1
+ − 1
<?php
+ − 2
+ − 3
/*
+ − 4
* Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
294
+ − 5
* Version 1.0.5 (Ferrishyn)
1
+ − 6
* Copyright (C) 2006-2007 Dan Fuhry
+ − 7
* sessions.php - everything related to security and user management
+ − 8
*
+ − 9
* This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
+ − 10
* as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+ − 11
*
+ − 12
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ − 13
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
+ − 14
*/
+ − 15
+ − 16
// Prepare a string for insertion into a MySQL database
+ − 17
function filter($str) { return $db->escape($str); }
+ − 18
+ − 19
/**
+ − 20
* Anything and everything related to security and user management. This includes AES encryption, which is illegal in some countries.
+ − 21
* Documenting the API was not easy - I hope you folks enjoy it.
+ − 22
* @package Enano
+ − 23
* @subpackage Session manager
+ − 24
* @category security, user management, logins, etc.
+ − 25
*/
+ − 26
+ − 27
class sessionManager {
+ − 28
+ − 29
# Variables
+ − 30
+ − 31
/**
+ − 32
* Whether we're logged in or not
+ − 33
* @var bool
+ − 34
*/
+ − 35
+ − 36
var $user_logged_in = false;
+ − 37
+ − 38
/**
+ − 39
* Our current low-privilege session key
+ − 40
* @var string
+ − 41
*/
+ − 42
+ − 43
var $sid;
+ − 44
+ − 45
/**
+ − 46
* Username of currently logged-in user, or IP address if not logged in
+ − 47
* @var string
+ − 48
*/
+ − 49
+ − 50
var $username;
+ − 51
+ − 52
/**
+ − 53
* User ID of currently logged-in user, or -1 if not logged in
+ − 54
* @var int
+ − 55
*/
+ − 56
+ − 57
var $user_id;
+ − 58
+ − 59
/**
+ − 60
* Real name of currently logged-in user, or blank if not logged in
+ − 61
* @var string
+ − 62
*/
+ − 63
+ − 64
var $real_name;
+ − 65
+ − 66
/**
+ − 67
* E-mail address of currently logged-in user, or blank if not logged in
+ − 68
* @var string
+ − 69
*/
+ − 70
+ − 71
var $email;
+ − 72
+ − 73
/**
31
+ − 74
* List of "extra" user information fields (IM handles, etc.)
+ − 75
* @var array (associative)
+ − 76
*/
+ − 77
+ − 78
var $user_extra;
+ − 79
+ − 80
/**
1
+ − 81
* User level of current user
+ − 82
* USER_LEVEL_GUEST: guest
+ − 83
* USER_LEVEL_MEMBER: regular user
+ − 84
* USER_LEVEL_CHPREF: default - pseudo-level that allows changing password and e-mail address (requires re-authentication)
+ − 85
* USER_LEVEL_MOD: moderator
+ − 86
* USER_LEVEL_ADMIN: administrator
+ − 87
* @var int
+ − 88
*/
+ − 89
+ − 90
var $user_level;
+ − 91
+ − 92
/**
+ − 93
* High-privilege session key
+ − 94
* @var string or false if not running on high-level authentication
+ − 95
*/
+ − 96
+ − 97
var $sid_super;
+ − 98
+ − 99
/**
+ − 100
* The user's theme preference, defaults to $template->default_theme
+ − 101
* @var string
+ − 102
*/
+ − 103
+ − 104
var $theme;
+ − 105
+ − 106
/**
+ − 107
* The user's style preference, or style auto-detected based on theme if not logged in
+ − 108
* @var string
+ − 109
*/
+ − 110
+ − 111
var $style;
+ − 112
+ − 113
/**
+ − 114
* Signature of current user - appended to comments, etc.
+ − 115
* @var string
+ − 116
*/
+ − 117
+ − 118
var $signature;
+ − 119
+ − 120
/**
+ − 121
* UNIX timestamp of when we were registered, or 0 if not logged in
+ − 122
* @var int
+ − 123
*/
+ − 124
+ − 125
var $reg_time;
+ − 126
+ − 127
/**
+ − 128
* MD5 hash of the current user's password, if applicable
+ − 129
* @var string OR bool false
+ − 130
*/
+ − 131
+ − 132
var $password_hash;
+ − 133
+ − 134
/**
+ − 135
* The number of unread private messages this user has.
+ − 136
* @var int
+ − 137
*/
+ − 138
+ − 139
var $unread_pms = 0;
+ − 140
+ − 141
/**
+ − 142
* AES key used to encrypt passwords and session key info - irreversibly destroyed when disallow_password_grab() is called
+ − 143
* @var string
+ − 144
*/
+ − 145
+ − 146
var $private_key;
+ − 147
+ − 148
/**
+ − 149
* Regex that defines a valid username, minus the ^ and $, these are added later
+ − 150
* @var string
+ − 151
*/
+ − 152
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 153
var $valid_username = '([^<>&\?\'"%\n\r\t\a\/]+)';
1
+ − 154
+ − 155
/**
+ − 156
* What we're allowed to do as far as permissions go. This changes based on the value of the "auth" URI param.
+ − 157
* @var string
+ − 158
*/
+ − 159
+ − 160
var $auth_level = -1;
+ − 161
+ − 162
/**
+ − 163
* State variable to track if a session timed out
+ − 164
* @var bool
+ − 165
*/
+ − 166
+ − 167
var $sw_timed_out = false;
+ − 168
+ − 169
/**
+ − 170
* Switch to track if we're started or not.
+ − 171
* @access private
+ − 172
* @var bool
+ − 173
*/
+ − 174
+ − 175
var $started = false;
+ − 176
+ − 177
/**
+ − 178
* Switch to control compatibility mode (for older Enano websites being upgraded)
+ − 179
* @access private
+ − 180
* @var bool
+ − 181
*/
+ − 182
+ − 183
var $compat = false;
+ − 184
+ − 185
/**
+ − 186
* Our list of permission types.
+ − 187
* @access private
+ − 188
* @var array
+ − 189
*/
+ − 190
+ − 191
var $acl_types = Array();
+ − 192
+ − 193
/**
+ − 194
* The list of descriptions for the permission types
+ − 195
* @var array
+ − 196
*/
+ − 197
+ − 198
var $acl_descs = Array();
+ − 199
+ − 200
/**
+ − 201
* A list of dependencies for ACL types.
+ − 202
* @var array
+ − 203
*/
+ − 204
+ − 205
var $acl_deps = Array();
+ − 206
+ − 207
/**
202
+ − 208
* Our tell-all list of permissions. Do not even try to change this.
+ − 209
* @access private
1
+ − 210
* @var array
+ − 211
*/
+ − 212
+ − 213
var $perms = Array();
+ − 214
+ − 215
/**
+ − 216
* A cache variable - saved after sitewide permissions are checked but before page-specific permissions.
+ − 217
* @var array
+ − 218
* @access private
+ − 219
*/
+ − 220
+ − 221
var $acl_base_cache = Array();
+ − 222
+ − 223
/**
+ − 224
* Stores the scope information for ACL types.
+ − 225
* @var array
+ − 226
* @access private
+ − 227
*/
+ − 228
+ − 229
var $acl_scope = Array();
+ − 230
+ − 231
/**
+ − 232
* Array to track which default permissions are being used
+ − 233
* @var array
+ − 234
* @access private
+ − 235
*/
+ − 236
+ − 237
var $acl_defaults_used = Array();
+ − 238
+ − 239
/**
+ − 240
* Array to track group membership.
+ − 241
* @var array
+ − 242
*/
+ − 243
+ − 244
var $groups = Array();
+ − 245
+ − 246
/**
+ − 247
* Associative array to track group modship.
+ − 248
* @var array
+ − 249
*/
+ − 250
+ − 251
var $group_mod = Array();
+ − 252
+ − 253
# Basic functions
+ − 254
+ − 255
/**
+ − 256
* Constructor.
+ − 257
*/
+ − 258
+ − 259
function __construct()
+ − 260
{
+ − 261
global $db, $session, $paths, $template, $plugins; // Common objects
215
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 262
232
2b60c89dc27f
Fixed a few major bugs with the upgrade script and the config file not getting loaded properly due to IN_ENANO_INSTALL
Dan
diff
changeset
+ − 263
if ( defined('IN_ENANO_INSTALL') && !defined('IN_ENANO_UPGRADE') )
215
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 264
{
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 265
@include(ENANO_ROOT.'/config.new.php');
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 266
}
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 267
else
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 268
{
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 269
@include(ENANO_ROOT.'/config.php');
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 270
}
58477ab3937f
Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually
Dan
diff
changeset
+ − 271
1
+ − 272
unset($dbhost, $dbname, $dbuser, $dbpasswd);
+ − 273
if(isset($crypto_key))
+ − 274
{
+ − 275
$this->private_key = $crypto_key;
+ − 276
$this->private_key = hexdecode($this->private_key);
+ − 277
}
+ − 278
else
+ − 279
{
+ − 280
if(is_writable(ENANO_ROOT.'/config.php'))
+ − 281
{
+ − 282
// Generate and stash a private key
+ − 283
// This should only happen during an automated silent gradual migration to the new encryption platform.
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 284
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 285
$this->private_key = $aes->gen_readymade_key();
+ − 286
+ − 287
$config = file_get_contents(ENANO_ROOT.'/config.php');
+ − 288
if(!$config)
+ − 289
{
+ − 290
die('$session->__construct(): can\'t get the contents of config.php');
+ − 291
}
+ − 292
+ − 293
$config = str_replace("?>", "\$crypto_key = '{$this->private_key}';\n?>", $config);
+ − 294
// And while we're at it...
+ − 295
$config = str_replace('MIDGET_INSTALLED', 'ENANO_INSTALLED', $config);
+ − 296
$fh = @fopen(ENANO_ROOT.'/config.php', 'w');
+ − 297
if ( !$fh )
+ − 298
{
+ − 299
die('$session->__construct(): Couldn\'t open config file for writing to store the private key, I tried to avoid something like this...');
+ − 300
}
+ − 301
+ − 302
fwrite($fh, $config);
+ − 303
fclose($fh);
+ − 304
}
+ − 305
else
+ − 306
{
+ − 307
die_semicritical('Crypto error', '<p>No private key was found in the config file, and we can\'t generate one because we don\'t have write access to the config file. Please CHMOD config.php to 666 or 777 and reload this page.</p>');
+ − 308
}
+ − 309
}
+ − 310
// Check for compatibility mode
+ − 311
if(defined('IN_ENANO_INSTALL'))
+ − 312
{
+ − 313
$q = $db->sql_query('SELECT old_encryption FROM '.table_prefix.'users LIMIT 1;');
+ − 314
if(!$q)
+ − 315
{
+ − 316
$error = mysql_error();
+ − 317
if(strstr($error, "Unknown column 'old_encryption'"))
+ − 318
$this->compat = true;
+ − 319
else
+ − 320
$db->_die('This should never happen and is a bug - the only error that was supposed to happen here didn\'t happen. (sessions.php in constructor, during compat mode check)');
+ − 321
}
+ − 322
$db->free_result();
+ − 323
}
+ − 324
}
+ − 325
+ − 326
/**
+ − 327
* PHP 4 compatible constructor.
+ − 328
*/
+ − 329
+ − 330
function sessionManager()
+ − 331
{
+ − 332
$this->__construct();
+ − 333
}
+ − 334
+ − 335
/**
+ − 336
* Wrapper function to sanitize strings for MySQL and HTML
+ − 337
* @param string $text The text to sanitize
+ − 338
* @return string
+ − 339
*/
+ − 340
+ − 341
function prepare_text($text)
+ − 342
{
+ − 343
global $db;
+ − 344
return $db->escape(htmlspecialchars($text));
+ − 345
}
+ − 346
+ − 347
/**
+ − 348
* Makes a SQL query and handles error checking
+ − 349
* @param string $query The SQL query to make
+ − 350
* @return resource
+ − 351
*/
+ − 352
+ − 353
function sql($query)
+ − 354
{
+ − 355
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 356
$result = $db->sql_query($query);
+ − 357
if(!$result)
+ − 358
{
+ − 359
$db->_die('The error seems to have occurred somewhere in the session management code.');
+ − 360
}
+ − 361
return $result;
+ − 362
}
+ − 363
+ − 364
# Session restoration and permissions
+ − 365
+ − 366
/**
+ − 367
* Initializes the basic state of things, including most user prefs, login data, cookie stuff
+ − 368
*/
+ − 369
+ − 370
function start()
+ − 371
{
+ − 372
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 373
if($this->started) return;
+ − 374
$this->started = true;
+ − 375
$user = false;
+ − 376
if(isset($_COOKIE['sid']))
+ − 377
{
+ − 378
if($this->compat)
+ − 379
{
+ − 380
$userdata = $this->compat_validate_session($_COOKIE['sid']);
+ − 381
}
+ − 382
else
+ − 383
{
+ − 384
$userdata = $this->validate_session($_COOKIE['sid']);
+ − 385
}
+ − 386
if(is_array($userdata))
+ − 387
{
+ − 388
$data = RenderMan::strToPageID($paths->get_pageid_from_url());
+ − 389
+ − 390
if(!$this->compat && $userdata['account_active'] != 1 && $data[1] != 'Special' && $data[1] != 'Admin')
+ − 391
{
+ − 392
$this->logout();
+ − 393
$a = getConfig('account_activation');
+ − 394
switch($a)
+ − 395
{
+ − 396
case 'none':
+ − 397
default:
+ − 398
$solution = 'Your account was most likely deactivated by an administrator. Please contact the site administration for further assistance.';
+ − 399
break;
+ − 400
case 'user':
+ − 401
$solution = 'Please check your e-mail; you should have been sent a message with instructions on how to activate your account. If you do not receive an e-mail from this site within 24 hours, please contact the site administration for further assistance.';
+ − 402
break;
+ − 403
case 'admin':
127
+ − 404
$solution = 'This website has been configured so that all user accounts must be activated by the administrator before they can be used, so your account will most likely be activated the next time an administrator visits the site.';
1
+ − 405
break;
+ − 406
}
127
+ − 407
+ − 408
// admin activation request opportunity
+ − 409
$q = $db->sql_query('SELECT 1 FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' AND edit_summary=\'' . $db->escape($userdata['username']) . '\';');
+ − 410
if ( !$q )
+ − 411
$db->_die();
+ − 412
+ − 413
$can_request = ( $db->numrows() < 1 );
+ − 414
$db->free_result();
+ − 415
+ − 416
if ( isset($_POST['logout']) )
+ − 417
{
+ − 418
$this->sid = $_COOKIE['sid'];
+ − 419
$this->user_logged_in = true;
+ − 420
$this->user_id = intval($userdata['user_id']);
+ − 421
$this->username = $userdata['username'];
+ − 422
$this->auth_level = USER_LEVEL_MEMBER;
+ − 423
$this->user_level = USER_LEVEL_MEMBER;
+ − 424
$this->logout();
+ − 425
redirect(scriptPath . '/', 'Logged out', 'You have successfully been logged out. All cookies cleared.', 4);
+ − 426
}
+ − 427
+ − 428
if ( $can_request && !isset($_POST['activation_request']) )
+ − 429
{
+ − 430
$form = '<p>If you are having trouble or did not receive the e-mail, you can request account activation from the administrators of this site.</p>
+ − 431
<form action="' . makeUrlNS('System', 'ActivateStub') . '" method="post">
+ − 432
<p><input type="submit" name="activation_request" value="Request account activation" /> <input type="submit" name="logout" value="Log out" /></p>
+ − 433
</form>';
+ − 434
}
+ − 435
else
+ − 436
{
+ − 437
if ( $can_request && isset($_POST['activation_request']) )
+ − 438
{
+ − 439
$this->admin_activation_request($userdata['username']);
+ − 440
$form = '<p>A request has just been sent to the administrators of this site. They will be able to activate your account or send you another activation e-mail if needed.</p>
+ − 441
<form action="' . makeUrlNS('System', 'ActivateStub') . '" method="post">
+ − 442
<p><input type="submit" name="logout" value="Log out" /></p>
+ − 443
</form>';
+ − 444
}
+ − 445
else
+ − 446
{
+ − 447
$form = '<p>There is an active request in the administrators\' control panel for your account to be activated.</p>
+ − 448
<form action="' . makeUrlNS('System', 'ActivateStub') . '" method="post">
+ − 449
<p><input type="submit" name="logout" value="Log out" /></p>
+ − 450
</form>';
+ − 451
}
+ − 452
}
+ − 453
+ − 454
die_semicritical('Account error', '<p>It appears that your user account has not yet been activated. '.$solution.'</p>' . $form);
1
+ − 455
}
+ − 456
+ − 457
$this->sid = $_COOKIE['sid'];
+ − 458
$this->user_logged_in = true;
+ − 459
$this->user_id = intval($userdata['user_id']);
+ − 460
$this->username = $userdata['username'];
+ − 461
$this->password_hash = $userdata['password'];
+ − 462
$this->user_level = intval($userdata['user_level']);
+ − 463
$this->real_name = $userdata['real_name'];
+ − 464
$this->email = $userdata['email'];
+ − 465
$this->unread_pms = $userdata['num_pms'];
+ − 466
if(!$this->compat)
+ − 467
{
+ − 468
$this->theme = $userdata['theme'];
+ − 469
$this->style = $userdata['style'];
+ − 470
$this->signature = $userdata['signature'];
+ − 471
$this->reg_time = $userdata['reg_time'];
+ − 472
}
+ − 473
// Small security risk here - it allows someone who has already authenticated as an administrator to store the "super" key in
+ − 474
// the cookie. Change this to USER_LEVEL_MEMBER to override that. The same 15-minute restriction applies to this "exploit".
+ − 475
$this->auth_level = $userdata['auth_level'];
+ − 476
if(!isset($template->named_theme_list[$this->theme]))
+ − 477
{
+ − 478
if($this->compat || !is_object($template))
+ − 479
{
+ − 480
$this->theme = 'oxygen';
+ − 481
$this->style = 'bleu';
+ − 482
}
+ − 483
else
+ − 484
{
+ − 485
$this->theme = $template->default_theme;
+ − 486
$this->style = $template->default_style;
+ − 487
}
+ − 488
}
+ − 489
$user = true;
+ − 490
+ − 491
if(isset($_REQUEST['auth']) && !$this->sid_super)
+ − 492
{
+ − 493
// Now he thinks he's a moderator. Or maybe even an administrator. Let's find out if he's telling the truth.
+ − 494
if($this->compat)
+ − 495
{
+ − 496
$key = $_REQUEST['auth'];
+ − 497
$super = $this->compat_validate_session($key);
+ − 498
}
+ − 499
else
+ − 500
{
+ − 501
$key = strrev($_REQUEST['auth']);
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 502
if ( !empty($key) && ( strlen($key) / 2 ) % 4 == 0 )
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 503
{
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 504
$super = $this->validate_session($key);
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 505
}
1
+ − 506
}
+ − 507
if(is_array($super))
+ − 508
{
+ − 509
$this->auth_level = intval($super['auth_level']);
+ − 510
$this->sid_super = $_REQUEST['auth'];
+ − 511
}
+ − 512
}
+ − 513
}
+ − 514
}
+ − 515
if(!$user)
+ − 516
{
+ − 517
//exit;
+ − 518
$this->register_guest_session();
+ − 519
}
+ − 520
if(!$this->compat)
+ − 521
{
+ − 522
// init groups
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 523
$q = $this->sql('SELECT g.group_name,g.group_id,m.is_mod FROM '.table_prefix.'groups AS g' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 524
. ' LEFT JOIN '.table_prefix.'group_members AS m' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 525
. ' ON g.group_id=m.group_id' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 526
. ' WHERE ( m.user_id='.$this->user_id.'' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 527
. ' OR g.group_name=\'Everyone\')' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 528
. ' ' . ( enano_version() == '1.0RC1' ? '' : 'AND ( m.pending != 1 OR m.pending IS NULL )' ) . '' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 529
. ' ORDER BY group_id ASC;'); // Make sure "Everyone" comes first so the permissions can be overridden
1
+ − 530
if($row = $db->fetchrow())
+ − 531
{
+ − 532
do {
+ − 533
$this->groups[$row['group_id']] = $row['group_name'];
+ − 534
$this->group_mod[$row['group_id']] = ( intval($row['is_mod']) == 1 );
+ − 535
} while($row = $db->fetchrow());
+ − 536
}
+ − 537
else
+ − 538
{
+ − 539
die('No group info');
+ − 540
}
+ − 541
}
+ − 542
$this->check_banlist();
+ − 543
+ − 544
if ( isset ( $_GET['printable'] ) )
+ − 545
{
+ − 546
$this->theme = 'printable';
+ − 547
$this->style = 'default';
+ − 548
}
+ − 549
+ − 550
}
+ − 551
+ − 552
# Logins
+ − 553
+ − 554
/**
+ − 555
* Attempts to perform a login using crypto functions
+ − 556
* @param string $username The username
+ − 557
* @param string $aes_data The encrypted password, hex-encoded
+ − 558
* @param string $aes_key The MD5 hash of the encryption key, hex-encoded
+ − 559
* @param string $challenge The 256-bit MD5 challenge string - first 128 bits should be the hash, the last 128 should be the challenge salt
+ − 560
* @param int $level The privilege level we're authenticating for, defaults to 0
+ − 561
* @return string 'success' on success, or error string on failure
+ − 562
*/
+ − 563
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 564
function login_with_crypto($username, $aes_data, $aes_key_id, $challenge, $level = USER_LEVEL_MEMBER)
1
+ − 565
{
+ − 566
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 567
+ − 568
$privcache = $this->private_key;
+ − 569
+ − 570
// Instanciate the Rijndael encryption object
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 571
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 572
+ − 573
// Fetch our decryption key
+ − 574
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 575
$aes_key = $this->fetch_public_key($aes_key_id);
235
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 576
if ( !$aes_key )
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 577
{
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 578
// It could be that our key cache is full. If it seems larger than 65KB, clear it
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 579
if ( strlen(getConfig('login_key_cache')) > 65000 )
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 580
{
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 581
setConfig('login_key_cache', '');
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 582
return 'It seems that the list of encryption keys used for login information has reached its maximum length, thus preventing new keys from being inserted. The list has been automatically cleared. Please try logging in again; if you are still unable to log in, please contact the site administration.';
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 583
}
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 584
return 'Couldn\'t look up public key "'.htmlspecialchars($aes_key_id).'" for decryption';
235
b3cfaf0a505c
Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long
Dan
diff
changeset
+ − 585
}
1
+ − 586
+ − 587
// Convert the key to a binary string
+ − 588
$bin_key = hexdecode($aes_key);
+ − 589
+ − 590
if(strlen($bin_key) != AES_BITS / 8)
+ − 591
return 'The decryption key is the wrong length';
+ − 592
+ − 593
// Decrypt our password
+ − 594
$password = $aes->decrypt($aes_data, $bin_key, ENC_HEX);
+ − 595
+ − 596
// Initialize our success switch
+ − 597
$success = false;
+ − 598
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 599
// Escaped username
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 600
$username = str_replace('_', ' ', $username);
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 601
$db_username_lower = $this->prepare_text(strtolower($username));
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 602
$db_username = $this->prepare_text($username);
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 603
1
+ − 604
// Select the user data from the table, and decrypt that so we can verify the password
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 605
$this->sql('SELECT password,old_encryption,user_id,user_level,theme,style,temp_password,temp_password_time FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=\''.$db_username_lower.'\' OR username=\'' . $db_username . '\';');
1
+ − 606
if($db->numrows() < 1)
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 607
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 608
// This wasn't logged in <1.0.2, dunno how it slipped through
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 609
if($level > USER_LEVEL_MEMBER)
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 610
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 611
else
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 612
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
177
+ − 613
return "The username and/or password is incorrect.";
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 614
}
1
+ − 615
$row = $db->fetchrow();
+ − 616
+ − 617
// Check to see if we're logging in using a temporary password
+ − 618
+ − 619
if((intval($row['temp_password_time']) + 3600*24) > time() )
+ − 620
{
+ − 621
$temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX );
+ − 622
if( $temp_pass == $password )
+ − 623
{
+ − 624
$url = makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']);
+ − 625
+ − 626
$code = $plugins->setHook('login_password_reset');
+ − 627
foreach ( $code as $cmd )
+ − 628
{
+ − 629
eval($cmd);
+ − 630
}
+ − 631
+ − 632
redirect($url, 'Login sucessful', 'Please wait while you are transferred to the Password Reset form.');
+ − 633
exit;
+ − 634
}
+ − 635
}
+ − 636
+ − 637
if($row['old_encryption'] == 1)
+ − 638
{
+ − 639
// The user's password is stored using the obsolete and insecure MD5 algorithm, so we'll update the field with the new password
+ − 640
if(md5($password) == $row['password'])
+ − 641
{
+ − 642
$pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 643
$this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';');
+ − 644
$success = true;
+ − 645
}
+ − 646
}
+ − 647
else
+ − 648
{
+ − 649
// Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match; if so then do challenge authentication
+ − 650
$real_pass = $aes->decrypt(hexdecode($row['password']), $this->private_key, ENC_BINARY);
+ − 651
if($password == $real_pass)
+ − 652
{
+ − 653
// Yay! We passed AES authentication, now do an MD5 challenge check to make sure we weren't spoofed
+ − 654
$chal = substr($challenge, 0, 32);
+ − 655
$salt = substr($challenge, 32, 32);
+ − 656
$correct_challenge = md5( $real_pass . $salt );
+ − 657
if($chal == $correct_challenge)
+ − 658
$success = true;
+ − 659
}
+ − 660
}
+ − 661
if($success)
+ − 662
{
+ − 663
if($level > $row['user_level'])
+ − 664
return 'You are not authorized for this level of access.';
+ − 665
+ − 666
$sess = $this->register_session(intval($row['user_id']), $username, $password, $level);
+ − 667
if($sess)
+ − 668
{
+ − 669
$this->username = $username;
+ − 670
$this->user_id = intval($row['user_id']);
+ − 671
$this->theme = $row['theme'];
+ − 672
$this->style = $row['style'];
+ − 673
+ − 674
if($level > USER_LEVEL_MEMBER)
+ − 675
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 676
else
+ − 677
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 678
+ − 679
$code = $plugins->setHook('login_success');
+ − 680
foreach ( $code as $cmd )
+ − 681
{
+ − 682
eval($cmd);
+ − 683
}
+ − 684
return 'success';
+ − 685
}
+ − 686
else
+ − 687
return 'Your login credentials were correct, but an internal error occurred while registering the session key in the database.';
+ − 688
}
+ − 689
else
+ − 690
{
+ − 691
if($level > USER_LEVEL_MEMBER)
+ − 692
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 693
else
+ − 694
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 695
+ − 696
return 'The username and/or password is incorrect.';
+ − 697
}
+ − 698
}
+ − 699
+ − 700
/**
+ − 701
* Attempts to login without using crypto stuff, mainly for use when the other side doesn't like Javascript
+ − 702
* This method of authentication is inherently insecure, there's really nothing we can do about it except hope and pray that everyone moves to Firefox
+ − 703
* Technically it still uses crypto, but it only decrypts the password already stored, which is (obviously) required for authentication
+ − 704
* @param string $username The username
+ − 705
* @param string $password The password -OR- the MD5 hash of the password if $already_md5ed is true
+ − 706
* @param bool $already_md5ed This should be set to true if $password is an MD5 hash, and should be false if it's plaintext. Defaults to false.
+ − 707
* @param int $level The privilege level we're authenticating for, defaults to 0
+ − 708
*/
+ − 709
+ − 710
function login_without_crypto($username, $password, $already_md5ed = false, $level = USER_LEVEL_MEMBER)
+ − 711
{
+ − 712
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 713
+ − 714
$pass_hashed = ( $already_md5ed ) ? $password : md5($password);
+ − 715
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 716
// Replace underscores with spaces in username
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 717
// (Added in 1.0.2)
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 718
$username = str_replace('_', ' ', $username);
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 719
1
+ − 720
// Perhaps we're upgrading Enano?
+ − 721
if($this->compat)
+ − 722
{
+ − 723
return $this->login_compat($username, $pass_hashed, $level);
+ − 724
}
+ − 725
+ − 726
// Instanciate the Rijndael encryption object
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 727
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 728
+ − 729
// Initialize our success switch
+ − 730
$success = false;
+ − 731
+ − 732
// Retrieve the real password from the database
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 733
$this->sql('SELECT password,old_encryption,user_id,user_level,temp_password,temp_password_time FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=\''.$this->prepare_text(strtolower($username)).'\';');
177
+ − 734
if ( $db->numrows() < 1 )
+ − 735
{
+ − 736
// This wasn't logged in <1.0.2, dunno how it slipped through
+ − 737
if($level > USER_LEVEL_MEMBER)
+ − 738
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 739
else
+ − 740
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 741
return "The username and/or password is incorrect.";
+ − 742
}
1
+ − 743
$row = $db->fetchrow();
+ − 744
+ − 745
// Check to see if we're logging in using a temporary password
+ − 746
+ − 747
if((intval($row['temp_password_time']) + 3600*24) > time() )
+ − 748
{
+ − 749
$temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX );
+ − 750
if( md5($temp_pass) == $pass_hashed )
+ − 751
{
+ − 752
$code = $plugins->setHook('login_password_reset');
+ − 753
foreach ( $code as $cmd )
+ − 754
{
+ − 755
eval($cmd);
+ − 756
}
+ − 757
+ − 758
header('Location: ' . makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']) );
+ − 759
+ − 760
exit;
+ − 761
}
+ − 762
}
+ − 763
+ − 764
if($row['old_encryption'] == 1)
+ − 765
{
+ − 766
// The user's password is stored using the obsolete and insecure MD5 algorithm - we'll update the field with the new password
+ − 767
if($pass_hashed == $row['password'] && !$already_md5ed)
+ − 768
{
+ − 769
$pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 770
$this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';');
+ − 771
$success = true;
+ − 772
}
+ − 773
elseif($pass_hashed == $row['password'] && $already_md5ed)
+ − 774
{
+ − 775
// We don't have the real password so don't bother with encrypting it, just call it success and get out of here
+ − 776
$success = true;
+ − 777
}
+ − 778
}
+ − 779
else
+ − 780
{
+ − 781
// Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match
+ − 782
$real_pass = $aes->decrypt($row['password'], $this->private_key);
+ − 783
if($pass_hashed == md5($real_pass))
+ − 784
{
+ − 785
$success = true;
+ − 786
}
+ − 787
}
+ − 788
if($success)
+ − 789
{
+ − 790
if((int)$level > (int)$row['user_level'])
+ − 791
return 'You are not authorized for this level of access.';
+ − 792
$sess = $this->register_session(intval($row['user_id']), $username, $real_pass, $level);
+ − 793
if($sess)
+ − 794
{
+ − 795
if($level > USER_LEVEL_MEMBER)
+ − 796
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 797
else
+ − 798
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 799
+ − 800
$code = $plugins->setHook('login_success');
+ − 801
foreach ( $code as $cmd )
+ − 802
{
+ − 803
eval($cmd);
+ − 804
}
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 805
1
+ − 806
return 'success';
+ − 807
}
+ − 808
else
+ − 809
return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.';
+ − 810
}
+ − 811
else
+ − 812
{
+ − 813
if($level > USER_LEVEL_MEMBER)
+ − 814
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 815
else
+ − 816
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 817
+ − 818
return 'The username and/or password is incorrect.';
+ − 819
}
+ − 820
}
+ − 821
+ − 822
/**
+ − 823
* Attempts to log in using the old table structure and algorithm.
+ − 824
* @param string $username
+ − 825
* @param string $password This should be an MD5 hash
+ − 826
* @return string 'success' if successful, or error message on failure
+ − 827
*/
+ − 828
+ − 829
function login_compat($username, $password, $level = 0)
+ − 830
{
+ − 831
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 832
$pass_hashed =& $password;
+ − 833
$this->sql('SELECT password,user_id,user_level FROM '.table_prefix.'users WHERE username=\''.$this->prepare_text($username).'\';');
+ − 834
if($db->numrows() < 1)
+ − 835
return 'The username and/or password is incorrect.';
+ − 836
$row = $db->fetchrow();
+ − 837
if($row['password'] == $password)
+ − 838
{
+ − 839
if((int)$level > (int)$row['user_level'])
+ − 840
return 'You are not authorized for this level of access.';
+ − 841
$sess = $this->register_session_compat(intval($row['user_id']), $username, $password, $level);
+ − 842
if($sess)
+ − 843
return 'success';
+ − 844
else
+ − 845
return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.';
+ − 846
}
+ − 847
else
+ − 848
{
+ − 849
return 'The username and/or password is incorrect.';
+ − 850
}
+ − 851
}
+ − 852
+ − 853
/**
+ − 854
* Registers a session key in the database. This function *ASSUMES* that the username and password have already been validated!
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 855
* Basically the session key is a hex-encoded cookie (encrypted with the site's private key) that says "u=[username];p=[sha1 of password];s=[unique key id]"
1
+ − 856
* @param int $user_id
+ − 857
* @param string $username
+ − 858
* @param string $password
+ − 859
* @param int $level The level of access to grant, defaults to USER_LEVEL_MEMBER
+ − 860
* @return bool
+ − 861
*/
+ − 862
+ − 863
function register_session($user_id, $username, $password, $level = USER_LEVEL_MEMBER)
+ − 864
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 865
// Random key identifier
1
+ − 866
$salt = md5(microtime() . mt_rand());
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 867
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 868
// SHA1 hash of password, stored in the key
1
+ − 869
$passha1 = sha1($password);
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 870
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 871
// Unencrypted session key
1
+ − 872
$session_key = "u=$username;p=$passha1;s=$salt";
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 873
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 874
// Encrypt the key
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 875
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 876
$session_key = $aes->encrypt($session_key, $this->private_key, ENC_HEX);
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 877
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 878
// If we're registering an elevated-privilege key, it needs to be on GET
1
+ − 879
if($level > USER_LEVEL_MEMBER)
+ − 880
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 881
// Reverse it - cosmetic only ;-)
1
+ − 882
$hexkey = strrev($session_key);
+ − 883
$this->sid_super = $hexkey;
+ − 884
$_GET['auth'] = $hexkey;
+ − 885
}
+ − 886
else
+ − 887
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 888
// Stash it in a cookie
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 889
// For now, make the cookie last forever, we can change this in 1.1.x
208
+ − 890
setcookie( 'sid', $session_key, time()+315360000, scriptPath.'/', null, ( isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off' ) );
1
+ − 891
$_COOKIE['sid'] = $session_key;
+ − 892
}
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 893
// $keyhash is stored in the database, this is for compatibility with the older DB structure
1
+ − 894
$keyhash = md5($session_key);
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 895
// Record the user's IP
1
+ − 896
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 897
if(!$ip)
+ − 898
die('$session->register_session: Remote-Addr was spoofed');
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 899
// The time needs to be stashed to enforce the 15-minute limit on elevated session keys
1
+ − 900
$time = time();
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 901
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 902
// Sanity check
1
+ − 903
if(!is_int($user_id))
+ − 904
die('Somehow an SQL injection attempt crawled into our session registrar! (1)');
+ − 905
if(!is_int($level))
+ − 906
die('Somehow an SQL injection attempt crawled into our session registrar! (2)');
+ − 907
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 908
// All done!
1
+ − 909
$query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$keyhash.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');');
+ − 910
return true;
+ − 911
}
+ − 912
+ − 913
/**
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 914
* Identical to register_session in nature, but uses the old login/table structure. DO NOT use this except in the upgrade script under very controlled circumstances.
1
+ − 915
* @see sessionManager::register_session()
+ − 916
* @access private
+ − 917
*/
+ − 918
+ − 919
function register_session_compat($user_id, $username, $password, $level = 0)
+ − 920
{
+ − 921
$salt = md5(microtime() . mt_rand());
+ − 922
$thekey = md5($password . $salt);
+ − 923
if($level > 0)
+ − 924
{
+ − 925
$this->sid_super = $thekey;
+ − 926
}
+ − 927
else
+ − 928
{
+ − 929
setcookie( 'sid', $thekey, time()+315360000, scriptPath.'/' );
+ − 930
$_COOKIE['sid'] = $thekey;
+ − 931
}
+ − 932
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 933
if(!$ip)
+ − 934
die('$session->register_session: Remote-Addr was spoofed');
+ − 935
$time = time();
+ − 936
if(!is_int($user_id))
+ − 937
die('Somehow an SQL injection attempt crawled into our session registrar! (1)');
+ − 938
if(!is_int($level))
+ − 939
die('Somehow an SQL injection attempt crawled into our session registrar! (2)');
+ − 940
$query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$thekey.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');');
+ − 941
return true;
+ − 942
}
+ − 943
+ − 944
/**
+ − 945
* Creates/restores a guest session
+ − 946
* @todo implement real session management for guests
+ − 947
*/
+ − 948
+ − 949
function register_guest_session()
+ − 950
{
+ − 951
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 952
$this->username = $_SERVER['REMOTE_ADDR'];
+ − 953
$this->user_level = USER_LEVEL_GUEST;
+ − 954
if($this->compat || defined('IN_ENANO_INSTALL'))
+ − 955
{
+ − 956
$this->theme = 'oxygen';
+ − 957
$this->style = 'bleu';
+ − 958
}
+ − 959
else
+ − 960
{
+ − 961
$this->theme = ( isset($_GET['theme']) && isset($template->named_theme_list[$_GET['theme']])) ? $_GET['theme'] : $template->default_theme;
+ − 962
$this->style = ( isset($_GET['style']) && file_exists(ENANO_ROOT.'/themes/'.$this->theme . '/css/'.$_GET['style'].'.css' )) ? $_GET['style'] : substr($template->named_theme_list[$this->theme]['default_style'], 0, strlen($template->named_theme_list[$this->theme]['default_style'])-4);
+ − 963
}
+ − 964
$this->user_id = 1;
+ − 965
}
+ − 966
+ − 967
/**
+ − 968
* Validates a session key, and returns the userdata associated with the key or false
+ − 969
* @param string $key The session key to validate
+ − 970
* @return array Keys are 'user_id', 'username', 'email', 'real_name', 'user_level', 'theme', 'style', 'signature', 'reg_time', 'account_active', 'activation_key', and 'auth_level' or bool false if validation failed. The key 'auth_level' is the maximum authorization level that this key provides.
+ − 971
*/
+ − 972
+ − 973
function validate_session($key)
+ − 974
{
+ − 975
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 976
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE, true);
+ − 977
$decrypted_key = $aes->decrypt($key, $this->private_key, ENC_HEX);
+ − 978
+ − 979
if ( !$decrypted_key )
+ − 980
{
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 981
// die_semicritical('AES encryption error', '<p>Something went wrong during the AES decryption process.</p><pre>'.print_r($decrypted_key, true).'</pre>');
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 982
return false;
1
+ − 983
}
+ − 984
+ − 985
$n = preg_match('/^u='.$this->valid_username.';p=([A-Fa-f0-9]+?);s=([A-Fa-f0-9]+?)$/', $decrypted_key, $keydata);
+ − 986
if($n < 1)
+ − 987
{
+ − 988
// echo '(debug) $session->validate_session: Key does not match regex<br />Decrypted key: '.$decrypted_key;
+ − 989
return false;
+ − 990
}
+ − 991
$keyhash = md5($key);
+ − 992
$salt = $db->escape($keydata[3]);
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 993
// using a normal call to $db->sql_query to avoid failing on errors here
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 994
$query = $db->sql_query('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 995
. ' u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms,' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 996
. ' x.* FROM '.table_prefix.'session_keys AS k' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 997
. ' LEFT JOIN '.table_prefix.'users AS u' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 998
. ' ON ( u.user_id=k.user_id )' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 999
. ' LEFT JOIN '.table_prefix.'users_extra AS x' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1000
. ' ON ( u.user_id=x.user_id OR x.user_id IS NULL )' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1001
. ' LEFT JOIN '.table_prefix.'privmsgs AS p' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1002
. ' ON ( p.message_to=u.username AND p.message_read=0 )' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1003
. ' WHERE k.session_key=\''.$keyhash.'\'' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1004
. ' AND k.salt=\''.$salt.'\'' . "\n"
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1005
. ' GROUP BY u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,x.user_id, x.user_aim, x.user_yahoo, x.user_msn, x.user_xmpp, x.user_homepage, x.user_location, x.user_job, x.user_hobbies, x.email_public;');
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1006
18
+ − 1007
if ( !$query )
+ − 1008
{
+ − 1009
$query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms FROM '.table_prefix.'session_keys AS k
+ − 1010
LEFT JOIN '.table_prefix.'users AS u
+ − 1011
ON ( u.user_id=k.user_id )
+ − 1012
LEFT JOIN '.table_prefix.'privmsgs AS p
+ − 1013
ON ( p.message_to=u.username AND p.message_read=0 )
+ − 1014
WHERE k.session_key=\''.$keyhash.'\'
+ − 1015
AND k.salt=\''.$salt.'\'
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1016
GROUP BY u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level;');
18
+ − 1017
}
1
+ − 1018
if($db->numrows() < 1)
+ − 1019
{
+ − 1020
// echo '(debug) $session->validate_session: Key was not found in database<br />';
+ − 1021
return false;
+ − 1022
}
+ − 1023
$row = $db->fetchrow();
+ − 1024
$row['user_id'] =& $row['uid'];
+ − 1025
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 1026
if($row['auth_level'] > $row['user_level'])
+ − 1027
{
+ − 1028
// Failed authorization check
+ − 1029
// echo '(debug) $session->validate_session: access to this auth level denied<br />';
+ − 1030
return false;
+ − 1031
}
+ − 1032
if($ip != $row['source_ip'])
+ − 1033
{
+ − 1034
// Failed IP address check
+ − 1035
// echo '(debug) $session->validate_session: IP address mismatch<br />';
+ − 1036
return false;
+ − 1037
}
+ − 1038
+ − 1039
// Do the password validation
+ − 1040
$real_pass = $aes->decrypt($row['password'], $this->private_key, ENC_HEX);
+ − 1041
+ − 1042
//die('<pre>'.print_r($keydata, true).'</pre>');
+ − 1043
if(sha1($real_pass) != $keydata[2])
+ − 1044
{
+ − 1045
// Failed password check
+ − 1046
// echo '(debug) $session->validate_session: encrypted password is wrong<br />Real password: '.$real_pass.'<br />Real hash: '.sha1($real_pass).'<br />User hash: '.$keydata[2];
+ − 1047
return false;
+ − 1048
}
+ − 1049
+ − 1050
$time_now = time();
+ − 1051
$time_key = $row['time'] + 900;
+ − 1052
if($time_now > $time_key && $row['auth_level'] > USER_LEVEL_MEMBER)
+ − 1053
{
+ − 1054
// Session timed out
+ − 1055
// echo '(debug) $session->validate_session: super session timed out<br />';
+ − 1056
$this->sw_timed_out = true;
+ − 1057
return false;
+ − 1058
}
+ − 1059
+ − 1060
// If this is an elevated-access session key, update the time
+ − 1061
if( $row['auth_level'] > USER_LEVEL_MEMBER )
+ − 1062
{
+ − 1063
$this->sql('UPDATE '.table_prefix.'session_keys SET time='.time().' WHERE session_key=\''.$keyhash.'\';');
+ − 1064
}
+ − 1065
31
+ − 1066
$user_extra = array();
+ − 1067
foreach ( array('user_aim', 'user_yahoo', 'user_msn', 'user_xmpp', 'user_homepage', 'user_location', 'user_job', 'user_hobbies', 'email_public') as $column )
+ − 1068
{
+ − 1069
$user_extra[$column] = $row[$column];
+ − 1070
}
+ − 1071
+ − 1072
$this->user_extra = $user_extra;
+ − 1073
// Leave the rest to PHP's automatic garbage collector ;-)
+ − 1074
1
+ − 1075
$row['password'] = md5($real_pass);
+ − 1076
return $row;
+ − 1077
}
+ − 1078
+ − 1079
/**
+ − 1080
* Validates a session key, and returns the userdata associated with the key or false. Optimized for compatibility with the old MD5-based auth system.
+ − 1081
* @param string $key The session key to validate
+ − 1082
* @return array Keys are 'user_id', 'username', 'email', 'real_name', 'user_level', 'theme', 'style', 'signature', 'reg_time', 'account_active', 'activation_key', and 'auth_level' or bool false if validation failed. The key 'auth_level' is the maximum authorization level that this key provides.
+ − 1083
*/
+ − 1084
+ − 1085
function compat_validate_session($key)
+ − 1086
{
+ − 1087
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1088
$key = $db->escape($key);
+ − 1089
+ − 1090
$query = $this->sql('SELECT u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,k.source_ip,k.salt,k.time,k.auth_level FROM '.table_prefix.'session_keys AS k
+ − 1091
LEFT JOIN '.table_prefix.'users AS u
+ − 1092
ON u.user_id=k.user_id
+ − 1093
WHERE k.session_key=\''.$key.'\';');
+ − 1094
if($db->numrows() < 1)
+ − 1095
{
+ − 1096
// echo '(debug) $session->validate_session: Key '.$key.' was not found in database<br />';
+ − 1097
return false;
+ − 1098
}
+ − 1099
$row = $db->fetchrow();
+ − 1100
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 1101
if($row['auth_level'] > $row['user_level'])
+ − 1102
{
+ − 1103
// Failed authorization check
+ − 1104
// echo '(debug) $session->validate_session: user not authorized for this access level';
+ − 1105
return false;
+ − 1106
}
+ − 1107
if($ip != $row['source_ip'])
+ − 1108
{
+ − 1109
// Failed IP address check
+ − 1110
// echo '(debug) $session->validate_session: IP address mismatch; IP in table: '.$row['source_ip'].'; reported IP: '.$ip.'';
+ − 1111
return false;
+ − 1112
}
+ − 1113
+ − 1114
// Do the password validation
+ − 1115
$real_key = md5($row['password'] . $row['salt']);
+ − 1116
+ − 1117
//die('<pre>'.print_r($keydata, true).'</pre>');
+ − 1118
if($real_key != $key)
+ − 1119
{
+ − 1120
// Failed password check
+ − 1121
// echo '(debug) $session->validate_session: supplied password is wrong<br />Real key: '.$real_key.'<br />User key: '.$key;
+ − 1122
return false;
+ − 1123
}
+ − 1124
+ − 1125
$time_now = time();
+ − 1126
$time_key = $row['time'] + 900;
+ − 1127
if($time_now > $time_key && $row['auth_level'] >= 1)
+ − 1128
{
+ − 1129
$this->sw_timed_out = true;
+ − 1130
// Session timed out
+ − 1131
// echo '(debug) $session->validate_session: super session timed out<br />';
+ − 1132
return false;
+ − 1133
}
+ − 1134
+ − 1135
return $row;
+ − 1136
}
+ − 1137
+ − 1138
/**
+ − 1139
* Demotes us to one less than the specified auth level. AKA destroys elevated authentication and/or logs out the user, depending on $level
+ − 1140
* @param int $level How low we should go - USER_LEVEL_MEMBER means demote to USER_LEVEL_GUEST, and anything more powerful than USER_LEVEL_MEMBER means demote to USER_LEVEL_MEMBER
+ − 1141
* @return string 'success' if successful, or error on failure
+ − 1142
*/
+ − 1143
+ − 1144
function logout($level = USER_LEVEL_MEMBER)
+ − 1145
{
+ − 1146
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1147
$ou = $this->username;
+ − 1148
$oid = $this->user_id;
+ − 1149
if($level > USER_LEVEL_CHPREF)
+ − 1150
{
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1151
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 1152
if(!$this->user_logged_in || $this->auth_level < USER_LEVEL_MOD) return 'success';
+ − 1153
// Destroy elevated privileges
+ − 1154
$keyhash = md5(strrev($this->sid_super));
+ − 1155
$this->sql('DELETE FROM '.table_prefix.'session_keys WHERE session_key=\''.$keyhash.'\' AND user_id=\'' . $this->user_id . '\';');
+ − 1156
$this->sid_super = false;
+ − 1157
$this->auth_level = USER_LEVEL_MEMBER;
+ − 1158
}
+ − 1159
else
+ − 1160
{
+ − 1161
if($this->user_logged_in)
+ − 1162
{
+ − 1163
// Completely destroy our session
+ − 1164
if($this->auth_level > USER_LEVEL_CHPREF)
+ − 1165
{
+ − 1166
$this->logout(USER_LEVEL_ADMIN);
+ − 1167
}
+ − 1168
$this->sql('DELETE FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($this->sid).'\';');
+ − 1169
setcookie( 'sid', '', time()-(3600*24), scriptPath.'/' );
+ − 1170
}
+ − 1171
}
+ − 1172
$code = $plugins->setHook('logout_success'); // , Array('level'=>$level,'old_username'=>$ou,'old_user_id'=>$oid));
+ − 1173
foreach ( $code as $cmd )
+ − 1174
{
+ − 1175
eval($cmd);
+ − 1176
}
+ − 1177
return 'success';
+ − 1178
}
+ − 1179
+ − 1180
# Miscellaneous stuff
+ − 1181
+ − 1182
/**
+ − 1183
* Appends the high-privilege session key to the URL if we are authorized to do high-privilege stuff
+ − 1184
* @param string $url The URL to add session data to
+ − 1185
* @return string
+ − 1186
*/
+ − 1187
+ − 1188
function append_sid($url)
+ − 1189
{
+ − 1190
$sep = ( strstr($url, '?') ) ? '&' : '?';
+ − 1191
if ( $this->sid_super )
+ − 1192
{
+ − 1193
$url = $url . $sep . 'auth=' . urlencode($this->sid_super);
+ − 1194
// echo($this->sid_super.'<br/>');
+ − 1195
}
+ − 1196
return $url;
+ − 1197
}
+ − 1198
+ − 1199
/**
+ − 1200
* Grabs the user's password MD5
+ − 1201
* @return string, or bool false if access denied
+ − 1202
*/
+ − 1203
+ − 1204
function grab_password_hash()
+ − 1205
{
+ − 1206
if(!$this->password_hash) return false;
+ − 1207
return $this->password_hash;
+ − 1208
}
+ − 1209
+ − 1210
/**
+ − 1211
* Destroys the user's password MD5 in memory
+ − 1212
*/
+ − 1213
+ − 1214
function disallow_password_grab()
+ − 1215
{
+ − 1216
$this->password_hash = false;
+ − 1217
return false;
+ − 1218
}
+ − 1219
+ − 1220
/**
+ − 1221
* Generates an AES key and stashes it in the database
+ − 1222
* @return string Hex-encoded AES key
+ − 1223
*/
+ − 1224
+ − 1225
function rijndael_genkey()
+ − 1226
{
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1227
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 1228
$key = $aes->gen_readymade_key();
+ − 1229
$keys = getConfig('login_key_cache');
+ − 1230
if(is_string($keys))
+ − 1231
$keys .= $key;
+ − 1232
else
+ − 1233
$keys = $key;
+ − 1234
setConfig('login_key_cache', $keys);
+ − 1235
return $key;
+ − 1236
}
+ − 1237
+ − 1238
/**
+ − 1239
* Generate a totally random 128-bit value for MD5 challenges
+ − 1240
* @return string
+ − 1241
*/
+ − 1242
+ − 1243
function dss_rand()
+ − 1244
{
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1245
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 1246
$random = $aes->randkey(128);
+ − 1247
unset($aes);
+ − 1248
return md5(microtime() . $random);
+ − 1249
}
+ − 1250
+ − 1251
/**
+ − 1252
* Fetch a cached login public key using the MD5sum as an identifier. Each key can only be fetched once before it is destroyed.
+ − 1253
* @param string $md5 The MD5 sum of the key
+ − 1254
* @return string, or bool false on failure
+ − 1255
*/
+ − 1256
+ − 1257
function fetch_public_key($md5)
+ − 1258
{
+ − 1259
$keys = getConfig('login_key_cache');
+ − 1260
$keys = enano_str_split($keys, AES_BITS / 4);
+ − 1261
+ − 1262
foreach($keys as $i => $k)
+ − 1263
{
+ − 1264
if(md5($k) == $md5)
+ − 1265
{
+ − 1266
unset($keys[$i]);
+ − 1267
if(count($keys) > 0)
+ − 1268
{
+ − 1269
if ( strlen(getConfig('login_key_cache') ) > 64000 )
+ − 1270
{
+ − 1271
// This should only need to be done once every month or so for an average-size site
+ − 1272
setConfig('login_key_cache', '');
+ − 1273
}
+ − 1274
else
+ − 1275
{
+ − 1276
$keys = implode('', array_values($keys));
+ − 1277
setConfig('login_key_cache', $keys);
+ − 1278
}
+ − 1279
}
+ − 1280
else
+ − 1281
{
+ − 1282
setConfig('login_key_cache', '');
+ − 1283
}
+ − 1284
return $k;
+ − 1285
}
+ − 1286
}
+ − 1287
// Couldn't find the key...
+ − 1288
return false;
+ − 1289
}
+ − 1290
+ − 1291
/**
+ − 1292
* Adds a user to a group.
+ − 1293
* @param int User ID
+ − 1294
* @param int Group ID
+ − 1295
* @param bool Group moderator - defaults to false
+ − 1296
* @return bool True on success, false on failure
+ − 1297
*/
+ − 1298
+ − 1299
function add_user_to_group($user_id, $group_id, $is_mod = false)
+ − 1300
{
+ − 1301
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1302
+ − 1303
// Validation
+ − 1304
if ( !is_int($user_id) || !is_int($group_id) || !is_bool($is_mod) )
+ − 1305
return false;
+ − 1306
if ( $user_id < 1 || $group_id < 1 )
+ − 1307
return false;
+ − 1308
+ − 1309
$mod_switch = ( $is_mod ) ? '1' : '0';
+ − 1310
$q = $this->sql('SELECT member_id,is_mod FROM '.table_prefix.'group_members WHERE user_id=' . $user_id . ' AND group_id=' . $group_id . ';');
+ − 1311
if ( !$q )
+ − 1312
$db->_die();
+ − 1313
if ( $db->numrows() < 1 )
+ − 1314
{
+ − 1315
// User is not in group
+ − 1316
$this->sql('INSERT INTO '.table_prefix.'group_members(user_id,group_id,is_mod) VALUES(' . $user_id . ', ' . $group_id . ', ' . $mod_switch . ');');
+ − 1317
return true;
+ − 1318
}
+ − 1319
else
+ − 1320
{
+ − 1321
$row = $db->fetchrow();
+ − 1322
// Update modship status
+ − 1323
if ( strval($row['is_mod']) == $mod_switch )
+ − 1324
{
+ − 1325
// Modship unchanged
+ − 1326
return true;
+ − 1327
}
+ − 1328
else
+ − 1329
{
+ − 1330
// Modship changed
+ − 1331
$this->sql('UPDATE '.table_prefix.'group_members SET is_mod=' . $mod_switch . ' WHERE member_id=' . $row['member_id'] . ';');
+ − 1332
return true;
+ − 1333
}
+ − 1334
}
+ − 1335
return false;
+ − 1336
}
+ − 1337
+ − 1338
/**
+ − 1339
* Removes a user from a group.
+ − 1340
* @param int User ID
+ − 1341
* @param int Group ID
+ − 1342
* @return bool True on success, false on failure
+ − 1343
* @todo put a little more error checking in...
+ − 1344
*/
+ − 1345
+ − 1346
function remove_user_from_group($user_id, $group_id)
+ − 1347
{
+ − 1348
if ( !is_int($user_id) || !is_int($group_id) )
+ − 1349
return false;
+ − 1350
$this->sql('DELETE FROM '.table_prefix."group_members WHERE user_id=$user_id AND group_id=$group_id;");
+ − 1351
return true;
+ − 1352
}
+ − 1353
+ − 1354
/**
+ − 1355
* Checks the banlist to ensure that we're an allowed user. Doesn't return anything because it dies if the user is banned.
+ − 1356
*/
+ − 1357
+ − 1358
function check_banlist()
+ − 1359
{
+ − 1360
global $db, $session, $paths, $template, $plugins; // Common objects
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1361
$col_reason = ( $this->compat ) ? '"No reason entered (session manager is in compatibility mode)" AS reason' : 'reason';
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1362
$banned = false;
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1363
if ( $this->user_logged_in )
1
+ − 1364
{
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1365
// check by IP, email, and username
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1366
if ( ENANO_DBLAYER == 'MYSQL' )
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1367
{
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1368
$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1369
. " ( ban_type = " . BAN_IP . " AND is_regex = 0 ) OR \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1370
. " ( ban_type = " . BAN_IP . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' REGEXP ban_value ) OR \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1371
. " ( ban_type = " . BAN_USER . " AND is_regex = 0 AND ban_value = '{$this->username}' ) OR \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1372
. " ( ban_type = " . BAN_USER . " AND is_regex = 1 AND '{$this->username}' REGEXP ban_value ) OR \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1373
. " ( ban_type = " . BAN_EMAIL . " AND is_regex = 0 AND ban_value = '{$this->email}' ) OR \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1374
. " ( ban_type = " . BAN_EMAIL . " AND is_regex = 1 AND '{$this->email}' REGEXP ban_value ) \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1375
. " ORDER BY ban_type ASC;";
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1376
}
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1377
else if ( ENANO_DBLAYER == 'PGSQL' )
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1378
{
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1379
$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE \n"
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1380
. " ( ban_type = " . BAN_IP . " AND is_regex = 0 ) OR \n"
261
+ − 1381
. " ( ban_type = " . BAN_IP . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' ~ ban_value ) OR \n"
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1382
. " ( ban_type = " . BAN_USER . " AND is_regex = 0 AND ban_value = '{$this->username}' ) OR \n"
261
+ − 1383
. " ( ban_type = " . BAN_USER . " AND is_regex = 1 AND '{$this->username}' ~ ban_value ) OR \n"
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1384
. " ( ban_type = " . BAN_EMAIL . " AND is_regex = 0 AND ban_value = '{$this->email}' ) OR \n"
261
+ − 1385
. " ( ban_type = " . BAN_EMAIL . " AND is_regex = 1 AND '{$this->email}' ~ ban_value ) \n"
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1386
. " ORDER BY ban_type ASC;";
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1387
}
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1388
$q = $this->sql($sql);
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1389
if ( $db->numrows() > 0 )
1
+ − 1390
{
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1391
while ( list($reason, $ban_value, $ban_type, $is_regex) = $db->fetchrow_num() )
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1392
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1393
if ( $ban_type == BAN_IP && $row['is_regex'] != 1 )
1
+ − 1394
{
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1395
// check range
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1396
$regexp = parse_ip_range_regex($ban_value);
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1397
if ( !$regexp )
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1398
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1399
continue;
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1400
}
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1401
if ( preg_match("/$regexp/", $_SERVER['REMOTE_ADDR']) )
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1402
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1403
$banned = true;
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1404
}
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1405
}
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1406
else
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1407
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1408
// User is banned
1
+ − 1409
$banned = true;
+ − 1410
}
+ − 1411
}
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1412
}
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1413
$db->free_result();
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1414
}
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1415
else
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1416
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1417
// check by IP only
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1418
if ( ENANO_DBLAYER == 'MYSQL' )
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1419
{
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1420
$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1421
( ban_type = " . BAN_IP . " AND is_regex = 0 ) OR
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1422
( ban_type = " . BAN_IP . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' REGEXP ban_value )
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1423
ORDER BY ban_type ASC;";
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1424
}
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1425
else if ( ENANO_DBLAYER == 'PGSQL' )
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1426
{
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1427
$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1428
( ban_type = " . BAN_IP . " AND is_regex = 0 ) OR
261
+ − 1429
( ban_type = " . BAN_IP . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' ~ ban_value )
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1430
ORDER BY ban_type ASC;";
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1431
}
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1432
$q = $this->sql($sql);
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1433
if ( $db->numrows() > 0 )
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1434
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1435
while ( list($reason, $ban_value, $ban_type, $is_regex) = $db->fetchrow_num() )
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1436
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1437
if ( $ban_type == BAN_IP && $row['is_regex'] != 1 )
1
+ − 1438
{
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1439
// check range
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1440
$regexp = parse_ip_range_regex($ban_value);
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1441
if ( !$regexp )
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1442
continue;
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1443
if ( preg_match("/$regexp/", $_SERVER['REMOTE_ADDR']) )
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1444
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1445
$banned = true;
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1446
}
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1447
}
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1448
else
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1449
{
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1450
// User is banned
1
+ − 1451
$banned = true;
+ − 1452
}
+ − 1453
}
+ − 1454
}
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1455
$db->free_result();
1
+ − 1456
}
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1457
if ( $banned && $paths->get_pageid_from_url() != $paths->nslist['Special'].'CSS' )
1
+ − 1458
{
+ − 1459
// This guy is banned - kill the session, kill the database connection, bail out, and be pretty about it
+ − 1460
die_semicritical('Ban notice', '<div class="error-box">You have been banned from this website. Please contact the site administrator for more information.<br /><br />Reason:<br />'.$reason.'</div>');
+ − 1461
exit;
+ − 1462
}
+ − 1463
}
+ − 1464
+ − 1465
# Registration
+ − 1466
+ − 1467
/**
+ − 1468
* Registers a user. This does not perform any type of login.
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1469
* @param string New user's username
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1470
* @param string This should be unencrypted.
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1471
* @param string E-mail address.
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1472
* @param string Optional, defaults to ''.
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1473
* @param bool Optional. If true, the account is not activated initially and an admin activation request is sent. The caller is responsible for sending the address info and notice.
1
+ − 1474
*/
+ − 1475
30
+ − 1476
function create_user($username, $password, $email, $real_name = '', $coppa = false)
13
fdd6b9dd42c3
Installer actually works now on dev servers; minor language change in template.php; code cleanliness fix in sessions.php
Dan
diff
changeset
+ − 1477
{
1
+ − 1478
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1479
+ − 1480
// Initialize AES
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1481
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 1482
+ − 1483
if(!preg_match('#^'.$this->valid_username.'$#', $username)) return 'The username you chose contains invalid characters.';
217
5bcdee999015
Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.
Dan
diff
changeset
+ − 1484
$username = str_replace('_', ' ', $username);
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1485
$user_orig = $username;
1
+ − 1486
$username = $this->prepare_text($username);
+ − 1487
$email = $this->prepare_text($email);
+ − 1488
$real_name = $this->prepare_text($real_name);
+ − 1489
+ − 1490
$nameclause = ( $real_name != '' ) ? ' OR real_name=\''.$real_name.'\'' : '';
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1491
$q = $this->sql('SELECT * FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=\''.strtolower($username).'\' OR email=\''.$email.'\''.$nameclause.';');
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1492
if($db->numrows() > 0)
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1493
{
1
+ − 1494
$r = 'The ';
+ − 1495
$i=0;
+ − 1496
$row = $db->fetchrow();
+ − 1497
// Wow! An error checker that actually speaks English with the properest grammar! :-P
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1498
if ( $row['username'] == $username )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1499
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1500
$r .= 'username';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1501
$i++;
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1502
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1503
if ( $row['email'] == $email )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1504
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1505
if($i) $r.=', ';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1506
$r .= 'e-mail address';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1507
$i++;
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1508
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1509
if ( $row['real_name'] == $real_name && $real_name != '' )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1510
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1511
if($i) $r.=', and ';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1512
$r .= 'real name';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1513
$i++;
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1514
}
1
+ − 1515
$r .= ' that you entered ';
+ − 1516
$r .= ( $i == 1 ) ? 'is' : 'are';
+ − 1517
$r .= ' already in use by another user.';
+ − 1518
return $r;
+ − 1519
}
+ − 1520
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1521
// Is the password strong enough?
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1522
if ( getConfig('pw_strength_enable') )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1523
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1524
$min_score = intval( getConfig('pw_strength_minimum') );
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1525
$pass_score = password_score($password);
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1526
if ( $pass_score < $min_score )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1527
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1528
return 'The password you entered did not meet the complexity requirements for this site. Please choose a stronger password.';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1529
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1530
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1531
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1532
$password = $aes->encrypt($password, $this->private_key, ENC_HEX);
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1533
1
+ − 1534
// Require the account to be activated?
+ − 1535
switch(getConfig('account_activation'))
+ − 1536
{
+ − 1537
case 'none':
+ − 1538
default:
+ − 1539
$active = '1';
+ − 1540
break;
+ − 1541
case 'user':
+ − 1542
$active = '0';
+ − 1543
break;
+ − 1544
case 'admin':
+ − 1545
$active = '0';
+ − 1546
break;
+ − 1547
}
30
+ − 1548
if ( $coppa )
+ − 1549
$active = '0';
+ − 1550
+ − 1551
$coppa_col = ( $coppa ) ? '1' : '0';
1
+ − 1552
+ − 1553
// Generate a totally random activation key
+ − 1554
$actkey = sha1 ( microtime() . mt_rand() );
+ − 1555
30
+ − 1556
// We good, create the user
+ − 1557
$this->sql('INSERT INTO '.table_prefix.'users ( username, password, email, real_name, theme, style, reg_time, account_active, activation_key, user_level, user_coppa ) VALUES ( \''.$username.'\', \''.$password.'\', \''.$email.'\', \''.$real_name.'\', \''.$template->default_theme.'\', \''.$template->default_style.'\', '.time().', '.$active.', \''.$actkey.'\', '.USER_LEVEL_CHPREF.', ' . $coppa_col . ' );');
1
+ − 1558
31
+ − 1559
// Get user ID and create users_extra entry
+ − 1560
$q = $this->sql('SELECT user_id FROM '.table_prefix."users WHERE username='$username';");
+ − 1561
if ( $db->numrows() > 0 )
+ − 1562
{
+ − 1563
$row = $db->fetchrow();
+ − 1564
$db->free_result();
+ − 1565
+ − 1566
$user_id =& $row['user_id'];
42
45ebe475ff75
I dunno how many times I'm gonna have to fix the "problem seems to be the hex conversion" bug, but this is at least the fourth try.
Dan
diff
changeset
+ − 1567
$this->sql('INSERT INTO '.table_prefix.'users_extra(user_id) VALUES(' . $user_id . ');');
31
+ − 1568
}
+ − 1569
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1570
// Grant edit and very limited mod access to the userpage
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1571
$acl_data = array(
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1572
'read' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1573
'view_source' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1574
'edit_page' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1575
'post_comments' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1576
'edit_comments' => AUTH_ALLOW, // only allows editing own comments
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1577
'history_view' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1578
'history_rollback' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1579
'rename' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1580
'delete_page' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1581
'tag_create' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1582
'tag_delete_own' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1583
'tag_delete_other' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1584
'edit_cat' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1585
'create_page' => AUTH_ALLOW
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1586
);
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1587
$acl_data = $db->escape($this->perm_to_string($acl_data));
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1588
$userpage = $db->escape(sanitize_page_id($user_orig));
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1589
$cols = "target_type, target_id, page_id, namespace, rules";
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1590
$vals = ACL_TYPE_USER . ", $user_id, '$userpage', 'User', '$acl_data'";
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1591
$q = "INSERT INTO ".table_prefix."acl($cols) VALUES($vals);";
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1592
$this->sql($q);
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1593
1
+ − 1594
// Require the account to be activated?
30
+ − 1595
if ( $coppa )
+ − 1596
{
+ − 1597
$this->admin_activation_request($username);
+ − 1598
$this->send_coppa_mail($username,$email);
+ − 1599
}
+ − 1600
else
1
+ − 1601
{
30
+ − 1602
switch(getConfig('account_activation'))
+ − 1603
{
+ − 1604
case 'none':
+ − 1605
default:
+ − 1606
break;
+ − 1607
case 'user':
+ − 1608
$a = $this->send_activation_mail($username);
+ − 1609
if(!$a)
+ − 1610
{
+ − 1611
$this->admin_activation_request($username);
+ − 1612
return 'The activation e-mail could not be sent due to an internal error. This could possibly be due to an incorrect SMTP configuration. A request has been sent to the administrator to activate your account for you. ' . $a;
+ − 1613
}
+ − 1614
break;
+ − 1615
case 'admin':
1
+ − 1616
$this->admin_activation_request($username);
30
+ − 1617
break;
+ − 1618
}
1
+ − 1619
}
+ − 1620
+ − 1621
// Leave some data behind for the hook
+ − 1622
$code = $plugins->setHook('user_registered'); // , Array('username'=>$username));
+ − 1623
foreach ( $code as $cmd )
+ − 1624
{
+ − 1625
eval($cmd);
+ − 1626
}
+ − 1627
+ − 1628
// $this->register_session($username, $password);
+ − 1629
return 'success';
+ − 1630
}
+ − 1631
+ − 1632
/**
+ − 1633
* Attempts to send an e-mail to the specified user with activation instructions.
+ − 1634
* @param string $u The usernamd of the user requesting activation
+ − 1635
* @return bool true on success, false on failure
+ − 1636
*/
+ − 1637
+ − 1638
function send_activation_mail($u, $actkey = false)
+ − 1639
{
+ − 1640
global $db, $session, $paths, $template, $plugins; // Common objects
131
+ − 1641
$q = $this->sql('SELECT username,email FROM '.table_prefix.'users WHERE user_id=2 OR user_level=' . USER_LEVEL_ADMIN . ' ORDER BY user_id ASC;');
1
+ − 1642
$un = $db->fetchrow();
+ − 1643
$admin_user = $un['username'];
+ − 1644
$q = $this->sql('SELECT username,activation_key,account_active,email FROM '.table_prefix.'users WHERE username=\''.$db->escape($u).'\';');
+ − 1645
$r = $db->fetchrow();
+ − 1646
if ( empty($r['email']) )
+ − 1647
$db->_die('BUG: $session->send_activation_mail(): no e-mail address in row');
+ − 1648
$message = 'Dear '.$u.',
+ − 1649
Thank you for registering on '.getConfig('site_name').'. Your account creation is almost complete. To complete the registration process, please click the following link or paste it into your web browser:
+ − 1650
+ − 1651
';
+ − 1652
if(isset($_SERVER['HTTPS'])) $prot = 'https';
+ − 1653
else $prot = 'http';
+ − 1654
if($_SERVER['SERVER_PORT'] == '80') $p = '';
+ − 1655
else $p = ':'.$_SERVER['SERVER_PORT'];
+ − 1656
$sidbak = false;
+ − 1657
if($this->sid_super)
+ − 1658
$sidbak = $this->sid_super;
+ − 1659
$this->sid_super = false;
+ − 1660
$aklink = makeUrlNS('Special', 'ActivateAccount/'.str_replace(' ', '_', $u).'/'. ( ( is_string($actkey) ) ? $actkey : $r['activation_key'] ) );
+ − 1661
if($sidbak)
+ − 1662
$this->sid_super = $sidbak;
+ − 1663
unset($sidbak);
+ − 1664
$message .= "$prot://".$_SERVER['HTTP_HOST'].$p.$aklink;
+ − 1665
$message .= "\n\nSincerely yours, \n$admin_user and the ".$_SERVER['HTTP_HOST']." administration team";
+ − 1666
if(getConfig('smtp_enabled') == '1')
+ − 1667
{
+ − 1668
$result = smtp_send_email($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), getConfig('contact_email'));
+ − 1669
if($result == 'success') $result = true;
+ − 1670
else { echo $result; $result = false; }
+ − 1671
} else {
+ − 1672
$result = mail($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), 'From: '.getConfig('contact_email'));
+ − 1673
}
+ − 1674
return $result;
+ − 1675
}
+ − 1676
+ − 1677
/**
30
+ − 1678
* Attempts to send an e-mail to the specified user's e-mail address on file intended for the parents
+ − 1679
* @param string $u The usernamd of the user requesting activation
+ − 1680
* @return bool true on success, false on failure
+ − 1681
*/
+ − 1682
+ − 1683
function send_coppa_mail($u, $actkey = false)
+ − 1684
{
+ − 1685
+ − 1686
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1687
+ − 1688
$q = $this->sql('SELECT username,email FROM '.table_prefix.'users WHERE user_id=2 OR user_level=' . USER_LEVEL_ADMIN . ' ORDER BY user_id ASC;');
+ − 1689
$un = $db->fetchrow();
+ − 1690
$admin_user = $un['username'];
+ − 1691
+ − 1692
$q = $this->sql('SELECT username,activation_key,account_active,email FROM '.table_prefix.'users WHERE username=\''.$db->escape($u).'\';');
+ − 1693
$r = $db->fetchrow();
+ − 1694
if ( empty($r['email']) )
+ − 1695
$db->_die('BUG: $session->send_activation_mail(): no e-mail address in row');
+ − 1696
+ − 1697
if(isset($_SERVER['HTTPS'])) $prot = 'https';
+ − 1698
else $prot = 'http';
+ − 1699
if($_SERVER['SERVER_PORT'] == '80') $p = '';
+ − 1700
else $p = ':'.$_SERVER['SERVER_PORT'];
+ − 1701
$sidbak = false;
+ − 1702
if($this->sid_super)
+ − 1703
$sidbak = $this->sid_super;
+ − 1704
$this->sid_super = false;
+ − 1705
if($sidbak)
+ − 1706
$this->sid_super = $sidbak;
+ − 1707
unset($sidbak);
+ − 1708
$link = "$prot://".$_SERVER['HTTP_HOST'].scriptPath;
+ − 1709
+ − 1710
$message = 'Dear parent or legal guardian,
+ − 1711
A child under the username ' . $u . ' recently registered on our website. The child provided your e-mail address as the one of his or her authorized parent or legal guardian, and to comply with the United States Childrens\' Online Privacy Protection act, we ask that all parents of children ages 13 or under please mail us a written form authorizing their child\'s use of our website.
+ − 1712
+ − 1713
If you wish for your child to be allowed access to our website, please print and fill out the form below, and mail it to this address:
+ − 1714
+ − 1715
' . getConfig('coppa_address') . '
+ − 1716
+ − 1717
If you do NOT wish for your child to be allowed access to our site, you do not need to do anything - your child will not be able to access our site as a registered user unless you authorize their account activation.
+ − 1718
+ − 1719
Authorization form:
+ − 1720
-------------------------------- Cut here --------------------------------
+ − 1721
+ − 1722
I, _______________________________________, the legal parent or guardian of the child registered on the website "' . getConfig('site_name') . '" as ' . $u . ', hereby give my authorization for the child\'s e-mail address, instant messaging information, location, and real name, to be collected and stored in a database owned and maintained by ' . getConfig('site_name') . ' at the child\'s option, and for the administrators of this website to use this information according to the privacy policy displayed on their website <' . $link . '>.
+ − 1723
+ − 1724
Child\'s name: _____________________________________
+ − 1725
+ − 1726
Child\'s e-mail address: _____________________________________
+ − 1727
(optional - if you don\'t provide this, we\'ll just send site-related e-mails to your e-mail address)
+ − 1728
+ − 1729
Signature of parent or guardian:
+ − 1730
+ − 1731
____________________________________________________
+ − 1732
+ − 1733
Date (YYYY-MM-DD): ______ / _____ / _____
+ − 1734
+ − 1735
-------------------------------- Cut here --------------------------------';
+ − 1736
$message .= "\n\nSincerely yours, \n$admin_user and the ".$_SERVER['HTTP_HOST']." administration team";
+ − 1737
+ − 1738
if(getConfig('smtp_enabled') == '1')
+ − 1739
{
+ − 1740
$result = smtp_send_email($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), getConfig('contact_email'));
+ − 1741
if($result == 'success')
+ − 1742
{
+ − 1743
$result = true;
+ − 1744
}
+ − 1745
else
+ − 1746
{
+ − 1747
echo $result;
+ − 1748
$result = false;
+ − 1749
}
+ − 1750
}
+ − 1751
else
+ − 1752
{
+ − 1753
$result = mail($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), 'From: '.getConfig('contact_email'));
+ − 1754
}
+ − 1755
return $result;
+ − 1756
}
+ − 1757
+ − 1758
/**
1
+ − 1759
* Sends an e-mail to a user so they can reset their password.
+ − 1760
* @param int $user The user ID, or username if it's a string
+ − 1761
* @return bool true on success, false on failure
+ − 1762
*/
+ − 1763
+ − 1764
function mail_password_reset($user)
+ − 1765
{
+ − 1766
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1767
if(is_int($user))
+ − 1768
{
+ − 1769
$q = $this->sql('SELECT user_id,username,email FROM '.table_prefix.'users WHERE user_id='.$user.';'); // This is SAFE! This is only called if $user is an integer
+ − 1770
}
+ − 1771
elseif(is_string($user))
+ − 1772
{
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 1773
$q = $this->sql('SELECT user_id,username,email FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=' . ENANO_SQLFUNC_LOWERCASE . '(\''.$db->escape($user).'\');');
1
+ − 1774
}
+ − 1775
else
+ − 1776
{
+ − 1777
return false;
+ − 1778
}
+ − 1779
+ − 1780
$row = $db->fetchrow();
+ − 1781
$temp_pass = $this->random_pass();
+ − 1782
+ − 1783
$this->register_temp_password($row['user_id'], $temp_pass);
+ − 1784
+ − 1785
$site_name = getConfig('site_name');
+ − 1786
+ − 1787
$message = "Dear {$row['username']},
+ − 1788
+ − 1789
Someone (hopefully you) on the {$site_name} website requested that a new password be created.
+ − 1790
+ − 1791
The request was sent from the IP address {$_SERVER['REMOTE_ADDR']}.
+ − 1792
+ − 1793
If you did not request the new password, then you do not need to do anything; the password will be invalidated after 24 hours.
+ − 1794
+ − 1795
If you did request this password, then please log in using the password shown below:
+ − 1796
+ − 1797
Password: {$temp_pass}
+ − 1798
+ − 1799
After you log in using this password, you will be able to reset your real password. You can only log in using this temporary password once.
+ − 1800
+ − 1801
Sincerely yours,
+ − 1802
The {$site_name} administration team
+ − 1803
";
+ − 1804
+ − 1805
if(getConfig('smtp_enabled') == '1')
+ − 1806
{
+ − 1807
$result = smtp_send_email($row['email'], getConfig('site_name').' password reset', preg_replace("#(?<!\r)\n#s", "\n", $message), getConfig('contact_email'));
+ − 1808
if($result == 'success')
+ − 1809
{
+ − 1810
$result = true;
+ − 1811
}
+ − 1812
else
+ − 1813
{
+ − 1814
echo '<p>'.$result.'</p>';
+ − 1815
$result = false;
+ − 1816
}
+ − 1817
} else {
+ − 1818
$result = mail($row['email'], getConfig('site_name').' password reset', preg_replace("#(?<!\r)\n#s", "\n", $message), 'From: '.getConfig('contact_email'));
+ − 1819
}
+ − 1820
return $result;
+ − 1821
}
+ − 1822
+ − 1823
/**
+ − 1824
* Sets the temporary password for the specified user to whatever is specified.
+ − 1825
* @param int $user_id
+ − 1826
* @param string $password
+ − 1827
* @return bool
+ − 1828
*/
+ − 1829
+ − 1830
function register_temp_password($user_id, $password)
+ − 1831
{
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1832
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 1833
$temp_pass = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 1834
$this->sql('UPDATE '.table_prefix.'users SET temp_password=\'' . $temp_pass . '\',temp_password_time='.time().' WHERE user_id='.intval($user_id).';');
+ − 1835
}
+ − 1836
+ − 1837
/**
+ − 1838
* Sends a request to the admin panel to have the username $u activated.
+ − 1839
* @param string $u The username of the user requesting activation
+ − 1840
*/
+ − 1841
+ − 1842
function admin_activation_request($u)
+ − 1843
{
+ − 1844
global $db;
+ − 1845
$this->sql('INSERT INTO '.table_prefix.'logs(log_type, action, time_id, date_string, author, edit_summary) VALUES(\'admin\', \'activ_req\', '.time().', \''.date('d M Y h:i a').'\', \''.$this->username.'\', \''.$db->escape($u).'\');');
+ − 1846
}
+ − 1847
+ − 1848
/**
+ − 1849
* Activates a user account. If the action fails, a report is sent to the admin.
+ − 1850
* @param string $user The username of the user requesting activation
+ − 1851
* @param string $key The activation key
+ − 1852
*/
+ − 1853
+ − 1854
function activate_account($user, $key)
+ − 1855
{
+ − 1856
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1857
$this->sql('UPDATE '.table_prefix.'users SET account_active=1 WHERE username=\''.$db->escape($user).'\' AND activation_key=\''.$db->escape($key).'\';');
+ − 1858
$r = mysql_affected_rows();
+ − 1859
if ( $r > 0 )
+ − 1860
{
+ − 1861
$e = $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'activ_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($user).'\', \''.$_SERVER['REMOTE_ADDR'].'\')');
+ − 1862
}
+ − 1863
else
+ − 1864
{
+ − 1865
$e = $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'activ_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($user).'\', \''.$_SERVER['REMOTE_ADDR'].'\')');
+ − 1866
}
+ − 1867
return $r;
+ − 1868
}
+ − 1869
+ − 1870
/**
+ − 1871
* For a given user level identifier (USER_LEVEL_*), returns a string describing that user level.
+ − 1872
* @param int User level
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1873
* @param bool If true, returns a shorter string. Optional.
1
+ − 1874
* @return string
+ − 1875
*/
+ − 1876
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1877
function userlevel_to_string($user_level, $short = false)
1
+ − 1878
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1879
if ( $short )
1
+ − 1880
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1881
switch ( $user_level )
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1882
{
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1883
case USER_LEVEL_GUEST:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1884
return 'Guest';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1885
case USER_LEVEL_MEMBER:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1886
return 'Member';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1887
case USER_LEVEL_CHPREF:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1888
return 'Sensitive preferences changeable';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1889
case USER_LEVEL_MOD:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1890
return 'Moderator';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1891
case USER_LEVEL_ADMIN:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1892
return 'Administrative';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1893
default:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1894
return "Level $user_level";
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1895
}
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1896
}
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1897
else
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1898
{
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1899
switch ( $user_level )
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1900
{
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1901
case USER_LEVEL_GUEST:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1902
return 'Low - guest privileges';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1903
case USER_LEVEL_MEMBER:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1904
return 'Standard - normal member level';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1905
case USER_LEVEL_CHPREF:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1906
return 'Medium - user can change his/her own e-mail address and password';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1907
case USER_LEVEL_MOD:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1908
return 'High - moderator privileges';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1909
case USER_LEVEL_ADMIN:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1910
return 'Highest - administrative privileges';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1911
default:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1912
return "Unknown ($user_level)";
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1913
}
1
+ − 1914
}
+ − 1915
}
+ − 1916
+ − 1917
/**
+ − 1918
* Updates a user's information in the database. Note that any of the values except $user_id can be false if you want to preserve the old values.
+ − 1919
* @param int $user_id The user ID of the user to update - this cannot be changed
+ − 1920
* @param string $username The new username
+ − 1921
* @param string $old_pass The current password - only required if sessionManager::$user_level < USER_LEVEL_ADMIN. This should usually be an UNENCRYPTED string. This can also be an array - if it is, key 0 is treated as data AES-encrypted with key 1
+ − 1922
* @param string $password The new password
+ − 1923
* @param string $email The new e-mail address
+ − 1924
* @param string $realname The new real name
+ − 1925
* @param string $signature The updated forum/comment signature
+ − 1926
* @param int $user_level The updated user level
+ − 1927
* @return string 'success' if successful, or array of error strings on failure
+ − 1928
*/
+ − 1929
+ − 1930
function update_user($user_id, $username = false, $old_pass = false, $password = false, $email = false, $realname = false, $signature = false, $user_level = false)
+ − 1931
{
+ − 1932
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1933
+ − 1934
// Create some arrays
+ − 1935
+ − 1936
$errors = Array(); // Used to hold error strings
+ − 1937
$strs = Array(); // Sub-query statements
+ − 1938
+ − 1939
// Scan the user ID for problems
+ − 1940
if(intval($user_id) < 1) $errors[] = 'SQL injection attempt';
+ − 1941
+ − 1942
// Instanciate the AES encryption class
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 1943
$aes = AESCrypt::singleton(AES_BITS, AES_BLOCKSIZE);
1
+ − 1944
+ − 1945
// If all of our input vars are false, then we've effectively done our job so get out of here
+ − 1946
if($username === false && $password === false && $email === false && $realname === false && $signature === false && $user_level === false)
+ − 1947
{
+ − 1948
// echo 'debug: $session->update_user(): success (no changes requested)';
+ − 1949
return 'success';
+ − 1950
}
+ − 1951
+ − 1952
// Initialize our authentication check
+ − 1953
$authed = false;
+ − 1954
+ − 1955
// Verify the inputted password
+ − 1956
if(is_string($old_pass))
+ − 1957
{
+ − 1958
$q = $this->sql('SELECT password FROM '.table_prefix.'users WHERE user_id='.$user_id.';');
+ − 1959
if($db->numrows() < 1)
+ − 1960
{
+ − 1961
$errors[] = 'The password data could not be selected for verification.';
+ − 1962
}
+ − 1963
else
+ − 1964
{
+ − 1965
$row = $db->fetchrow();
+ − 1966
$real = $aes->decrypt($row['password'], $this->private_key, ENC_HEX);
+ − 1967
if($real == $old_pass)
+ − 1968
$authed = true;
+ − 1969
}
+ − 1970
}
+ − 1971
+ − 1972
elseif(is_array($old_pass))
+ − 1973
{
+ − 1974
$old_pass = $aes->decrypt($old_pass[0], $old_pass[1]);
+ − 1975
$q = $this->sql('SELECT password FROM '.table_prefix.'users WHERE user_id='.$user_id.';');
+ − 1976
if($db->numrows() < 1)
+ − 1977
{
+ − 1978
$errors[] = 'The password data could not be selected for verification.';
+ − 1979
}
+ − 1980
else
+ − 1981
{
+ − 1982
$row = $db->fetchrow();
+ − 1983
$real = $aes->decrypt($row['password'], $this->private_key, ENC_HEX);
+ − 1984
if($real == $old_pass)
+ − 1985
$authed = true;
+ − 1986
}
+ − 1987
}
+ − 1988
+ − 1989
// Initialize our query
+ − 1990
$q = 'UPDATE '.table_prefix.'users SET ';
+ − 1991
+ − 1992
if($this->auth_level >= USER_LEVEL_ADMIN || $authed) // Need the current password in order to update the e-mail address, change the username, or reset the password
+ − 1993
{
+ − 1994
// Username
+ − 1995
if(is_string($username))
+ − 1996
{
+ − 1997
// Check the username for problems
+ − 1998
if(!preg_match('#^'.$this->valid_username.'$#', $username))
+ − 1999
$errors[] = 'The username you entered contains invalid characters.';
+ − 2000
$strs[] = 'username=\''.$db->escape($username).'\'';
+ − 2001
}
+ − 2002
// Password
+ − 2003
if(is_string($password) && strlen($password) >= 6)
+ − 2004
{
+ − 2005
// Password needs to be encrypted before being stashed
+ − 2006
$encpass = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 2007
if(!$encpass)
+ − 2008
$errors[] = 'The password could not be encrypted due to an internal error.';
+ − 2009
$strs[] = 'password=\''.$encpass.'\'';
+ − 2010
}
+ − 2011
// E-mail addy
+ − 2012
if(is_string($email))
+ − 2013
{
+ − 2014
// I didn't write this regex.
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 2015
if(!preg_match('/^(?:[\w\d]+\.?)+@((?:(?:[\w\d]\-?)+\.)+\w{2,4}|localhost)$/', $email))
1
+ − 2016
$errors[] = 'The e-mail address you entered is invalid.';
+ − 2017
$strs[] = 'email=\''.$db->escape($email).'\'';
+ − 2018
}
+ − 2019
}
+ − 2020
// Real name
+ − 2021
if(is_string($realname))
+ − 2022
{
+ − 2023
$strs[] = 'real_name=\''.$db->escape($realname).'\'';
+ − 2024
}
+ − 2025
// Forum/comment signature
+ − 2026
if(is_string($signature))
+ − 2027
{
+ − 2028
$strs[] = 'signature=\''.$db->escape($signature).'\'';
+ − 2029
}
+ − 2030
// User level
+ − 2031
if(is_int($user_level))
+ − 2032
{
+ − 2033
$strs[] = 'user_level='.$user_level;
+ − 2034
}
+ − 2035
+ − 2036
// Add our generated query to the query string
+ − 2037
$q .= implode(',', $strs);
+ − 2038
+ − 2039
// One last error check
+ − 2040
if(sizeof($strs) < 1) $errors[] = 'An internal error occured building the SQL query, this is a bug';
+ − 2041
if(sizeof($errors) > 0) return $errors;
+ − 2042
+ − 2043
// Free our temp arrays
+ − 2044
unset($strs, $errors);
+ − 2045
+ − 2046
// Finalize the query and run it
+ − 2047
$q .= ' WHERE user_id='.$user_id.';';
+ − 2048
$this->sql($q);
+ − 2049
+ − 2050
// We also need to trigger re-activation.
+ − 2051
if ( is_string($email) )
+ − 2052
{
+ − 2053
switch(getConfig('account_activation'))
+ − 2054
{
+ − 2055
case 'user':
+ − 2056
case 'admin':
+ − 2057
+ − 2058
if ( $session->user_level >= USER_LEVEL_MOD && getConfig('account_activation') == 'admin' )
+ − 2059
// Don't require re-activation by admins for admins
+ − 2060
break;
+ − 2061
+ − 2062
// retrieve username
+ − 2063
if ( !$username )
+ − 2064
{
+ − 2065
$q = $this->sql('SELECT username FROM '.table_prefix.'users WHERE user_id='.$user_id.';');
+ − 2066
if($db->numrows() < 1)
+ − 2067
{
+ − 2068
$errors[] = 'The username could not be selected.';
+ − 2069
}
+ − 2070
else
+ − 2071
{
+ − 2072
$row = $db->fetchrow();
+ − 2073
$username = $row['username'];
+ − 2074
}
+ − 2075
}
+ − 2076
if ( !$username )
+ − 2077
return $errors;
+ − 2078
+ − 2079
// Generate a totally random activation key
+ − 2080
$actkey = sha1 ( microtime() . mt_rand() );
+ − 2081
$a = $this->send_activation_mail($username, $actkey);
+ − 2082
if(!$a)
+ − 2083
{
+ − 2084
$this->admin_activation_request($username);
+ − 2085
}
+ − 2086
// Deactivate the account until e-mail is confirmed
+ − 2087
$q = $db->sql_query('UPDATE '.table_prefix.'users SET account_active=0,activation_key=\'' . $actkey . '\' WHERE user_id=' . $user_id . ';');
+ − 2088
break;
+ − 2089
}
+ − 2090
}
+ − 2091
+ − 2092
// Yay! We're done
+ − 2093
return 'success';
+ − 2094
}
+ − 2095
+ − 2096
#
+ − 2097
# Access Control Lists
+ − 2098
#
+ − 2099
+ − 2100
/**
+ − 2101
* Creates a new permission field in memory. If the permissions are set in the database, they are used. Otherwise, $default_perm is used.
+ − 2102
* @param string $acl_type An identifier for this field
+ − 2103
* @param int $default_perm Whether permission should be granted or not if it's not specified in the ACLs.
+ − 2104
* @param string $desc A human readable name for the permission type
+ − 2105
* @param array $deps The list of dependencies - this should be an array of ACL types
+ − 2106
* @param string $scope Which namespaces this field should apply to. This should be either a pipe-delimited list of namespace IDs or just "All".
+ − 2107
*/
+ − 2108
+ − 2109
function register_acl_type($acl_type, $default_perm = AUTH_DISALLOW, $desc = false, $deps = Array(), $scope = 'All')
+ − 2110
{
+ − 2111
if(isset($this->acl_types[$acl_type]))
+ − 2112
return false;
+ − 2113
else
+ − 2114
{
+ − 2115
if(!$desc)
+ − 2116
{
+ − 2117
$desc = capitalize_first_letter(str_replace('_', ' ', $acl_type));
+ − 2118
}
+ − 2119
$this->acl_types[$acl_type] = $default_perm;
+ − 2120
$this->acl_descs[$acl_type] = $desc;
+ − 2121
$this->acl_deps[$acl_type] = $deps;
+ − 2122
$this->acl_scope[$acl_type] = explode('|', $scope);
+ − 2123
}
+ − 2124
return true;
+ − 2125
}
+ − 2126
+ − 2127
/**
+ − 2128
* Tells us whether permission $type is allowed or not based on the current rules.
+ − 2129
* @param string $type The permission identifier ($acl_type passed to sessionManager::register_acl_type())
+ − 2130
* @param bool $no_deps If true, disables dependency checking
+ − 2131
* @return bool True if allowed, false if denied or if an error occured
+ − 2132
*/
+ − 2133
+ − 2134
function get_permissions($type, $no_deps = false)
+ − 2135
{
+ − 2136
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2137
if ( isset( $this->perms[$type] ) )
+ − 2138
{
+ − 2139
if ( $this->perms[$type] == AUTH_DENY )
+ − 2140
$ret = false;
+ − 2141
else if ( $this->perms[$type] == AUTH_WIKIMODE && $paths->wiki_mode )
+ − 2142
$ret = true;
+ − 2143
else if ( $this->perms[$type] == AUTH_WIKIMODE && !$paths->wiki_mode )
+ − 2144
$ret = false;
+ − 2145
else if ( $this->perms[$type] == AUTH_ALLOW )
+ − 2146
$ret = true;
+ − 2147
else if ( $this->perms[$type] == AUTH_DISALLOW )
+ − 2148
$ret = false;
+ − 2149
}
+ − 2150
else if(isset($this->acl_types[$type]))
+ − 2151
{
+ − 2152
if ( $this->acl_types[$type] == AUTH_DENY )
+ − 2153
$ret = false;
+ − 2154
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && $paths->wiki_mode )
+ − 2155
$ret = true;
+ − 2156
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && !$paths->wiki_mode )
+ − 2157
$ret = false;
+ − 2158
else if ( $this->acl_types[$type] == AUTH_ALLOW )
+ − 2159
$ret = true;
+ − 2160
else if ( $this->acl_types[$type] == AUTH_DISALLOW )
+ − 2161
$ret = false;
+ − 2162
}
+ − 2163
else
+ − 2164
{
+ − 2165
// ACL type is undefined
+ − 2166
trigger_error('Unknown access type "' . $type . '"', E_USER_WARNING);
+ − 2167
return false; // Be on the safe side and deny access
+ − 2168
}
+ − 2169
if ( !$no_deps )
+ − 2170
{
+ − 2171
if ( !$this->acl_check_deps($type) )
+ − 2172
return false;
+ − 2173
}
+ − 2174
return $ret;
+ − 2175
}
+ − 2176
+ − 2177
/**
+ − 2178
* Fetch the permissions that apply to the current user for the page specified. The object you get will have the get_permissions method
+ − 2179
* and several other abilities.
+ − 2180
* @param string $page_id
+ − 2181
* @param string $namespace
+ − 2182
* @return object
+ − 2183
*/
+ − 2184
+ − 2185
function fetch_page_acl($page_id, $namespace)
+ − 2186
{
+ − 2187
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2188
+ − 2189
if ( count ( $this->acl_base_cache ) < 1 )
+ − 2190
{
+ − 2191
// Permissions table not yet initialized
+ − 2192
return false;
+ − 2193
}
+ − 2194
155
+ − 2195
// cache of permission objects (to save RAM and SQL queries)
+ − 2196
static $objcache = array();
+ − 2197
+ − 2198
if ( count($objcache) == 0 )
+ − 2199
{
+ − 2200
foreach ( $paths->nslist as $key => $_ )
+ − 2201
{
+ − 2202
$objcache[$key] = array();
+ − 2203
}
+ − 2204
}
+ − 2205
+ − 2206
if ( isset($objcache[$namespace][$page_id]) )
+ − 2207
{
+ − 2208
return $objcache[$namespace][$page_id];
+ − 2209
}
+ − 2210
1
+ − 2211
//if ( !isset( $paths->pages[$paths->nslist[$namespace] . $page_id] ) )
+ − 2212
//{
+ − 2213
// // Page does not exist
+ − 2214
// return false;
+ − 2215
//}
+ − 2216
155
+ − 2217
$objcache[$namespace][$page_id] = new Session_ACLPageInfo( $page_id, $namespace, $this->acl_types, $this->acl_descs, $this->acl_deps, $this->acl_base_cache );
+ − 2218
$object =& $objcache[$namespace][$page_id];
1
+ − 2219
+ − 2220
return $object;
+ − 2221
+ − 2222
}
+ − 2223
+ − 2224
/**
+ − 2225
* Read all of our permissions from the database and process/apply them. This should be called after the page is determined.
+ − 2226
* @access private
+ − 2227
*/
+ − 2228
+ − 2229
function init_permissions()
+ − 2230
{
+ − 2231
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2232
// Initialize the permissions list with some defaults
+ − 2233
$this->perms = $this->acl_types;
+ − 2234
$this->acl_defaults_used = $this->perms;
+ − 2235
+ − 2236
// Fetch sitewide defaults from the permissions table
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 2237
$bs = 'SELECT rules, target_type, target_id FROM '.table_prefix.'acl' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 2238
. ' WHERE page_id IS NULL AND namespace IS NULL AND' . "\n"
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 2239
. ' ( ';
1
+ − 2240
+ − 2241
$q = Array();
+ − 2242
$q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$this->user_id.' )';
+ − 2243
if(count($this->groups) > 0)
+ − 2244
{
+ − 2245
foreach($this->groups as $g_id => $g_name)
+ − 2246
{
+ − 2247
$q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
+ − 2248
}
+ − 2249
}
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 2250
$bs .= implode(" OR \n ", $q) . " ) \n ORDER BY target_type ASC, target_id ASC;";
1
+ − 2251
$q = $this->sql($bs);
+ − 2252
if ( $row = $db->fetchrow() )
+ − 2253
{
+ − 2254
do {
+ − 2255
$rules = $this->string_to_perm($row['rules']);
+ − 2256
$is_everyone = ( $row['target_type'] == ACL_TYPE_GROUP && $row['target_id'] == 1 );
+ − 2257
$this->acl_merge_with_current($rules, $is_everyone);
+ − 2258
} while ( $row = $db->fetchrow() );
+ − 2259
}
+ − 2260
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2261
// Cache the sitewide permissions for later use
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2262
$this->acl_base_cache = $this->perms;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2263
1
+ − 2264
// Eliminate types that don't apply to this namespace
+ − 2265
foreach ( $this->perms AS $i => $perm )
+ − 2266
{
+ − 2267
if ( !in_array ( $paths->namespace, $this->acl_scope[$i] ) && !in_array('All', $this->acl_scope[$i]) )
+ − 2268
{
+ − 2269
unset($this->perms[$i]);
+ − 2270
}
+ − 2271
}
+ − 2272
73
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2273
// PAGE group info
261
+ − 2274
$pg_list = $paths->get_page_groups($paths->page_id, $paths->namespace);
73
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2275
$pg_info = '';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2276
foreach ( $pg_list as $g_id )
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2277
{
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2278
$pg_info .= ' ( page_id=\'' . $g_id . '\' AND namespace=\'__PageGroup\' ) OR';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2279
}
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2280
1
+ − 2281
// Build a query to grab ACL info
+ − 2282
$bs = 'SELECT rules,target_type,target_id FROM '.table_prefix.'acl WHERE ( ';
+ − 2283
$q = Array();
+ − 2284
$q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$this->user_id.' )';
+ − 2285
if(count($this->groups) > 0)
+ − 2286
{
+ − 2287
foreach($this->groups as $g_id => $g_name)
+ − 2288
{
+ − 2289
$q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
+ − 2290
}
+ − 2291
}
+ − 2292
// The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual
+ − 2293
// permissions to override group permissions.
261
+ − 2294
$bs .= implode(" OR\n ", $q) . " )\n AND (" . $pg_info . ' ( page_id=\''.$db->escape($paths->page_id).'\' AND namespace=\''.$db->escape($paths->namespace).'\' ) )
1
+ − 2295
ORDER BY target_type ASC, page_id ASC, namespace ASC;';
+ − 2296
$q = $this->sql($bs);
+ − 2297
if ( $row = $db->fetchrow() )
+ − 2298
{
+ − 2299
do {
+ − 2300
$rules = $this->string_to_perm($row['rules']);
+ − 2301
$is_everyone = ( $row['target_type'] == ACL_TYPE_GROUP && $row['target_id'] == 1 );
+ − 2302
$this->acl_merge_with_current($rules, $is_everyone);
+ − 2303
} while ( $row = $db->fetchrow() );
+ − 2304
}
+ − 2305
+ − 2306
}
+ − 2307
+ − 2308
/**
+ − 2309
* Extends the scope of a permission type.
+ − 2310
* @param string The name of the permission type
+ − 2311
* @param string The namespace(s) that should be covered. This can be either one namespace ID or a pipe-delimited list.
+ − 2312
* @param object Optional - the current $paths object, in case we're doing this from the acl_rule_init hook
+ − 2313
*/
+ − 2314
+ − 2315
function acl_extend_scope($perm_type, $namespaces, &$p_in)
+ − 2316
{
+ − 2317
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2318
$p_obj = ( is_object($p_in) ) ? $p_in : $paths;
+ − 2319
$nslist = explode('|', $namespaces);
+ − 2320
foreach ( $nslist as $i => $ns )
+ − 2321
{
+ − 2322
if ( !isset($p_obj->nslist[$ns]) )
+ − 2323
{
+ − 2324
unset($nslist[$i]);
+ − 2325
}
+ − 2326
else
+ − 2327
{
+ − 2328
$this->acl_scope[$perm_type][] = $ns;
+ − 2329
if ( isset($this->acl_types[$perm_type]) && !isset($this->perms[$perm_type]) )
+ − 2330
{
+ − 2331
$this->perms[$perm_type] = $this->acl_types[$perm_type];
+ − 2332
}
+ − 2333
}
+ − 2334
}
+ − 2335
}
+ − 2336
+ − 2337
/**
+ − 2338
* Converts a permissions field into a string for database insertion. Similar in spirit to serialize().
+ − 2339
* @param array $perms An associative array with only integers as values
+ − 2340
* @return string
+ − 2341
*/
+ − 2342
+ − 2343
function perm_to_string($perms)
+ − 2344
{
+ − 2345
$s = '';
+ − 2346
foreach($perms as $perm => $ac)
+ − 2347
{
+ − 2348
$s .= "$perm=$ac;";
+ − 2349
}
+ − 2350
return $s;
+ − 2351
}
+ − 2352
+ − 2353
/**
+ − 2354
* Converts a permissions string back to an array.
+ − 2355
* @param string $perms The result from sessionManager::perm_to_string()
+ − 2356
* @return array
+ − 2357
*/
+ − 2358
+ − 2359
function string_to_perm($perms)
+ − 2360
{
+ − 2361
$ret = Array();
+ − 2362
preg_match_all('#([a-z0-9_-]+)=([0-9]+);#i', $perms, $matches);
+ − 2363
foreach($matches[1] as $i => $t)
+ − 2364
{
+ − 2365
$ret[$t] = intval($matches[2][$i]);
+ − 2366
}
+ − 2367
return $ret;
+ − 2368
}
+ − 2369
+ − 2370
/**
+ − 2371
* Merges two ACL arrays. Both parameters should be permission list arrays. The second group takes precedence over the first, but AUTH_DENY always prevails.
+ − 2372
* @param array $perm1 The first set of permissions
+ − 2373
* @param array $perm2 The second set of permissions
+ − 2374
* @return array
+ − 2375
*/
+ − 2376
+ − 2377
function acl_merge($perm1, $perm2)
+ − 2378
{
+ − 2379
$ret = $perm1;
+ − 2380
foreach ( $perm2 as $type => $level )
+ − 2381
{
+ − 2382
if ( isset( $ret[$type] ) )
+ − 2383
{
+ − 2384
if ( $ret[$type] != AUTH_DENY )
+ − 2385
$ret[$type] = $level;
+ − 2386
}
+ − 2387
// else
+ − 2388
// {
+ − 2389
// $ret[$type] = $level;
+ − 2390
// }
+ − 2391
}
+ − 2392
return $ret;
+ − 2393
}
+ − 2394
+ − 2395
/**
+ − 2396
* Merges the ACL array sent with the current permissions table, deciding precedence based on whether defaults are in effect or not.
+ − 2397
* @param array The array to merge into the master ACL list
+ − 2398
* @param bool If true, $perm is treated as the "new default"
+ − 2399
* @param int 1 if this is a site-wide ACL, 2 if page-specific. Defaults to 2.
+ − 2400
*/
+ − 2401
+ − 2402
function acl_merge_with_current($perm, $is_everyone = false, $scope = 2)
+ − 2403
{
+ − 2404
foreach ( $this->perms as $i => $p )
+ − 2405
{
+ − 2406
if ( isset($perm[$i]) )
+ − 2407
{
+ − 2408
if ( $is_everyone && !$this->acl_defaults_used[$i] )
+ − 2409
continue;
+ − 2410
// Decide precedence
+ − 2411
if ( isset($this->acl_defaults_used[$i]) )
+ − 2412
{
+ − 2413
//echo "$i: default in use, overriding to: {$perm[$i]}<br />";
+ − 2414
// Defaults are in use, override
+ − 2415
$this->perms[$i] = $perm[$i];
+ − 2416
$this->acl_defaults_used[$i] = ( $is_everyone );
+ − 2417
}
+ − 2418
else
+ − 2419
{
+ − 2420
//echo "$i: default NOT in use";
+ − 2421
// Defaults are not in use, merge as normal
+ − 2422
if ( $this->perms[$i] != AUTH_DENY )
+ − 2423
{
+ − 2424
//echo ", but overriding";
+ − 2425
$this->perms[$i] = $perm[$i];
+ − 2426
}
+ − 2427
//echo "<br />";
+ − 2428
}
+ − 2429
}
+ − 2430
}
+ − 2431
}
+ − 2432
+ − 2433
/**
+ − 2434
* Merges two ACL arrays. Both parameters should be permission list arrays. The second group takes precedence
+ − 2435
* over the first, without exceptions. This is used to merge the hardcoded defaults with admin-specified
+ − 2436
* defaults, which take precedence.
+ − 2437
* @param array $perm1 The first set of permissions
+ − 2438
* @param array $perm2 The second set of permissions
+ − 2439
* @return array
+ − 2440
*/
+ − 2441
+ − 2442
function acl_merge_complete($perm1, $perm2)
+ − 2443
{
+ − 2444
$ret = $perm1;
+ − 2445
foreach ( $perm2 as $type => $level )
+ − 2446
{
+ − 2447
$ret[$type] = $level;
+ − 2448
}
+ − 2449
return $ret;
+ − 2450
}
+ − 2451
+ − 2452
/**
+ − 2453
* Tell us if the dependencies for a given permission are met.
+ − 2454
* @param string The ACL permission ID
+ − 2455
* @return bool
+ − 2456
*/
+ − 2457
+ − 2458
function acl_check_deps($type)
+ − 2459
{
+ − 2460
if(!isset($this->acl_deps[$type])) // This will only happen if the permissions table is hacked or improperly accessed
+ − 2461
return true;
+ − 2462
if(sizeof($this->acl_deps[$type]) < 1)
+ − 2463
return true;
+ − 2464
$deps = $this->acl_deps[$type];
+ − 2465
while(true)
+ − 2466
{
+ − 2467
$full_resolved = true;
+ − 2468
$j = sizeof($deps);
+ − 2469
for ( $i = 0; $i < $j; $i++ )
+ − 2470
{
+ − 2471
$b = $deps;
+ − 2472
$deps = array_merge($deps, $this->acl_deps[$deps[$i]]);
+ − 2473
if( $b == $deps )
+ − 2474
{
+ − 2475
break 2;
+ − 2476
}
+ − 2477
$j = sizeof($deps);
+ − 2478
}
+ − 2479
}
+ − 2480
//die('<pre>'.print_r($deps, true).'</pre>');
+ − 2481
foreach($deps as $d)
+ − 2482
{
+ − 2483
if ( !$this->get_permissions($d) )
+ − 2484
{
+ − 2485
return false;
+ − 2486
}
+ − 2487
}
+ − 2488
return true;
+ − 2489
}
+ − 2490
+ − 2491
/**
+ − 2492
* Makes a CAPTCHA code and caches the code in the database
+ − 2493
* @param int $len The length of the code, in bytes
+ − 2494
* @return string A unique identifier assigned to the code. This hash should be passed to sessionManager::getCaptcha() to retrieve the code.
+ − 2495
*/
+ − 2496
+ − 2497
function make_captcha($len = 7)
+ − 2498
{
212
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2499
$code = $this->generate_captcha_code($len);
1
+ − 2500
$hash = md5(microtime() . mt_rand());
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 2501
$this->sql('INSERT INTO '.table_prefix.'session_keys(session_key,salt,auth_level,source_ip,user_id) VALUES(\''.$hash.'\', \'\', -1, \''.ip2hex($_SERVER['REMOTE_ADDR']).'\', -2);');
1
+ − 2502
return $hash;
+ − 2503
}
+ − 2504
+ − 2505
/**
212
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2506
* Generates the actual confirmation code text.
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2507
* @param int String length
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2508
* @return string
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2509
*/
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2510
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2511
function generate_captcha_code($len = 7)
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2512
{
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2513
$chars = array('A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9');
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2514
$s = '';
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2515
for ( $i = 0; $i < $len; $i++ )
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2516
{
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2517
$s .= $chars[mt_rand(0, count($chars)-1)];
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2518
}
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2519
return $s;
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2520
}
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2521
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2522
/**
1
+ − 2523
* For the given code ID, returns the correct CAPTCHA code, or false on failure
+ − 2524
* @param string $hash The unique ID assigned to the code
+ − 2525
* @return string The correct confirmation code
+ − 2526
*/
+ − 2527
+ − 2528
function get_captcha($hash)
+ − 2529
{
+ − 2530
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2531
$s = $this->sql('SELECT salt FROM '.table_prefix.'session_keys WHERE session_key=\''.$db->escape($hash).'\' AND source_ip=\''.ip2hex($_SERVER['REMOTE_ADDR']).'\';');
212
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2532
if ( $db->numrows() < 1 )
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2533
{
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2534
return false;
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2535
}
1
+ − 2536
$r = $db->fetchrow();
212
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2537
$db->free_result();
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2538
$this->sql('DELETE FROM ' . table_prefix . 'session_keys WHERE salt=\'' . $db->escape($r['salt']) . '\';');
1
+ − 2539
return $r['salt'];
+ − 2540
}
+ − 2541
+ − 2542
/**
212
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2543
* (AS OF 1.0.2: Deprecated. Captcha codes are now killed on first fetch for security.) Deletes all CAPTCHA codes cached in the DB for this user.
1
+ − 2544
*/
+ − 2545
+ − 2546
function kill_captcha()
+ − 2547
{
212
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2548
// $this->sql('DELETE FROM '.table_prefix.'session_keys WHERE user_id=-2 AND source_ip=\''.ip2hex($_SERVER['REMOTE_ADDR']).'\';');
d57af0b0302e
Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true
Dan
diff
changeset
+ − 2549
return true;
1
+ − 2550
}
+ − 2551
+ − 2552
/**
+ − 2553
* Generates a random password.
+ − 2554
* @param int $length Optional - length of password
+ − 2555
* @return string
+ − 2556
*/
+ − 2557
+ − 2558
function random_pass($length = 10)
+ − 2559
{
+ − 2560
$valid_chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+@#%&<>';
+ − 2561
$valid_chars = enano_str_split($valid_chars);
+ − 2562
$ret = '';
+ − 2563
for ( $i = 0; $i < $length; $i++ )
+ − 2564
{
+ − 2565
$ret .= $valid_chars[mt_rand(0, count($valid_chars)-1)];
+ − 2566
}
+ − 2567
return $ret;
+ − 2568
}
+ − 2569
+ − 2570
/**
+ − 2571
* Generates some Javascript that calls the AES encryption library.
+ − 2572
* @param string The name of the form
+ − 2573
* @param string The name of the password field
+ − 2574
* @param string The name of the field that switches encryption on or off
+ − 2575
* @param string The name of the field that contains the encryption key
+ − 2576
* @param string The name of the field that will contain the encrypted password
+ − 2577
* @param string The name of the field that handles MD5 challenge data
+ − 2578
* @return string
+ − 2579
*/
+ − 2580
+ − 2581
function aes_javascript($form_name, $pw_field, $use_crypt, $crypt_key, $crypt_data, $challenge)
+ − 2582
{
+ − 2583
$code = '
+ − 2584
<script type="text/javascript">
+ − 2585
disableJSONExts();
+ − 2586
str = \'\';
+ − 2587
for(i=0;i<keySizeInBits/4;i++) str+=\'0\';
+ − 2588
var key = hexToByteArray(str);
+ − 2589
var pt = hexToByteArray(str);
+ − 2590
var ct = rijndaelEncrypt(pt, key, \'ECB\');
+ − 2591
var ct = byteArrayToHex(ct);
+ − 2592
switch(keySizeInBits)
+ − 2593
{
+ − 2594
case 128:
+ − 2595
v = \'66e94bd4ef8a2c3b884cfa59ca342b2e\';
+ − 2596
break;
+ − 2597
case 192:
+ − 2598
v = \'aae06992acbf52a3e8f4a96ec9300bd7aae06992acbf52a3e8f4a96ec9300bd7\';
+ − 2599
break;
+ − 2600
case 256:
+ − 2601
v = \'dc95c078a2408989ad48a21492842087dc95c078a2408989ad48a21492842087\';
+ − 2602
break;
+ − 2603
}
+ − 2604
var testpassed = ' . ( ( isset($_GET['use_crypt']) && $_GET['use_crypt']=='0') ? 'false; // CRYPTO-AUTH DISABLED ON USER REQUEST // ' : '' ) . '( ct == v && md5_vm_test() );
+ − 2605
var frm = document.forms.'.$form_name.';
+ − 2606
function runEncryption()
+ − 2607
{
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2608
var frm = document.forms.'.$form_name.';
1
+ − 2609
if(testpassed)
+ − 2610
{
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2611
frm.'.$use_crypt.'.value = \'yes\';
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2612
var cryptkey = frm.'.$crypt_key.'.value;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2613
frm.'.$crypt_key.'.value = hex_md5(cryptkey);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2614
cryptkey = hexToByteArray(cryptkey);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2615
if(!cryptkey || ( ( typeof cryptkey == \'string\' || typeof cryptkey == \'object\' ) ) && cryptkey.length != keySizeInBits / 8 )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2616
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2617
if ( frm._login ) frm._login.disabled = true;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2618
len = ( typeof cryptkey == \'string\' || typeof cryptkey == \'object\' ) ? \'\\nLen: \'+cryptkey.length : \'\';
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2619
alert(\'The key is messed up\\nType: \'+typeof(cryptkey)+len);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2620
}
1
+ − 2621
pass = frm.'.$pw_field.'.value;
+ − 2622
chal = frm.'.$challenge.'.value;
+ − 2623
challenge = hex_md5(pass + chal) + chal;
+ − 2624
frm.'.$challenge.'.value = challenge;
+ − 2625
pass = stringToByteArray(pass);
+ − 2626
cryptstring = rijndaelEncrypt(pass, cryptkey, \'ECB\');
+ − 2627
if(!cryptstring)
+ − 2628
{
+ − 2629
return false;
+ − 2630
}
+ − 2631
cryptstring = byteArrayToHex(cryptstring);
+ − 2632
frm.'.$crypt_data.'.value = cryptstring;
+ − 2633
frm.'.$pw_field.'.value = \'\';
+ − 2634
}
+ − 2635
return false;
+ − 2636
}
+ − 2637
</script>
+ − 2638
';
+ − 2639
return $code;
+ − 2640
}
+ − 2641
+ − 2642
}
+ − 2643
+ − 2644
/**
+ − 2645
* Class used to fetch permissions for a specific page. Used internally by SessionManager.
+ − 2646
* @package Enano
+ − 2647
* @subpackage Session manager
+ − 2648
* @license http://www.gnu.org/copyleft/gpl.html
+ − 2649
* @access private
+ − 2650
*/
+ − 2651
+ − 2652
class Session_ACLPageInfo {
+ − 2653
+ − 2654
/**
+ − 2655
* The page ID of this ACL info package
+ − 2656
* @var string
+ − 2657
*/
+ − 2658
+ − 2659
var $page_id;
+ − 2660
+ − 2661
/**
+ − 2662
* The namespace of the page being checked
+ − 2663
* @var string
+ − 2664
*/
+ − 2665
+ − 2666
var $namespace;
+ − 2667
+ − 2668
/**
+ − 2669
* Our list of permission types.
+ − 2670
* @access private
+ − 2671
* @var array
+ − 2672
*/
+ − 2673
+ − 2674
var $acl_types = Array();
+ − 2675
+ − 2676
/**
+ − 2677
* The list of descriptions for the permission types
+ − 2678
* @var array
+ − 2679
*/
+ − 2680
+ − 2681
var $acl_descs = Array();
+ − 2682
+ − 2683
/**
+ − 2684
* A list of dependencies for ACL types.
+ − 2685
* @var array
+ − 2686
*/
+ − 2687
+ − 2688
var $acl_deps = Array();
+ − 2689
+ − 2690
/**
202
+ − 2691
* Our tell-all list of permissions. Do not even try to change this.
+ − 2692
* @access private
1
+ − 2693
* @var array
+ − 2694
*/
+ − 2695
+ − 2696
var $perms = Array();
+ − 2697
+ − 2698
/**
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2699
* Array to track which default permissions are being used
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2700
* @var array
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2701
* @access private
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2702
*/
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2703
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2704
var $acl_defaults_used = Array();
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2705
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2706
/**
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2707
* Tracks whether Wiki Mode is on for the page we're operating on.
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2708
* @var bool
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2709
*/
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2710
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2711
var $wiki_mode = false;
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2712
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2713
/**
1
+ − 2714
* Constructor.
+ − 2715
* @param string $page_id The ID of the page to check
+ − 2716
* @param string $namespace The namespace of the page to check.
+ − 2717
* @param array $acl_types List of ACL types
+ − 2718
* @param array $acl_descs List of human-readable descriptions for permissions (associative)
+ − 2719
* @param array $acl_deps List of dependencies for permissions. For example, viewing history/diffs depends on the ability to read the page.
+ − 2720
* @param array $base What to start with - this is an attempt to reduce the number of SQL queries.
+ − 2721
*/
+ − 2722
+ − 2723
function Session_ACLPageInfo($page_id, $namespace, $acl_types, $acl_descs, $acl_deps, $base)
+ − 2724
{
+ − 2725
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2726
+ − 2727
$this->acl_deps = $acl_deps;
+ − 2728
$this->acl_types = $acl_types;
+ − 2729
$this->acl_descs = $acl_descs;
+ − 2730
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2731
$this->perms = $acl_types;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2732
$this->perms = $session->acl_merge_complete($this->perms, $base);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2733
73
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2734
// PAGE group info
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2735
$pg_list = $paths->get_page_groups($page_id, $namespace);
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2736
$pg_info = '';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2737
foreach ( $pg_list as $g_id )
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2738
{
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2739
$pg_info .= ' ( page_id=\'' . $g_id . '\' AND namespace=\'__PageGroup\' ) OR';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2740
}
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2741
1
+ − 2742
// Build a query to grab ACL info
259
112debff64bd
SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON
Dan
diff
changeset
+ − 2743
$bs = 'SELECT rules,target_type,target_id FROM '.table_prefix.'acl WHERE ' . "\n"
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 2744
. ' ( ';
1
+ − 2745
$q = Array();
+ − 2746
$q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$session->user_id.' )';
+ − 2747
if(count($session->groups) > 0)
+ − 2748
{
+ − 2749
foreach($session->groups as $g_id => $g_name)
+ − 2750
{
+ − 2751
$q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
+ − 2752
}
+ − 2753
}
+ − 2754
// The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual
+ − 2755
// permissions to override group permissions.
229
b2f985e4cef3
Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added
Dan
diff
changeset
+ − 2756
$bs .= implode(" OR\n ", $q) . ' ) AND (' . $pg_info . ' page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\' )
1
+ − 2757
ORDER BY target_type ASC, page_id ASC, namespace ASC;';
+ − 2758
$q = $session->sql($bs);
+ − 2759
if ( $row = $db->fetchrow() )
+ − 2760
{
+ − 2761
do {
+ − 2762
$rules = $session->string_to_perm($row['rules']);
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2763
$is_everyone = ( $row['target_type'] == ACL_TYPE_GROUP && $row['target_id'] == 1 );
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2764
$this->acl_merge_with_current($rules, $is_everyone);
1
+ − 2765
} while ( $row = $db->fetchrow() );
+ − 2766
}
+ − 2767
+ − 2768
$this->page_id = $page_id;
+ − 2769
$this->namespace = $namespace;
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2770
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2771
$pathskey = $paths->nslist[$this->namespace].$this->page_id;
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2772
$ppwm = 2;
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2773
if ( isset($paths->pages[$pathskey]) )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2774
{
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2775
if ( isset($paths->pages[$pathskey]['wiki_mode']) )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2776
$ppwm = $paths->pages[$pathskey]['wiki_mode'];
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2777
}
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2778
if ( $ppwm == 1 && ( $session->user_logged_in || getConfig('wiki_mode_require_login') != '1' ) )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2779
$this->wiki_mode = true;
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2780
else if ( $ppwm == 1 && !$session->user_logged_in && getConfig('wiki_mode_require_login') == '1' )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2781
$this->wiki_mode = true;
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2782
else if ( $ppwm == 0 )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2783
$this->wiki_mode = false;
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2784
else if ( $ppwm == 2 )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2785
{
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2786
if ( $session->user_logged_in )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2787
{
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2788
$this->wiki_mode = ( getConfig('wiki_mode') == '1' );
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2789
}
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2790
else
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2791
{
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2792
$this->wiki_mode = ( getConfig('wiki_mode') == '1' && getConfig('wiki_mode_require_login') != '1' );
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2793
}
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2794
}
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2795
else
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2796
{
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2797
// Ech. Internal logic failure, this should never happen.
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2798
return false;
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2799
}
1
+ − 2800
}
+ − 2801
+ − 2802
/**
+ − 2803
* Tells us whether permission $type is allowed or not based on the current rules.
+ − 2804
* @param string $type The permission identifier ($acl_type passed to sessionManager::register_acl_type())
+ − 2805
* @param bool $no_deps If true, disables dependency checking
+ − 2806
* @return bool True if allowed, false if denied or if an error occured
+ − 2807
*/
+ − 2808
+ − 2809
function get_permissions($type, $no_deps = false)
+ − 2810
{
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2811
// echo '<pre>' . print_r($this->perms, true) . '</pre>';
1
+ − 2812
global $db, $session, $paths, $template, $plugins; // Common objects
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2813
1
+ − 2814
if ( isset( $this->perms[$type] ) )
+ − 2815
{
+ − 2816
if ( $this->perms[$type] == AUTH_DENY )
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2817
{
1
+ − 2818
$ret = false;
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2819
}
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2820
else if ( $this->perms[$type] == AUTH_WIKIMODE && $this->wiki_mode )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2821
{
1
+ − 2822
$ret = true;
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2823
}
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2824
else if ( $this->perms[$type] == AUTH_WIKIMODE && !$this->wiki_mode )
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2825
{
1
+ − 2826
$ret = false;
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2827
}
1
+ − 2828
else if ( $this->perms[$type] == AUTH_ALLOW )
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2829
{
1
+ − 2830
$ret = true;
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2831
}
1
+ − 2832
else if ( $this->perms[$type] == AUTH_DISALLOW )
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2833
{
1
+ − 2834
$ret = false;
265
915d399dfdbf
Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)
Dan
diff
changeset
+ − 2835
}
1
+ − 2836
}
+ − 2837
else if(isset($this->acl_types[$type]))
+ − 2838
{
+ − 2839
if ( $this->acl_types[$type] == AUTH_DENY )
+ − 2840
$ret = false;
+ − 2841
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && $paths->wiki_mode )
+ − 2842
$ret = true;
+ − 2843
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && !$paths->wiki_mode )
+ − 2844
$ret = false;
+ − 2845
else if ( $this->acl_types[$type] == AUTH_ALLOW )
+ − 2846
$ret = true;
+ − 2847
else if ( $this->acl_types[$type] == AUTH_DISALLOW )
+ − 2848
$ret = false;
+ − 2849
}
+ − 2850
else
+ − 2851
{
+ − 2852
// ACL type is undefined
+ − 2853
trigger_error('Unknown access type "' . $type . '"', E_USER_WARNING);
+ − 2854
return false; // Be on the safe side and deny access
+ − 2855
}
+ − 2856
if ( !$no_deps )
+ − 2857
{
+ − 2858
if ( !$this->acl_check_deps($type) )
+ − 2859
return false;
+ − 2860
}
+ − 2861
return $ret;
+ − 2862
}
+ − 2863
+ − 2864
/**
+ − 2865
* Tell us if the dependencies for a given permission are met.
+ − 2866
* @param string The ACL permission ID
+ − 2867
* @return bool
+ − 2868
*/
+ − 2869
+ − 2870
function acl_check_deps($type)
+ − 2871
{
+ − 2872
if(!isset($this->acl_deps[$type])) // This will only happen if the permissions table is hacked or improperly accessed
+ − 2873
return true;
+ − 2874
if(sizeof($this->acl_deps[$type]) < 1)
+ − 2875
return true;
+ − 2876
$deps = $this->acl_deps[$type];
+ − 2877
while(true)
+ − 2878
{
+ − 2879
$full_resolved = true;
+ − 2880
$j = sizeof($deps);
+ − 2881
for ( $i = 0; $i < $j; $i++ )
+ − 2882
{
+ − 2883
$b = $deps;
+ − 2884
$deps = array_merge($deps, $this->acl_deps[$deps[$i]]);
+ − 2885
if( $b == $deps )
+ − 2886
{
+ − 2887
break 2;
+ − 2888
}
+ − 2889
$j = sizeof($deps);
+ − 2890
}
+ − 2891
}
+ − 2892
//die('<pre>'.print_r($deps, true).'</pre>');
+ − 2893
foreach($deps as $d)
+ − 2894
{
+ − 2895
if ( !$this->get_permissions($d) )
+ − 2896
{
+ − 2897
return false;
+ − 2898
}
+ − 2899
}
+ − 2900
return true;
+ − 2901
}
+ − 2902
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2903
/**
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2904
* Merges the ACL array sent with the current permissions table, deciding precedence based on whether defaults are in effect or not.
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2905
* @param array The array to merge into the master ACL list
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2906
* @param bool If true, $perm is treated as the "new default"
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2907
* @param int 1 if this is a site-wide ACL, 2 if page-specific. Defaults to 2.
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2908
*/
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2909
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2910
function acl_merge_with_current($perm, $is_everyone = false, $scope = 2)
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2911
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2912
foreach ( $this->perms as $i => $p )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2913
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2914
if ( isset($perm[$i]) )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2915
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2916
if ( $is_everyone && !$this->acl_defaults_used[$i] )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2917
continue;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2918
// Decide precedence
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2919
if ( isset($this->acl_defaults_used[$i]) )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2920
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2921
//echo "$i: default in use, overriding to: {$perm[$i]}<br />";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2922
// Defaults are in use, override
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2923
$this->perms[$i] = $perm[$i];
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2924
$this->acl_defaults_used[$i] = ( $is_everyone );
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2925
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2926
else
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2927
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2928
//echo "$i: default NOT in use";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2929
// Defaults are not in use, merge as normal
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2930
if ( $this->perms[$i] != AUTH_DENY )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2931
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2932
//echo ", but overriding";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2933
$this->perms[$i] = $perm[$i];
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2934
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2935
//echo "<br />";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2936
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2937
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2938
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2939
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2940
1
+ − 2941
}
+ − 2942
+ − 2943
?>