1
+ − 1
<?php
+ − 2
+ − 3
/*
+ − 4
* Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between
142
ca9118d9c0f2
Rebrand as 1.0.2 (Coblynau); internal links are now parsed by RenderMan::parse_internal_links()
Dan
diff
changeset
+ − 5
* Version 1.0.2 (Coblynau)
1
+ − 6
* Copyright (C) 2006-2007 Dan Fuhry
+ − 7
* sessions.php - everything related to security and user management
+ − 8
*
+ − 9
* This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License
+ − 10
* as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
+ − 11
*
+ − 12
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
+ − 13
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
+ − 14
*/
+ − 15
+ − 16
// Prepare a string for insertion into a MySQL database
+ − 17
function filter($str) { return $db->escape($str); }
+ − 18
+ − 19
/**
+ − 20
* Anything and everything related to security and user management. This includes AES encryption, which is illegal in some countries.
+ − 21
* Documenting the API was not easy - I hope you folks enjoy it.
+ − 22
* @package Enano
+ − 23
* @subpackage Session manager
+ − 24
* @category security, user management, logins, etc.
+ − 25
*/
+ − 26
+ − 27
class sessionManager {
+ − 28
+ − 29
# Variables
+ − 30
+ − 31
/**
+ − 32
* Whether we're logged in or not
+ − 33
* @var bool
+ − 34
*/
+ − 35
+ − 36
var $user_logged_in = false;
+ − 37
+ − 38
/**
+ − 39
* Our current low-privilege session key
+ − 40
* @var string
+ − 41
*/
+ − 42
+ − 43
var $sid;
+ − 44
+ − 45
/**
+ − 46
* Username of currently logged-in user, or IP address if not logged in
+ − 47
* @var string
+ − 48
*/
+ − 49
+ − 50
var $username;
+ − 51
+ − 52
/**
+ − 53
* User ID of currently logged-in user, or -1 if not logged in
+ − 54
* @var int
+ − 55
*/
+ − 56
+ − 57
var $user_id;
+ − 58
+ − 59
/**
+ − 60
* Real name of currently logged-in user, or blank if not logged in
+ − 61
* @var string
+ − 62
*/
+ − 63
+ − 64
var $real_name;
+ − 65
+ − 66
/**
+ − 67
* E-mail address of currently logged-in user, or blank if not logged in
+ − 68
* @var string
+ − 69
*/
+ − 70
+ − 71
var $email;
+ − 72
+ − 73
/**
31
+ − 74
* List of "extra" user information fields (IM handles, etc.)
+ − 75
* @var array (associative)
+ − 76
*/
+ − 77
+ − 78
var $user_extra;
+ − 79
+ − 80
/**
1
+ − 81
* User level of current user
+ − 82
* USER_LEVEL_GUEST: guest
+ − 83
* USER_LEVEL_MEMBER: regular user
+ − 84
* USER_LEVEL_CHPREF: default - pseudo-level that allows changing password and e-mail address (requires re-authentication)
+ − 85
* USER_LEVEL_MOD: moderator
+ − 86
* USER_LEVEL_ADMIN: administrator
+ − 87
* @var int
+ − 88
*/
+ − 89
+ − 90
var $user_level;
+ − 91
+ − 92
/**
+ − 93
* High-privilege session key
+ − 94
* @var string or false if not running on high-level authentication
+ − 95
*/
+ − 96
+ − 97
var $sid_super;
+ − 98
+ − 99
/**
+ − 100
* The user's theme preference, defaults to $template->default_theme
+ − 101
* @var string
+ − 102
*/
+ − 103
+ − 104
var $theme;
+ − 105
+ − 106
/**
+ − 107
* The user's style preference, or style auto-detected based on theme if not logged in
+ − 108
* @var string
+ − 109
*/
+ − 110
+ − 111
var $style;
+ − 112
+ − 113
/**
+ − 114
* Signature of current user - appended to comments, etc.
+ − 115
* @var string
+ − 116
*/
+ − 117
+ − 118
var $signature;
+ − 119
+ − 120
/**
+ − 121
* UNIX timestamp of when we were registered, or 0 if not logged in
+ − 122
* @var int
+ − 123
*/
+ − 124
+ − 125
var $reg_time;
+ − 126
+ − 127
/**
+ − 128
* MD5 hash of the current user's password, if applicable
+ − 129
* @var string OR bool false
+ − 130
*/
+ − 131
+ − 132
var $password_hash;
+ − 133
+ − 134
/**
+ − 135
* The number of unread private messages this user has.
+ − 136
* @var int
+ − 137
*/
+ − 138
+ − 139
var $unread_pms = 0;
+ − 140
+ − 141
/**
+ − 142
* AES key used to encrypt passwords and session key info - irreversibly destroyed when disallow_password_grab() is called
+ − 143
* @var string
+ − 144
*/
+ − 145
+ − 146
var $private_key;
+ − 147
+ − 148
/**
+ − 149
* Regex that defines a valid username, minus the ^ and $, these are added later
+ − 150
* @var string
+ − 151
*/
+ − 152
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 153
//var $valid_username = '([A-Za-z0-9 \!\@\(\)-]+)';
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 154
var $valid_username = '([^<>_&\?\'"%\n\r\t\a\/]+)';
1
+ − 155
+ − 156
/**
+ − 157
* What we're allowed to do as far as permissions go. This changes based on the value of the "auth" URI param.
+ − 158
* @var string
+ − 159
*/
+ − 160
+ − 161
var $auth_level = -1;
+ − 162
+ − 163
/**
+ − 164
* State variable to track if a session timed out
+ − 165
* @var bool
+ − 166
*/
+ − 167
+ − 168
var $sw_timed_out = false;
+ − 169
+ − 170
/**
+ − 171
* Switch to track if we're started or not.
+ − 172
* @access private
+ − 173
* @var bool
+ − 174
*/
+ − 175
+ − 176
var $started = false;
+ − 177
+ − 178
/**
+ − 179
* Switch to control compatibility mode (for older Enano websites being upgraded)
+ − 180
* @access private
+ − 181
* @var bool
+ − 182
*/
+ − 183
+ − 184
var $compat = false;
+ − 185
+ − 186
/**
+ − 187
* Our list of permission types.
+ − 188
* @access private
+ − 189
* @var array
+ − 190
*/
+ − 191
+ − 192
var $acl_types = Array();
+ − 193
+ − 194
/**
+ − 195
* The list of descriptions for the permission types
+ − 196
* @var array
+ − 197
*/
+ − 198
+ − 199
var $acl_descs = Array();
+ − 200
+ − 201
/**
+ − 202
* A list of dependencies for ACL types.
+ − 203
* @var array
+ − 204
*/
+ − 205
+ − 206
var $acl_deps = Array();
+ − 207
+ − 208
/**
+ − 209
* Our tell-all list of permissions.
+ − 210
* @access private - or, preferably, protected
+ − 211
* @var array
+ − 212
*/
+ − 213
+ − 214
var $perms = Array();
+ − 215
+ − 216
/**
+ − 217
* A cache variable - saved after sitewide permissions are checked but before page-specific permissions.
+ − 218
* @var array
+ − 219
* @access private
+ − 220
*/
+ − 221
+ − 222
var $acl_base_cache = Array();
+ − 223
+ − 224
/**
+ − 225
* Stores the scope information for ACL types.
+ − 226
* @var array
+ − 227
* @access private
+ − 228
*/
+ − 229
+ − 230
var $acl_scope = Array();
+ − 231
+ − 232
/**
+ − 233
* Array to track which default permissions are being used
+ − 234
* @var array
+ − 235
* @access private
+ − 236
*/
+ − 237
+ − 238
var $acl_defaults_used = Array();
+ − 239
+ − 240
/**
+ − 241
* Array to track group membership.
+ − 242
* @var array
+ − 243
*/
+ − 244
+ − 245
var $groups = Array();
+ − 246
+ − 247
/**
+ − 248
* Associative array to track group modship.
+ − 249
* @var array
+ − 250
*/
+ − 251
+ − 252
var $group_mod = Array();
+ − 253
+ − 254
# Basic functions
+ − 255
+ − 256
/**
+ − 257
* Constructor.
+ − 258
*/
+ − 259
+ − 260
function __construct()
+ − 261
{
+ − 262
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 263
include(ENANO_ROOT.'/config.php');
+ − 264
unset($dbhost, $dbname, $dbuser, $dbpasswd);
+ − 265
if(isset($crypto_key))
+ − 266
{
+ − 267
$this->private_key = $crypto_key;
+ − 268
$this->private_key = hexdecode($this->private_key);
+ − 269
}
+ − 270
else
+ − 271
{
+ − 272
if(is_writable(ENANO_ROOT.'/config.php'))
+ − 273
{
+ − 274
// Generate and stash a private key
+ − 275
// This should only happen during an automated silent gradual migration to the new encryption platform.
+ − 276
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 277
$this->private_key = $aes->gen_readymade_key();
+ − 278
+ − 279
$config = file_get_contents(ENANO_ROOT.'/config.php');
+ − 280
if(!$config)
+ − 281
{
+ − 282
die('$session->__construct(): can\'t get the contents of config.php');
+ − 283
}
+ − 284
+ − 285
$config = str_replace("?>", "\$crypto_key = '{$this->private_key}';\n?>", $config);
+ − 286
// And while we're at it...
+ − 287
$config = str_replace('MIDGET_INSTALLED', 'ENANO_INSTALLED', $config);
+ − 288
$fh = @fopen(ENANO_ROOT.'/config.php', 'w');
+ − 289
if ( !$fh )
+ − 290
{
+ − 291
die('$session->__construct(): Couldn\'t open config file for writing to store the private key, I tried to avoid something like this...');
+ − 292
}
+ − 293
+ − 294
fwrite($fh, $config);
+ − 295
fclose($fh);
+ − 296
}
+ − 297
else
+ − 298
{
+ − 299
die_semicritical('Crypto error', '<p>No private key was found in the config file, and we can\'t generate one because we don\'t have write access to the config file. Please CHMOD config.php to 666 or 777 and reload this page.</p>');
+ − 300
}
+ − 301
}
+ − 302
// Check for compatibility mode
+ − 303
if(defined('IN_ENANO_INSTALL'))
+ − 304
{
+ − 305
$q = $db->sql_query('SELECT old_encryption FROM '.table_prefix.'users LIMIT 1;');
+ − 306
if(!$q)
+ − 307
{
+ − 308
$error = mysql_error();
+ − 309
if(strstr($error, "Unknown column 'old_encryption'"))
+ − 310
$this->compat = true;
+ − 311
else
+ − 312
$db->_die('This should never happen and is a bug - the only error that was supposed to happen here didn\'t happen. (sessions.php in constructor, during compat mode check)');
+ − 313
}
+ − 314
$db->free_result();
+ − 315
}
+ − 316
}
+ − 317
+ − 318
/**
+ − 319
* PHP 4 compatible constructor.
+ − 320
*/
+ − 321
+ − 322
function sessionManager()
+ − 323
{
+ − 324
$this->__construct();
+ − 325
}
+ − 326
+ − 327
/**
+ − 328
* Wrapper function to sanitize strings for MySQL and HTML
+ − 329
* @param string $text The text to sanitize
+ − 330
* @return string
+ − 331
*/
+ − 332
+ − 333
function prepare_text($text)
+ − 334
{
+ − 335
global $db;
+ − 336
return $db->escape(htmlspecialchars($text));
+ − 337
}
+ − 338
+ − 339
/**
+ − 340
* Makes a SQL query and handles error checking
+ − 341
* @param string $query The SQL query to make
+ − 342
* @return resource
+ − 343
*/
+ − 344
+ − 345
function sql($query)
+ − 346
{
+ − 347
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 348
$result = $db->sql_query($query);
+ − 349
if(!$result)
+ − 350
{
+ − 351
$db->_die('The error seems to have occurred somewhere in the session management code.');
+ − 352
}
+ − 353
return $result;
+ − 354
}
+ − 355
+ − 356
# Session restoration and permissions
+ − 357
+ − 358
/**
+ − 359
* Initializes the basic state of things, including most user prefs, login data, cookie stuff
+ − 360
*/
+ − 361
+ − 362
function start()
+ − 363
{
+ − 364
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 365
if($this->started) return;
+ − 366
$this->started = true;
+ − 367
$user = false;
+ − 368
if(isset($_COOKIE['sid']))
+ − 369
{
+ − 370
if($this->compat)
+ − 371
{
+ − 372
$userdata = $this->compat_validate_session($_COOKIE['sid']);
+ − 373
}
+ − 374
else
+ − 375
{
+ − 376
$userdata = $this->validate_session($_COOKIE['sid']);
+ − 377
}
+ − 378
if(is_array($userdata))
+ − 379
{
+ − 380
$data = RenderMan::strToPageID($paths->get_pageid_from_url());
+ − 381
+ − 382
if(!$this->compat && $userdata['account_active'] != 1 && $data[1] != 'Special' && $data[1] != 'Admin')
+ − 383
{
+ − 384
$this->logout();
+ − 385
$a = getConfig('account_activation');
+ − 386
switch($a)
+ − 387
{
+ − 388
case 'none':
+ − 389
default:
+ − 390
$solution = 'Your account was most likely deactivated by an administrator. Please contact the site administration for further assistance.';
+ − 391
break;
+ − 392
case 'user':
+ − 393
$solution = 'Please check your e-mail; you should have been sent a message with instructions on how to activate your account. If you do not receive an e-mail from this site within 24 hours, please contact the site administration for further assistance.';
+ − 394
break;
+ − 395
case 'admin':
127
+ − 396
$solution = 'This website has been configured so that all user accounts must be activated by the administrator before they can be used, so your account will most likely be activated the next time an administrator visits the site.';
1
+ − 397
break;
+ − 398
}
127
+ − 399
+ − 400
// admin activation request opportunity
+ − 401
$q = $db->sql_query('SELECT 1 FROM '.table_prefix.'logs WHERE log_type=\'admin\' AND action=\'activ_req\' AND edit_summary=\'' . $db->escape($userdata['username']) . '\';');
+ − 402
if ( !$q )
+ − 403
$db->_die();
+ − 404
+ − 405
$can_request = ( $db->numrows() < 1 );
+ − 406
$db->free_result();
+ − 407
+ − 408
if ( isset($_POST['logout']) )
+ − 409
{
+ − 410
$this->sid = $_COOKIE['sid'];
+ − 411
$this->user_logged_in = true;
+ − 412
$this->user_id = intval($userdata['user_id']);
+ − 413
$this->username = $userdata['username'];
+ − 414
$this->auth_level = USER_LEVEL_MEMBER;
+ − 415
$this->user_level = USER_LEVEL_MEMBER;
+ − 416
$this->logout();
+ − 417
redirect(scriptPath . '/', 'Logged out', 'You have successfully been logged out. All cookies cleared.', 4);
+ − 418
}
+ − 419
+ − 420
if ( $can_request && !isset($_POST['activation_request']) )
+ − 421
{
+ − 422
$form = '<p>If you are having trouble or did not receive the e-mail, you can request account activation from the administrators of this site.</p>
+ − 423
<form action="' . makeUrlNS('System', 'ActivateStub') . '" method="post">
+ − 424
<p><input type="submit" name="activation_request" value="Request account activation" /> <input type="submit" name="logout" value="Log out" /></p>
+ − 425
</form>';
+ − 426
}
+ − 427
else
+ − 428
{
+ − 429
if ( $can_request && isset($_POST['activation_request']) )
+ − 430
{
+ − 431
$this->admin_activation_request($userdata['username']);
+ − 432
$form = '<p>A request has just been sent to the administrators of this site. They will be able to activate your account or send you another activation e-mail if needed.</p>
+ − 433
<form action="' . makeUrlNS('System', 'ActivateStub') . '" method="post">
+ − 434
<p><input type="submit" name="logout" value="Log out" /></p>
+ − 435
</form>';
+ − 436
}
+ − 437
else
+ − 438
{
+ − 439
$form = '<p>There is an active request in the administrators\' control panel for your account to be activated.</p>
+ − 440
<form action="' . makeUrlNS('System', 'ActivateStub') . '" method="post">
+ − 441
<p><input type="submit" name="logout" value="Log out" /></p>
+ − 442
</form>';
+ − 443
}
+ − 444
}
+ − 445
+ − 446
die_semicritical('Account error', '<p>It appears that your user account has not yet been activated. '.$solution.'</p>' . $form);
1
+ − 447
}
+ − 448
+ − 449
$this->sid = $_COOKIE['sid'];
+ − 450
$this->user_logged_in = true;
+ − 451
$this->user_id = intval($userdata['user_id']);
+ − 452
$this->username = $userdata['username'];
+ − 453
$this->password_hash = $userdata['password'];
+ − 454
$this->user_level = intval($userdata['user_level']);
+ − 455
$this->real_name = $userdata['real_name'];
+ − 456
$this->email = $userdata['email'];
+ − 457
$this->unread_pms = $userdata['num_pms'];
+ − 458
if(!$this->compat)
+ − 459
{
+ − 460
$this->theme = $userdata['theme'];
+ − 461
$this->style = $userdata['style'];
+ − 462
$this->signature = $userdata['signature'];
+ − 463
$this->reg_time = $userdata['reg_time'];
+ − 464
}
+ − 465
// Small security risk here - it allows someone who has already authenticated as an administrator to store the "super" key in
+ − 466
// the cookie. Change this to USER_LEVEL_MEMBER to override that. The same 15-minute restriction applies to this "exploit".
+ − 467
$this->auth_level = $userdata['auth_level'];
+ − 468
if(!isset($template->named_theme_list[$this->theme]))
+ − 469
{
+ − 470
if($this->compat || !is_object($template))
+ − 471
{
+ − 472
$this->theme = 'oxygen';
+ − 473
$this->style = 'bleu';
+ − 474
}
+ − 475
else
+ − 476
{
+ − 477
$this->theme = $template->default_theme;
+ − 478
$this->style = $template->default_style;
+ − 479
}
+ − 480
}
+ − 481
$user = true;
+ − 482
+ − 483
if(isset($_REQUEST['auth']) && !$this->sid_super)
+ − 484
{
+ − 485
// Now he thinks he's a moderator. Or maybe even an administrator. Let's find out if he's telling the truth.
+ − 486
if($this->compat)
+ − 487
{
+ − 488
$key = $_REQUEST['auth'];
+ − 489
$super = $this->compat_validate_session($key);
+ − 490
}
+ − 491
else
+ − 492
{
+ − 493
$key = strrev($_REQUEST['auth']);
+ − 494
$super = $this->validate_session($key);
+ − 495
}
+ − 496
if(is_array($super))
+ − 497
{
+ − 498
$this->auth_level = intval($super['auth_level']);
+ − 499
$this->sid_super = $_REQUEST['auth'];
+ − 500
}
+ − 501
}
+ − 502
}
+ − 503
}
+ − 504
if(!$user)
+ − 505
{
+ − 506
//exit;
+ − 507
$this->register_guest_session();
+ − 508
}
+ − 509
if(!$this->compat)
+ − 510
{
+ − 511
// init groups
+ − 512
$q = $this->sql('SELECT g.group_name,g.group_id,m.is_mod FROM '.table_prefix.'groups AS g
+ − 513
LEFT JOIN '.table_prefix.'group_members AS m
+ − 514
ON g.group_id=m.group_id
+ − 515
WHERE ( m.user_id='.$this->user_id.'
+ − 516
OR g.group_name=\'Everyone\')
+ − 517
' . ( enano_version() == '1.0RC1' ? '' : 'AND ( m.pending != 1 OR m.pending IS NULL )' ) . '
+ − 518
ORDER BY group_id ASC;'); // Make sure "Everyone" comes first so the permissions can be overridden
+ − 519
if($row = $db->fetchrow())
+ − 520
{
+ − 521
do {
+ − 522
$this->groups[$row['group_id']] = $row['group_name'];
+ − 523
$this->group_mod[$row['group_id']] = ( intval($row['is_mod']) == 1 );
+ − 524
} while($row = $db->fetchrow());
+ − 525
}
+ − 526
else
+ − 527
{
+ − 528
die('No group info');
+ − 529
}
+ − 530
}
+ − 531
$this->check_banlist();
+ − 532
+ − 533
if ( isset ( $_GET['printable'] ) )
+ − 534
{
+ − 535
$this->theme = 'printable';
+ − 536
$this->style = 'default';
+ − 537
}
+ − 538
+ − 539
}
+ − 540
+ − 541
# Logins
+ − 542
+ − 543
/**
+ − 544
* Attempts to perform a login using crypto functions
+ − 545
* @param string $username The username
+ − 546
* @param string $aes_data The encrypted password, hex-encoded
+ − 547
* @param string $aes_key The MD5 hash of the encryption key, hex-encoded
+ − 548
* @param string $challenge The 256-bit MD5 challenge string - first 128 bits should be the hash, the last 128 should be the challenge salt
+ − 549
* @param int $level The privilege level we're authenticating for, defaults to 0
+ − 550
* @return string 'success' on success, or error string on failure
+ − 551
*/
+ − 552
+ − 553
function login_with_crypto($username, $aes_data, $aes_key, $challenge, $level = USER_LEVEL_MEMBER)
+ − 554
{
+ − 555
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 556
+ − 557
$privcache = $this->private_key;
+ − 558
+ − 559
// Instanciate the Rijndael encryption object
+ − 560
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 561
+ − 562
// Fetch our decryption key
+ − 563
+ − 564
$aes_key = $this->fetch_public_key($aes_key);
+ − 565
if(!$aes_key)
+ − 566
return 'Couldn\'t look up public key "'.$aes_key.'" for decryption';
+ − 567
+ − 568
// Convert the key to a binary string
+ − 569
$bin_key = hexdecode($aes_key);
+ − 570
+ − 571
if(strlen($bin_key) != AES_BITS / 8)
+ − 572
return 'The decryption key is the wrong length';
+ − 573
+ − 574
// Decrypt our password
+ − 575
$password = $aes->decrypt($aes_data, $bin_key, ENC_HEX);
+ − 576
+ − 577
// Initialize our success switch
+ − 578
$success = false;
+ − 579
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 580
// Escaped username
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 581
$db_username_lower = $this->prepare_text(strtolower($username));
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 582
$db_username = $this->prepare_text($username);
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 583
1
+ − 584
// Select the user data from the table, and decrypt that so we can verify the password
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 585
$this->sql('SELECT password,old_encryption,user_id,user_level,theme,style,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$db_username_lower.'\' OR username=\'' . $db_username . '\';');
1
+ − 586
if($db->numrows() < 1)
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 587
{
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 588
return "The username and/or password is incorrect.\n$db->latest_query";
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 589
// This wasn't logged in <1.0.2, dunno how it slipped through
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 590
if($level > USER_LEVEL_MEMBER)
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 591
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 592
else
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 593
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 594
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 595
}
1
+ − 596
$row = $db->fetchrow();
+ − 597
+ − 598
// Check to see if we're logging in using a temporary password
+ − 599
+ − 600
if((intval($row['temp_password_time']) + 3600*24) > time() )
+ − 601
{
+ − 602
$temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX );
+ − 603
if( $temp_pass == $password )
+ − 604
{
+ − 605
$url = makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']);
+ − 606
+ − 607
$code = $plugins->setHook('login_password_reset');
+ − 608
foreach ( $code as $cmd )
+ − 609
{
+ − 610
eval($cmd);
+ − 611
}
+ − 612
+ − 613
redirect($url, 'Login sucessful', 'Please wait while you are transferred to the Password Reset form.');
+ − 614
exit;
+ − 615
}
+ − 616
}
+ − 617
+ − 618
if($row['old_encryption'] == 1)
+ − 619
{
+ − 620
// The user's password is stored using the obsolete and insecure MD5 algorithm, so we'll update the field with the new password
+ − 621
if(md5($password) == $row['password'])
+ − 622
{
+ − 623
$pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 624
$this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';');
+ − 625
$success = true;
+ − 626
}
+ − 627
}
+ − 628
else
+ − 629
{
+ − 630
// Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match; if so then do challenge authentication
+ − 631
$real_pass = $aes->decrypt(hexdecode($row['password']), $this->private_key, ENC_BINARY);
+ − 632
if($password == $real_pass)
+ − 633
{
+ − 634
// Yay! We passed AES authentication, now do an MD5 challenge check to make sure we weren't spoofed
+ − 635
$chal = substr($challenge, 0, 32);
+ − 636
$salt = substr($challenge, 32, 32);
+ − 637
$correct_challenge = md5( $real_pass . $salt );
+ − 638
if($chal == $correct_challenge)
+ − 639
$success = true;
+ − 640
}
+ − 641
}
+ − 642
if($success)
+ − 643
{
+ − 644
if($level > $row['user_level'])
+ − 645
return 'You are not authorized for this level of access.';
+ − 646
+ − 647
$sess = $this->register_session(intval($row['user_id']), $username, $password, $level);
+ − 648
if($sess)
+ − 649
{
+ − 650
$this->username = $username;
+ − 651
$this->user_id = intval($row['user_id']);
+ − 652
$this->theme = $row['theme'];
+ − 653
$this->style = $row['style'];
+ − 654
+ − 655
if($level > USER_LEVEL_MEMBER)
+ − 656
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 657
else
+ − 658
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 659
+ − 660
$code = $plugins->setHook('login_success');
+ − 661
foreach ( $code as $cmd )
+ − 662
{
+ − 663
eval($cmd);
+ − 664
}
+ − 665
return 'success';
+ − 666
}
+ − 667
else
+ − 668
return 'Your login credentials were correct, but an internal error occurred while registering the session key in the database.';
+ − 669
}
+ − 670
else
+ − 671
{
+ − 672
if($level > USER_LEVEL_MEMBER)
+ − 673
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 674
else
+ − 675
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 676
+ − 677
return 'The username and/or password is incorrect.';
+ − 678
}
+ − 679
}
+ − 680
+ − 681
/**
+ − 682
* Attempts to login without using crypto stuff, mainly for use when the other side doesn't like Javascript
+ − 683
* This method of authentication is inherently insecure, there's really nothing we can do about it except hope and pray that everyone moves to Firefox
+ − 684
* Technically it still uses crypto, but it only decrypts the password already stored, which is (obviously) required for authentication
+ − 685
* @param string $username The username
+ − 686
* @param string $password The password -OR- the MD5 hash of the password if $already_md5ed is true
+ − 687
* @param bool $already_md5ed This should be set to true if $password is an MD5 hash, and should be false if it's plaintext. Defaults to false.
+ − 688
* @param int $level The privilege level we're authenticating for, defaults to 0
+ − 689
*/
+ − 690
+ − 691
function login_without_crypto($username, $password, $already_md5ed = false, $level = USER_LEVEL_MEMBER)
+ − 692
{
+ − 693
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 694
+ − 695
$pass_hashed = ( $already_md5ed ) ? $password : md5($password);
+ − 696
+ − 697
// Perhaps we're upgrading Enano?
+ − 698
if($this->compat)
+ − 699
{
+ − 700
return $this->login_compat($username, $pass_hashed, $level);
+ − 701
}
+ − 702
+ − 703
// Instanciate the Rijndael encryption object
+ − 704
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 705
+ − 706
// Initialize our success switch
+ − 707
$success = false;
+ − 708
+ − 709
// Retrieve the real password from the database
+ − 710
$this->sql('SELECT password,old_encryption,user_id,user_level,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$this->prepare_text(strtolower($username)).'\';');
+ − 711
if($db->numrows() < 1)
+ − 712
return 'The username and/or password is incorrect.';
+ − 713
$row = $db->fetchrow();
+ − 714
+ − 715
// Check to see if we're logging in using a temporary password
+ − 716
+ − 717
if((intval($row['temp_password_time']) + 3600*24) > time() )
+ − 718
{
+ − 719
$temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX );
+ − 720
if( md5($temp_pass) == $pass_hashed )
+ − 721
{
+ − 722
$code = $plugins->setHook('login_password_reset');
+ − 723
foreach ( $code as $cmd )
+ − 724
{
+ − 725
eval($cmd);
+ − 726
}
+ − 727
+ − 728
header('Location: ' . makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']) );
+ − 729
+ − 730
exit;
+ − 731
}
+ − 732
}
+ − 733
+ − 734
if($row['old_encryption'] == 1)
+ − 735
{
+ − 736
// The user's password is stored using the obsolete and insecure MD5 algorithm - we'll update the field with the new password
+ − 737
if($pass_hashed == $row['password'] && !$already_md5ed)
+ − 738
{
+ − 739
$pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 740
$this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';');
+ − 741
$success = true;
+ − 742
}
+ − 743
elseif($pass_hashed == $row['password'] && $already_md5ed)
+ − 744
{
+ − 745
// We don't have the real password so don't bother with encrypting it, just call it success and get out of here
+ − 746
$success = true;
+ − 747
}
+ − 748
}
+ − 749
else
+ − 750
{
+ − 751
// Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match
+ − 752
$real_pass = $aes->decrypt($row['password'], $this->private_key);
+ − 753
if($pass_hashed == md5($real_pass))
+ − 754
{
+ − 755
$success = true;
+ − 756
}
+ − 757
}
+ − 758
if($success)
+ − 759
{
+ − 760
if((int)$level > (int)$row['user_level'])
+ − 761
return 'You are not authorized for this level of access.';
+ − 762
$sess = $this->register_session(intval($row['user_id']), $username, $real_pass, $level);
+ − 763
if($sess)
+ − 764
{
+ − 765
if($level > USER_LEVEL_MEMBER)
+ − 766
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 767
else
+ − 768
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 769
+ − 770
$code = $plugins->setHook('login_success');
+ − 771
foreach ( $code as $cmd )
+ − 772
{
+ − 773
eval($cmd);
+ − 774
}
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 775
1
+ − 776
return 'success';
+ − 777
}
+ − 778
else
+ − 779
return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.';
+ − 780
}
+ − 781
else
+ − 782
{
+ − 783
if($level > USER_LEVEL_MEMBER)
+ − 784
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
+ − 785
else
+ − 786
$this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');
+ − 787
+ − 788
return 'The username and/or password is incorrect.';
+ − 789
}
+ − 790
}
+ − 791
+ − 792
/**
+ − 793
* Attempts to log in using the old table structure and algorithm.
+ − 794
* @param string $username
+ − 795
* @param string $password This should be an MD5 hash
+ − 796
* @return string 'success' if successful, or error message on failure
+ − 797
*/
+ − 798
+ − 799
function login_compat($username, $password, $level = 0)
+ − 800
{
+ − 801
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 802
$pass_hashed =& $password;
+ − 803
$this->sql('SELECT password,user_id,user_level FROM '.table_prefix.'users WHERE username=\''.$this->prepare_text($username).'\';');
+ − 804
if($db->numrows() < 1)
+ − 805
return 'The username and/or password is incorrect.';
+ − 806
$row = $db->fetchrow();
+ − 807
if($row['password'] == $password)
+ − 808
{
+ − 809
if((int)$level > (int)$row['user_level'])
+ − 810
return 'You are not authorized for this level of access.';
+ − 811
$sess = $this->register_session_compat(intval($row['user_id']), $username, $password, $level);
+ − 812
if($sess)
+ − 813
return 'success';
+ − 814
else
+ − 815
return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.';
+ − 816
}
+ − 817
else
+ − 818
{
+ − 819
return 'The username and/or password is incorrect.';
+ − 820
}
+ − 821
}
+ − 822
+ − 823
/**
+ − 824
* Registers a session key in the database. This function *ASSUMES* that the username and password have already been validated!
+ − 825
* Basically the session key is a base64-encoded cookie (encrypted with the site's private key) that says "u=[username];p=[sha1 of password]"
+ − 826
* @param int $user_id
+ − 827
* @param string $username
+ − 828
* @param string $password
+ − 829
* @param int $level The level of access to grant, defaults to USER_LEVEL_MEMBER
+ − 830
* @return bool
+ − 831
*/
+ − 832
+ − 833
function register_session($user_id, $username, $password, $level = USER_LEVEL_MEMBER)
+ − 834
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 835
// Random key identifier
1
+ − 836
$salt = md5(microtime() . mt_rand());
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 837
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 838
// SHA1 hash of password, stored in the key
1
+ − 839
$passha1 = sha1($password);
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 840
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 841
// Unencrypted session key
1
+ − 842
$session_key = "u=$username;p=$passha1;s=$salt";
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 843
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 844
// Encrypt the key
1
+ − 845
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 846
$session_key = $aes->encrypt($session_key, $this->private_key, ENC_HEX);
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 847
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 848
// If we're registering an elevated-privilege key, it needs to be on GET
1
+ − 849
if($level > USER_LEVEL_MEMBER)
+ − 850
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 851
// Reverse it - cosmetic only ;-)
1
+ − 852
$hexkey = strrev($session_key);
+ − 853
$this->sid_super = $hexkey;
+ − 854
$_GET['auth'] = $hexkey;
+ − 855
}
+ − 856
else
+ − 857
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 858
// Stash it in a cookie
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 859
// For now, make the cookie last forever, we can change this in 1.1.x
1
+ − 860
setcookie( 'sid', $session_key, time()+315360000, scriptPath.'/' );
+ − 861
$_COOKIE['sid'] = $session_key;
+ − 862
}
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 863
// $keyhash is stored in the database, this is for compatibility with the older DB structure
1
+ − 864
$keyhash = md5($session_key);
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 865
// Record the user's IP
1
+ − 866
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 867
if(!$ip)
+ − 868
die('$session->register_session: Remote-Addr was spoofed');
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 869
// The time needs to be stashed to enforce the 15-minute limit on elevated session keys
1
+ − 870
$time = time();
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 871
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 872
// Sanity check
1
+ − 873
if(!is_int($user_id))
+ − 874
die('Somehow an SQL injection attempt crawled into our session registrar! (1)');
+ − 875
if(!is_int($level))
+ − 876
die('Somehow an SQL injection attempt crawled into our session registrar! (2)');
+ − 877
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 878
// All done!
1
+ − 879
$query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$keyhash.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');');
+ − 880
return true;
+ − 881
}
+ − 882
+ − 883
/**
+ − 884
* Identical to register_session in nature, but uses the old login/table structure. DO NOT use this.
+ − 885
* @see sessionManager::register_session()
+ − 886
* @access private
+ − 887
*/
+ − 888
+ − 889
function register_session_compat($user_id, $username, $password, $level = 0)
+ − 890
{
+ − 891
$salt = md5(microtime() . mt_rand());
+ − 892
$thekey = md5($password . $salt);
+ − 893
if($level > 0)
+ − 894
{
+ − 895
$this->sid_super = $thekey;
+ − 896
}
+ − 897
else
+ − 898
{
+ − 899
setcookie( 'sid', $thekey, time()+315360000, scriptPath.'/' );
+ − 900
$_COOKIE['sid'] = $thekey;
+ − 901
}
+ − 902
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 903
if(!$ip)
+ − 904
die('$session->register_session: Remote-Addr was spoofed');
+ − 905
$time = time();
+ − 906
if(!is_int($user_id))
+ − 907
die('Somehow an SQL injection attempt crawled into our session registrar! (1)');
+ − 908
if(!is_int($level))
+ − 909
die('Somehow an SQL injection attempt crawled into our session registrar! (2)');
+ − 910
$query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$thekey.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');');
+ − 911
return true;
+ − 912
}
+ − 913
+ − 914
/**
+ − 915
* Creates/restores a guest session
+ − 916
* @todo implement real session management for guests
+ − 917
*/
+ − 918
+ − 919
function register_guest_session()
+ − 920
{
+ − 921
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 922
$this->username = $_SERVER['REMOTE_ADDR'];
+ − 923
$this->user_level = USER_LEVEL_GUEST;
+ − 924
if($this->compat || defined('IN_ENANO_INSTALL'))
+ − 925
{
+ − 926
$this->theme = 'oxygen';
+ − 927
$this->style = 'bleu';
+ − 928
}
+ − 929
else
+ − 930
{
+ − 931
$this->theme = ( isset($_GET['theme']) && isset($template->named_theme_list[$_GET['theme']])) ? $_GET['theme'] : $template->default_theme;
+ − 932
$this->style = ( isset($_GET['style']) && file_exists(ENANO_ROOT.'/themes/'.$this->theme . '/css/'.$_GET['style'].'.css' )) ? $_GET['style'] : substr($template->named_theme_list[$this->theme]['default_style'], 0, strlen($template->named_theme_list[$this->theme]['default_style'])-4);
+ − 933
}
+ − 934
$this->user_id = 1;
+ − 935
}
+ − 936
+ − 937
/**
+ − 938
* Validates a session key, and returns the userdata associated with the key or false
+ − 939
* @param string $key The session key to validate
+ − 940
* @return array Keys are 'user_id', 'username', 'email', 'real_name', 'user_level', 'theme', 'style', 'signature', 'reg_time', 'account_active', 'activation_key', and 'auth_level' or bool false if validation failed. The key 'auth_level' is the maximum authorization level that this key provides.
+ − 941
*/
+ − 942
+ − 943
function validate_session($key)
+ − 944
{
+ − 945
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 946
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE, true);
+ − 947
$decrypted_key = $aes->decrypt($key, $this->private_key, ENC_HEX);
+ − 948
+ − 949
if ( !$decrypted_key )
+ − 950
{
+ − 951
die_semicritical('AES encryption error', '<p>Something went wrong during the AES decryption process.</p><pre>'.print_r($decrypted_key, true).'</pre>');
+ − 952
}
+ − 953
+ − 954
$n = preg_match('/^u='.$this->valid_username.';p=([A-Fa-f0-9]+?);s=([A-Fa-f0-9]+?)$/', $decrypted_key, $keydata);
+ − 955
if($n < 1)
+ − 956
{
+ − 957
// echo '(debug) $session->validate_session: Key does not match regex<br />Decrypted key: '.$decrypted_key;
+ − 958
return false;
+ − 959
}
+ − 960
$keyhash = md5($key);
+ − 961
$salt = $db->escape($keydata[3]);
18
+ − 962
$query = $db->sql_query('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms,x.* FROM '.table_prefix.'session_keys AS k
+ − 963
LEFT JOIN '.table_prefix.'users AS u
+ − 964
ON ( u.user_id=k.user_id )
+ − 965
LEFT JOIN '.table_prefix.'users_extra AS x
+ − 966
ON ( u.user_id=x.user_id OR x.user_id IS NULL )
+ − 967
LEFT JOIN '.table_prefix.'privmsgs AS p
+ − 968
ON ( p.message_to=u.username AND p.message_read=0 )
+ − 969
WHERE k.session_key=\''.$keyhash.'\'
+ − 970
AND k.salt=\''.$salt.'\'
+ − 971
GROUP BY u.user_id;');
+ − 972
if ( !$query )
+ − 973
{
+ − 974
$query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms FROM '.table_prefix.'session_keys AS k
+ − 975
LEFT JOIN '.table_prefix.'users AS u
+ − 976
ON ( u.user_id=k.user_id )
+ − 977
LEFT JOIN '.table_prefix.'privmsgs AS p
+ − 978
ON ( p.message_to=u.username AND p.message_read=0 )
+ − 979
WHERE k.session_key=\''.$keyhash.'\'
+ − 980
AND k.salt=\''.$salt.'\'
+ − 981
GROUP BY u.user_id;');
+ − 982
}
1
+ − 983
if($db->numrows() < 1)
+ − 984
{
+ − 985
// echo '(debug) $session->validate_session: Key was not found in database<br />';
+ − 986
return false;
+ − 987
}
+ − 988
$row = $db->fetchrow();
+ − 989
$row['user_id'] =& $row['uid'];
+ − 990
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 991
if($row['auth_level'] > $row['user_level'])
+ − 992
{
+ − 993
// Failed authorization check
+ − 994
// echo '(debug) $session->validate_session: access to this auth level denied<br />';
+ − 995
return false;
+ − 996
}
+ − 997
if($ip != $row['source_ip'])
+ − 998
{
+ − 999
// Failed IP address check
+ − 1000
// echo '(debug) $session->validate_session: IP address mismatch<br />';
+ − 1001
return false;
+ − 1002
}
+ − 1003
+ − 1004
// Do the password validation
+ − 1005
$real_pass = $aes->decrypt($row['password'], $this->private_key, ENC_HEX);
+ − 1006
+ − 1007
//die('<pre>'.print_r($keydata, true).'</pre>');
+ − 1008
if(sha1($real_pass) != $keydata[2])
+ − 1009
{
+ − 1010
// Failed password check
+ − 1011
// echo '(debug) $session->validate_session: encrypted password is wrong<br />Real password: '.$real_pass.'<br />Real hash: '.sha1($real_pass).'<br />User hash: '.$keydata[2];
+ − 1012
return false;
+ − 1013
}
+ − 1014
+ − 1015
$time_now = time();
+ − 1016
$time_key = $row['time'] + 900;
+ − 1017
if($time_now > $time_key && $row['auth_level'] > USER_LEVEL_MEMBER)
+ − 1018
{
+ − 1019
// Session timed out
+ − 1020
// echo '(debug) $session->validate_session: super session timed out<br />';
+ − 1021
$this->sw_timed_out = true;
+ − 1022
return false;
+ − 1023
}
+ − 1024
+ − 1025
// If this is an elevated-access session key, update the time
+ − 1026
if( $row['auth_level'] > USER_LEVEL_MEMBER )
+ − 1027
{
+ − 1028
$this->sql('UPDATE '.table_prefix.'session_keys SET time='.time().' WHERE session_key=\''.$keyhash.'\';');
+ − 1029
}
+ − 1030
31
+ − 1031
$user_extra = array();
+ − 1032
foreach ( array('user_aim', 'user_yahoo', 'user_msn', 'user_xmpp', 'user_homepage', 'user_location', 'user_job', 'user_hobbies', 'email_public') as $column )
+ − 1033
{
+ − 1034
$user_extra[$column] = $row[$column];
+ − 1035
}
+ − 1036
+ − 1037
$this->user_extra = $user_extra;
+ − 1038
// Leave the rest to PHP's automatic garbage collector ;-)
+ − 1039
1
+ − 1040
$row['password'] = md5($real_pass);
+ − 1041
return $row;
+ − 1042
}
+ − 1043
+ − 1044
/**
+ − 1045
* Validates a session key, and returns the userdata associated with the key or false. Optimized for compatibility with the old MD5-based auth system.
+ − 1046
* @param string $key The session key to validate
+ − 1047
* @return array Keys are 'user_id', 'username', 'email', 'real_name', 'user_level', 'theme', 'style', 'signature', 'reg_time', 'account_active', 'activation_key', and 'auth_level' or bool false if validation failed. The key 'auth_level' is the maximum authorization level that this key provides.
+ − 1048
*/
+ − 1049
+ − 1050
function compat_validate_session($key)
+ − 1051
{
+ − 1052
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1053
$key = $db->escape($key);
+ − 1054
+ − 1055
$query = $this->sql('SELECT u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,k.source_ip,k.salt,k.time,k.auth_level FROM '.table_prefix.'session_keys AS k
+ − 1056
LEFT JOIN '.table_prefix.'users AS u
+ − 1057
ON u.user_id=k.user_id
+ − 1058
WHERE k.session_key=\''.$key.'\';');
+ − 1059
if($db->numrows() < 1)
+ − 1060
{
+ − 1061
// echo '(debug) $session->validate_session: Key '.$key.' was not found in database<br />';
+ − 1062
return false;
+ − 1063
}
+ − 1064
$row = $db->fetchrow();
+ − 1065
$ip = ip2hex($_SERVER['REMOTE_ADDR']);
+ − 1066
if($row['auth_level'] > $row['user_level'])
+ − 1067
{
+ − 1068
// Failed authorization check
+ − 1069
// echo '(debug) $session->validate_session: user not authorized for this access level';
+ − 1070
return false;
+ − 1071
}
+ − 1072
if($ip != $row['source_ip'])
+ − 1073
{
+ − 1074
// Failed IP address check
+ − 1075
// echo '(debug) $session->validate_session: IP address mismatch; IP in table: '.$row['source_ip'].'; reported IP: '.$ip.'';
+ − 1076
return false;
+ − 1077
}
+ − 1078
+ − 1079
// Do the password validation
+ − 1080
$real_key = md5($row['password'] . $row['salt']);
+ − 1081
+ − 1082
//die('<pre>'.print_r($keydata, true).'</pre>');
+ − 1083
if($real_key != $key)
+ − 1084
{
+ − 1085
// Failed password check
+ − 1086
// echo '(debug) $session->validate_session: supplied password is wrong<br />Real key: '.$real_key.'<br />User key: '.$key;
+ − 1087
return false;
+ − 1088
}
+ − 1089
+ − 1090
$time_now = time();
+ − 1091
$time_key = $row['time'] + 900;
+ − 1092
if($time_now > $time_key && $row['auth_level'] >= 1)
+ − 1093
{
+ − 1094
$this->sw_timed_out = true;
+ − 1095
// Session timed out
+ − 1096
// echo '(debug) $session->validate_session: super session timed out<br />';
+ − 1097
return false;
+ − 1098
}
+ − 1099
+ − 1100
return $row;
+ − 1101
}
+ − 1102
+ − 1103
/**
+ − 1104
* Demotes us to one less than the specified auth level. AKA destroys elevated authentication and/or logs out the user, depending on $level
+ − 1105
* @param int $level How low we should go - USER_LEVEL_MEMBER means demote to USER_LEVEL_GUEST, and anything more powerful than USER_LEVEL_MEMBER means demote to USER_LEVEL_MEMBER
+ − 1106
* @return string 'success' if successful, or error on failure
+ − 1107
*/
+ − 1108
+ − 1109
function logout($level = USER_LEVEL_MEMBER)
+ − 1110
{
+ − 1111
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1112
$ou = $this->username;
+ − 1113
$oid = $this->user_id;
+ − 1114
if($level > USER_LEVEL_CHPREF)
+ − 1115
{
+ − 1116
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 1117
if(!$this->user_logged_in || $this->auth_level < USER_LEVEL_MOD) return 'success';
+ − 1118
// Destroy elevated privileges
+ − 1119
$keyhash = md5(strrev($this->sid_super));
+ − 1120
$this->sql('DELETE FROM '.table_prefix.'session_keys WHERE session_key=\''.$keyhash.'\' AND user_id=\'' . $this->user_id . '\';');
+ − 1121
$this->sid_super = false;
+ − 1122
$this->auth_level = USER_LEVEL_MEMBER;
+ − 1123
}
+ − 1124
else
+ − 1125
{
+ − 1126
if($this->user_logged_in)
+ − 1127
{
+ − 1128
// Completely destroy our session
+ − 1129
if($this->auth_level > USER_LEVEL_CHPREF)
+ − 1130
{
+ − 1131
$this->logout(USER_LEVEL_ADMIN);
+ − 1132
}
+ − 1133
$this->sql('DELETE FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($this->sid).'\';');
+ − 1134
setcookie( 'sid', '', time()-(3600*24), scriptPath.'/' );
+ − 1135
}
+ − 1136
}
+ − 1137
$code = $plugins->setHook('logout_success'); // , Array('level'=>$level,'old_username'=>$ou,'old_user_id'=>$oid));
+ − 1138
foreach ( $code as $cmd )
+ − 1139
{
+ − 1140
eval($cmd);
+ − 1141
}
+ − 1142
return 'success';
+ − 1143
}
+ − 1144
+ − 1145
# Miscellaneous stuff
+ − 1146
+ − 1147
/**
+ − 1148
* Appends the high-privilege session key to the URL if we are authorized to do high-privilege stuff
+ − 1149
* @param string $url The URL to add session data to
+ − 1150
* @return string
+ − 1151
*/
+ − 1152
+ − 1153
function append_sid($url)
+ − 1154
{
+ − 1155
$sep = ( strstr($url, '?') ) ? '&' : '?';
+ − 1156
if ( $this->sid_super )
+ − 1157
{
+ − 1158
$url = $url . $sep . 'auth=' . urlencode($this->sid_super);
+ − 1159
// echo($this->sid_super.'<br/>');
+ − 1160
}
+ − 1161
return $url;
+ − 1162
}
+ − 1163
+ − 1164
/**
+ − 1165
* Grabs the user's password MD5
+ − 1166
* @return string, or bool false if access denied
+ − 1167
*/
+ − 1168
+ − 1169
function grab_password_hash()
+ − 1170
{
+ − 1171
if(!$this->password_hash) return false;
+ − 1172
return $this->password_hash;
+ − 1173
}
+ − 1174
+ − 1175
/**
+ − 1176
* Destroys the user's password MD5 in memory
+ − 1177
*/
+ − 1178
+ − 1179
function disallow_password_grab()
+ − 1180
{
+ − 1181
$this->password_hash = false;
+ − 1182
return false;
+ − 1183
}
+ − 1184
+ − 1185
/**
+ − 1186
* Generates an AES key and stashes it in the database
+ − 1187
* @return string Hex-encoded AES key
+ − 1188
*/
+ − 1189
+ − 1190
function rijndael_genkey()
+ − 1191
{
+ − 1192
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 1193
$key = $aes->gen_readymade_key();
+ − 1194
$keys = getConfig('login_key_cache');
+ − 1195
if(is_string($keys))
+ − 1196
$keys .= $key;
+ − 1197
else
+ − 1198
$keys = $key;
+ − 1199
setConfig('login_key_cache', $keys);
+ − 1200
return $key;
+ − 1201
}
+ − 1202
+ − 1203
/**
+ − 1204
* Generate a totally random 128-bit value for MD5 challenges
+ − 1205
* @return string
+ − 1206
*/
+ − 1207
+ − 1208
function dss_rand()
+ − 1209
{
+ − 1210
$aes = new AESCrypt();
+ − 1211
$random = $aes->randkey(128);
+ − 1212
unset($aes);
+ − 1213
return md5(microtime() . $random);
+ − 1214
}
+ − 1215
+ − 1216
/**
+ − 1217
* Fetch a cached login public key using the MD5sum as an identifier. Each key can only be fetched once before it is destroyed.
+ − 1218
* @param string $md5 The MD5 sum of the key
+ − 1219
* @return string, or bool false on failure
+ − 1220
*/
+ − 1221
+ − 1222
function fetch_public_key($md5)
+ − 1223
{
+ − 1224
$keys = getConfig('login_key_cache');
+ − 1225
$keys = enano_str_split($keys, AES_BITS / 4);
+ − 1226
+ − 1227
foreach($keys as $i => $k)
+ − 1228
{
+ − 1229
if(md5($k) == $md5)
+ − 1230
{
+ − 1231
unset($keys[$i]);
+ − 1232
if(count($keys) > 0)
+ − 1233
{
+ − 1234
if ( strlen(getConfig('login_key_cache') ) > 64000 )
+ − 1235
{
+ − 1236
// This should only need to be done once every month or so for an average-size site
+ − 1237
setConfig('login_key_cache', '');
+ − 1238
}
+ − 1239
else
+ − 1240
{
+ − 1241
$keys = implode('', array_values($keys));
+ − 1242
setConfig('login_key_cache', $keys);
+ − 1243
}
+ − 1244
}
+ − 1245
else
+ − 1246
{
+ − 1247
setConfig('login_key_cache', '');
+ − 1248
}
+ − 1249
return $k;
+ − 1250
}
+ − 1251
}
+ − 1252
// Couldn't find the key...
+ − 1253
return false;
+ − 1254
}
+ − 1255
+ − 1256
/**
+ − 1257
* Adds a user to a group.
+ − 1258
* @param int User ID
+ − 1259
* @param int Group ID
+ − 1260
* @param bool Group moderator - defaults to false
+ − 1261
* @return bool True on success, false on failure
+ − 1262
*/
+ − 1263
+ − 1264
function add_user_to_group($user_id, $group_id, $is_mod = false)
+ − 1265
{
+ − 1266
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1267
+ − 1268
// Validation
+ − 1269
if ( !is_int($user_id) || !is_int($group_id) || !is_bool($is_mod) )
+ − 1270
return false;
+ − 1271
if ( $user_id < 1 || $group_id < 1 )
+ − 1272
return false;
+ − 1273
+ − 1274
$mod_switch = ( $is_mod ) ? '1' : '0';
+ − 1275
$q = $this->sql('SELECT member_id,is_mod FROM '.table_prefix.'group_members WHERE user_id=' . $user_id . ' AND group_id=' . $group_id . ';');
+ − 1276
if ( !$q )
+ − 1277
$db->_die();
+ − 1278
if ( $db->numrows() < 1 )
+ − 1279
{
+ − 1280
// User is not in group
+ − 1281
$this->sql('INSERT INTO '.table_prefix.'group_members(user_id,group_id,is_mod) VALUES(' . $user_id . ', ' . $group_id . ', ' . $mod_switch . ');');
+ − 1282
return true;
+ − 1283
}
+ − 1284
else
+ − 1285
{
+ − 1286
$row = $db->fetchrow();
+ − 1287
// Update modship status
+ − 1288
if ( strval($row['is_mod']) == $mod_switch )
+ − 1289
{
+ − 1290
// Modship unchanged
+ − 1291
return true;
+ − 1292
}
+ − 1293
else
+ − 1294
{
+ − 1295
// Modship changed
+ − 1296
$this->sql('UPDATE '.table_prefix.'group_members SET is_mod=' . $mod_switch . ' WHERE member_id=' . $row['member_id'] . ';');
+ − 1297
return true;
+ − 1298
}
+ − 1299
}
+ − 1300
return false;
+ − 1301
}
+ − 1302
+ − 1303
/**
+ − 1304
* Removes a user from a group.
+ − 1305
* @param int User ID
+ − 1306
* @param int Group ID
+ − 1307
* @return bool True on success, false on failure
+ − 1308
* @todo put a little more error checking in...
+ − 1309
*/
+ − 1310
+ − 1311
function remove_user_from_group($user_id, $group_id)
+ − 1312
{
+ − 1313
if ( !is_int($user_id) || !is_int($group_id) )
+ − 1314
return false;
+ − 1315
$this->sql('DELETE FROM '.table_prefix."group_members WHERE user_id=$user_id AND group_id=$group_id;");
+ − 1316
return true;
+ − 1317
}
+ − 1318
+ − 1319
/**
+ − 1320
* Checks the banlist to ensure that we're an allowed user. Doesn't return anything because it dies if the user is banned.
+ − 1321
*/
+ − 1322
+ − 1323
function check_banlist()
+ − 1324
{
+ − 1325
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1326
if($this->compat)
+ − 1327
$q = $this->sql('SELECT ban_id,ban_type,ban_value,is_regex FROM '.table_prefix.'banlist ORDER BY ban_type;');
+ − 1328
else
+ − 1329
$q = $this->sql('SELECT ban_id,ban_type,ban_value,is_regex,reason FROM '.table_prefix.'banlist ORDER BY ban_type;');
+ − 1330
if(!$q) $db->_die('The banlist data could not be selected.');
+ − 1331
$banned = false;
+ − 1332
while($row = $db->fetchrow())
+ − 1333
{
+ − 1334
if($this->compat)
+ − 1335
$row['reason'] = 'None available - session manager is in compatibility mode';
+ − 1336
switch($row['ban_type'])
+ − 1337
{
+ − 1338
case BAN_IP:
+ − 1339
if(intval($row['is_regex'])==1) {
+ − 1340
if(preg_match('#'.$row['ban_value'].'#i', $_SERVER['REMOTE_ADDR']))
+ − 1341
{
+ − 1342
$banned = true;
+ − 1343
$reason = $row['reason'];
+ − 1344
}
+ − 1345
}
+ − 1346
else {
+ − 1347
if($row['ban_value']==$_SERVER['REMOTE_ADDR']) { $banned = true; $reason = $row['reason']; }
+ − 1348
}
+ − 1349
break;
+ − 1350
case BAN_USER:
+ − 1351
if(intval($row['is_regex'])==1) {
+ − 1352
if(preg_match('#'.$row['ban_value'].'#i', $this->username))
+ − 1353
{
+ − 1354
$banned = true;
+ − 1355
$reason = $row['reason'];
+ − 1356
}
+ − 1357
}
+ − 1358
else {
+ − 1359
if($row['ban_value']==$this->username) { $banned = true; $reason = $row['reason']; }
+ − 1360
}
+ − 1361
break;
+ − 1362
case BAN_EMAIL:
+ − 1363
if(intval($row['is_regex'])==1) {
+ − 1364
if(preg_match('#'.$row['ban_value'].'#i', $this->email))
+ − 1365
{
+ − 1366
$banned = true;
+ − 1367
$reason = $row['reason'];
+ − 1368
}
+ − 1369
}
+ − 1370
else {
+ − 1371
if($row['ban_value']==$this->email) { $banned = true; $reason = $row['reason']; }
+ − 1372
}
+ − 1373
break;
+ − 1374
default:
+ − 1375
die('Ban error: rule "'.$row['ban_value'].'" has an invalid type ('.$row['ban_type'].')');
+ − 1376
}
+ − 1377
}
+ − 1378
if($banned && $paths->get_pageid_from_url() != $paths->nslist['Special'].'CSS')
+ − 1379
{
+ − 1380
// This guy is banned - kill the session, kill the database connection, bail out, and be pretty about it
+ − 1381
die_semicritical('Ban notice', '<div class="error-box">You have been banned from this website. Please contact the site administrator for more information.<br /><br />Reason:<br />'.$reason.'</div>');
+ − 1382
exit;
+ − 1383
}
+ − 1384
}
+ − 1385
+ − 1386
# Registration
+ − 1387
+ − 1388
/**
+ − 1389
* Registers a user. This does not perform any type of login.
+ − 1390
* @param string $username
+ − 1391
* @param string $password This should be unencrypted.
+ − 1392
* @param string $email
+ − 1393
* @param string $real_name Optional, defaults to ''.
30
+ − 1394
* @param bool $coppa Optional. If true, the account is not activated initially and an admin activation request is sent. The caller is responsible for sending the address info and notice.
1
+ − 1395
*/
+ − 1396
30
+ − 1397
function create_user($username, $password, $email, $real_name = '', $coppa = false)
13
fdd6b9dd42c3
Installer actually works now on dev servers; minor language change in template.php; code cleanliness fix in sessions.php
Dan
diff
changeset
+ − 1398
{
1
+ − 1399
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1400
+ − 1401
// Initialize AES
+ − 1402
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 1403
+ − 1404
if(!preg_match('#^'.$this->valid_username.'$#', $username)) return 'The username you chose contains invalid characters.';
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1405
$user_orig = $username;
1
+ − 1406
$username = $this->prepare_text($username);
+ − 1407
$email = $this->prepare_text($email);
+ − 1408
$real_name = $this->prepare_text($real_name);
+ − 1409
+ − 1410
$nameclause = ( $real_name != '' ) ? ' OR real_name=\''.$real_name.'\'' : '';
+ − 1411
$q = $this->sql('SELECT * FROM '.table_prefix.'users WHERE lcase(username)=\''.strtolower($username).'\' OR email=\''.$email.'\''.$nameclause.';');
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1412
if($db->numrows() > 0)
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1413
{
1
+ − 1414
$r = 'The ';
+ − 1415
$i=0;
+ − 1416
$row = $db->fetchrow();
+ − 1417
// Wow! An error checker that actually speaks English with the properest grammar! :-P
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1418
if ( $row['username'] == $username )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1419
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1420
$r .= 'username';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1421
$i++;
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1422
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1423
if ( $row['email'] == $email )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1424
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1425
if($i) $r.=', ';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1426
$r .= 'e-mail address';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1427
$i++;
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1428
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1429
if ( $row['real_name'] == $real_name && $real_name != '' )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1430
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1431
if($i) $r.=', and ';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1432
$r .= 'real name';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1433
$i++;
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1434
}
1
+ − 1435
$r .= ' that you entered ';
+ − 1436
$r .= ( $i == 1 ) ? 'is' : 'are';
+ − 1437
$r .= ' already in use by another user.';
+ − 1438
return $r;
+ − 1439
}
+ − 1440
133
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1441
// Is the password strong enough?
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1442
if ( getConfig('pw_strength_enable') )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1443
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1444
$min_score = intval( getConfig('pw_strength_minimum') );
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1445
$pass_score = password_score($password);
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1446
if ( $pass_score < $min_score )
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1447
{
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1448
return 'The password you entered did not meet the complexity requirements for this site. Please choose a stronger password.';
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1449
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1450
}
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1451
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1452
$password = $aes->encrypt($password, $this->private_key, ENC_HEX);
af0f6ec48de3
Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working
Dan
diff
changeset
+ − 1453
1
+ − 1454
// Require the account to be activated?
+ − 1455
switch(getConfig('account_activation'))
+ − 1456
{
+ − 1457
case 'none':
+ − 1458
default:
+ − 1459
$active = '1';
+ − 1460
break;
+ − 1461
case 'user':
+ − 1462
$active = '0';
+ − 1463
break;
+ − 1464
case 'admin':
+ − 1465
$active = '0';
+ − 1466
break;
+ − 1467
}
30
+ − 1468
if ( $coppa )
+ − 1469
$active = '0';
+ − 1470
+ − 1471
$coppa_col = ( $coppa ) ? '1' : '0';
1
+ − 1472
+ − 1473
// Generate a totally random activation key
+ − 1474
$actkey = sha1 ( microtime() . mt_rand() );
+ − 1475
30
+ − 1476
// We good, create the user
+ − 1477
$this->sql('INSERT INTO '.table_prefix.'users ( username, password, email, real_name, theme, style, reg_time, account_active, activation_key, user_level, user_coppa ) VALUES ( \''.$username.'\', \''.$password.'\', \''.$email.'\', \''.$real_name.'\', \''.$template->default_theme.'\', \''.$template->default_style.'\', '.time().', '.$active.', \''.$actkey.'\', '.USER_LEVEL_CHPREF.', ' . $coppa_col . ' );');
1
+ − 1478
31
+ − 1479
// Get user ID and create users_extra entry
+ − 1480
$q = $this->sql('SELECT user_id FROM '.table_prefix."users WHERE username='$username';");
+ − 1481
if ( $db->numrows() > 0 )
+ − 1482
{
+ − 1483
$row = $db->fetchrow();
+ − 1484
$db->free_result();
+ − 1485
+ − 1486
$user_id =& $row['user_id'];
42
45ebe475ff75
I dunno how many times I'm gonna have to fix the "problem seems to be the hex conversion" bug, but this is at least the fourth try.
Dan
diff
changeset
+ − 1487
$this->sql('INSERT INTO '.table_prefix.'users_extra(user_id) VALUES(' . $user_id . ');');
31
+ − 1488
}
+ − 1489
135
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1490
// Grant edit and very limited mod access to the userpage
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1491
$acl_data = array(
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1492
'read' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1493
'view_source' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1494
'edit_page' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1495
'post_comments' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1496
'edit_comments' => AUTH_ALLOW, // only allows editing own comments
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1497
'history_view' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1498
'history_rollback' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1499
'rename' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1500
'delete_page' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1501
'tag_create' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1502
'tag_delete_own' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1503
'tag_delete_other' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1504
'edit_cat' => AUTH_ALLOW,
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1505
'create_page' => AUTH_ALLOW
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1506
);
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1507
$acl_data = $db->escape($this->perm_to_string($acl_data));
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1508
$userpage = $db->escape(sanitize_page_id($user_orig));
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1509
$cols = "target_type, target_id, page_id, namespace, rules";
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1510
$vals = ACL_TYPE_USER . ", $user_id, '$userpage', 'User', '$acl_data'";
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1511
$q = "INSERT INTO ".table_prefix."acl($cols) VALUES($vals);";
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1512
$this->sql($q);
c5dbad7ec2d0
Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)
Dan
diff
changeset
+ − 1513
1
+ − 1514
// Require the account to be activated?
30
+ − 1515
if ( $coppa )
+ − 1516
{
+ − 1517
$this->admin_activation_request($username);
+ − 1518
$this->send_coppa_mail($username,$email);
+ − 1519
}
+ − 1520
else
1
+ − 1521
{
30
+ − 1522
switch(getConfig('account_activation'))
+ − 1523
{
+ − 1524
case 'none':
+ − 1525
default:
+ − 1526
break;
+ − 1527
case 'user':
+ − 1528
$a = $this->send_activation_mail($username);
+ − 1529
if(!$a)
+ − 1530
{
+ − 1531
$this->admin_activation_request($username);
+ − 1532
return 'The activation e-mail could not be sent due to an internal error. This could possibly be due to an incorrect SMTP configuration. A request has been sent to the administrator to activate your account for you. ' . $a;
+ − 1533
}
+ − 1534
break;
+ − 1535
case 'admin':
1
+ − 1536
$this->admin_activation_request($username);
30
+ − 1537
break;
+ − 1538
}
1
+ − 1539
}
+ − 1540
+ − 1541
// Leave some data behind for the hook
+ − 1542
$code = $plugins->setHook('user_registered'); // , Array('username'=>$username));
+ − 1543
foreach ( $code as $cmd )
+ − 1544
{
+ − 1545
eval($cmd);
+ − 1546
}
+ − 1547
+ − 1548
// $this->register_session($username, $password);
+ − 1549
return 'success';
+ − 1550
}
+ − 1551
+ − 1552
/**
+ − 1553
* Attempts to send an e-mail to the specified user with activation instructions.
+ − 1554
* @param string $u The usernamd of the user requesting activation
+ − 1555
* @return bool true on success, false on failure
+ − 1556
*/
+ − 1557
+ − 1558
function send_activation_mail($u, $actkey = false)
+ − 1559
{
+ − 1560
global $db, $session, $paths, $template, $plugins; // Common objects
131
+ − 1561
$q = $this->sql('SELECT username,email FROM '.table_prefix.'users WHERE user_id=2 OR user_level=' . USER_LEVEL_ADMIN . ' ORDER BY user_id ASC;');
1
+ − 1562
$un = $db->fetchrow();
+ − 1563
$admin_user = $un['username'];
+ − 1564
$q = $this->sql('SELECT username,activation_key,account_active,email FROM '.table_prefix.'users WHERE username=\''.$db->escape($u).'\';');
+ − 1565
$r = $db->fetchrow();
+ − 1566
if ( empty($r['email']) )
+ − 1567
$db->_die('BUG: $session->send_activation_mail(): no e-mail address in row');
+ − 1568
$message = 'Dear '.$u.',
+ − 1569
Thank you for registering on '.getConfig('site_name').'. Your account creation is almost complete. To complete the registration process, please click the following link or paste it into your web browser:
+ − 1570
+ − 1571
';
+ − 1572
if(isset($_SERVER['HTTPS'])) $prot = 'https';
+ − 1573
else $prot = 'http';
+ − 1574
if($_SERVER['SERVER_PORT'] == '80') $p = '';
+ − 1575
else $p = ':'.$_SERVER['SERVER_PORT'];
+ − 1576
$sidbak = false;
+ − 1577
if($this->sid_super)
+ − 1578
$sidbak = $this->sid_super;
+ − 1579
$this->sid_super = false;
+ − 1580
$aklink = makeUrlNS('Special', 'ActivateAccount/'.str_replace(' ', '_', $u).'/'. ( ( is_string($actkey) ) ? $actkey : $r['activation_key'] ) );
+ − 1581
if($sidbak)
+ − 1582
$this->sid_super = $sidbak;
+ − 1583
unset($sidbak);
+ − 1584
$message .= "$prot://".$_SERVER['HTTP_HOST'].$p.$aklink;
+ − 1585
$message .= "\n\nSincerely yours, \n$admin_user and the ".$_SERVER['HTTP_HOST']." administration team";
+ − 1586
error_reporting(E_ALL);
+ − 1587
dc_dump($r, 'session: about to send activation e-mail to '.$r['email']);
+ − 1588
if(getConfig('smtp_enabled') == '1')
+ − 1589
{
+ − 1590
$result = smtp_send_email($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), getConfig('contact_email'));
+ − 1591
if($result == 'success') $result = true;
+ − 1592
else { echo $result; $result = false; }
+ − 1593
} else {
+ − 1594
$result = mail($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), 'From: '.getConfig('contact_email'));
+ − 1595
}
+ − 1596
return $result;
+ − 1597
}
+ − 1598
+ − 1599
/**
30
+ − 1600
* Attempts to send an e-mail to the specified user's e-mail address on file intended for the parents
+ − 1601
* @param string $u The usernamd of the user requesting activation
+ − 1602
* @return bool true on success, false on failure
+ − 1603
*/
+ − 1604
+ − 1605
function send_coppa_mail($u, $actkey = false)
+ − 1606
{
+ − 1607
+ − 1608
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1609
+ − 1610
$q = $this->sql('SELECT username,email FROM '.table_prefix.'users WHERE user_id=2 OR user_level=' . USER_LEVEL_ADMIN . ' ORDER BY user_id ASC;');
+ − 1611
$un = $db->fetchrow();
+ − 1612
$admin_user = $un['username'];
+ − 1613
+ − 1614
$q = $this->sql('SELECT username,activation_key,account_active,email FROM '.table_prefix.'users WHERE username=\''.$db->escape($u).'\';');
+ − 1615
$r = $db->fetchrow();
+ − 1616
if ( empty($r['email']) )
+ − 1617
$db->_die('BUG: $session->send_activation_mail(): no e-mail address in row');
+ − 1618
+ − 1619
if(isset($_SERVER['HTTPS'])) $prot = 'https';
+ − 1620
else $prot = 'http';
+ − 1621
if($_SERVER['SERVER_PORT'] == '80') $p = '';
+ − 1622
else $p = ':'.$_SERVER['SERVER_PORT'];
+ − 1623
$sidbak = false;
+ − 1624
if($this->sid_super)
+ − 1625
$sidbak = $this->sid_super;
+ − 1626
$this->sid_super = false;
+ − 1627
if($sidbak)
+ − 1628
$this->sid_super = $sidbak;
+ − 1629
unset($sidbak);
+ − 1630
$link = "$prot://".$_SERVER['HTTP_HOST'].scriptPath;
+ − 1631
+ − 1632
$message = 'Dear parent or legal guardian,
+ − 1633
A child under the username ' . $u . ' recently registered on our website. The child provided your e-mail address as the one of his or her authorized parent or legal guardian, and to comply with the United States Childrens\' Online Privacy Protection act, we ask that all parents of children ages 13 or under please mail us a written form authorizing their child\'s use of our website.
+ − 1634
+ − 1635
If you wish for your child to be allowed access to our website, please print and fill out the form below, and mail it to this address:
+ − 1636
+ − 1637
' . getConfig('coppa_address') . '
+ − 1638
+ − 1639
If you do NOT wish for your child to be allowed access to our site, you do not need to do anything - your child will not be able to access our site as a registered user unless you authorize their account activation.
+ − 1640
+ − 1641
Authorization form:
+ − 1642
-------------------------------- Cut here --------------------------------
+ − 1643
+ − 1644
I, _______________________________________, the legal parent or guardian of the child registered on the website "' . getConfig('site_name') . '" as ' . $u . ', hereby give my authorization for the child\'s e-mail address, instant messaging information, location, and real name, to be collected and stored in a database owned and maintained by ' . getConfig('site_name') . ' at the child\'s option, and for the administrators of this website to use this information according to the privacy policy displayed on their website <' . $link . '>.
+ − 1645
+ − 1646
Child\'s name: _____________________________________
+ − 1647
+ − 1648
Child\'s e-mail address: _____________________________________
+ − 1649
(optional - if you don\'t provide this, we\'ll just send site-related e-mails to your e-mail address)
+ − 1650
+ − 1651
Signature of parent or guardian:
+ − 1652
+ − 1653
____________________________________________________
+ − 1654
+ − 1655
Date (YYYY-MM-DD): ______ / _____ / _____
+ − 1656
+ − 1657
-------------------------------- Cut here --------------------------------';
+ − 1658
$message .= "\n\nSincerely yours, \n$admin_user and the ".$_SERVER['HTTP_HOST']." administration team";
+ − 1659
+ − 1660
error_reporting(E_ALL);
+ − 1661
+ − 1662
dc_dump($r, 'session: about to send COPPA e-mail to '.$r['email']);
+ − 1663
if(getConfig('smtp_enabled') == '1')
+ − 1664
{
+ − 1665
$result = smtp_send_email($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), getConfig('contact_email'));
+ − 1666
if($result == 'success')
+ − 1667
{
+ − 1668
$result = true;
+ − 1669
}
+ − 1670
else
+ − 1671
{
+ − 1672
echo $result;
+ − 1673
$result = false;
+ − 1674
}
+ − 1675
}
+ − 1676
else
+ − 1677
{
+ − 1678
$result = mail($r['email'], getConfig('site_name').' website account activation', preg_replace("#(?<!\r)\n#s", "\n", $message), 'From: '.getConfig('contact_email'));
+ − 1679
}
+ − 1680
return $result;
+ − 1681
}
+ − 1682
+ − 1683
/**
1
+ − 1684
* Sends an e-mail to a user so they can reset their password.
+ − 1685
* @param int $user The user ID, or username if it's a string
+ − 1686
* @return bool true on success, false on failure
+ − 1687
*/
+ − 1688
+ − 1689
function mail_password_reset($user)
+ − 1690
{
+ − 1691
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1692
if(is_int($user))
+ − 1693
{
+ − 1694
$q = $this->sql('SELECT user_id,username,email FROM '.table_prefix.'users WHERE user_id='.$user.';'); // This is SAFE! This is only called if $user is an integer
+ − 1695
}
+ − 1696
elseif(is_string($user))
+ − 1697
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1698
$q = $this->sql('SELECT user_id,username,email FROM '.table_prefix.'users WHERE lcase(username)=lcase(\''.$db->escape($user).'\');');
1
+ − 1699
}
+ − 1700
else
+ − 1701
{
+ − 1702
return false;
+ − 1703
}
+ − 1704
+ − 1705
$row = $db->fetchrow();
+ − 1706
$temp_pass = $this->random_pass();
+ − 1707
+ − 1708
$this->register_temp_password($row['user_id'], $temp_pass);
+ − 1709
+ − 1710
$site_name = getConfig('site_name');
+ − 1711
+ − 1712
$message = "Dear {$row['username']},
+ − 1713
+ − 1714
Someone (hopefully you) on the {$site_name} website requested that a new password be created.
+ − 1715
+ − 1716
The request was sent from the IP address {$_SERVER['REMOTE_ADDR']}.
+ − 1717
+ − 1718
If you did not request the new password, then you do not need to do anything; the password will be invalidated after 24 hours.
+ − 1719
+ − 1720
If you did request this password, then please log in using the password shown below:
+ − 1721
+ − 1722
Password: {$temp_pass}
+ − 1723
+ − 1724
After you log in using this password, you will be able to reset your real password. You can only log in using this temporary password once.
+ − 1725
+ − 1726
Sincerely yours,
+ − 1727
The {$site_name} administration team
+ − 1728
";
+ − 1729
+ − 1730
if(getConfig('smtp_enabled') == '1')
+ − 1731
{
+ − 1732
$result = smtp_send_email($row['email'], getConfig('site_name').' password reset', preg_replace("#(?<!\r)\n#s", "\n", $message), getConfig('contact_email'));
+ − 1733
if($result == 'success')
+ − 1734
{
+ − 1735
$result = true;
+ − 1736
}
+ − 1737
else
+ − 1738
{
+ − 1739
echo '<p>'.$result.'</p>';
+ − 1740
$result = false;
+ − 1741
}
+ − 1742
} else {
+ − 1743
$result = mail($row['email'], getConfig('site_name').' password reset', preg_replace("#(?<!\r)\n#s", "\n", $message), 'From: '.getConfig('contact_email'));
+ − 1744
}
+ − 1745
return $result;
+ − 1746
}
+ − 1747
+ − 1748
/**
+ − 1749
* Sets the temporary password for the specified user to whatever is specified.
+ − 1750
* @param int $user_id
+ − 1751
* @param string $password
+ − 1752
* @return bool
+ − 1753
*/
+ − 1754
+ − 1755
function register_temp_password($user_id, $password)
+ − 1756
{
+ − 1757
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 1758
$temp_pass = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 1759
$this->sql('UPDATE '.table_prefix.'users SET temp_password=\'' . $temp_pass . '\',temp_password_time='.time().' WHERE user_id='.intval($user_id).';');
+ − 1760
}
+ − 1761
+ − 1762
/**
+ − 1763
* Sends a request to the admin panel to have the username $u activated.
+ − 1764
* @param string $u The username of the user requesting activation
+ − 1765
*/
+ − 1766
+ − 1767
function admin_activation_request($u)
+ − 1768
{
+ − 1769
global $db;
+ − 1770
$this->sql('INSERT INTO '.table_prefix.'logs(log_type, action, time_id, date_string, author, edit_summary) VALUES(\'admin\', \'activ_req\', '.time().', \''.date('d M Y h:i a').'\', \''.$this->username.'\', \''.$db->escape($u).'\');');
+ − 1771
}
+ − 1772
+ − 1773
/**
+ − 1774
* Activates a user account. If the action fails, a report is sent to the admin.
+ − 1775
* @param string $user The username of the user requesting activation
+ − 1776
* @param string $key The activation key
+ − 1777
*/
+ − 1778
+ − 1779
function activate_account($user, $key)
+ − 1780
{
+ − 1781
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1782
$this->sql('UPDATE '.table_prefix.'users SET account_active=1 WHERE username=\''.$db->escape($user).'\' AND activation_key=\''.$db->escape($key).'\';');
+ − 1783
$r = mysql_affected_rows();
+ − 1784
if ( $r > 0 )
+ − 1785
{
+ − 1786
$e = $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'activ_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($user).'\', \''.$_SERVER['REMOTE_ADDR'].'\')');
+ − 1787
}
+ − 1788
else
+ − 1789
{
+ − 1790
$e = $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'activ_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($user).'\', \''.$_SERVER['REMOTE_ADDR'].'\')');
+ − 1791
}
+ − 1792
return $r;
+ − 1793
}
+ − 1794
+ − 1795
/**
+ − 1796
* For a given user level identifier (USER_LEVEL_*), returns a string describing that user level.
+ − 1797
* @param int User level
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1798
* @param bool If true, returns a shorter string. Optional.
1
+ − 1799
* @return string
+ − 1800
*/
+ − 1801
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1802
function userlevel_to_string($user_level, $short = false)
1
+ − 1803
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1804
if ( $short )
1
+ − 1805
{
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1806
switch ( $user_level )
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1807
{
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1808
case USER_LEVEL_GUEST:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1809
return 'Guest';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1810
case USER_LEVEL_MEMBER:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1811
return 'Member';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1812
case USER_LEVEL_CHPREF:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1813
return 'Sensitive preferences changeable';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1814
case USER_LEVEL_MOD:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1815
return 'Moderator';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1816
case USER_LEVEL_ADMIN:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1817
return 'Administrative';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1818
default:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1819
return "Level $user_level";
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1820
}
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1821
}
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1822
else
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1823
{
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1824
switch ( $user_level )
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1825
{
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1826
case USER_LEVEL_GUEST:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1827
return 'Low - guest privileges';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1828
case USER_LEVEL_MEMBER:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1829
return 'Standard - normal member level';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1830
case USER_LEVEL_CHPREF:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1831
return 'Medium - user can change his/her own e-mail address and password';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1832
case USER_LEVEL_MOD:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1833
return 'High - moderator privileges';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1834
case USER_LEVEL_ADMIN:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1835
return 'Highest - administrative privileges';
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1836
default:
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1837
return "Unknown ($user_level)";
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1838
}
1
+ − 1839
}
+ − 1840
}
+ − 1841
+ − 1842
/**
+ − 1843
* Updates a user's information in the database. Note that any of the values except $user_id can be false if you want to preserve the old values.
+ − 1844
* @param int $user_id The user ID of the user to update - this cannot be changed
+ − 1845
* @param string $username The new username
+ − 1846
* @param string $old_pass The current password - only required if sessionManager::$user_level < USER_LEVEL_ADMIN. This should usually be an UNENCRYPTED string. This can also be an array - if it is, key 0 is treated as data AES-encrypted with key 1
+ − 1847
* @param string $password The new password
+ − 1848
* @param string $email The new e-mail address
+ − 1849
* @param string $realname The new real name
+ − 1850
* @param string $signature The updated forum/comment signature
+ − 1851
* @param int $user_level The updated user level
+ − 1852
* @return string 'success' if successful, or array of error strings on failure
+ − 1853
*/
+ − 1854
+ − 1855
function update_user($user_id, $username = false, $old_pass = false, $password = false, $email = false, $realname = false, $signature = false, $user_level = false)
+ − 1856
{
+ − 1857
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 1858
+ − 1859
// Create some arrays
+ − 1860
+ − 1861
$errors = Array(); // Used to hold error strings
+ − 1862
$strs = Array(); // Sub-query statements
+ − 1863
+ − 1864
// Scan the user ID for problems
+ − 1865
if(intval($user_id) < 1) $errors[] = 'SQL injection attempt';
+ − 1866
+ − 1867
// Instanciate the AES encryption class
+ − 1868
$aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);
+ − 1869
+ − 1870
// If all of our input vars are false, then we've effectively done our job so get out of here
+ − 1871
if($username === false && $password === false && $email === false && $realname === false && $signature === false && $user_level === false)
+ − 1872
{
+ − 1873
// echo 'debug: $session->update_user(): success (no changes requested)';
+ − 1874
return 'success';
+ − 1875
}
+ − 1876
+ − 1877
// Initialize our authentication check
+ − 1878
$authed = false;
+ − 1879
+ − 1880
// Verify the inputted password
+ − 1881
if(is_string($old_pass))
+ − 1882
{
+ − 1883
$q = $this->sql('SELECT password FROM '.table_prefix.'users WHERE user_id='.$user_id.';');
+ − 1884
if($db->numrows() < 1)
+ − 1885
{
+ − 1886
$errors[] = 'The password data could not be selected for verification.';
+ − 1887
}
+ − 1888
else
+ − 1889
{
+ − 1890
$row = $db->fetchrow();
+ − 1891
$real = $aes->decrypt($row['password'], $this->private_key, ENC_HEX);
+ − 1892
if($real == $old_pass)
+ − 1893
$authed = true;
+ − 1894
}
+ − 1895
}
+ − 1896
+ − 1897
elseif(is_array($old_pass))
+ − 1898
{
+ − 1899
$old_pass = $aes->decrypt($old_pass[0], $old_pass[1]);
+ − 1900
$q = $this->sql('SELECT password FROM '.table_prefix.'users WHERE user_id='.$user_id.';');
+ − 1901
if($db->numrows() < 1)
+ − 1902
{
+ − 1903
$errors[] = 'The password data could not be selected for verification.';
+ − 1904
}
+ − 1905
else
+ − 1906
{
+ − 1907
$row = $db->fetchrow();
+ − 1908
$real = $aes->decrypt($row['password'], $this->private_key, ENC_HEX);
+ − 1909
if($real == $old_pass)
+ − 1910
$authed = true;
+ − 1911
}
+ − 1912
}
+ − 1913
+ − 1914
// Initialize our query
+ − 1915
$q = 'UPDATE '.table_prefix.'users SET ';
+ − 1916
+ − 1917
if($this->auth_level >= USER_LEVEL_ADMIN || $authed) // Need the current password in order to update the e-mail address, change the username, or reset the password
+ − 1918
{
+ − 1919
// Username
+ − 1920
if(is_string($username))
+ − 1921
{
+ − 1922
// Check the username for problems
+ − 1923
if(!preg_match('#^'.$this->valid_username.'$#', $username))
+ − 1924
$errors[] = 'The username you entered contains invalid characters.';
+ − 1925
$strs[] = 'username=\''.$db->escape($username).'\'';
+ − 1926
}
+ − 1927
// Password
+ − 1928
if(is_string($password) && strlen($password) >= 6)
+ − 1929
{
+ − 1930
// Password needs to be encrypted before being stashed
+ − 1931
$encpass = $aes->encrypt($password, $this->private_key, ENC_HEX);
+ − 1932
if(!$encpass)
+ − 1933
$errors[] = 'The password could not be encrypted due to an internal error.';
+ − 1934
$strs[] = 'password=\''.$encpass.'\'';
+ − 1935
}
+ − 1936
// E-mail addy
+ − 1937
if(is_string($email))
+ − 1938
{
+ − 1939
// I didn't write this regex.
32
4d87aad3c4c0
Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details
Dan
diff
changeset
+ − 1940
if(!preg_match('/^(?:[\w\d]+\.?)+@((?:(?:[\w\d]\-?)+\.)+\w{2,4}|localhost)$/', $email))
1
+ − 1941
$errors[] = 'The e-mail address you entered is invalid.';
+ − 1942
$strs[] = 'email=\''.$db->escape($email).'\'';
+ − 1943
}
+ − 1944
}
+ − 1945
// Real name
+ − 1946
if(is_string($realname))
+ − 1947
{
+ − 1948
$strs[] = 'real_name=\''.$db->escape($realname).'\'';
+ − 1949
}
+ − 1950
// Forum/comment signature
+ − 1951
if(is_string($signature))
+ − 1952
{
+ − 1953
$strs[] = 'signature=\''.$db->escape($signature).'\'';
+ − 1954
}
+ − 1955
// User level
+ − 1956
if(is_int($user_level))
+ − 1957
{
+ − 1958
$strs[] = 'user_level='.$user_level;
+ − 1959
}
+ − 1960
+ − 1961
// Add our generated query to the query string
+ − 1962
$q .= implode(',', $strs);
+ − 1963
+ − 1964
// One last error check
+ − 1965
if(sizeof($strs) < 1) $errors[] = 'An internal error occured building the SQL query, this is a bug';
+ − 1966
if(sizeof($errors) > 0) return $errors;
+ − 1967
+ − 1968
// Free our temp arrays
+ − 1969
unset($strs, $errors);
+ − 1970
+ − 1971
// Finalize the query and run it
+ − 1972
$q .= ' WHERE user_id='.$user_id.';';
+ − 1973
$this->sql($q);
+ − 1974
+ − 1975
// We also need to trigger re-activation.
+ − 1976
if ( is_string($email) )
+ − 1977
{
+ − 1978
switch(getConfig('account_activation'))
+ − 1979
{
+ − 1980
case 'user':
+ − 1981
case 'admin':
+ − 1982
+ − 1983
if ( $session->user_level >= USER_LEVEL_MOD && getConfig('account_activation') == 'admin' )
+ − 1984
// Don't require re-activation by admins for admins
+ − 1985
break;
+ − 1986
+ − 1987
// retrieve username
+ − 1988
if ( !$username )
+ − 1989
{
+ − 1990
$q = $this->sql('SELECT username FROM '.table_prefix.'users WHERE user_id='.$user_id.';');
+ − 1991
if($db->numrows() < 1)
+ − 1992
{
+ − 1993
$errors[] = 'The username could not be selected.';
+ − 1994
}
+ − 1995
else
+ − 1996
{
+ − 1997
$row = $db->fetchrow();
+ − 1998
$username = $row['username'];
+ − 1999
}
+ − 2000
}
+ − 2001
if ( !$username )
+ − 2002
return $errors;
+ − 2003
+ − 2004
// Generate a totally random activation key
+ − 2005
$actkey = sha1 ( microtime() . mt_rand() );
+ − 2006
$a = $this->send_activation_mail($username, $actkey);
+ − 2007
if(!$a)
+ − 2008
{
+ − 2009
$this->admin_activation_request($username);
+ − 2010
}
+ − 2011
// Deactivate the account until e-mail is confirmed
+ − 2012
$q = $db->sql_query('UPDATE '.table_prefix.'users SET account_active=0,activation_key=\'' . $actkey . '\' WHERE user_id=' . $user_id . ';');
+ − 2013
break;
+ − 2014
}
+ − 2015
}
+ − 2016
+ − 2017
// Yay! We're done
+ − 2018
return 'success';
+ − 2019
}
+ − 2020
+ − 2021
#
+ − 2022
# Access Control Lists
+ − 2023
#
+ − 2024
+ − 2025
/**
+ − 2026
* Creates a new permission field in memory. If the permissions are set in the database, they are used. Otherwise, $default_perm is used.
+ − 2027
* @param string $acl_type An identifier for this field
+ − 2028
* @param int $default_perm Whether permission should be granted or not if it's not specified in the ACLs.
+ − 2029
* @param string $desc A human readable name for the permission type
+ − 2030
* @param array $deps The list of dependencies - this should be an array of ACL types
+ − 2031
* @param string $scope Which namespaces this field should apply to. This should be either a pipe-delimited list of namespace IDs or just "All".
+ − 2032
*/
+ − 2033
+ − 2034
function register_acl_type($acl_type, $default_perm = AUTH_DISALLOW, $desc = false, $deps = Array(), $scope = 'All')
+ − 2035
{
+ − 2036
if(isset($this->acl_types[$acl_type]))
+ − 2037
return false;
+ − 2038
else
+ − 2039
{
+ − 2040
if(!$desc)
+ − 2041
{
+ − 2042
$desc = capitalize_first_letter(str_replace('_', ' ', $acl_type));
+ − 2043
}
+ − 2044
$this->acl_types[$acl_type] = $default_perm;
+ − 2045
$this->acl_descs[$acl_type] = $desc;
+ − 2046
$this->acl_deps[$acl_type] = $deps;
+ − 2047
$this->acl_scope[$acl_type] = explode('|', $scope);
+ − 2048
}
+ − 2049
return true;
+ − 2050
}
+ − 2051
+ − 2052
/**
+ − 2053
* Tells us whether permission $type is allowed or not based on the current rules.
+ − 2054
* @param string $type The permission identifier ($acl_type passed to sessionManager::register_acl_type())
+ − 2055
* @param bool $no_deps If true, disables dependency checking
+ − 2056
* @return bool True if allowed, false if denied or if an error occured
+ − 2057
*/
+ − 2058
+ − 2059
function get_permissions($type, $no_deps = false)
+ − 2060
{
+ − 2061
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2062
if ( isset( $this->perms[$type] ) )
+ − 2063
{
+ − 2064
if ( $this->perms[$type] == AUTH_DENY )
+ − 2065
$ret = false;
+ − 2066
else if ( $this->perms[$type] == AUTH_WIKIMODE && $paths->wiki_mode )
+ − 2067
$ret = true;
+ − 2068
else if ( $this->perms[$type] == AUTH_WIKIMODE && !$paths->wiki_mode )
+ − 2069
$ret = false;
+ − 2070
else if ( $this->perms[$type] == AUTH_ALLOW )
+ − 2071
$ret = true;
+ − 2072
else if ( $this->perms[$type] == AUTH_DISALLOW )
+ − 2073
$ret = false;
+ − 2074
}
+ − 2075
else if(isset($this->acl_types[$type]))
+ − 2076
{
+ − 2077
if ( $this->acl_types[$type] == AUTH_DENY )
+ − 2078
$ret = false;
+ − 2079
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && $paths->wiki_mode )
+ − 2080
$ret = true;
+ − 2081
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && !$paths->wiki_mode )
+ − 2082
$ret = false;
+ − 2083
else if ( $this->acl_types[$type] == AUTH_ALLOW )
+ − 2084
$ret = true;
+ − 2085
else if ( $this->acl_types[$type] == AUTH_DISALLOW )
+ − 2086
$ret = false;
+ − 2087
}
+ − 2088
else
+ − 2089
{
+ − 2090
// ACL type is undefined
+ − 2091
trigger_error('Unknown access type "' . $type . '"', E_USER_WARNING);
+ − 2092
return false; // Be on the safe side and deny access
+ − 2093
}
+ − 2094
if ( !$no_deps )
+ − 2095
{
+ − 2096
if ( !$this->acl_check_deps($type) )
+ − 2097
return false;
+ − 2098
}
+ − 2099
return $ret;
+ − 2100
}
+ − 2101
+ − 2102
/**
+ − 2103
* Fetch the permissions that apply to the current user for the page specified. The object you get will have the get_permissions method
+ − 2104
* and several other abilities.
+ − 2105
* @param string $page_id
+ − 2106
* @param string $namespace
+ − 2107
* @return object
+ − 2108
*/
+ − 2109
+ − 2110
function fetch_page_acl($page_id, $namespace)
+ − 2111
{
+ − 2112
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2113
+ − 2114
if ( count ( $this->acl_base_cache ) < 1 )
+ − 2115
{
+ − 2116
// Permissions table not yet initialized
+ − 2117
return false;
+ − 2118
}
+ − 2119
155
+ − 2120
// cache of permission objects (to save RAM and SQL queries)
+ − 2121
static $objcache = array();
+ − 2122
+ − 2123
if ( count($objcache) == 0 )
+ − 2124
{
+ − 2125
foreach ( $paths->nslist as $key => $_ )
+ − 2126
{
+ − 2127
$objcache[$key] = array();
+ − 2128
}
+ − 2129
}
+ − 2130
+ − 2131
if ( isset($objcache[$namespace][$page_id]) )
+ − 2132
{
+ − 2133
return $objcache[$namespace][$page_id];
+ − 2134
}
+ − 2135
1
+ − 2136
//if ( !isset( $paths->pages[$paths->nslist[$namespace] . $page_id] ) )
+ − 2137
//{
+ − 2138
// // Page does not exist
+ − 2139
// return false;
+ − 2140
//}
+ − 2141
155
+ − 2142
$objcache[$namespace][$page_id] = new Session_ACLPageInfo( $page_id, $namespace, $this->acl_types, $this->acl_descs, $this->acl_deps, $this->acl_base_cache );
+ − 2143
$object =& $objcache[$namespace][$page_id];
1
+ − 2144
+ − 2145
return $object;
+ − 2146
+ − 2147
}
+ − 2148
+ − 2149
/**
+ − 2150
* Read all of our permissions from the database and process/apply them. This should be called after the page is determined.
+ − 2151
* @access private
+ − 2152
*/
+ − 2153
+ − 2154
function init_permissions()
+ − 2155
{
+ − 2156
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2157
// Initialize the permissions list with some defaults
+ − 2158
$this->perms = $this->acl_types;
+ − 2159
$this->acl_defaults_used = $this->perms;
+ − 2160
+ − 2161
// Fetch sitewide defaults from the permissions table
+ − 2162
$bs = 'SELECT rules FROM '.table_prefix.'acl WHERE page_id IS NULL AND namespace IS NULL AND ( ';
+ − 2163
+ − 2164
$q = Array();
+ − 2165
$q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$this->user_id.' )';
+ − 2166
if(count($this->groups) > 0)
+ − 2167
{
+ − 2168
foreach($this->groups as $g_id => $g_name)
+ − 2169
{
+ − 2170
$q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
+ − 2171
}
+ − 2172
}
+ − 2173
$bs .= implode(' OR ', $q) . ' ) ORDER BY target_type ASC, target_id ASC;';
+ − 2174
$q = $this->sql($bs);
+ − 2175
if ( $row = $db->fetchrow() )
+ − 2176
{
+ − 2177
do {
+ − 2178
$rules = $this->string_to_perm($row['rules']);
+ − 2179
$is_everyone = ( $row['target_type'] == ACL_TYPE_GROUP && $row['target_id'] == 1 );
+ − 2180
$this->acl_merge_with_current($rules, $is_everyone);
+ − 2181
} while ( $row = $db->fetchrow() );
+ − 2182
}
+ − 2183
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2184
// Cache the sitewide permissions for later use
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2185
$this->acl_base_cache = $this->perms;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2186
1
+ − 2187
// Eliminate types that don't apply to this namespace
+ − 2188
foreach ( $this->perms AS $i => $perm )
+ − 2189
{
+ − 2190
if ( !in_array ( $paths->namespace, $this->acl_scope[$i] ) && !in_array('All', $this->acl_scope[$i]) )
+ − 2191
{
+ − 2192
unset($this->perms[$i]);
+ − 2193
}
+ − 2194
}
+ − 2195
73
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2196
// PAGE group info
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2197
$pg_list = $paths->get_page_groups($paths->cpage['urlname_nons'], $paths->namespace);
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2198
$pg_info = '';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2199
foreach ( $pg_list as $g_id )
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2200
{
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2201
$pg_info .= ' ( page_id=\'' . $g_id . '\' AND namespace=\'__PageGroup\' ) OR';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2202
}
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2203
1
+ − 2204
// Build a query to grab ACL info
+ − 2205
$bs = 'SELECT rules,target_type,target_id FROM '.table_prefix.'acl WHERE ( ';
+ − 2206
$q = Array();
+ − 2207
$q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$this->user_id.' )';
+ − 2208
if(count($this->groups) > 0)
+ − 2209
{
+ − 2210
foreach($this->groups as $g_id => $g_name)
+ − 2211
{
+ − 2212
$q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
+ − 2213
}
+ − 2214
}
+ − 2215
// The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual
+ − 2216
// permissions to override group permissions.
73
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2217
$bs .= implode(' OR ', $q) . ' ) AND (' . $pg_info . ' ( page_id=\''.$db->escape($paths->cpage['urlname_nons']).'\' AND namespace=\''.$db->escape($paths->namespace).'\' ) )
1
+ − 2218
ORDER BY target_type ASC, page_id ASC, namespace ASC;';
+ − 2219
$q = $this->sql($bs);
+ − 2220
if ( $row = $db->fetchrow() )
+ − 2221
{
+ − 2222
do {
+ − 2223
$rules = $this->string_to_perm($row['rules']);
+ − 2224
$is_everyone = ( $row['target_type'] == ACL_TYPE_GROUP && $row['target_id'] == 1 );
+ − 2225
$this->acl_merge_with_current($rules, $is_everyone);
+ − 2226
} while ( $row = $db->fetchrow() );
+ − 2227
}
+ − 2228
+ − 2229
}
+ − 2230
+ − 2231
/**
+ − 2232
* Extends the scope of a permission type.
+ − 2233
* @param string The name of the permission type
+ − 2234
* @param string The namespace(s) that should be covered. This can be either one namespace ID or a pipe-delimited list.
+ − 2235
* @param object Optional - the current $paths object, in case we're doing this from the acl_rule_init hook
+ − 2236
*/
+ − 2237
+ − 2238
function acl_extend_scope($perm_type, $namespaces, &$p_in)
+ − 2239
{
+ − 2240
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2241
$p_obj = ( is_object($p_in) ) ? $p_in : $paths;
+ − 2242
$nslist = explode('|', $namespaces);
+ − 2243
foreach ( $nslist as $i => $ns )
+ − 2244
{
+ − 2245
if ( !isset($p_obj->nslist[$ns]) )
+ − 2246
{
+ − 2247
unset($nslist[$i]);
+ − 2248
}
+ − 2249
else
+ − 2250
{
+ − 2251
$this->acl_scope[$perm_type][] = $ns;
+ − 2252
if ( isset($this->acl_types[$perm_type]) && !isset($this->perms[$perm_type]) )
+ − 2253
{
+ − 2254
$this->perms[$perm_type] = $this->acl_types[$perm_type];
+ − 2255
}
+ − 2256
}
+ − 2257
}
+ − 2258
}
+ − 2259
+ − 2260
/**
+ − 2261
* Converts a permissions field into a string for database insertion. Similar in spirit to serialize().
+ − 2262
* @param array $perms An associative array with only integers as values
+ − 2263
* @return string
+ − 2264
*/
+ − 2265
+ − 2266
function perm_to_string($perms)
+ − 2267
{
+ − 2268
$s = '';
+ − 2269
foreach($perms as $perm => $ac)
+ − 2270
{
+ − 2271
$s .= "$perm=$ac;";
+ − 2272
}
+ − 2273
return $s;
+ − 2274
}
+ − 2275
+ − 2276
/**
+ − 2277
* Converts a permissions string back to an array.
+ − 2278
* @param string $perms The result from sessionManager::perm_to_string()
+ − 2279
* @return array
+ − 2280
*/
+ − 2281
+ − 2282
function string_to_perm($perms)
+ − 2283
{
+ − 2284
$ret = Array();
+ − 2285
preg_match_all('#([a-z0-9_-]+)=([0-9]+);#i', $perms, $matches);
+ − 2286
foreach($matches[1] as $i => $t)
+ − 2287
{
+ − 2288
$ret[$t] = intval($matches[2][$i]);
+ − 2289
}
+ − 2290
return $ret;
+ − 2291
}
+ − 2292
+ − 2293
/**
+ − 2294
* Merges two ACL arrays. Both parameters should be permission list arrays. The second group takes precedence over the first, but AUTH_DENY always prevails.
+ − 2295
* @param array $perm1 The first set of permissions
+ − 2296
* @param array $perm2 The second set of permissions
+ − 2297
* @return array
+ − 2298
*/
+ − 2299
+ − 2300
function acl_merge($perm1, $perm2)
+ − 2301
{
+ − 2302
$ret = $perm1;
+ − 2303
foreach ( $perm2 as $type => $level )
+ − 2304
{
+ − 2305
if ( isset( $ret[$type] ) )
+ − 2306
{
+ − 2307
if ( $ret[$type] != AUTH_DENY )
+ − 2308
$ret[$type] = $level;
+ − 2309
}
+ − 2310
// else
+ − 2311
// {
+ − 2312
// $ret[$type] = $level;
+ − 2313
// }
+ − 2314
}
+ − 2315
return $ret;
+ − 2316
}
+ − 2317
+ − 2318
/**
+ − 2319
* Merges the ACL array sent with the current permissions table, deciding precedence based on whether defaults are in effect or not.
+ − 2320
* @param array The array to merge into the master ACL list
+ − 2321
* @param bool If true, $perm is treated as the "new default"
+ − 2322
* @param int 1 if this is a site-wide ACL, 2 if page-specific. Defaults to 2.
+ − 2323
*/
+ − 2324
+ − 2325
function acl_merge_with_current($perm, $is_everyone = false, $scope = 2)
+ − 2326
{
+ − 2327
foreach ( $this->perms as $i => $p )
+ − 2328
{
+ − 2329
if ( isset($perm[$i]) )
+ − 2330
{
+ − 2331
if ( $is_everyone && !$this->acl_defaults_used[$i] )
+ − 2332
continue;
+ − 2333
// Decide precedence
+ − 2334
if ( isset($this->acl_defaults_used[$i]) )
+ − 2335
{
+ − 2336
//echo "$i: default in use, overriding to: {$perm[$i]}<br />";
+ − 2337
// Defaults are in use, override
+ − 2338
$this->perms[$i] = $perm[$i];
+ − 2339
$this->acl_defaults_used[$i] = ( $is_everyone );
+ − 2340
}
+ − 2341
else
+ − 2342
{
+ − 2343
//echo "$i: default NOT in use";
+ − 2344
// Defaults are not in use, merge as normal
+ − 2345
if ( $this->perms[$i] != AUTH_DENY )
+ − 2346
{
+ − 2347
//echo ", but overriding";
+ − 2348
$this->perms[$i] = $perm[$i];
+ − 2349
}
+ − 2350
//echo "<br />";
+ − 2351
}
+ − 2352
}
+ − 2353
}
+ − 2354
}
+ − 2355
+ − 2356
/**
+ − 2357
* Merges two ACL arrays. Both parameters should be permission list arrays. The second group takes precedence
+ − 2358
* over the first, without exceptions. This is used to merge the hardcoded defaults with admin-specified
+ − 2359
* defaults, which take precedence.
+ − 2360
* @param array $perm1 The first set of permissions
+ − 2361
* @param array $perm2 The second set of permissions
+ − 2362
* @return array
+ − 2363
*/
+ − 2364
+ − 2365
function acl_merge_complete($perm1, $perm2)
+ − 2366
{
+ − 2367
$ret = $perm1;
+ − 2368
foreach ( $perm2 as $type => $level )
+ − 2369
{
+ − 2370
$ret[$type] = $level;
+ − 2371
}
+ − 2372
return $ret;
+ − 2373
}
+ − 2374
+ − 2375
/**
+ − 2376
* Tell us if the dependencies for a given permission are met.
+ − 2377
* @param string The ACL permission ID
+ − 2378
* @return bool
+ − 2379
*/
+ − 2380
+ − 2381
function acl_check_deps($type)
+ − 2382
{
+ − 2383
if(!isset($this->acl_deps[$type])) // This will only happen if the permissions table is hacked or improperly accessed
+ − 2384
return true;
+ − 2385
if(sizeof($this->acl_deps[$type]) < 1)
+ − 2386
return true;
+ − 2387
$deps = $this->acl_deps[$type];
+ − 2388
while(true)
+ − 2389
{
+ − 2390
$full_resolved = true;
+ − 2391
$j = sizeof($deps);
+ − 2392
for ( $i = 0; $i < $j; $i++ )
+ − 2393
{
+ − 2394
$b = $deps;
+ − 2395
$deps = array_merge($deps, $this->acl_deps[$deps[$i]]);
+ − 2396
if( $b == $deps )
+ − 2397
{
+ − 2398
break 2;
+ − 2399
}
+ − 2400
$j = sizeof($deps);
+ − 2401
}
+ − 2402
}
+ − 2403
//die('<pre>'.print_r($deps, true).'</pre>');
+ − 2404
foreach($deps as $d)
+ − 2405
{
+ − 2406
if ( !$this->get_permissions($d) )
+ − 2407
{
+ − 2408
return false;
+ − 2409
}
+ − 2410
}
+ − 2411
return true;
+ − 2412
}
+ − 2413
+ − 2414
/**
+ − 2415
* Makes a CAPTCHA code and caches the code in the database
+ − 2416
* @param int $len The length of the code, in bytes
+ − 2417
* @return string A unique identifier assigned to the code. This hash should be passed to sessionManager::getCaptcha() to retrieve the code.
+ − 2418
*/
+ − 2419
+ − 2420
function make_captcha($len = 7)
+ − 2421
{
+ − 2422
$chars = array('A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9');
+ − 2423
$s = '';
+ − 2424
for($i=0;$i<$len;$i++) $s .= $chars[mt_rand(0, count($chars)-1)];
+ − 2425
$hash = md5(microtime() . mt_rand());
+ − 2426
$this->sql('INSERT INTO '.table_prefix.'session_keys(session_key,salt,auth_level,source_ip,user_id) VALUES(\''.$hash.'\', \''.$s.'\', -1, \''.ip2hex($_SERVER['REMOTE_ADDR']).'\', -2);');
+ − 2427
return $hash;
+ − 2428
}
+ − 2429
+ − 2430
/**
+ − 2431
* For the given code ID, returns the correct CAPTCHA code, or false on failure
+ − 2432
* @param string $hash The unique ID assigned to the code
+ − 2433
* @return string The correct confirmation code
+ − 2434
*/
+ − 2435
+ − 2436
function get_captcha($hash)
+ − 2437
{
+ − 2438
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2439
$s = $this->sql('SELECT salt FROM '.table_prefix.'session_keys WHERE session_key=\''.$db->escape($hash).'\' AND source_ip=\''.ip2hex($_SERVER['REMOTE_ADDR']).'\';');
+ − 2440
if($db->numrows() < 1) return false;
+ − 2441
$r = $db->fetchrow();
+ − 2442
return $r['salt'];
+ − 2443
}
+ − 2444
+ − 2445
/**
+ − 2446
* Deletes all CAPTCHA codes cached in the DB for this user.
+ − 2447
*/
+ − 2448
+ − 2449
function kill_captcha()
+ − 2450
{
+ − 2451
$this->sql('DELETE FROM '.table_prefix.'session_keys WHERE user_id=-2 AND source_ip=\''.ip2hex($_SERVER['REMOTE_ADDR']).'\';');
+ − 2452
}
+ − 2453
+ − 2454
/**
+ − 2455
* Generates a random password.
+ − 2456
* @param int $length Optional - length of password
+ − 2457
* @return string
+ − 2458
*/
+ − 2459
+ − 2460
function random_pass($length = 10)
+ − 2461
{
+ − 2462
$valid_chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_+@#%&<>';
+ − 2463
$valid_chars = enano_str_split($valid_chars);
+ − 2464
$ret = '';
+ − 2465
for ( $i = 0; $i < $length; $i++ )
+ − 2466
{
+ − 2467
$ret .= $valid_chars[mt_rand(0, count($valid_chars)-1)];
+ − 2468
}
+ − 2469
return $ret;
+ − 2470
}
+ − 2471
+ − 2472
/**
+ − 2473
* Generates some Javascript that calls the AES encryption library.
+ − 2474
* @param string The name of the form
+ − 2475
* @param string The name of the password field
+ − 2476
* @param string The name of the field that switches encryption on or off
+ − 2477
* @param string The name of the field that contains the encryption key
+ − 2478
* @param string The name of the field that will contain the encrypted password
+ − 2479
* @param string The name of the field that handles MD5 challenge data
+ − 2480
* @return string
+ − 2481
*/
+ − 2482
+ − 2483
function aes_javascript($form_name, $pw_field, $use_crypt, $crypt_key, $crypt_data, $challenge)
+ − 2484
{
+ − 2485
$code = '
+ − 2486
<script type="text/javascript">
+ − 2487
disableJSONExts();
+ − 2488
str = \'\';
+ − 2489
for(i=0;i<keySizeInBits/4;i++) str+=\'0\';
+ − 2490
var key = hexToByteArray(str);
+ − 2491
var pt = hexToByteArray(str);
+ − 2492
var ct = rijndaelEncrypt(pt, key, \'ECB\');
+ − 2493
var ct = byteArrayToHex(ct);
+ − 2494
switch(keySizeInBits)
+ − 2495
{
+ − 2496
case 128:
+ − 2497
v = \'66e94bd4ef8a2c3b884cfa59ca342b2e\';
+ − 2498
break;
+ − 2499
case 192:
+ − 2500
v = \'aae06992acbf52a3e8f4a96ec9300bd7aae06992acbf52a3e8f4a96ec9300bd7\';
+ − 2501
break;
+ − 2502
case 256:
+ − 2503
v = \'dc95c078a2408989ad48a21492842087dc95c078a2408989ad48a21492842087\';
+ − 2504
break;
+ − 2505
}
+ − 2506
var testpassed = ' . ( ( isset($_GET['use_crypt']) && $_GET['use_crypt']=='0') ? 'false; // CRYPTO-AUTH DISABLED ON USER REQUEST // ' : '' ) . '( ct == v && md5_vm_test() );
+ − 2507
var frm = document.forms.'.$form_name.';
+ − 2508
function runEncryption()
+ − 2509
{
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2510
var frm = document.forms.'.$form_name.';
1
+ − 2511
if(testpassed)
+ − 2512
{
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2513
frm.'.$use_crypt.'.value = \'yes\';
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2514
var cryptkey = frm.'.$crypt_key.'.value;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2515
frm.'.$crypt_key.'.value = hex_md5(cryptkey);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2516
cryptkey = hexToByteArray(cryptkey);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2517
if(!cryptkey || ( ( typeof cryptkey == \'string\' || typeof cryptkey == \'object\' ) ) && cryptkey.length != keySizeInBits / 8 )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2518
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2519
if ( frm._login ) frm._login.disabled = true;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2520
len = ( typeof cryptkey == \'string\' || typeof cryptkey == \'object\' ) ? \'\\nLen: \'+cryptkey.length : \'\';
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2521
alert(\'The key is messed up\\nType: \'+typeof(cryptkey)+len);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2522
}
1
+ − 2523
pass = frm.'.$pw_field.'.value;
+ − 2524
chal = frm.'.$challenge.'.value;
+ − 2525
challenge = hex_md5(pass + chal) + chal;
+ − 2526
frm.'.$challenge.'.value = challenge;
+ − 2527
pass = stringToByteArray(pass);
+ − 2528
cryptstring = rijndaelEncrypt(pass, cryptkey, \'ECB\');
+ − 2529
if(!cryptstring)
+ − 2530
{
+ − 2531
return false;
+ − 2532
}
+ − 2533
cryptstring = byteArrayToHex(cryptstring);
+ − 2534
frm.'.$crypt_data.'.value = cryptstring;
+ − 2535
frm.'.$pw_field.'.value = \'\';
+ − 2536
}
+ − 2537
return false;
+ − 2538
}
+ − 2539
</script>
+ − 2540
';
+ − 2541
return $code;
+ − 2542
}
+ − 2543
+ − 2544
}
+ − 2545
+ − 2546
/**
+ − 2547
* Class used to fetch permissions for a specific page. Used internally by SessionManager.
+ − 2548
* @package Enano
+ − 2549
* @subpackage Session manager
+ − 2550
* @license http://www.gnu.org/copyleft/gpl.html
+ − 2551
* @access private
+ − 2552
*/
+ − 2553
+ − 2554
class Session_ACLPageInfo {
+ − 2555
+ − 2556
/**
+ − 2557
* The page ID of this ACL info package
+ − 2558
* @var string
+ − 2559
*/
+ − 2560
+ − 2561
var $page_id;
+ − 2562
+ − 2563
/**
+ − 2564
* The namespace of the page being checked
+ − 2565
* @var string
+ − 2566
*/
+ − 2567
+ − 2568
var $namespace;
+ − 2569
+ − 2570
/**
+ − 2571
* Our list of permission types.
+ − 2572
* @access private
+ − 2573
* @var array
+ − 2574
*/
+ − 2575
+ − 2576
var $acl_types = Array();
+ − 2577
+ − 2578
/**
+ − 2579
* The list of descriptions for the permission types
+ − 2580
* @var array
+ − 2581
*/
+ − 2582
+ − 2583
var $acl_descs = Array();
+ − 2584
+ − 2585
/**
+ − 2586
* A list of dependencies for ACL types.
+ − 2587
* @var array
+ − 2588
*/
+ − 2589
+ − 2590
var $acl_deps = Array();
+ − 2591
+ − 2592
/**
+ − 2593
* Our tell-all list of permissions.
+ − 2594
* @access private - or, preferably, protected...too bad this has to be PHP4 compatible
+ − 2595
* @var array
+ − 2596
*/
+ − 2597
+ − 2598
var $perms = Array();
+ − 2599
+ − 2600
/**
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2601
* Array to track which default permissions are being used
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2602
* @var array
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2603
* @access private
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2604
*/
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2605
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2606
var $acl_defaults_used = Array();
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2607
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2608
/**
1
+ − 2609
* Constructor.
+ − 2610
* @param string $page_id The ID of the page to check
+ − 2611
* @param string $namespace The namespace of the page to check.
+ − 2612
* @param array $acl_types List of ACL types
+ − 2613
* @param array $acl_descs List of human-readable descriptions for permissions (associative)
+ − 2614
* @param array $acl_deps List of dependencies for permissions. For example, viewing history/diffs depends on the ability to read the page.
+ − 2615
* @param array $base What to start with - this is an attempt to reduce the number of SQL queries.
+ − 2616
*/
+ − 2617
+ − 2618
function Session_ACLPageInfo($page_id, $namespace, $acl_types, $acl_descs, $acl_deps, $base)
+ − 2619
{
+ − 2620
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2621
+ − 2622
$this->acl_deps = $acl_deps;
+ − 2623
$this->acl_types = $acl_types;
+ − 2624
$this->acl_descs = $acl_descs;
+ − 2625
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2626
$this->perms = $acl_types;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2627
$this->perms = $session->acl_merge_complete($this->perms, $base);
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2628
73
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2629
// PAGE group info
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2630
$pg_list = $paths->get_page_groups($page_id, $namespace);
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2631
$pg_info = '';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2632
foreach ( $pg_list as $g_id )
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2633
{
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2634
$pg_info .= ' ( page_id=\'' . $g_id . '\' AND namespace=\'__PageGroup\' ) OR';
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2635
}
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2636
1
+ − 2637
// Build a query to grab ACL info
+ − 2638
$bs = 'SELECT rules FROM '.table_prefix.'acl WHERE ( ';
+ − 2639
$q = Array();
+ − 2640
$q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$session->user_id.' )';
+ − 2641
if(count($session->groups) > 0)
+ − 2642
{
+ − 2643
foreach($session->groups as $g_id => $g_name)
+ − 2644
{
+ − 2645
$q[] = '( target_type='.ACL_TYPE_GROUP.' AND target_id='.intval($g_id).' )';
+ − 2646
}
+ − 2647
}
+ − 2648
// The reason we're using an ORDER BY statement here is because ACL_TYPE_GROUP is less than ACL_TYPE_USER, causing the user's individual
+ − 2649
// permissions to override group permissions.
73
0a74676a2f2f
Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too
Dan
diff
changeset
+ − 2650
$bs .= implode(' OR ', $q) . ' ) AND (' . $pg_info . ' page_id=\''.$db->escape($page_id).'\' AND namespace=\''.$db->escape($namespace).'\' )
1
+ − 2651
ORDER BY target_type ASC, page_id ASC, namespace ASC;';
+ − 2652
$q = $session->sql($bs);
+ − 2653
if ( $row = $db->fetchrow() )
+ − 2654
{
+ − 2655
do {
+ − 2656
$rules = $session->string_to_perm($row['rules']);
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2657
$is_everyone = ( $row['target_type'] == ACL_TYPE_GROUP && $row['target_id'] == 1 );
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2658
$this->acl_merge_with_current($rules, $is_everyone);
1
+ − 2659
} while ( $row = $db->fetchrow() );
+ − 2660
}
+ − 2661
+ − 2662
$this->page_id = $page_id;
+ − 2663
$this->namespace = $namespace;
+ − 2664
}
+ − 2665
+ − 2666
/**
+ − 2667
* Tells us whether permission $type is allowed or not based on the current rules.
+ − 2668
* @param string $type The permission identifier ($acl_type passed to sessionManager::register_acl_type())
+ − 2669
* @param bool $no_deps If true, disables dependency checking
+ − 2670
* @return bool True if allowed, false if denied or if an error occured
+ − 2671
*/
+ − 2672
+ − 2673
function get_permissions($type, $no_deps = false)
+ − 2674
{
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2675
// echo '<pre>' . print_r($this->perms, true) . '</pre>';
1
+ − 2676
global $db, $session, $paths, $template, $plugins; // Common objects
+ − 2677
if ( isset( $this->perms[$type] ) )
+ − 2678
{
+ − 2679
if ( $this->perms[$type] == AUTH_DENY )
+ − 2680
$ret = false;
+ − 2681
else if ( $this->perms[$type] == AUTH_WIKIMODE &&
+ − 2682
( isset($paths->pages[$paths->nslist[$this->namespace].$this->page_id]) &&
+ − 2683
( $paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '1' ||
+ − 2684
( $paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '2'
+ − 2685
&& getConfig('wiki_mode') == '1'
+ − 2686
) ) ) )
+ − 2687
$ret = true;
+ − 2688
else if ( $this->perms[$type] == AUTH_WIKIMODE && (
+ − 2689
!isset($paths->pages[$paths->nslist[$this->namespace].$this->page_id])
+ − 2690
|| (
+ − 2691
isset($paths->pages[$paths->nslist[$this->namespace].$this->page_id]) && (
+ − 2692
$paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '0'
+ − 2693
|| (
+ − 2694
$paths->pages[$paths->nslist[$this->namespace].$this->page_id]['wiki_mode'] == '2' && getConfig('wiki_mode') != '1'
+ − 2695
) ) ) ) )
+ − 2696
$ret = false;
+ − 2697
else if ( $this->perms[$type] == AUTH_ALLOW )
+ − 2698
$ret = true;
+ − 2699
else if ( $this->perms[$type] == AUTH_DISALLOW )
+ − 2700
$ret = false;
+ − 2701
}
+ − 2702
else if(isset($this->acl_types[$type]))
+ − 2703
{
+ − 2704
if ( $this->acl_types[$type] == AUTH_DENY )
+ − 2705
$ret = false;
+ − 2706
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && $paths->wiki_mode )
+ − 2707
$ret = true;
+ − 2708
else if ( $this->acl_types[$type] == AUTH_WIKIMODE && !$paths->wiki_mode )
+ − 2709
$ret = false;
+ − 2710
else if ( $this->acl_types[$type] == AUTH_ALLOW )
+ − 2711
$ret = true;
+ − 2712
else if ( $this->acl_types[$type] == AUTH_DISALLOW )
+ − 2713
$ret = false;
+ − 2714
}
+ − 2715
else
+ − 2716
{
+ − 2717
// ACL type is undefined
+ − 2718
trigger_error('Unknown access type "' . $type . '"', E_USER_WARNING);
+ − 2719
return false; // Be on the safe side and deny access
+ − 2720
}
+ − 2721
if ( !$no_deps )
+ − 2722
{
+ − 2723
if ( !$this->acl_check_deps($type) )
+ − 2724
return false;
+ − 2725
}
+ − 2726
return $ret;
+ − 2727
}
+ − 2728
+ − 2729
/**
+ − 2730
* Tell us if the dependencies for a given permission are met.
+ − 2731
* @param string The ACL permission ID
+ − 2732
* @return bool
+ − 2733
*/
+ − 2734
+ − 2735
function acl_check_deps($type)
+ − 2736
{
+ − 2737
if(!isset($this->acl_deps[$type])) // This will only happen if the permissions table is hacked or improperly accessed
+ − 2738
return true;
+ − 2739
if(sizeof($this->acl_deps[$type]) < 1)
+ − 2740
return true;
+ − 2741
$deps = $this->acl_deps[$type];
+ − 2742
while(true)
+ − 2743
{
+ − 2744
$full_resolved = true;
+ − 2745
$j = sizeof($deps);
+ − 2746
for ( $i = 0; $i < $j; $i++ )
+ − 2747
{
+ − 2748
$b = $deps;
+ − 2749
$deps = array_merge($deps, $this->acl_deps[$deps[$i]]);
+ − 2750
if( $b == $deps )
+ − 2751
{
+ − 2752
break 2;
+ − 2753
}
+ − 2754
$j = sizeof($deps);
+ − 2755
}
+ − 2756
}
+ − 2757
//die('<pre>'.print_r($deps, true).'</pre>');
+ − 2758
foreach($deps as $d)
+ − 2759
{
+ − 2760
if ( !$this->get_permissions($d) )
+ − 2761
{
+ − 2762
return false;
+ − 2763
}
+ − 2764
}
+ − 2765
return true;
+ − 2766
}
+ − 2767
72
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2768
/**
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2769
* Merges the ACL array sent with the current permissions table, deciding precedence based on whether defaults are in effect or not.
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2770
* @param array The array to merge into the master ACL list
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2771
* @param bool If true, $perm is treated as the "new default"
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2772
* @param int 1 if this is a site-wide ACL, 2 if page-specific. Defaults to 2.
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2773
*/
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2774
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2775
function acl_merge_with_current($perm, $is_everyone = false, $scope = 2)
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2776
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2777
foreach ( $this->perms as $i => $p )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2778
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2779
if ( isset($perm[$i]) )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2780
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2781
if ( $is_everyone && !$this->acl_defaults_used[$i] )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2782
continue;
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2783
// Decide precedence
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2784
if ( isset($this->acl_defaults_used[$i]) )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2785
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2786
//echo "$i: default in use, overriding to: {$perm[$i]}<br />";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2787
// Defaults are in use, override
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2788
$this->perms[$i] = $perm[$i];
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2789
$this->acl_defaults_used[$i] = ( $is_everyone );
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2790
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2791
else
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2792
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2793
//echo "$i: default NOT in use";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2794
// Defaults are not in use, merge as normal
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2795
if ( $this->perms[$i] != AUTH_DENY )
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2796
{
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2797
//echo ", but overriding";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2798
$this->perms[$i] = $perm[$i];
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2799
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2800
//echo "<br />";
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2801
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2802
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2803
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2804
}
bda11e521e8a
Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()
Dan
diff
changeset
+ − 2805
1
+ − 2806
}
+ − 2807
+ − 2808
?>