLS['admin_id'] as $id=>$aid_acls) { + if ($aid == $aid_acls) { // Okay, one line was found! - if ((!empty($act)) && ($ADMINS_ACLS['action_menu'][$id] == $act)) - { + if ((!empty($act)) && ($ADMINS_ACLS['action_menu'][$id] == $act)) { // Main menu line found $acl_mode = $ADMINS_ACLS['access_mode'][$id]; $lines = 1; } - elseif ((!empty($wht)) && ($ADMINS_ACLS['what_menu'][$id] == $wht)) - { + elseif ((!empty($wht)) && ($ADMINS_ACLS['what_menu'][$id] == $wht)) { // Check sub menu $acl_mode = $ADMINS_ACLS['access_mode'][$id]; $lines = 1; } - if ($lines == 1) - { + if ($lines == 1) { // Count cache hits $_CONFIG['cache_hits']++; break; @@ -116,29 +106,22 @@ function ADMINS_CHECK_ACL($act, $wht) } // No ACL found? - if ($acl_mode == "failed") - { + if ($acl_mode == "failed") { $acl_mode = ""; $lines = 0; } - } - else - { + } else { // No lines here $lines = 0; } - } - else - { + } else { // Old version, so load it from database if (!empty($act)) { // Main menu $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%d AND action_menu='%s' LIMIT 1", array(bigintval($aid), $act), __FILE__, __LINE__); - } - elseif (!empty($wht)) - { + } elseif (!empty($wht)) { // Sub menu $result = SQL_QUERY_ESC("SELECT access_mode FROM "._MYSQL_PREFIX."_admins_acls WHERE admin_id=%d AND what_menu='%s' LIMIT 1", array(bigintval($aid), $wht), __FILE__, __LINE__); @@ -158,20 +141,20 @@ function ADMINS_CHECK_ACL($act, $wht) // Return value return $ret; } + // Create email link to admins's account -function ADMINS_CREATE_EMAIL_LINK($email, $mod="admin") -{ +function ADMINS_CREATE_EMAIL_LINK($email, $mod="admin") { $locked = " AND status='CONFIRMED'"; if (IS_ADMIN()) $locked = ""; - if (strpos("@", $email) > 0) - { + if (strpos("@", $email) > 0) { // Create email link $result = SQL_QUERY_ESC("SELECT id FROM "._MYSQL_PREFIX."_admins WHERE email='%s'".$locked." LIMIT 1", array($email), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { + + // Is there an entry? + if (SQL_NUMROWS($result) == 1) { // Load userid list($uid) = SQL_FETCHROW($result); @@ -181,9 +164,7 @@ WHERE email='%s'".$locked." LIMIT 1", // Free memory SQL_FREERESULT($result); - } - elseif (bigintval($email) > 0) - { + } elseif (bigintval($email) > 0) { // Direct ID given $email = URL."/modules.php?module=".$mod."&what=admins_contct&admin=".bigintval($email); } @@ -191,5 +172,220 @@ WHERE email='%s'".$locked." LIMIT 1", // Return rewritten (?) email address return $email; } + +// Change a lot admin account +function ADMINS_CHANGE_ADMIN_ACCOUNT($POST) { + global $CACHE; + + // Begin the update + $CACHE_UPDATE = "0"; + foreach ($POST['login'] as $id=>$login) { + // Secure ID number + $id = bigintval($id); + + // When both passwords match update admin account + if ($POST['pass1'][$id] == $POST['pass2'][$id]) { + // Save only when both passwords are the same (also when they are empty) + $ADD = ""; $CACHE_UPDATE = "1"; + + // Generate hash + $hash = generateHash($POST['pass1'][$id]); + + // Save password when set + if (!empty($POST['pass1'][$id])) $ADD = sprintf(", password='%s'", SQL_ESCAPE($hash)); + + // Get admin's ID + $salt = substr(GET_ADMIN_HASH($_SESSION['admin_login']), 0, -40); + $aid = GET_ADMIN_ID($_SESSION['admin_login']); + + // Rewrite cookie when it's own account + if ($aid == $id) { + // Timeout + $TIMEOUT = time() + bigintval($_SESSION['admin_to']); + + // Set timeout cookie + set_session("admin_last", time(), $TIMEOUT, COOKIE_PATH); + + if ($login != $_SESSION['admin_login']) { + // Update login cookie + set_session("admin_login", $login, $TIMEOUT, COOKIE_PATH); + + // Update password cookie as well? + if (!empty($ADD)) set_session("admin_md5", $hash, $TIMEOUT, COOKIE_PATH); + } elseif (generateHash($POST['pass1'][$id], $salt) != $_SESSION['admin_md5']) { + // Update password cookie + set_session("admin_md5", $hash, $TIMEOUT, COOKIE_PATH); + } + + } + + // Update admin account + $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET +login='%s'".$ADD.", +email='%s', +default_acl='%s', +la_mode='%s' +WHERE id=%d LIMIT 1", + array( + $login, + $POST['email'][$id], + $POST['mode'][$id], + $POST['la_mode'][$id], + $id +), __FILE__, __LINE__); + + // Admin account saved + $MSG = ADMIN_ACCOUNT_SAVED; + } else { + // Passwords did not match + $MSG = ADMINS_ERROR_PASS_MISMATCH; + } + + // Display message + if (!empty($MSG)) { + LOAD_TEMPLATE("admin_settings_saved", false, "".$MSG.""); + } + } + + // Remove cache file + if ((EXT_IS_ACTIVE("cache")) && ($CACHE_UPDATE == "1")) { + if ($CACHE->cache_file("admins", true)) $CACHE->cache_destroy(); + } +} + +// Make admin accounts editable +function ADMINS_EDIT_ADMIN_ACCOUNTS ($POST) { + // Begin the edit loop + $SW = 2; $OUT = ""; + foreach ($POST['sel'] as $id=>$sel) { + // Secure ID number + $id = bigintval($id); + + // Get the admin's data + $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1", + array($id), __FILE__, __LINE__); + if ((SQL_NUMROWS($result) == 1) && ($sel == 1)) { + // Entry found + $content = SQL_FETCHARRAY($result); + SQL_FREERESULT($result); + + // Prepare some more data for the template + $content['sw'] = $SW; + $content['id'] = $id; + $content['mode'] = ADD_OPTION_LINES("/ARRAY/", array("allow", "deny"), array(ADMINS_ALLOW_MODE, ADMINS_DENY_MODE), $content['mode']); + $content['la_mode'] = ADD_OPTION_LINES("/ARRAY/", array("global", "OLD", "NEW"), array(ADMINS_GLOBAL_LA_SETTING, ADMINS_OLD_LA_SETTING, ADMINS_NEW_LA_SETTING), $content['la_mode']); + + // Load row template and switch color + $OUT .= LOAD_TEMPLATE("admin_edit_admins_row", true, $content); + $SW = 3 - $SW; + } + } + define('__ADMINS_ROWS', $OUT); + + // Load template + LOAD_TEMPLATE("admin_edit_admins"); +} + +// Delete given admin accounts +function ADMINS_DELETE_ADMIN_ACCOUNTS ($POST) { + // Check if this account is the last one which cannot be deleted... + $result_main = SQL_QUERY("SELECT id FROM "._MYSQL_PREFIX."_admins", __FILE__, __LINE__); + $accounts = SQL_NUMROWS($result_main); + SQL_FREERESULT($result_main); + if ($accounts > 1) { + // Delete accounts + $SW = 2; $OUT = ""; + foreach ($POST['sel'] as $id=>$sel) { + // Secure ID number + $id = bigintval($id); + + // Get the admin's data + $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1", + array($id), __FILE__, __LINE__); + if (SQL_NUMROWS($result) == 1) { + // Entry found + $content = SQL_FETCHARRAY($result); + SQL_FREERESULT($result); + $eval = "\$content['mode'] = ADMINS_".strtoupper($content['mode'])."_MODE;"; + eval($eval); + $eval = "\$content['la_mode'] = ADMINS_".strtoupper($content['la_mode'])."_LA_SETTING;"; + eval($eval); + + // Prepare some more data + $content['sw'] = $SW; + $content['id'] = $id; + + // Load row template and switch color + $OUT .= LOAD_TEMPLATE("admin_del_admins_row", true, $content); + $SW = 3 - $SW; + } + } + define('__ADMINS_ROWS', $OUT); + + // Load template + LOAD_TEMPLATE("admin_del_admins"); + } else { + // Cannot delete last account! + LOAD_TEMPLATE("admin_settings_saved", false, ADMIN_ADMINS_CANNOT_DELETE_LAST); + } +} + +// Remove the given accounts +function ADMINS_REMOVE_ADMIN_ACCOUNTS ($POST) { + // Begin removal + $CACHE_UPDATE = "0"; + foreach ($POST['sel'] as $id=>$del) { + // Secure ID number + $id = bigintval($id); + + // Delete only when it's not your own account! + if (($del == 1) && (GET_ADMIN_ID($_SESSION['admin_login']) != $id)) { + // Rewrite his tasks to all admins + $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin='0' WHERE assigned_admin='%s'", + array($id), __FILE__, __LINE__); + + // Remove account + $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1", + array($id), __FILE__, __LINE__); + + $CACHE_UPDATE = "1"; + } + } + + // Remove cache if cache system is activated + if ((EXT_IS_ACTIVE("cache")) && ($CACHE_UPDATE == "1")) { + if ($CACHE->cache_file("admins", true)) $CACHE->cache_destroy(); + } +} + +// List all admin accounts +function ADMINS_LIST_ADMIN_ACCOUNTS() { + // Select all admin accounts + $result = SQL_QUERY("SELECT id, login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins ORDER BY login ASC", __FILE__, __LINE__); + $SW = 2; $OUT = ""; + while ($content = SQL_FETCHARRAY($result)) { + // Compile some variables + $eval = "\$content['mode'] = ADMINS_".strtoupper($content['mode'])."_MODE;"; + eval($eval); + $eval = "\$content['la_mode'] = ADMINS_".strtoupper($content['la_mode'])."_LA_SETTING;"; + eval($eval); + + // Prepare some more data + $content['sw'] = $SW; + $content['email_link'] = CREATE_EMAIL_LINK($content['id']); + + // Load row template and switch color + $OUT .= LOAD_TEMPLATE("admin_list_admins_row", true, $content); + $SW = 3 - $SW; + } + + // Free memory + SQL_FREERESULT($result); + define('__ADMINS_ROWS', $OUT); + + // Load template + LOAD_TEMPLATE("admin_list_admins"); +} + // ?> diff --git a/inc/modules/admin/what-admins_edit.php b/inc/modules/admin/what-admins_edit.php index 80c4301711..7bf777273a 100644 --- a/inc/modules/admin/what-admins_edit.php +++ b/inc/modules/admin/what-admins_edit.php @@ -47,231 +47,31 @@ global $CACHE; if (empty($_POST['sel'])) $_POST['sel'] = array(); // Check if direct admin account was selected -if (!empty($_GET['admin'])) -{ +if (!empty($_GET['admin'])) { // Secure ID number $aid = bigintval($_GET['admin']); $_POST['edit'] = "1"; $_POST['sel'][$aid] = array("1"); } -if ((isset($_POST['edit'])) && (SELECTION_COUNT($_POST['sel']) > 0)) -{ +if ((isset($_POST['edit'])) && (SELECTION_COUNT($_POST['sel']) > 0)) { // Edit account(s) - $SW = 2; $OUT = ""; - foreach ($_POST['sel'] as $id=>$sel) - { - $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1", - array(bigintval($id)), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { - // Entry found - $content = SQL_FETCHARRAY($result); - SQL_FREERESULT($result); - $content['mode'] = ADD_OPTION_LINES("/ARRAY/", array("allow", "deny"), array(ADMINS_ALLOW_MODE, ADMINS_DENY_MODE), $content['mode']); - $content['la_mode'] = ADD_OPTION_LINES("/ARRAY/", array("global", "OLD", "NEW"), array(ADMINS_GLOBAL_LA_SETTING, ADMINS_OLD_LA_SETTING, ADMINS_NEW_LA_SETTING), $content['la_mode']); - - // Prepare some more data for the template - $content['sw'] = $SW; - $content['id'] = $id; - - // Load row template and switch color - $OUT .= LOAD_TEMPLATE("admin_edit_admins_row", true, $content); - $SW = 3 - $SW; - } - } - define('__ADMINS_ROWS', $OUT); - - // Load template - LOAD_TEMPLATE("admin_edit_admins"); -} - elseif ((isset($_POST['change'])) && (sizeof($_POST['login']) > 0)) -{ + ADMINS_EDIT_ACCOUNTS($_POST); +} elseif ((isset($_POST['change'])) && (sizeof($_POST['login']) > 0)) { // Change admin accounts - $CACHE_UPDATE = "0"; - foreach ($_POST['login'] as $id=>$login) - { - // Secure ID number - $id = bigintval($id); - - // When both passwords match update admin account - if ($_POST['pass1'][$id] == $_POST['pass2'][$id]) - { - // Save only when both passwords are the same (also when they are empty) - $ADD = ""; $CACHE_UPDATE = "1"; - - // Generate hash - $hash = generateHash($_POST['pass1'][$id]); - - // Save password when set - if (!empty($_POST['pass1'][$id])) $ADD = ", password='".$hash."'"; - - // Get admin's ID - $salt = substr(GET_ADMIN_HASH($_SESSION['admin_login']), 0, -40); - $aid = GET_ADMIN_ID($_SESSION['admin_login']); - - // Rewrite cookie when it's own account - if ($aid == $id) - { - // Timeout - $TIMEOUT = time() + bigintval($_SESSION['admin_to']); - - // Set timeout cookie - set_session("admin_last", time(), $TIMEOUT, COOKIE_PATH); - - if ($login != $_SESSION['admin_login']) - { - // Update login cookie - set_session("admin_login", $login, $TIMEOUT, COOKIE_PATH); - - // Update password cookie as well? - if (!empty($ADD)) set_session("admin_md5", $hash, $TIMEOUT, COOKIE_PATH); - } - elseif (generateHash($_POST['pass1'][$id], $salt) != $_SESSION['admin_md5']) - { - // Update password cookie - set_session("admin_md5", $hash, $TIMEOUT, COOKIE_PATH); - } - - } - - // Update admin account - $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_admins SET -login='%s'".$ADD.", -email='%s', -default_acl='%s', -la_mode='%s' -WHERE id=%d LIMIT 1", - array( - $login, - $_POST['email'][$id], - $_POST['mode'][$id], - $_POST['la_mode'][$id], - $id -), __FILE__, __LINE__); - - // Admin account saved - $MSG = ADMIN_ACCOUNT_SAVED; - } - else - { - // Passwords did not match - $MSG = ADMINS_ERROR_PASS_MISMATCH; - } - } - - // Remove cache file - if ((EXT_IS_ACTIVE("cache")) && ($CACHE_UPDATE == "1")) - { - if ($CACHE->cache_file("admins", true)) $CACHE->cache_destroy(); - } - - // Display message - if (!empty($MSG)) - { - LOAD_TEMPLATE("admin_settings_saved", false, "".$MSG.""); - } -} - elseif ((isset($_POST['del'])) && (SELECTION_COUNT($_POST['sel']) > 0)) -{ - // Check if this account is the last one which cannot be deleted... - $result_main = SQL_QUERY("SELECT id FROM "._MYSQL_PREFIX."_admins", __FILE__, __LINE__); - $accounts = SQL_NUMROWS($result_main); - SQL_FREERESULT($result_main); - if ($accounts > 1) - { - // Delete accounts - $SW = 2; $OUT = ""; - foreach ($_POST['sel'] as $id=>$sel) - { - $result = SQL_QUERY_ESC("SELECT login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1", - array(bigintval($id)), __FILE__, __LINE__); - if (SQL_NUMROWS($result) == 1) - { - // Entry found - $content = SQL_FETCHARRAY($result); - SQL_FREERESULT($result); - $eval = "\$content['mode'] = ADMINS_".strtoupper($content['mode'])."_MODE;"; - eval($eval); - $eval = "\$content['la_mode'] = ADMINS_".strtoupper($content['la_mode'])."_LA_SETTING;"; - eval($eval); - - // Prepare some more data - $content['sw'] = $SW; - $content['id'] = $id; - - // Load row template and switch color - $OUT .= LOAD_TEMPLATE("admin_del_admins_row", true, $content); - $SW = 3 - $SW; - } - } - define('__ADMINS_ROWS', $OUT); - - // Load template - LOAD_TEMPLATE("admin_del_admins"); - } - else - { - // Cannot delete last account! - LOAD_TEMPLATE("admin_settings_saved", false, ADMIN_ADMINS_CANNOT_DELETE_LAST); - } -} - else -{ - if ((isset($_POST['remove'])) && (SELECTION_COUNT($_POST['sel']) > 0)) - { + ADMINS_CHANGE_ADMIN_ACCOUNT($_POST); +} elseif ((isset($_POST['del'])) && (SELECTION_COUNT($_POST['sel']) > 0)) { + // Show admin accounts for deletetion + ADMINS_DELETE_ADMIN_ACCOUNTS($_POST); +} else { + if ((isset($_POST['remove'])) && (SELECTION_COUNT($_POST['sel']) > 0)) { // Remove accounts now - $CACHE_UPDATE = "0"; - foreach ($_POST['sel'] as $id=>$del) - { - // Delete only when it's not your own account! - if (($del == 1) && (GET_ADMIN_ID($_SESSION['admin_login']) != $id)) - { - // Rewrite his tasks to all admins - $result = SQL_QUERY_ESC("UPDATE "._MYSQL_PREFIX."_task_system SET assigned_admin='0' WHERE assigned_admin='%s'", - array(bigintval($id)), __FILE__, __LINE__); - - // Remove account - $result = SQL_QUERY_ESC("DELETE LOW_PRIORITY FROM "._MYSQL_PREFIX."_admins WHERE id=%d LIMIT 1", - array(bigintval($id)), __FILE__, __LINE__); - - $CACHE_UPDATE = "1"; - } - } - - // Remove cache if cache system is activated - if ((EXT_IS_ACTIVE("cache")) && ($CACHE_UPDATE == "1")) - { - if ($CACHE->cache_file("admins", true)) $CACHE->cache_destroy(); - } + ADMINS_REMOVE_ADMIN_ACCOUNTS($_POST); } // List all admin accounts - $result = SQL_QUERY("SELECT id, login, email, default_acl AS mode, la_mode FROM "._MYSQL_PREFIX."_admins ORDER BY login", __FILE__, __LINE__); - $SW = 2; $OUT = ""; - while ($content = SQL_FETCHARRAY($result)) - { - // Compile some variables - $eval = "\$content['mode'] = ADMINS_".strtoupper($content['mode'])."_MODE;"; - eval($eval); - $eval = "\$content['la_mode'] = ADMINS_".strtoupper($content['la_mode'])."_LA_SETTING;"; - eval($eval); - - // Prepare some more data - $content['sw'] = $SW; - $content['email_link'] = CREATE_EMAIL_LINK($content['id']); - - // Load row template and switch color - $OUT .= LOAD_TEMPLATE("admin_list_admins_row", true, $content); - $SW = 3 - $SW; - } - - // Free memory - SQL_FREERESULT($result); - define('__ADMINS_ROWS', $OUT); - - // Load template - LOAD_TEMPLATE("admin_list_admins"); + ADMINS_LIST_ADMIN_ACCOUNTS(); } + // ?> -- 2.30.2