commit 00e5c3363501ed1a458128a91ad17017032b3df2 parent 59510c540bca1f32c2d32df1531d5477413a1539 Author: MTRNord <mtrnord1@gmail.com> Date: Thu, 16 Apr 2015 15:50:06 +0200 prepare user management Diffstat:
42 files changed, 4423 insertions(+), 437 deletions(-)
diff --git a/core/backend/admin/modules/modul_normal-login/account.php b/core/backend/admin/modules/modul_normal-login/account.php @@ -0,0 +1,32 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Account</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'> +Hey, $loggedInUser->displayname. This is an example secure page designed to demonstrate some of the basic features of UserCake. Just so you know, your title at the moment is $loggedInUser->title, and that can be changed in the admin panel. You registered this account on " . date("M d, Y", $loggedInUser->signupTimeStamp()) . ". +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/activate-account.php b/core/backend/admin/modules/modul_normal-login/activate-account.php @@ -0,0 +1,66 @@ +<?php +/* +UserCake Version: 2.0.1 +http://usercake.com +*/ +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Get token param +if(isset($_GET["token"])) +{ + $token = $_GET["token"]; + if(!isset($token)) + { + $errors[] = lang("FORGOTPASS_INVALID_TOKEN"); + } + else if(!validateActivationToken($token)) //Check for a valid token. Must exist and active must be = 0 + { + $errors[] = lang("ACCOUNT_TOKEN_NOT_FOUND"); + } + else + { + //Activate the users account + if(!setUserActive($token)) + { + $errors[] = lang("SQL_ERROR"); + } + } +} +else +{ + $errors[] = lang("FORGOTPASS_INVALID_TOKEN"); +} + +if(count($errors) == 0) { + $successes[] = lang("ACCOUNT_ACTIVATION_COMPLETE"); +} + +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Activate Account</h2> + +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/admin_configuration.php b/core/backend/admin/modules/modul_normal-login/admin_configuration.php @@ -0,0 +1,237 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Forms posted +if(!empty($_POST)) +{ + $cfgId = array(); + $newSettings = $_POST['settings']; + + //Validate new site name + if ($newSettings[1] != $websiteName) { + $newWebsiteName = $newSettings[1]; + if(minMaxRange(1,150,$newWebsiteName)) + { + $errors[] = lang("CONFIG_NAME_CHAR_LIMIT",array(1,150)); + } + else if (count($errors) == 0) { + $cfgId[] = 1; + $cfgValue[1] = $newWebsiteName; + $websiteName = $newWebsiteName; + } + } + + //Validate new URL + if ($newSettings[2] != $websiteUrl) { + $newWebsiteUrl = $newSettings[2]; + if(minMaxRange(1,150,$newWebsiteUrl)) + { + $errors[] = lang("CONFIG_URL_CHAR_LIMIT",array(1,150)); + } + else if (substr($newWebsiteUrl, -1) != "/"){ + $errors[] = lang("CONFIG_INVALID_URL_END"); + } + else if (count($errors) == 0) { + $cfgId[] = 2; + $cfgValue[2] = $newWebsiteUrl; + $websiteUrl = $newWebsiteUrl; + } + } + + //Validate new site email address + if ($newSettings[3] != $emailAddress) { + $newEmail = $newSettings[3]; + if(minMaxRange(1,150,$newEmail)) + { + $errors[] = lang("CONFIG_EMAIL_CHAR_LIMIT",array(1,150)); + } + elseif(!isValidEmail($newEmail)) + { + $errors[] = lang("CONFIG_EMAIL_INVALID"); + } + else if (count($errors) == 0) { + $cfgId[] = 3; + $cfgValue[3] = $newEmail; + $emailAddress = $newEmail; + } + } + + //Validate email activation selection + if ($newSettings[4] != $emailActivation) { + $newActivation = $newSettings[4]; + if($newActivation != "true" AND $newActivation != "false") + { + $errors[] = lang("CONFIG_ACTIVATION_TRUE_FALSE"); + } + else if (count($errors) == 0) { + $cfgId[] = 4; + $cfgValue[4] = $newActivation; + $emailActivation = $newActivation; + } + } + + //Validate new email activation resend threshold + if ($newSettings[5] != $resend_activation_threshold) { + $newResend_activation_threshold = $newSettings[5]; + if($newResend_activation_threshold > 72 OR $newResend_activation_threshold < 0) + { + $errors[] = lang("CONFIG_ACTIVATION_RESEND_RANGE",array(0,72)); + } + else if (count($errors) == 0) { + $cfgId[] = 5; + $cfgValue[5] = $newResend_activation_threshold; + $resend_activation_threshold = $newResend_activation_threshold; + } + } + + //Validate new language selection + if ($newSettings[6] != $language) { + $newLanguage = $newSettings[6]; + if(minMaxRange(1,150,$language)) + { + $errors[] = lang("CONFIG_LANGUAGE_CHAR_LIMIT",array(1,150)); + } + elseif (!file_exists($newLanguage)) { + $errors[] = lang("CONFIG_LANGUAGE_INVALID",array($newLanguage)); + } + else if (count($errors) == 0) { + $cfgId[] = 6; + $cfgValue[6] = $newLanguage; + $language = $newLanguage; + } + } + + //Validate new template selection + if ($newSettings[7] != $template) { + $newTemplate = $newSettings[7]; + if(minMaxRange(1,150,$template)) + { + $errors[] = lang("CONFIG_TEMPLATE_CHAR_LIMIT",array(1,150)); + } + elseif (!file_exists($newTemplate)) { + $errors[] = lang("CONFIG_TEMPLATE_INVALID",array($newTemplate)); + } + else if (count($errors) == 0) { + $cfgId[] = 7; + $cfgValue[7] = $newTemplate; + $template = $newTemplate; + } + } + + //Update configuration table with new settings + if (count($errors) == 0 AND count($cfgId) > 0) { + updateConfig($cfgId, $cfgValue); + $successes[] = lang("CONFIG_UPDATE_SUCCESSFUL"); + } +} + +$languages = getLanguageFiles(); //Retrieve list of language files +$templates = getTemplateFiles(); //Retrieve list of template files +$permissionData = fetchAllPermissions(); //Retrieve list of all permission levels +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Admin Configuration</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<div id='regbox'> +<form name='adminConfiguration' action='".$_SERVER['PHP_SELF']."' method='post'> +<p> +<label>Website Name:</label> +<input type='text' name='settings[".$settings['website_name']['id']."]' value='".$websiteName."' /> +</p> +<p> +<label>Website URL:</label> +<input type='text' name='settings[".$settings['website_url']['id']."]' value='".$websiteUrl."' /> +</p> +<p> +<label>Email:</label> +<input type='text' name='settings[".$settings['email']['id']."]' value='".$emailAddress."' /> +</p> +<p> +<label>Activation Threshold:</label> +<input type='text' name='settings[".$settings['resend_activation_threshold']['id']."]' value='".$resend_activation_threshold."' /> +</p> +<p> +<label>Language:</label> +<select name='settings[".$settings['language']['id']."]'>"; + +//Display language options +foreach ($languages as $optLang){ + if ($optLang == $language){ + echo "<option value='".$optLang."' selected>$optLang</option>"; + } + else { + echo "<option value='".$optLang."'>$optLang</option>"; + } +} + +echo " +</select> +</p> +<p> +<label>Email Activation:</label> +<select name='settings[".$settings['activation']['id']."]'>"; + +//Display email activation options +if ($emailActivation == "true"){ + echo " + <option value='true' selected>True</option> + <option value='false'>False</option> + </select>"; +} +else { + echo " + <option value='true'>True</option> + <option value='false' selected>False</option> + </select>"; +} + +echo "</p> +<p> +<label>Template:</label> +<select name='settings[".$settings['template']['id']."]'>"; + +//Display template options +foreach ($templates as $temp){ + if ($temp == $template){ + echo "<option value='".$temp."' selected>$temp</option>"; + } + else { + echo "<option value='".$temp."'>$temp</option>"; + } +} + +echo " +</select> +</p> +<input type='submit' name='Submit' value='Submit' /> +</form> +</div> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/admin_page.php b/core/backend/admin/modules/modul_normal-login/admin_page.php @@ -0,0 +1,160 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} +$pageId = $_GET['id']; + +//Check if selected pages exist +if(!pageIdExists($pageId)){ + header("Location: admin_pages.php"); die(); +} + +$pageDetails = fetchPageDetails($pageId); //Fetch information specific to page + +//Forms posted +if(!empty($_POST)){ + $update = 0; + + if(!empty($_POST['private'])){ $private = $_POST['private']; } + + //Toggle private page setting + if (isset($private) AND $private == 'Yes'){ + if ($pageDetails['private'] == 0){ + if (updatePrivate($pageId, 1)){ + $successes[] = lang("PAGE_PRIVATE_TOGGLED", array("private")); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + } + elseif ($pageDetails['private'] == 1){ + if (updatePrivate($pageId, 0)){ + $successes[] = lang("PAGE_PRIVATE_TOGGLED", array("public")); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + //Remove permission level(s) access to page + if(!empty($_POST['removePermission'])){ + $remove = $_POST['removePermission']; + if ($deletion_count = removePage($pageId, $remove)){ + $successes[] = lang("PAGE_ACCESS_REMOVED", array($deletion_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + + } + + //Add permission level(s) access to page + if(!empty($_POST['addPermission'])){ + $add = $_POST['addPermission']; + if ($addition_count = addPage($pageId, $add)){ + $successes[] = lang("PAGE_ACCESS_ADDED", array($addition_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + $pageDetails = fetchPageDetails($pageId); +} + +$pagePermissions = fetchPagePermissions($pageId); +$permissionData = fetchAllPermissions(); + +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Admin Page</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<form name='adminPage' action='".$_SERVER['PHP_SELF']."?id=".$pageId."' method='post'> +<input type='hidden' name='process' value='1'> +<table class='admin'> +<tr><td> +<h3>Page Information</h3> +<div id='regbox'> +<p> +<label>ID:</label> +".$pageDetails['id']." +</p> +<p> +<label>Name:</label> +".$pageDetails['page']." +</p> +<p> +<label>Private:</label>"; + +//Display private checkbox +if ($pageDetails['private'] == 1){ + echo "<input type='checkbox' name='private' id='private' value='Yes' checked>"; +} +else { + echo "<input type='checkbox' name='private' id='private' value='Yes'>"; +} + +echo " +</p> +</div></td><td> +<h3>Page Access</h3> +<div id='regbox'> +<p> +Remove Access:"; + +//Display list of permission levels with access +foreach ($permissionData as $v1) { + if(isset($pagePermissions[$v1['id']])){ + echo "<br><input type='checkbox' name='removePermission[".$v1['id']."]' id='removePermission[".$v1['id']."]' value='".$v1['id']."'> ".$v1['name']; + } +} + +echo" +</p><p>Add Access:"; + +//Display list of permission levels without access +foreach ($permissionData as $v1) { + if(!isset($pagePermissions[$v1['id']])){ + echo "<br><input type='checkbox' name='addPermission[".$v1['id']."]' id='addPermission[".$v1['id']."]' value='".$v1['id']."'> ".$v1['name']; + } +} + +echo" +</p> +</div> +</td> +</tr> +</table> +<p> +<label> </label> +<input type='submit' value='Update' class='submit' /> +</p> +</form> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/admin_pages.php b/core/backend/admin/modules/modul_normal-login/admin_pages.php @@ -0,0 +1,96 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +$pages = getPageFiles(); //Retrieve list of pages in root usercake folder +$dbpages = fetchAllPages(); //Retrieve list of pages in pages table +$creations = array(); +$deletions = array(); + +//Check if any pages exist which are not in DB +foreach ($pages as $page){ + if(!isset($dbpages[$page])){ + $creations[] = $page; + } +} + +//Enter new pages in DB if found +if (count($creations) > 0) { + createPages($creations) ; +} + +if (count($dbpages) > 0){ + //Check if DB contains pages that don't exist + foreach ($dbpages as $page){ + if(!isset($pages[$page['page']])){ + $deletions[] = $page['id']; + } + } +} + +//Delete pages from DB if not found +if (count($deletions) > 0) { + deletePages($deletions); +} + +//Update DB pages +$dbpages = fetchAllPages(); + +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Admin Pages</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'> +<table class='admin'> +<tr><th>Id</th><th>Page</th><th>Access</th></tr>"; + +//Display list of pages +foreach ($dbpages as $page){ + echo " + <tr> + <td> + ".$page['id']." + </td> + <td> + <a href ='admin_page.php?id=".$page['id']."'>".$page['page']."</a> + </td> + <td>"; + + //Show public/private setting of page + if($page['private'] == 0){ + echo "Public"; + } + else { + echo "Private"; + } + + echo " + </td> + </tr>"; +} + +echo " +</table> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/admin_permission.php b/core/backend/admin/modules/modul_normal-login/admin_permission.php @@ -0,0 +1,220 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} +$permissionId = $_GET['id']; + +//Check if selected permission level exists +if(!permissionIdExists($permissionId)){ + header("Location: admin_permissions.php"); die(); +} + +$permissionDetails = fetchPermissionDetails($permissionId); //Fetch information specific to permission level + +//Forms posted +if(!empty($_POST)){ + + //Delete selected permission level + if(!empty($_POST['delete'])){ + $deletions = $_POST['delete']; + if ($deletion_count = deletePermission($deletions)){ + $successes[] = lang("PERMISSION_DELETIONS_SUCCESSFUL", array($deletion_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + else + { + //Update permission level name + if($permissionDetails['name'] != $_POST['name']) { + $permission = trim($_POST['name']); + + //Validate new name + if (permissionNameExists($permission)){ + $errors[] = lang("ACCOUNT_PERMISSIONNAME_IN_USE", array($permission)); + } + elseif (minMaxRange(1, 50, $permission)){ + $errors[] = lang("ACCOUNT_PERMISSION_CHAR_LIMIT", array(1, 50)); + } + else { + if (updatePermissionName($permissionId, $permission)){ + $successes[] = lang("PERMISSION_NAME_UPDATE", array($permission)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + } + + //Remove access to pages + if(!empty($_POST['removePermission'])){ + $remove = $_POST['removePermission']; + if ($deletion_count = removePermission($permissionId, $remove)) { + $successes[] = lang("PERMISSION_REMOVE_USERS", array($deletion_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + //Add access to pages + if(!empty($_POST['addPermission'])){ + $add = $_POST['addPermission']; + if ($addition_count = addPermission($permissionId, $add)) { + $successes[] = lang("PERMISSION_ADD_USERS", array($addition_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + //Remove access to pages + if(!empty($_POST['removePage'])){ + $remove = $_POST['removePage']; + if ($deletion_count = removePage($remove, $permissionId)) { + $successes[] = lang("PERMISSION_REMOVE_PAGES", array($deletion_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + //Add access to pages + if(!empty($_POST['addPage'])){ + $add = $_POST['addPage']; + if ($addition_count = addPage($add, $permissionId)) { + $successes[] = lang("PERMISSION_ADD_PAGES", array($addition_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + $permissionDetails = fetchPermissionDetails($permissionId); + } +} + +$pagePermissions = fetchPermissionPages($permissionId); //Retrieve list of accessible pages +$permissionUsers = fetchPermissionUsers($permissionId); //Retrieve list of users with membership +$userData = fetchAllUsers(); //Fetch all users +$pageData = fetchAllPages(); //Fetch all pages + +require_once("models/header.php"); +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Admin Permissions</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<form name='adminPermission' action='".$_SERVER['PHP_SELF']."?id=".$permissionId."' method='post'> +<table class='admin'> +<tr><td> +<h3>Permission Information</h3> +<div id='regbox'> +<p> +<label>ID:</label> +".$permissionDetails['id']." +</p> +<p> +<label>Name:</label> +<input type='text' name='name' value='".$permissionDetails['name']."' /> +</p> +<label>Delete:</label> +<input type='checkbox' name='delete[".$permissionDetails['id']."]' id='delete[".$permissionDetails['id']."]' value='".$permissionDetails['id']."'> +</p> +</div></td><td> +<h3>Permission Membership</h3> +<div id='regbox'> +<p> +Remove Members:"; + +//List users with permission level +foreach ($userData as $v1) { + if(isset($permissionUsers[$v1['id']])){ + echo "<br><input type='checkbox' name='removePermission[".$v1['id']."]' id='removePermission[".$v1['id']."]' value='".$v1['id']."'> ".$v1['display_name']; + } +} + +echo" +</p><p>Add Members:"; + +//List users without permission level +foreach ($userData as $v1) { + if(!isset($permissionUsers[$v1['id']])){ + echo "<br><input type='checkbox' name='addPermission[".$v1['id']."]' id='addPermission[".$v1['id']."]' value='".$v1['id']."'> ".$v1['display_name']; + } +} + +echo" +</p> +</div> +</td> +<td> +<h3>Permission Access</h3> +<div id='regbox'> +<p> +Public Access:"; + +//List public pages +foreach ($pageData as $v1) { + if($v1['private'] != 1){ + echo "<br>".$v1['page']; + } +} + +echo" +</p> +<p> +Remove Access:"; + +//List pages accessible to permission level +foreach ($pageData as $v1) { + if(isset($pagePermissions[$v1['id']]) AND $v1['private'] == 1){ + echo "<br><input type='checkbox' name='removePage[".$v1['id']."]' id='removePage[".$v1['id']."]' value='".$v1['id']."'> ".$v1['page']; + } +} + +echo" +</p><p>Add Access:"; + +//List pages inaccessible to permission level +foreach ($pageData as $v1) { + if(!isset($pagePermissions[$v1['id']]) AND $v1['private'] == 1){ + echo "<br><input type='checkbox' name='addPage[".$v1['id']."]' id='addPage[".$v1['id']."]' value='".$v1['id']."'> ".$v1['page']; + } +} + +echo" +</p> +</div> +</td> +</tr> +</table> +<p> +<label> </label> +<input type='submit' value='Update' class='submit' /> +</p> +</form> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/admin_permissions.php b/core/backend/admin/modules/modul_normal-login/admin_permissions.php @@ -0,0 +1,94 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Forms posted +if(!empty($_POST)) +{ + //Delete permission levels + if(!empty($_POST['delete'])){ + $deletions = $_POST['delete']; + if ($deletion_count = deletePermission($deletions)){ + $successes[] = lang("PERMISSION_DELETIONS_SUCCESSFUL", array($deletion_count)); + } + } + + //Create new permission level + if(!empty($_POST['newPermission'])) { + $permission = trim($_POST['newPermission']); + + //Validate request + if (permissionNameExists($permission)){ + $errors[] = lang("PERMISSION_NAME_IN_USE", array($permission)); + } + elseif (minMaxRange(1, 50, $permission)){ + $errors[] = lang("PERMISSION_CHAR_LIMIT", array(1, 50)); + } + else{ + if (createPermission($permission)) { + $successes[] = lang("PERMISSION_CREATION_SUCCESSFUL", array($permission)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + } +} + +$permissionData = fetchAllPermissions(); //Retrieve list of all permission levels + +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Admin Permissions</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<form name='adminPermissions' action='".$_SERVER['PHP_SELF']."' method='post'> +<table class='admin'> +<tr> +<th>Delete</th><th>Permission Name</th> +</tr>"; + +//List each permission level +foreach ($permissionData as $v1) { + echo " + <tr> + <td><input type='checkbox' name='delete[".$v1['id']."]' id='delete[".$v1['id']."]' value='".$v1['id']."'></td> + <td><a href='admin_permission.php?id=".$v1['id']."'>".$v1['name']."</a></td> + </tr>"; +} + +echo " +</table> +<p> +<label>Permission Name:</label> +<input type='text' name='newPermission' /> +</p> +<input type='submit' name='Submit' value='Submit' /> +</form> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/admin_user.php b/core/backend/admin/modules/modul_normal-login/admin_user.php @@ -0,0 +1,265 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} +$userId = $_GET['id']; + +//Check if selected user exists +if(!userIdExists($userId)){ + header("Location: admin_users.php"); die(); +} + +$userdetails = fetchUserDetails(NULL, NULL, $userId); //Fetch user details + +//Forms posted +if(!empty($_POST)) +{ + //Delete selected account + if(!empty($_POST['delete'])){ + $deletions = $_POST['delete']; + if ($deletion_count = deleteUsers($deletions)) { + $successes[] = lang("ACCOUNT_DELETIONS_SUCCESSFUL", array($deletion_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + else + { + //Update display name + if ($userdetails['display_name'] != $_POST['display']){ + $displayname = trim($_POST['display']); + + //Validate display name + if(displayNameExists($displayname)) + { + $errors[] = lang("ACCOUNT_DISPLAYNAME_IN_USE",array($displayname)); + } + elseif(minMaxRange(5,25,$displayname)) + { + $errors[] = lang("ACCOUNT_DISPLAY_CHAR_LIMIT",array(5,25)); + } + elseif(!ctype_alnum($displayname)){ + $errors[] = lang("ACCOUNT_DISPLAY_INVALID_CHARACTERS"); + } + else { + if (updateDisplayName($userId, $displayname)){ + $successes[] = lang("ACCOUNT_DISPLAYNAME_UPDATED", array($displayname)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + } + else { + $displayname = $userdetails['display_name']; + } + + //Activate account + if(isset($_POST['activate']) && $_POST['activate'] == "activate"){ + if (setUserActive($userdetails['activation_token'])){ + $successes[] = lang("ACCOUNT_MANUALLY_ACTIVATED", array($displayname)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + //Update email + if ($userdetails['email'] != $_POST['email']){ + $email = trim($_POST["email"]); + + //Validate email + if(!isValidEmail($email)) + { + $errors[] = lang("ACCOUNT_INVALID_EMAIL"); + } + elseif(emailExists($email)) + { + $errors[] = lang("ACCOUNT_EMAIL_IN_USE",array($email)); + } + else { + if (updateEmail($userId, $email)){ + $successes[] = lang("ACCOUNT_EMAIL_UPDATED"); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + } + + //Update title + if ($userdetails['title'] != $_POST['title']){ + $title = trim($_POST['title']); + + //Validate title + if(minMaxRange(1,50,$title)) + { + $errors[] = lang("ACCOUNT_TITLE_CHAR_LIMIT",array(1,50)); + } + else { + if (updateTitle($userId, $title)){ + $successes[] = lang("ACCOUNT_TITLE_UPDATED", array ($displayname, $title)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + } + + //Remove permission level + if(!empty($_POST['removePermission'])){ + $remove = $_POST['removePermission']; + if ($deletion_count = removePermission($remove, $userId)){ + $successes[] = lang("ACCOUNT_PERMISSION_REMOVED", array ($deletion_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + if(!empty($_POST['addPermission'])){ + $add = $_POST['addPermission']; + if ($addition_count = addPermission($add, $userId)){ + $successes[] = lang("ACCOUNT_PERMISSION_ADDED", array ($addition_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } + } + + $userdetails = fetchUserDetails(NULL, NULL, $userId); + } +} + +$userPermission = fetchUserPermissions($userId); +$permissionData = fetchAllPermissions(); + +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Admin User</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<form name='adminUser' action='".$_SERVER['PHP_SELF']."?id=".$userId."' method='post'> +<table class='admin'><tr><td> +<h3>User Information</h3> +<div id='regbox'> +<p> +<label>ID:</label> +".$userdetails['id']." +</p> +<p> +<label>Username:</label> +".$userdetails['user_name']." +</p> +<p> +<label>Display Name:</label> +<input type='text' name='display' value='".$userdetails['display_name']."' /> +</p> +<p> +<label>Email:</label> +<input type='text' name='email' value='".$userdetails['email']."' /> +</p> +<p> +<label>Active:</label>"; + +//Display activation link, if account inactive +if ($userdetails['active'] == '1'){ + echo "Yes"; +} +else{ + echo "No + </p> + <p> + <label>Activate:</label> + <input type='checkbox' name='activate' id='activate' value='activate'> + "; +} + +echo " +</p> +<p> +<label>Title:</label> +<input type='text' name='title' value='".$userdetails['title']."' /> +</p> +<p> +<label>Sign Up:</label> +".date("j M, Y", $userdetails['sign_up_stamp'])." +</p> +<p> +<label>Last Sign In:</label>"; + +//Last sign in, interpretation +if ($userdetails['last_sign_in_stamp'] == '0'){ + echo "Never"; +} +else { + echo date("j M, Y", $userdetails['last_sign_in_stamp']); +} + +echo " +</p> +<p> +<label>Delete:</label> +<input type='checkbox' name='delete[".$userdetails['id']."]' id='delete[".$userdetails['id']."]' value='".$userdetails['id']."'> +</p> +<p> +<label> </label> +<input type='submit' value='Update' class='submit' /> +</p> +</div> +</td> +<td> +<h3>Permission Membership</h3> +<div id='regbox'> +<p>Remove Permission:"; + +//List of permission levels user is apart of +foreach ($permissionData as $v1) { + if(isset($userPermission[$v1['id']])){ + echo "<br><input type='checkbox' name='removePermission[".$v1['id']."]' id='removePermission[".$v1['id']."]' value='".$v1['id']."'> ".$v1['name']; + } +} + +//List of permission levels user is not apart of +echo "</p><p>Add Permission:"; +foreach ($permissionData as $v1) { + if(!isset($userPermission[$v1['id']])){ + echo "<br><input type='checkbox' name='addPermission[".$v1['id']."]' id='addPermission[".$v1['id']."]' value='".$v1['id']."'> ".$v1['name']; + } +} + +echo" +</p> +</div> +</td> +</tr> +</table> +</form> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/admin_users.php b/core/backend/admin/modules/modul_normal-login/admin_users.php @@ -0,0 +1,82 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Forms posted +if(!empty($_POST)) +{ + $deletions = $_POST['delete']; + if ($deletion_count = deleteUsers($deletions)){ + $successes[] = lang("ACCOUNT_DELETIONS_SUCCESSFUL", array($deletion_count)); + } + else { + $errors[] = lang("SQL_ERROR"); + } +} + +$userData = fetchAllUsers(); //Fetch information for all users + +require_once("models/header.php"); +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Admin Users</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<form name='adminUsers' action='".$_SERVER['PHP_SELF']."' method='post'> +<table class='admin'> +<tr> +<th>Delete</th><th>Username</th><th>Display Name</th><th>Title</th><th>Last Sign In</th> +</tr>"; + +//Cycle through users +foreach ($userData as $v1) { + echo " + <tr> + <td><input type='checkbox' name='delete[".$v1['id']."]' id='delete[".$v1['id']."]' value='".$v1['id']."'></td> + <td><a href='admin_user.php?id=".$v1['id']."'>".$v1['user_name']."</a></td> + <td>".$v1['display_name']."</td> + <td>".$v1['title']."</td> + <td> + "; + + //Interprety last login + if ($v1['last_sign_in_stamp'] == '0'){ + echo "Never"; + } + else { + echo date("j M, Y", $v1['last_sign_in_stamp']); + } + echo " + </td> + </tr>"; +} + +echo " +</table> +<input type='submit' name='Submit' value='Delete' /> +</form> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/check_auth.php b/core/backend/admin/modules/modul_normal-login/check_auth.php @@ -1,57 +0,0 @@ -<?php - /* - * useable var - * authokay boolean - * authinfo Integer/String if (authokay) { the userid } else { the reason because the auth faild} - */ - ############################### - # include files from root dir # - ############################### - $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); - $currentdir = getcwd(); - $root_2 = str_replace($root_1, '', $currentdir); - $root_3 = explode("/", $root_2); - if ($root_3[1] == 'core') { - $root = realpath($_SERVER["DOCUMENT_ROOT"]); - }else{ - $root = $root_1 . '/' . $root_3[1]; - } - $authokay = false; - include($root . '/core/config/connect.db.inc.php'); - //Check if Database connection established - if (mysqli_connect_errno()) { - printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); - exit(); - } - - if (!empty($_SERVER['HTTP_CLIENT_IP'])) { - $ip = $_SERVER['HTTP_CLIENT_IP']; - } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { - $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; - } else { - $ip = $_SERVER['REMOTE_ADDR']; - } - $hash=hash('sha512',$_SERVER['HTTP_USER_AGENT'].$ip); - $abfrage = "SELECT id, hash,vaildtime,userid FROM cookiedata WHERE hash = '$hash'"; - $ergebnis = mysqli_query($connection, $abfrage); - while($row = mysqli_fetch_object($ergebnis)){ - if ($row->hash == $hash){ - $id_db = $row->id; - $expirtaion_time=$row->vaildtime; - $userid = $row->userid; - } - } - $cookie = hash('sha512',$hash.$userid.$expirtaion_time); - if ($expirtaion_time< time()) { - $loeschen = "DELETE FROM acess_data WHERE id = '$id_db'"; - $loesch = mysqli_query($connection, $loeschen); - $authinfo = 'cookie timeout'; - }else{ - if ($_COOKIE["acess"] == $cookie) { - $authokay = true; - $authinfo = $userid; - } else { - $authinfo = 'wrong cookie'; - } - } -?> -\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/del_token.php b/core/backend/admin/modules/modul_normal-login/del_token.php @@ -1,24 +0,0 @@ -<?php - ############################### - # include files from root dir # - ############################### - $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); - $currentdir = getcwd(); - $root_2 = str_replace($root_1, '', $currentdir); - $root_3 = explode("/", $root_2); - if ($root_3[1] == 'core') { - $root = realpath($_SERVER["DOCUMENT_ROOT"]); - }else{ - $root = $root_1 . '/' . $root_3[1]; - } - $token = $_GET['token']; - include($root . '/core/config/connect.db.inc.php'); - //Check if Database connection established - if (mysqli_connect_errno()) { - printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); - exit(); - } - $loeschen = "DELETE FROM hashtoken WHERE token = '$token'"; - $loesch = mysqli_query($connection, $loeschen); - header("Location: ./login.php"); -?> diff --git a/core/backend/admin/modules/modul_normal-login/forgot-password.php b/core/backend/admin/modules/modul_normal-login/forgot-password.php @@ -0,0 +1,217 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//User has confirmed they want their password changed +if(!empty($_GET["confirm"])) +{ + $token = trim($_GET["confirm"]); + + if($token == "" || !validateActivationToken($token,TRUE)) + { + $errors[] = lang("FORGOTPASS_INVALID_TOKEN"); + } + else + { + $rand_pass = getUniqueCode(15); //Get unique code + $secure_pass = generateHash($rand_pass); //Generate random hash + $userdetails = fetchUserDetails(NULL,$token); //Fetchs user details + $mail = new userCakeMail(); + + //Setup our custom hooks + $hooks = array( + "searchStrs" => array("#GENERATED-PASS#","#USERNAME#"), + "subjectStrs" => array($rand_pass,$userdetails["display_name"]) + ); + + if(!$mail->newTemplateMsg("your-lost-password.txt",$hooks)) + { + $errors[] = lang("MAIL_TEMPLATE_BUILD_ERROR"); + } + else + { + if(!$mail->sendMail($userdetails["email"],"Your new password")) + { + $errors[] = lang("MAIL_ERROR"); + } + else + { + if(!updatePasswordFromToken($secure_pass,$token)) + { + $errors[] = lang("SQL_ERROR"); + } + else + { + if(!flagLostPasswordRequest($userdetails["user_name"],0)) + { + $errors[] = lang("SQL_ERROR"); + } + else { + $successes[] = lang("FORGOTPASS_NEW_PASS_EMAIL"); + } + } + } + } + } +} + +//User has denied this request +if(!empty($_GET["deny"])) +{ + $token = trim($_GET["deny"]); + + if($token == "" || !validateActivationToken($token,TRUE)) + { + $errors[] = lang("FORGOTPASS_INVALID_TOKEN"); + } + else + { + + $userdetails = fetchUserDetails(NULL,$token); + + if(!flagLostPasswordRequest($userdetails["user_name"],0)) + { + $errors[] = lang("SQL_ERROR"); + } + else { + $successes[] = lang("FORGOTPASS_REQUEST_CANNED"); + } + } +} + +//Forms posted +if(!empty($_POST)) +{ + $email = $_POST["email"]; + $username = sanitize($_POST["username"]); + + //Perform some validation + //Feel free to edit / change as required + + if(trim($email) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_EMAIL"); + } + //Check to ensure email is in the correct format / in the db + else if(!isValidEmail($email) || !emailExists($email)) + { + $errors[] = lang("ACCOUNT_INVALID_EMAIL"); + } + + if(trim($username) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_USERNAME"); + } + else if(!usernameExists($username)) + { + $errors[] = lang("ACCOUNT_INVALID_USERNAME"); + } + + if(count($errors) == 0) + { + + //Check that the username / email are associated to the same account + if(!emailUsernameLinked($email,$username)) + { + $errors[] = lang("ACCOUNT_USER_OR_EMAIL_INVALID"); + } + else + { + //Check if the user has any outstanding lost password requests + $userdetails = fetchUserDetails($username); + if($userdetails["lost_password_request"] == 1) + { + $errors[] = lang("FORGOTPASS_REQUEST_EXISTS"); + } + else + { + //Email the user asking to confirm this change password request + //We can use the template builder here + + //We use the activation token again for the url key it gets regenerated everytime it's used. + + $mail = new userCakeMail(); + $confirm_url = lang("CONFIRM")."\n".$websiteUrl."forgot-password.php?confirm=".$userdetails["activation_token"]; + $deny_url = lang("DENY")."\n".$websiteUrl."forgot-password.php?deny=".$userdetails["activation_token"]; + + //Setup our custom hooks + $hooks = array( + "searchStrs" => array("#CONFIRM-URL#","#DENY-URL#","#USERNAME#"), + "subjectStrs" => array($confirm_url,$deny_url,$userdetails["user_name"]) + ); + + if(!$mail->newTemplateMsg("lost-password-request.txt",$hooks)) + { + $errors[] = lang("MAIL_TEMPLATE_BUILD_ERROR"); + } + else + { + if(!$mail->sendMail($userdetails["email"],"Lost password request")) + { + $errors[] = lang("MAIL_ERROR"); + } + else + { + //Update the DB to show this account has an outstanding request + if(!flagLostPasswordRequest($userdetails["user_name"],1)) + { + $errors[] = lang("SQL_ERROR"); + } + else { + + $successes[] = lang("FORGOTPASS_REQUEST_SUCCESS"); + } + } + } + } + } + } +} + +require_once("models/header.php"); +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Forgot Password</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<div id='regbox'> +<form name='newLostPass' action='".$_SERVER['PHP_SELF']."' method='post'> +<p> +<label>Username:</label> +<input type='text' name='username' /> +</p> +<p> +<label>Email:</label> +<input type='text' name='email' /> +</p> +<p> +<label> </label> +<input type='submit' value='Submit' class='submit' /> +</p> +</form> +</div> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/index.php b/core/backend/admin/modules/modul_normal-login/index.php @@ -0,0 +1,47 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>2.00</h2> +<div id='left-nav'>"; +include("left-nav.php"); + +echo " +</div> +<div id='main'> +<p>Thank you for downloading UserCake. 100% Free and Opensource.</p> +<p>Copyright (c) 2009-2012</p> +<p>Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the 'Software'), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions:</p> +<p>The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software.</p> +<p>THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE.</p> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/inhalt.php b/core/backend/admin/modules/modul_normal-login/inhalt.php @@ -1,9 +0,0 @@ -<?php - include('./navi.php'); - include('./check_auth.php'); - if ($authokay) { - print("hallo Benutzer mit der ID ".$authinfo); - } else { - die($authinfo); - } -?> -\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/install/index.php b/core/backend/admin/modules/modul_normal-login/install/index.php @@ -0,0 +1,285 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ +require_once("../models/db-settings.php"); + +echo " +<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'> +<html xmlns='http://www.w3.org/1999/xhtml'> +<head> +<meta http-equiv='Content-Type' content='text/html; charset=utf-8' /> +<title>UserCake</title> +<link href='../models/site-templates/default.css' rel='stylesheet' type='text/css' /> +<script src='../models/funcs.js' type='text/javascript'> +</script> +</head> +<body> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Installer</h2>"; + +if(isset($_GET["install"])) +{ + $db_issue = false; + + $permissions_sql = " + CREATE TABLE IF NOT EXISTS `".$db_table_prefix."permissions` ( + `id` int(11) NOT NULL AUTO_INCREMENT, + `name` varchar(150) NOT NULL, + PRIMARY KEY (`id`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=3 ; + "; + + $permissions_entry = " + INSERT INTO `".$db_table_prefix."permissions` (`id`, `name`) VALUES + (1, 'New Member'), + (2, 'Administrator'); + "; + + $users_sql = " + CREATE TABLE IF NOT EXISTS `".$db_table_prefix."users` ( + `id` int(11) NOT NULL AUTO_INCREMENT, + `user_name` varchar(50) NOT NULL, + `display_name` varchar(50) NOT NULL, + `password` varchar(225) NOT NULL, + `email` varchar(150) NOT NULL, + `activation_token` varchar(225) NOT NULL, + `last_activation_request` int(11) NOT NULL, + `lost_password_request` tinyint(1) NOT NULL, + `active` tinyint(1) NOT NULL, + `title` varchar(150) NOT NULL, + `sign_up_stamp` int(11) NOT NULL, + `last_sign_in_stamp` int(11) NOT NULL, + PRIMARY KEY (`id`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ; + "; + + $user_permission_matches_sql = " + CREATE TABLE IF NOT EXISTS `".$db_table_prefix."user_permission_matches` ( + `id` int(11) NOT NULL AUTO_INCREMENT, + `user_id` int(11) NOT NULL, + `permission_id` int(11) NOT NULL, + PRIMARY KEY (`id`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ; + "; + + $user_permission_matches_entry = " + INSERT INTO `".$db_table_prefix."user_permission_matches` (`id`, `user_id`, `permission_id`) VALUES + (1, 1, 2); + "; + + $configuration_sql = " + CREATE TABLE IF NOT EXISTS `".$db_table_prefix."configuration` ( + `id` int(11) NOT NULL AUTO_INCREMENT, + `name` varchar(150) NOT NULL, + `value` varchar(150) NOT NULL, + PRIMARY KEY (`id`) + ) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=8 ; + "; + + $configuration_entry = " + INSERT INTO `".$db_table_prefix."configuration` (`id`, `name`, `value`) VALUES + (1, 'website_name', 'UserCake'), + (2, 'website_url', 'localhost/'), + (3, 'email', 'noreply@ILoveUserCake.com'), + (4, 'activation', 'false'), + (5, 'resend_activation_threshold', '0'), + (6, 'language', 'models/languages/en.php'), + (7, 'template', 'models/site-templates/default.css'); + "; + + $pages_sql = "CREATE TABLE IF NOT EXISTS `".$db_table_prefix."pages` ( + `id` int(11) NOT NULL AUTO_INCREMENT, + `page` varchar(150) NOT NULL, + `private` tinyint(1) NOT NULL DEFAULT '0', + PRIMARY KEY (`id`) + ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=18 ; + "; + + $pages_entry = "INSERT INTO `".$db_table_prefix."pages` (`id`, `page`, `private`) VALUES + (1, 'account.php', 1), + (2, 'activate-account.php', 0), + (3, 'admin_configuration.php', 1), + (4, 'admin_page.php', 1), + (5, 'admin_pages.php', 1), + (6, 'admin_permission.php', 1), + (7, 'admin_permissions.php', 1), + (8, 'admin_user.php', 1), + (9, 'admin_users.php', 1), + (10, 'forgot-password.php', 0), + (11, 'index.php', 0), + (12, 'left-nav.php', 0), + (13, 'login.php', 0), + (14, 'logout.php', 1), + (15, 'register.php', 0), + (16, 'resend-activation.php', 0), + (17, 'user_settings.php', 1); + "; + + $permission_page_matches_sql = "CREATE TABLE IF NOT EXISTS `".$db_table_prefix."permission_page_matches` ( + `id` int(11) NOT NULL AUTO_INCREMENT, + `permission_id` int(11) NOT NULL, + `page_id` int(11) NOT NULL, + PRIMARY KEY (`id`) + ) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=23 ; + "; + + $permission_page_matches_entry = "INSERT INTO `".$db_table_prefix."permission_page_matches` (`id`, `permission_id`, `page_id`) VALUES + (1, 1, 1), + (2, 1, 14), + (3, 1, 17), + (4, 2, 1), + (5, 2, 3), + (6, 2, 4), + (7, 2, 5), + (8, 2, 6), + (9, 2, 7), + (10, 2, 8), + (11, 2, 9), + (12, 2, 14), + (13, 2, 17); + "; + + $stmt = $mysqli->prepare($configuration_sql); + if($stmt->execute()) + { + $cfg_result = "<p>".$db_table_prefix."configuration table created.....</p>"; + } + else + { + $cfg_result = "<p>Error constructing ".$db_table_prefix."configuration table.</p>"; + $db_issue = true; + } + + echo $cfg_result; + $stmt = $mysqli->prepare($configuration_entry); + if($stmt->execute()) + { + echo "<p>Inserted basic config settings into ".$db_table_prefix."configuration table.....</p>"; + } + else + { + echo "<p>Error inserting config settings access.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($permissions_sql); + if($stmt->execute()) + { + echo "<p>".$db_table_prefix."permissions table created.....</p>"; + } + else + { + echo "<p>Error constructing ".$db_table_prefix."permissions table.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($permissions_entry); + if($stmt->execute()) + { + echo "<p>Inserted 'New Member' and 'Admin' groups into ".$db_table_prefix."permissions table.....</p>"; + } + else + { + echo "<p>Error inserting permissions.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($user_permission_matches_sql); + if($stmt->execute()) + { + echo "<p>".$db_table_prefix."user_permission_matches table created.....</p>"; + } + else + { + echo "<p>Error constructing ".$db_table_prefix."user_permission_matches table.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($user_permission_matches_entry); + if($stmt->execute()) + { + echo "<p>Added 'Admin' entry for first user in ".$db_table_prefix."user_permission_matches table.....</p>"; + } + else + { + echo "<p>Error inserting admin into ".$db_table_prefix."user_permission_matches.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($pages_sql); + if($stmt->execute()) + { + echo "<p>".$db_table_prefix."pages table created.....</p>"; + } + else + { + echo "<p>Error constructing ".$db_table_prefix."pages table.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($pages_entry); + if($stmt->execute()) + { + echo "<p>Added default pages to ".$db_table_prefix."pages table.....</p>"; + } + else + { + echo "<p>Error inserting pages into ".$db_table_prefix."pages.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($permission_page_matches_sql); + if($stmt->execute()) + { + echo "<p>".$db_table_prefix."permission_page_matches table created.....</p>"; + } + else + { + echo "<p>Error constructing ".$db_table_prefix."permission_page_matches table.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($permission_page_matches_entry); + if($stmt->execute()) + { + echo "<p>Added default access to ".$db_table_prefix."permission_page_matches table.....</p>"; + } + else + { + echo "<p>Error adding default access to ".$db_table_prefix."user_permission_matches.</p>"; + $db_issue = true; + } + + $stmt = $mysqli->prepare($users_sql); + if($stmt->execute()) + { + echo "<p>".$db_table_prefix."users table created.....</p>"; + } + else + { + echo "<p>Error constructing users table.</p>"; + $db_issue = true; + } + + + if(!$db_issue) + echo "<p><strong>Database setup complete, please delete the install folder.</strong></p>"; + else + echo "<p><a href=\"?install=true\">Try again</a></p>"; +} +else +{ + echo " + <a href='?install=true'>Install UserCake</a> + "; +} + +echo " +</body> +</html>"; + +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/left-nav.php b/core/backend/admin/modules/modul_normal-login/left-nav.php @@ -0,0 +1,44 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Links for logged in user +if(isUserLoggedIn()) { + echo " + <ul> + <li><a href='account.php'>Account Home</a></li> + <li><a href='user_settings.php'>User Settings</a></li> + <li><a href='logout.php'>Logout</a></li> + </ul>"; + + //Links for permission level 2 (default admin) + if ($loggedInUser->checkPermission(array(2))){ + echo " + <ul> + <li><a href='admin_configuration.php'>Admin Configuration</a></li> + <li><a href='admin_users.php'>Admin Users</a></li> + <li><a href='admin_permissions.php'>Admin Permissions</a></li> + <li><a href='admin_pages.php'>Admin Pages</a></li> + </ul>"; + } +} +//Links for users not logged in +else { + echo " + <ul> + <li><a href='index.php'>Home</a></li> + <li><a href='login.php'>Login</a></li> + <li><a href='register.php'>Register</a></li> + <li><a href='forgot-password.php'>Forgot Password</a></li>"; + if ($emailActivation) + { + echo "<li><a href='resend-activation.php'>Resend Activation Email</a></li>"; + } + echo "</ul>"; +} + +?> diff --git a/core/backend/admin/modules/modul_normal-login/login.php b/core/backend/admin/modules/modul_normal-login/login.php @@ -1,77 +1,125 @@ -<html> - <head> - <title>login</title> - <meta http-equiv="content-type" content="text/html; charset=UTF-8"> - <!--<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/2.0.3/jquery.min.js"></script>!--> - <script type="text/javascript" src="../../../../libs/security/sha.js"></script> - <script type="text/javascript"> - window.setTimeout("reload_timeout()", 295000); - function reload_timeout() { - var token = document.getElementById('token').innerHTML; - self.location.href='./del_token.php?token='+token; - } - function go() { - var token = document.getElementById('token').innerHTML; - var username = document.getElementById('username').value; - var passwd = document.getElementById('passwd').value; - var ga_token = document.getElementById('ga_token').value; - var shaObj = new jsSHA(passwd+username, "TEXT"); - var hash = shaObj.getHash("SHA-512", "HEX"); - //document.write(hash); - var shaObj1 = new jsSHA(hash+token, "TEXT"); - var hash = shaObj1.getHash("SHA-512", "HEX"); - //document.write('<br/>'); - //document.write(hash); - //alert("test") - var anfragestr = './login_handling.php?username='+username+'&token='+token+'&hash='+hash+'&ga_token='+ga_token; - self.location.href=anfragestr; - } - </script> - </head> - <body> - <div id='token' style="display:none"> - <?php - ############################### - # include files from root dir # - ############################### - $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); - $currentdir = getcwd(); - $root_2 = str_replace($root_1, '', $currentdir); - $root_3 = explode("/", $root_2); - if ($root_3[1] == 'core') { - $root = realpath($_SERVER["DOCUMENT_ROOT"]); - }else{ - $root = $root_1 . '/' . $root_3[1]; - } - include($root . '/core/config/connect.db.inc.php'); - //Check if Database connection established - if (mysqli_connect_errno()) { - printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); - exit(); - } - $token = hash('sha512',rand().time()); - $time = time(); - $eintrag = "INSERT INTO hashtoken(token, time)VALUES('$token', '$time')"; - $eintragen = mysqli_query($connection, $eintrag); - print($token); - ?> - </div> - <?php - include_once('./navi.php'); - ?> - <h1>Login ohne Klartext-Passwort übertragung</h1> - Username: - <br/> - <input type='text' id='username' name='username'/> - <br/> - Passwort: - <br/> - <input type="password" id='passwd' name="passwd"/> - <br/> - Token: - <br/> - <input type="text" id='ga_token' name="ga_token"/> - <br/> - <input type='submit' name="go" value="go" onClick='go()'/> - </body> -</html> -\ No newline at end of file +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Prevent the user visiting the logged in page if he/she is already logged in +if(isUserLoggedIn()) { header("Location: account.php"); die(); } + +//Forms posted +if(!empty($_POST)) +{ + $errors = array(); + $username = sanitize(trim($_POST["username"])); + $password = trim($_POST["password"]); + + //Perform some validation + //Feel free to edit / change as required + if($username == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_USERNAME"); + } + if($password == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_PASSWORD"); + } + + if(count($errors) == 0) + { + //A security note here, never tell the user which credential was incorrect + if(!usernameExists($username)) + { + $errors[] = lang("ACCOUNT_USER_OR_PASS_INVALID"); + } + else + { + $userdetails = fetchUserDetails($username); + //See if the user's account is activated + if($userdetails["active"]==0) + { + $errors[] = lang("ACCOUNT_INACTIVE"); + } + else + { + //Hash the password and use the salt from the database to compare the password. + $entered_pass = generateHash($password,$userdetails["password"]); + + if($entered_pass != $userdetails["password"]) + { + //Again, we know the password is at fault here, but lets not give away the combination incase of someone bruteforcing + $errors[] = lang("ACCOUNT_USER_OR_PASS_INVALID"); + } + else + { + //Passwords match! we're good to go' + + //Construct a new logged in user object + //Transfer some db data to the session object + $loggedInUser = new loggedInUser(); + $loggedInUser->email = $userdetails["email"]; + $loggedInUser->user_id = $userdetails["id"]; + $loggedInUser->hash_pw = $userdetails["password"]; + $loggedInUser->title = $userdetails["title"]; + $loggedInUser->displayname = $userdetails["display_name"]; + $loggedInUser->username = $userdetails["user_name"]; + + //Update last sign in + $loggedInUser->updateLastSignIn(); + $_SESSION["userCakeUser"] = $loggedInUser; + + //Redirect to user account page + header("Location: account.php"); + die(); + } + } + } + } +} + +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Login</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<div id='regbox'> +<form name='login' action='".$_SERVER['PHP_SELF']."' method='post'> +<p> +<label>Username:</label> +<input type='text' name='username' /> +</p> +<p> +<label>Password:</label> +<input type='password' name='password' /> +</p> +<p> +<label> </label> +<input type='submit' value='Login' class='submit' /> +</p> +</form> +</div> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/login_handling.php b/core/backend/admin/modules/modul_normal-login/login_handling.php @@ -1,109 +0,0 @@ -<?php - ############################### - # include files from root dir # - ############################### - $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); - $currentdir = getcwd(); - $root_2 = str_replace($root_1, '', $currentdir); - $root_3 = explode("/", $root_2); - if ($root_3[1] == 'core') { - $root = realpath($_SERVER["DOCUMENT_ROOT"]); - }else{ - $root = $root_1 . '/' . $root_3[1]; - } - include_once('./navi.php'); - include_once($root . '/core/libs/GA/GoogleAuthenticator.php'); - $g = new GoogleAuthenticator(); - function die_back($str) { - die ($str.'<br/><a href="./login.php">back</a>'); - } - $token = $_GET['ga_token']; - $user = $_GET['username']; - $hash = $_GET['hash']; - $ga_token_input = $_GET['ga_token']; - include($root . '/core/config/connect.db.inc.php'); - //Check if Database connection established - if (mysqli_connect_errno()) { - printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); - exit(); - } - $token_vaild = false; - $abfrage = "SELECT time,vaild_sec,token FROM hashtoken WHERE token = '$token'"; - $ergebnis = mysqli_query($connection, $abfrage); - - while($row = mysqli_fetch_object($ergebnis)){ - $token_vaild = true; - $creat_time = $row->time; - $vaild_sec = $row->vaild_sec; - } - - if (!($token_vaild)) { - die_back('something went wrong :/'); - } - if (($creat_time + $vaild_sec) < time()) { - die_back('timeout'); - } - $loeschen = "DELETE FROM hashtoken WHERE token = '$token'"; - $loesch = mysqli_query($connection, $loeschen); - $user_exist = false; - $abfrage = "SELECT name,passwdhash,id,ga_secret FROM user WHERE name = '$user'"; - $ergebnis = mysqli_query($connection, $abfrage); - while($row = mysqli_fetch_object($ergebnis)){ - $user_exist = true; - $passwdhash = $row->passwdhash; - $userid = $row->id; - $ga_secret = $row->ga_secret; - } - if (!$user_exist) { - die_back('unbekanter benutzername'); - } - $hash_db = hash('sha512',$passwdhash.$token); - if ($hash_db == $hash) { - print("du bist eingelogt"); - } else { - die_back('falsches passwort'); - } - - if (!empty($_SERVER['HTTP_CLIENT_IP'])) { - $ip = $_SERVER['HTTP_CLIENT_IP']; - } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { - $ip = $_SERVER['HTTP_X_FORWARDED_FOR']; - } else { - $ip = $_SERVER['REMOTE_ADDR']; - } - $hash=hash('sha512',$_SERVER['HTTP_USER_AGENT'].$ip); - - $vorhanden = false; - - $abfrage = "SELECT id, hash FROM cookiedata WHERE hash = '$hash'"; - $ergebnis = mysqli_query($connection, $abfrage); - while($row = mysqli_fetch_object($ergebnis)){ - if ($row->hash == $hash){ - $id_cookie = $row->id; - $vorhanden =true; - } - } - - $expiration_time = time() +120*60; //laenge des auth - $cookie = hash('sha512',$hash.$userid.$expiration_time); - if ($vorhanden){ - $aendern = "UPDATE cookiedata Set hash = '$hash', userid = '$userid', vaildtime = '$expiration_time' cookie_hash = '$cookie' WHERE id = '$id_cookie'"; - $update = mysqli_query($connection, $aendern); - print("update"); - } else { - $eintrag = "INSERT INTO cookiedata (hash, userid, vaildtime, cookie_hash) VALUES ('$hash', '$userid', '$expiration_time', '$cookie')"; - $eintragen = mysqli_query($connection, $eintrag); - print("new"); - } - - if ($eintragen ||$update) { - if ($g->checkCode($ga_secret,$ga_token_input)) { - setcookie("acess",$cookie,$expiration_time); - print("Hallo ".$user."<br/>Wilkommen"); - } else { - die_back("the token is wrong or to old, try it again"); - } - } else { - die_back("something on the db went wrong"); - } -?> -\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/logout.php b/core/backend/admin/modules/modul_normal-login/logout.php @@ -1,29 +1,35 @@ -<?php - ############################### - # include files from root dir # - ############################### - $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); - $currentdir = getcwd(); - $root_2 = str_replace($root_1, '', $currentdir); - $root_3 = explode("/", $root_2); - if ($root_3[1] == 'core') { - $root = realpath($_SERVER["DOCUMENT_ROOT"]); - }else{ - $root = $root_1 . '/' . $root_3[1]; - } - include('./navi.php'); - $cookie = $_COOKIE["acess"]; - include($root . '/core/config/connect.db.inc.php'); - //Check if Database connection established - if (mysqli_connect_errno()) { - printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); - exit(); - } - include('./check_auth.php'); - if (!$authokay) { - die('nobody to logout'); - } - $loeschen = "DELETE FROM cookiedata WHERE cookie_hash = '$cookie'"; - $loesch = mysql_query($connection, $loeschen); - print('logged out'); -?> -\ No newline at end of file +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Log the user out +if(isUserLoggedIn()) +{ + $loggedInUser->userLogOut(); +} + +if(!empty($websiteUrl)) +{ + $add_http = ""; + + if(strpos($websiteUrl,"http://") === false) + { + $add_http = "http://"; + } + + header("Location: ".$add_http.$websiteUrl); + die(); +} +else +{ + header("Location: http://".$_SERVER['HTTP_HOST']); + die(); +} + +?> + diff --git a/core/backend/admin/modules/modul_normal-login/models/captcha.php b/core/backend/admin/modules/modul_normal-login/models/captcha.php @@ -0,0 +1,27 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ +session_start(); +$md5_hash = md5(rand(0,99999)); +$security_code = substr($md5_hash, 25, 5); +$enc = md5($security_code); +$_SESSION['captcha'] = $enc; + +$width = 150; +$height = 30; + +$image = ImageCreate($width, $height); +$white = ImageColorAllocate($image, 255, 255, 255); +$black = ImageColorAllocate($image, 0, 0, 0); +$grey = ImageColorAllocate($image, 200, 200, 200); + +ImageFill($image, 0, 0, $white); +ImageString($image, 10, 5, 0, $security_code, $black); + +header("Content-Type: image/png"); +ImagePng($image); +ImageDestroy($image); + +?> diff --git a/core/backend/admin/modules/modul_normal-login/models/class.mail.php b/core/backend/admin/modules/modul_normal-login/models/class.mail.php @@ -0,0 +1,55 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +class userCakeMail { + //UserCake uses a text based system with hooks to replace various strs in txt email templates + public $contents = NULL; + + //Function used for replacing hooks in our templates + public function newTemplateMsg($template,$additionalHooks) + { + global $mail_templates_dir,$debug_mode; + + $this->contents = file_get_contents($mail_templates_dir.$template); + + //Check to see we can access the file / it has some contents + if(!$this->contents || empty($this->contents)) + { + return false; + } + else + { + //Replace default hooks + $this->contents = replaceDefaultHook($this->contents); + + //Replace defined / custom hooks + $this->contents = str_replace($additionalHooks["searchStrs"],$additionalHooks["subjectStrs"],$this->contents); + + return true; + } + } + + public function sendMail($email,$subject,$msg = NULL) + { + global $websiteName,$emailAddress; + + $header = "MIME-Version: 1.0\r\n"; + $header .= "Content-type: text/plain; charset=iso-8859-1\r\n"; + $header .= "From: ". $websiteName . " <" . $emailAddress . ">\r\n"; + + //Check to see if we sending a template email. + if($msg == NULL) + $msg = $this->contents; + + $message = $msg; + + $message = wordwrap($message, 70); + + return mail($email,$subject,$message,$header); + } +} + +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/models/class.newuser.php b/core/backend/admin/modules/modul_normal-login/models/class.newuser.php @@ -0,0 +1,162 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + + +class User +{ + public $user_active = 0; + private $clean_email; + public $status = false; + private $clean_password; + private $username; + private $displayname; + public $sql_failure = false; + public $mail_failure = false; + public $email_taken = false; + public $username_taken = false; + public $displayname_taken = false; + public $activation_token = 0; + public $success = NULL; + + function __construct($user,$display,$pass,$email) + { + //Used for display only + $this->displayname = $display; + + //Sanitize + $this->clean_email = sanitize($email); + $this->clean_password = trim($pass); + $this->username = sanitize($user); + + if(usernameExists($this->username)) + { + $this->username_taken = true; + } + else if(displayNameExists($this->displayname)) + { + $this->displayname_taken = true; + } + else if(emailExists($this->clean_email)) + { + $this->email_taken = true; + } + else + { + //No problems have been found. + $this->status = true; + } + } + + public function userCakeAddUser() + { + global $mysqli,$emailActivation,$websiteUrl,$db_table_prefix; + + //Prevent this function being called if there were construction errors + if($this->status) + { + //Construct a secure hash for the plain text password + $secure_pass = generateHash($this->clean_password); + + //Construct a unique activation token + $this->activation_token = generateActivationToken(); + + //Do we need to send out an activation email? + if($emailActivation == "true") + { + //User must activate their account first + $this->user_active = 0; + + $mail = new userCakeMail(); + + //Build the activation message + $activation_message = lang("ACCOUNT_ACTIVATION_MESSAGE",array($websiteUrl,$this->activation_token)); + + //Define more if you want to build larger structures + $hooks = array( + "searchStrs" => array("#ACTIVATION-MESSAGE","#ACTIVATION-KEY","#USERNAME#"), + "subjectStrs" => array($activation_message,$this->activation_token,$this->displayname) + ); + + /* Build the template - Optional, you can just use the sendMail function + Instead to pass a message. */ + + if(!$mail->newTemplateMsg("new-registration.txt",$hooks)) + { + $this->mail_failure = true; + } + else + { + //Send the mail. Specify users email here and subject. + //SendMail can have a third parementer for message if you do not wish to build a template. + + if(!$mail->sendMail($this->clean_email,"New User")) + { + $this->mail_failure = true; + } + } + $this->success = lang("ACCOUNT_REGISTRATION_COMPLETE_TYPE2"); + } + else + { + //Instant account activation + $this->user_active = 1; + $this->success = lang("ACCOUNT_REGISTRATION_COMPLETE_TYPE1"); + } + + + if(!$this->mail_failure) + { + //Insert the user into the database providing no errors have been found. + $stmt = $mysqli->prepare("INSERT INTO ".$db_table_prefix."users ( + user_name, + display_name, + password, + email, + activation_token, + last_activation_request, + lost_password_request, + active, + title, + sign_up_stamp, + last_sign_in_stamp + ) + VALUES ( + ?, + ?, + ?, + ?, + ?, + '".time()."', + '0', + ?, + 'New Member', + '".time()."', + '0' + )"); + + $stmt->bind_param("sssssi", $this->username, $this->displayname, $secure_pass, $this->clean_email, $this->activation_token, $this->user_active); + $stmt->execute(); + $inserted_id = $mysqli->insert_id; + $stmt->close(); + + //Insert default permission into matches table + $stmt = $mysqli->prepare("INSERT INTO ".$db_table_prefix."user_permission_matches ( + user_id, + permission_id + ) + VALUES ( + ?, + '1' + )"); + $stmt->bind_param("s", $inserted_id); + $stmt->execute(); + $stmt->close(); + } + } + } +} + +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/models/class.user.php b/core/backend/admin/modules/modul_normal-login/models/class.user.php @@ -0,0 +1,119 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +class loggedInUser { + public $email = NULL; + public $hash_pw = NULL; + public $user_id = NULL; + + //Simple function to update the last sign in of a user + public function updateLastSignIn() + { + global $mysqli,$db_table_prefix; + $time = time(); + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET + last_sign_in_stamp = ? + WHERE + id = ?"); + $stmt->bind_param("ii", $time, $this->user_id); + $stmt->execute(); + $stmt->close(); + } + + //Return the timestamp when the user registered + public function signupTimeStamp() + { + global $mysqli,$db_table_prefix; + + $stmt = $mysqli->prepare("SELECT sign_up_stamp + FROM ".$db_table_prefix."users + WHERE id = ?"); + $stmt->bind_param("i", $this->user_id); + $stmt->execute(); + $stmt->bind_result($timestamp); + $stmt->fetch(); + $stmt->close(); + return ($timestamp); + } + + //Update a users password + public function updatePassword($pass) + { + global $mysqli,$db_table_prefix; + $secure_pass = generateHash($pass); + $this->hash_pw = $secure_pass; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET + password = ? + WHERE + id = ?"); + $stmt->bind_param("si", $secure_pass, $this->user_id); + $stmt->execute(); + $stmt->close(); + } + + //Update a users email + public function updateEmail($email) + { + global $mysqli,$db_table_prefix; + $this->email = $email; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET + email = ? + WHERE + id = ?"); + $stmt->bind_param("si", $email, $this->user_id); + $stmt->execute(); + $stmt->close(); + } + + //Is a user has a permission + public function checkPermission($permission) + { + global $mysqli,$db_table_prefix,$master_account; + + //Grant access if master user + + $stmt = $mysqli->prepare("SELECT id + FROM ".$db_table_prefix."user_permission_matches + WHERE user_id = ? + AND permission_id = ? + LIMIT 1 + "); + $access = 0; + foreach($permission as $check){ + if ($access == 0){ + $stmt->bind_param("ii", $this->user_id, $check); + $stmt->execute(); + $stmt->store_result(); + if ($stmt->num_rows > 0){ + $access = 1; + } + } + } + if ($access == 1) + { + return true; + } + if ($this->user_id == $master_account){ + return true; + } + else + { + return false; + } + $stmt->close(); + } + + //Logout + public function userLogOut() + { + destroySession("userCakeUser"); + } +} + +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/models/config.php b/core/backend/admin/modules/modul_normal-login/models/config.php @@ -0,0 +1,57 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ +require_once("db-settings.php"); //Require DB connection + +//Retrieve settings +$stmt = $mysqli->prepare("SELECT id, name, value + FROM ".$db_table_prefix."configuration"); +$stmt->execute(); +$stmt->bind_result($id, $name, $value); + +while ($stmt->fetch()){ + $settings[$name] = array('id' => $id, 'name' => $name, 'value' => $value); +} +$stmt->close(); + +//Set Settings +$emailActivation = $settings['activation']['value']; +$mail_templates_dir = "models/mail-templates/"; +$websiteName = $settings['website_name']['value']; +$websiteUrl = $settings['website_url']['value']; +$emailAddress = $settings['email']['value']; +$resend_activation_threshold = $settings['resend_activation_threshold']['value']; +$emailDate = date('dmy'); +$language = $settings['language']['value']; +$template = $settings['template']['value']; + +$master_account = -1; + +$default_hooks = array("#WEBSITENAME#","#WEBSITEURL#","#DATE#"); +$default_replace = array($websiteName,$websiteUrl,$emailDate); + +if (!file_exists($language)) { + $language = "models/languages/en.php"; +} + +if(!isset($language)) $language = "models/languages/en.php"; + +//Pages to require +require_once($language); +require_once("class.mail.php"); +require_once("class.user.php"); +require_once("class.newuser.php"); +require_once("funcs.php"); + +session_start(); + +//Global User Object Var +//loggedInUser can be used globally if constructed +if(isset($_SESSION["userCakeUser"]) && is_object($_SESSION["userCakeUser"])) +{ + $loggedInUser = $_SESSION["userCakeUser"]; +} + +?> diff --git a/core/backend/admin/modules/modul_normal-login/models/db-settings.php b/core/backend/admin/modules/modul_normal-login/models/db-settings.php @@ -0,0 +1,50 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ +############################### +# include files from root dir # +############################### +$root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); +$currentdir = getcwd(); +$root_2 = str_replace($root_1, '', $currentdir); +$root_3 = explode("/", $root_2); +if ($root_3[1] == 'core') { + echo $root_3[1]; + $root = realpath($_SERVER["DOCUMENT_ROOT"]); +}else{ + $root = $root_1 . '/' . $root_3[1]; +} +require_once($root."/core/config/connect.db.inc.php"); +//Database Information +$db_host = $db_servername; //Host address (most likely localhost) +$db_name = $db_name; //Name of Database +$db_user = $db_username; //Name of database user +$db_pass = $db_password; //Password for database user +$db_table_prefix = "rpicms_"; + +GLOBAL $errors; +GLOBAL $successes; + +$errors = array(); +$successes = array(); + +/* Create a new mysqli object with database connection parameters */ +$mysqli = new mysqli($db_host, $db_user, $db_pass, $db_name); +GLOBAL $mysqli; + +if(mysqli_connect_errno()) { + echo "Connection Failed: " . mysqli_connect_errno(); + exit(); +} + +//Direct to install directory, if it exists +if(is_dir("install/")) +{ + header("Location: install/"); + die(); + +} + +?> diff --git a/core/backend/admin/modules/modul_normal-login/models/funcs.js b/core/backend/admin/modules/modul_normal-login/models/funcs.js @@ -0,0 +1,11 @@ +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ +function showHide(div){ + if(document.getElementById(div).style.display = 'block'){ + document.getElementById(div).style.display = 'none'; + }else{ + document.getElementById(div).style.display = 'block'; + } +} diff --git a/core/backend/admin/modules/modul_normal-login/models/funcs.php b/core/backend/admin/modules/modul_normal-login/models/funcs.php @@ -0,0 +1,1185 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +//Functions that do not interact with DB +//------------------------------------------------------------------------------ + +//Retrieve a list of all .php files in models/languages +function getLanguageFiles() +{ + $directory = "models/languages/"; + $languages = glob($directory . "*.php"); + //print each file name + return $languages; +} + +//Retrieve a list of all .css files in models/site-templates +function getTemplateFiles() +{ + $directory = "models/site-templates/"; + $languages = glob($directory . "*.css"); + //print each file name + return $languages; +} + +//Retrieve a list of all .php files in root files folder +function getPageFiles() +{ + $directory = ""; + $pages = glob($directory . "*.php"); + //print each file name + foreach ($pages as $page){ + $row[$page] = $page; + } + return $row; +} + +//Destroys a session as part of logout +function destroySession($name) +{ + if(isset($_SESSION[$name])) + { + $_SESSION[$name] = NULL; + unset($_SESSION[$name]); + } +} + +//Generate a unique code +function getUniqueCode($length = "") +{ + $code = md5(uniqid(rand(), true)); + if ($length != "") return substr($code, 0, $length); + else return $code; +} + +//Generate an activation key +function generateActivationToken($gen = null) +{ + do + { + $gen = md5(uniqid(mt_rand(), false)); + } + while(validateActivationToken($gen)); + return $gen; +} + +//@ Thanks to - http://phpsec.org +function generateHash($plainText, $salt = null) +{ + if ($salt === null) + { + $salt = substr(md5(uniqid(rand(), true)), 0, 25); + } + else + { + $salt = substr($salt, 0, 25); + } + + return $salt . sha1($salt . $plainText); +} + +//Checks if an email is valid +function isValidEmail($email) +{ + if (filter_var($email, FILTER_VALIDATE_EMAIL)) { + return true; + } + else { + return false; + } +} + +//Inputs language strings from selected language. +function lang($key,$markers = NULL) +{ + global $lang; + if($markers == NULL) + { + $str = $lang[$key]; + } + else + { + //Replace any dyamic markers + $str = $lang[$key]; + $iteration = 1; + foreach($markers as $marker) + { + $str = str_replace("%m".$iteration."%",$marker,$str); + $iteration++; + } + } + //Ensure we have something to return + if($str == "") + { + return ("No language key found"); + } + else + { + return $str; + } +} + +//Checks if a string is within a min and max length +function minMaxRange($min, $max, $what) +{ + if(strlen(trim($what)) < $min) + return true; + else if(strlen(trim($what)) > $max) + return true; + else + return false; +} + +//Replaces hooks with specified text +function replaceDefaultHook($str) +{ + global $default_hooks,$default_replace; + return (str_replace($default_hooks,$default_replace,$str)); +} + +//Displays error and success messages +function resultBlock($errors,$successes){ + //Error block + if(count($errors) > 0) + { + echo "<div id='error'> + <a href='#' onclick=\"showHide('error');\">[X]</a> + <ul>"; + foreach($errors as $error) + { + echo "<li>".$error."</li>"; + } + echo "</ul>"; + echo "</div>"; + } + //Success block + if(count($successes) > 0) + { + echo "<div id='success'> + <a href='#' onclick=\"showHide('success');\">[X]</a> + <ul>"; + foreach($successes as $success) + { + echo "<li>".$success."</li>"; + } + echo "</ul>"; + echo "</div>"; + } +} + +//Completely sanitizes text +function sanitize($str) +{ + return strtolower(strip_tags(trim(($str)))); +} + +//Functions that interact mainly with .users table +//------------------------------------------------------------------------------ + +//Delete a defined array of users +function deleteUsers($users) { + global $mysqli,$db_table_prefix; + $i = 0; + $stmt = $mysqli->prepare("DELETE FROM ".$db_table_prefix."users + WHERE id = ?"); + $stmt2 = $mysqli->prepare("DELETE FROM ".$db_table_prefix."user_permission_matches + WHERE user_id = ?"); + foreach($users as $id){ + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt2->bind_param("i", $id); + $stmt2->execute(); + $i++; + } + $stmt->close(); + $stmt2->close(); + return $i; +} + +//Check if a display name exists in the DB +function displayNameExists($displayname) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT active + FROM ".$db_table_prefix."users + WHERE + display_name = ? + LIMIT 1"); + $stmt->bind_param("s", $displayname); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Check if an email exists in the DB +function emailExists($email) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT active + FROM ".$db_table_prefix."users + WHERE + email = ? + LIMIT 1"); + $stmt->bind_param("s", $email); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Check if a user name and email belong to the same user +function emailUsernameLinked($email,$username) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT active + FROM ".$db_table_prefix."users + WHERE user_name = ? + AND + email = ? + LIMIT 1 + "); + $stmt->bind_param("ss", $username, $email); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Retrieve information for all users +function fetchAllUsers() +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + user_name, + display_name, + password, + email, + activation_token, + last_activation_request, + lost_password_request, + active, + title, + sign_up_stamp, + last_sign_in_stamp + FROM ".$db_table_prefix."users"); + $stmt->execute(); + $stmt->bind_result($id, $user, $display, $password, $email, $token, $activationRequest, $passwordRequest, $active, $title, $signUp, $signIn); + + while ($stmt->fetch()){ + $row[] = array('id' => $id, 'user_name' => $user, 'display_name' => $display, 'password' => $password, 'email' => $email, 'activation_token' => $token, 'last_activation_request' => $activationRequest, 'lost_password_request' => $passwordRequest, 'active' => $active, 'title' => $title, 'sign_up_stamp' => $signUp, 'last_sign_in_stamp' => $signIn); + } + $stmt->close(); + return ($row); +} + +//Retrieve complete user information by username, token or ID +function fetchUserDetails($username=NULL,$token=NULL, $id=NULL) +{ + if($username!=NULL) { + $column = "user_name"; + $data = $username; + } + elseif($token!=NULL) { + $column = "activation_token"; + $data = $token; + } + elseif($id!=NULL) { + $column = "id"; + $data = $id; + } + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + user_name, + display_name, + password, + email, + activation_token, + last_activation_request, + lost_password_request, + active, + title, + sign_up_stamp, + last_sign_in_stamp + FROM ".$db_table_prefix."users + WHERE + $column = ? + LIMIT 1"); + $stmt->bind_param("s", $data); + + $stmt->execute(); + $stmt->bind_result($id, $user, $display, $password, $email, $token, $activationRequest, $passwordRequest, $active, $title, $signUp, $signIn); + while ($stmt->fetch()){ + $row = array('id' => $id, 'user_name' => $user, 'display_name' => $display, 'password' => $password, 'email' => $email, 'activation_token' => $token, 'last_activation_request' => $activationRequest, 'lost_password_request' => $passwordRequest, 'active' => $active, 'title' => $title, 'sign_up_stamp' => $signUp, 'last_sign_in_stamp' => $signIn); + } + $stmt->close(); + return ($row); +} + +//Toggle if lost password request flag on or off +function flagLostPasswordRequest($username,$value) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET lost_password_request = ? + WHERE + user_name = ? + LIMIT 1 + "); + $stmt->bind_param("ss", $value, $username); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Check if a user is logged in +function isUserLoggedIn() +{ + global $loggedInUser,$mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + password + FROM ".$db_table_prefix."users + WHERE + id = ? + AND + password = ? + AND + active = 1 + LIMIT 1"); + $stmt->bind_param("is", $loggedInUser->user_id, $loggedInUser->hash_pw); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if($loggedInUser == NULL) + { + return false; + } + else + { + if ($num_returns > 0) + { + return true; + } + else + { + destroySession("userCakeUser"); + return false; + } + } +} + +//Change a user from inactive to active +function setUserActive($token) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET active = 1 + WHERE + activation_token = ? + LIMIT 1"); + $stmt->bind_param("s", $token); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Change a user's display name +function updateDisplayName($id, $display) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET display_name = ? + WHERE + id = ? + LIMIT 1"); + $stmt->bind_param("si", $display, $id); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Update a user's email +function updateEmail($id, $email) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET + email = ? + WHERE + id = ?"); + $stmt->bind_param("si", $email, $id); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Input new activation token, and update the time of the most recent activation request +function updateLastActivationRequest($new_activation_token,$username,$email) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET activation_token = ?, + last_activation_request = ? + WHERE email = ? + AND + user_name = ?"); + $stmt->bind_param("ssss", $new_activation_token, time(), $email, $username); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Generate a random password, and new token +function updatePasswordFromToken($pass,$token) +{ + global $mysqli,$db_table_prefix; + $new_activation_token = generateActivationToken(); + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET password = ?, + activation_token = ? + WHERE + activation_token = ?"); + $stmt->bind_param("sss", $pass, $new_activation_token, $token); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Update a user's title +function updateTitle($id, $title) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."users + SET + title = ? + WHERE + id = ?"); + $stmt->bind_param("si", $title, $id); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Check if a user ID exists in the DB +function userIdExists($id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT active + FROM ".$db_table_prefix."users + WHERE + id = ? + LIMIT 1"); + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Checks if a username exists in the DB +function usernameExists($username) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT active + FROM ".$db_table_prefix."users + WHERE + user_name = ? + LIMIT 1"); + $stmt->bind_param("s", $username); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Check if activation token exists in DB +function validateActivationToken($token,$lostpass=NULL) +{ + global $mysqli,$db_table_prefix; + if($lostpass == NULL) + { + $stmt = $mysqli->prepare("SELECT active + FROM ".$db_table_prefix."users + WHERE active = 0 + AND + activation_token = ? + LIMIT 1"); + } + else + { + $stmt = $mysqli->prepare("SELECT active + FROM ".$db_table_prefix."users + WHERE active = 1 + AND + activation_token = ? + AND + lost_password_request = 1 + LIMIT 1"); + } + $stmt->bind_param("s", $token); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Functions that interact mainly with .permissions table +//------------------------------------------------------------------------------ + +//Create a permission level in DB +function createPermission($permission) { + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("INSERT INTO ".$db_table_prefix."permissions ( + name + ) + VALUES ( + ? + )"); + $stmt->bind_param("s", $permission); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Delete a permission level from the DB +function deletePermission($permission) { + global $mysqli,$db_table_prefix,$errors; + $i = 0; + $stmt = $mysqli->prepare("DELETE FROM ".$db_table_prefix."permissions + WHERE id = ?"); + $stmt2 = $mysqli->prepare("DELETE FROM ".$db_table_prefix."user_permission_matches + WHERE permission_id = ?"); + $stmt3 = $mysqli->prepare("DELETE FROM ".$db_table_prefix."permission_page_matches + WHERE permission_id = ?"); + foreach($permission as $id){ + if ($id == 1){ + $errors[] = lang("CANNOT_DELETE_NEWUSERS"); + } + elseif ($id == 2){ + $errors[] = lang("CANNOT_DELETE_ADMIN"); + } + else{ + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt2->bind_param("i", $id); + $stmt2->execute(); + $stmt3->bind_param("i", $id); + $stmt3->execute(); + $i++; + } + } + $stmt->close(); + $stmt2->close(); + $stmt3->close(); + return $i; +} + +//Retrieve information for all permission levels +function fetchAllPermissions() +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + name + FROM ".$db_table_prefix."permissions"); + $stmt->execute(); + $stmt->bind_result($id, $name); + while ($stmt->fetch()){ + $row[] = array('id' => $id, 'name' => $name); + } + $stmt->close(); + return ($row); +} + +//Retrieve information for a single permission level +function fetchPermissionDetails($id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + name + FROM ".$db_table_prefix."permissions + WHERE + id = ? + LIMIT 1"); + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt->bind_result($id, $name); + while ($stmt->fetch()){ + $row = array('id' => $id, 'name' => $name); + } + $stmt->close(); + return ($row); +} + +//Check if a permission level ID exists in the DB +function permissionIdExists($id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT id + FROM ".$db_table_prefix."permissions + WHERE + id = ? + LIMIT 1"); + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Check if a permission level name exists in the DB +function permissionNameExists($permission) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT id + FROM ".$db_table_prefix."permissions + WHERE + name = ? + LIMIT 1"); + $stmt->bind_param("s", $permission); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Change a permission level's name +function updatePermissionName($id, $name) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."permissions + SET name = ? + WHERE + id = ? + LIMIT 1"); + $stmt->bind_param("si", $name, $id); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Functions that interact mainly with .user_permission_matches table +//------------------------------------------------------------------------------ + +//Match permission level(s) with user(s) +function addPermission($permission, $user) { + global $mysqli,$db_table_prefix; + $i = 0; + $stmt = $mysqli->prepare("INSERT INTO ".$db_table_prefix."user_permission_matches ( + permission_id, + user_id + ) + VALUES ( + ?, + ? + )"); + if (is_array($permission)){ + foreach($permission as $id){ + $stmt->bind_param("ii", $id, $user); + $stmt->execute(); + $i++; + } + } + elseif (is_array($user)){ + foreach($user as $id){ + $stmt->bind_param("ii", $permission, $id); + $stmt->execute(); + $i++; + } + } + else { + $stmt->bind_param("ii", $permission, $user); + $stmt->execute(); + $i++; + } + $stmt->close(); + return $i; +} + +//Retrieve information for all user/permission level matches +function fetchAllMatches() +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + user_id, + permission_id + FROM ".$db_table_prefix."user_permission_matches"); + $stmt->execute(); + $stmt->bind_result($id, $user, $permission); + while ($stmt->fetch()){ + $row[] = array('id' => $id, 'user_id' => $user, 'permission_id' => $permission); + } + $stmt->close(); + return ($row); +} + +//Retrieve list of permission levels a user has +function fetchUserPermissions($user_id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + permission_id + FROM ".$db_table_prefix."user_permission_matches + WHERE user_id = ? + "); + $stmt->bind_param("i", $user_id); + $stmt->execute(); + $stmt->bind_result($id, $permission); + while ($stmt->fetch()){ + $row[$permission] = array('id' => $id, 'permission_id' => $permission); + } + $stmt->close(); + if (isset($row)){ + return ($row); + } +} + +//Retrieve list of users who have a permission level +function fetchPermissionUsers($permission_id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT id, user_id + FROM ".$db_table_prefix."user_permission_matches + WHERE permission_id = ? + "); + $stmt->bind_param("i", $permission_id); + $stmt->execute(); + $stmt->bind_result($id, $user); + while ($stmt->fetch()){ + $row[$user] = array('id' => $id, 'user_id' => $user); + } + $stmt->close(); + if (isset($row)){ + return ($row); + } +} + +//Unmatch permission level(s) from user(s) +function removePermission($permission, $user) { + global $mysqli,$db_table_prefix; + $i = 0; + $stmt = $mysqli->prepare("DELETE FROM ".$db_table_prefix."user_permission_matches + WHERE permission_id = ? + AND user_id =?"); + if (is_array($permission)){ + foreach($permission as $id){ + $stmt->bind_param("ii", $id, $user); + $stmt->execute(); + $i++; + } + } + elseif (is_array($user)){ + foreach($user as $id){ + $stmt->bind_param("ii", $permission, $id); + $stmt->execute(); + $i++; + } + } + else { + $stmt->bind_param("ii", $permission, $user); + $stmt->execute(); + $i++; + } + $stmt->close(); + return $i; +} + +//Functions that interact mainly with .configuration table +//------------------------------------------------------------------------------ + +//Update configuration table +function updateConfig($id, $value) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."configuration + SET + value = ? + WHERE + id = ?"); + foreach ($id as $cfg){ + $stmt->bind_param("si", $value[$cfg], $cfg); + $stmt->execute(); + } + $stmt->close(); +} + +//Functions that interact mainly with .pages table +//------------------------------------------------------------------------------ + +//Add a page to the DB +function createPages($pages) { + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("INSERT INTO ".$db_table_prefix."pages ( + page + ) + VALUES ( + ? + )"); + foreach($pages as $page){ + $stmt->bind_param("s", $page); + $stmt->execute(); + } + $stmt->close(); +} + +//Delete a page from the DB +function deletePages($pages) { + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("DELETE FROM ".$db_table_prefix."pages + WHERE id = ?"); + $stmt2 = $mysqli->prepare("DELETE FROM ".$db_table_prefix."permission_page_matches + WHERE page_id = ?"); + foreach($pages as $id){ + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt2->bind_param("i", $id); + $stmt2->execute(); + } + $stmt->close(); + $stmt2->close(); +} + +//Fetch information on all pages +function fetchAllPages() +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + page, + private + FROM ".$db_table_prefix."pages"); + $stmt->execute(); + $stmt->bind_result($id, $page, $private); + while ($stmt->fetch()){ + $row[$page] = array('id' => $id, 'page' => $page, 'private' => $private); + } + $stmt->close(); + if (isset($row)){ + return ($row); + } +} + +//Fetch information for a specific page +function fetchPageDetails($id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + page, + private + FROM ".$db_table_prefix."pages + WHERE + id = ? + LIMIT 1"); + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt->bind_result($id, $page, $private); + while ($stmt->fetch()){ + $row = array('id' => $id, 'page' => $page, 'private' => $private); + } + $stmt->close(); + return ($row); +} + +//Check if a page ID exists +function pageIdExists($id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT private + FROM ".$db_table_prefix."pages + WHERE + id = ? + LIMIT 1"); + $stmt->bind_param("i", $id); + $stmt->execute(); + $stmt->store_result(); + $num_returns = $stmt->num_rows; + $stmt->close(); + + if ($num_returns > 0) + { + return true; + } + else + { + return false; + } +} + +//Toggle private/public setting of a page +function updatePrivate($id, $private) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("UPDATE ".$db_table_prefix."pages + SET + private = ? + WHERE + id = ?"); + $stmt->bind_param("ii", $private, $id); + $result = $stmt->execute(); + $stmt->close(); + return $result; +} + +//Functions that interact mainly with .permission_page_matches table +//------------------------------------------------------------------------------ + +//Match permission level(s) with page(s) +function addPage($page, $permission) { + global $mysqli,$db_table_prefix; + $i = 0; + $stmt = $mysqli->prepare("INSERT INTO ".$db_table_prefix."permission_page_matches ( + permission_id, + page_id + ) + VALUES ( + ?, + ? + )"); + if (is_array($permission)){ + foreach($permission as $id){ + $stmt->bind_param("ii", $id, $page); + $stmt->execute(); + $i++; + } + } + elseif (is_array($page)){ + foreach($page as $id){ + $stmt->bind_param("ii", $permission, $id); + $stmt->execute(); + $i++; + } + } + else { + $stmt->bind_param("ii", $permission, $page); + $stmt->execute(); + $i++; + } + $stmt->close(); + return $i; +} + +//Retrieve list of permission levels that can access a page +function fetchPagePermissions($page_id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + permission_id + FROM ".$db_table_prefix."permission_page_matches + WHERE page_id = ? + "); + $stmt->bind_param("i", $page_id); + $stmt->execute(); + $stmt->bind_result($id, $permission); + while ($stmt->fetch()){ + $row[$permission] = array('id' => $id, 'permission_id' => $permission); + } + $stmt->close(); + if (isset($row)){ + return ($row); + } +} + +//Retrieve list of pages that a permission level can access +function fetchPermissionPages($permission_id) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id, + page_id + FROM ".$db_table_prefix."permission_page_matches + WHERE permission_id = ? + "); + $stmt->bind_param("i", $permission_id); + $stmt->execute(); + $stmt->bind_result($id, $page); + while ($stmt->fetch()){ + $row[$page] = array('id' => $id, 'permission_id' => $page); + } + $stmt->close(); + if (isset($row)){ + return ($row); + } +} + +//Unmatched permission and page +function removePage($page, $permission) { + global $mysqli,$db_table_prefix; + $i = 0; + $stmt = $mysqli->prepare("DELETE FROM ".$db_table_prefix."permission_page_matches + WHERE page_id = ? + AND permission_id =?"); + if (is_array($page)){ + foreach($page as $id){ + $stmt->bind_param("ii", $id, $permission); + $stmt->execute(); + $i++; + } + } + elseif (is_array($permission)){ + foreach($permission as $id){ + $stmt->bind_param("ii", $page, $id); + $stmt->execute(); + $i++; + } + } + else { + $stmt->bind_param("ii", $permission, $user); + $stmt->execute(); + $i++; + } + $stmt->close(); + return $i; +} + +//Check if a user has access to a page +function securePage($uri){ + + //Separate document name from uri + $tokens = explode('/', $uri); + $page = $tokens[sizeof($tokens)-1]; + global $mysqli,$db_table_prefix,$loggedInUser; + //retrieve page details + $stmt = $mysqli->prepare("SELECT + id, + page, + private + FROM ".$db_table_prefix."pages + WHERE + page = ? + LIMIT 1"); + $stmt->bind_param("s", $page); + $stmt->execute(); + $stmt->bind_result($id, $page, $private); + while ($stmt->fetch()){ + $pageDetails = array('id' => $id, 'page' => $page, 'private' => $private); + } + $stmt->close(); + //If page does not exist in DB, allow access + if (empty($pageDetails)){ + return true; + } + //If page is public, allow access + elseif ($pageDetails['private'] == 0) { + return true; + } + //If user is not logged in, deny access + elseif(!isUserLoggedIn()) + { + header("Location: login.php"); + return false; + } + else { + //Retrieve list of permission levels with access to page + $stmt = $mysqli->prepare("SELECT + permission_id + FROM ".$db_table_prefix."permission_page_matches + WHERE page_id = ? + "); + $stmt->bind_param("i", $pageDetails['id']); + $stmt->execute(); + $stmt->bind_result($permission); + while ($stmt->fetch()){ + $pagePermissions[] = $permission; + } + $stmt->close(); + //Check if user's permission levels allow access to page + if ($loggedInUser->checkPermission($pagePermissions)){ + return true; + } + //Grant access if master user + elseif ($loggedInUser->user_id == $master_account){ + return true; + } + else { + header("Location: account.php"); + return false; + } + } +} + +?> diff --git a/core/backend/admin/modules/modul_normal-login/models/header.php b/core/backend/admin/modules/modul_normal-login/models/header.php @@ -0,0 +1,17 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ +echo " +<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'> +<html xmlns='http://www.w3.org/1999/xhtml'> +<head> +<meta http-equiv='Content-Type' content='text/html; charset=utf-8' /> +<title>".$websiteName."</title> +<link href='".$template."' rel='stylesheet' type='text/css' /> +<script src='models/funcs.js' type='text/javascript'> +</script> +</head>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/models/languages/en.php b/core/backend/admin/modules/modul_normal-login/models/languages/en.php @@ -0,0 +1,121 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +/* +%m1% - Dymamic markers which are replaced at run time by the relevant index. +*/ + +$lang = array(); + +//Account +$lang = array_merge($lang,array( + "ACCOUNT_SPECIFY_USERNAME" => "Please enter your username", + "ACCOUNT_SPECIFY_PASSWORD" => "Please enter your password", + "ACCOUNT_SPECIFY_EMAIL" => "Please enter your email address", + "ACCOUNT_INVALID_EMAIL" => "Invalid email address", + "ACCOUNT_USER_OR_EMAIL_INVALID" => "Username or email address is invalid", + "ACCOUNT_USER_OR_PASS_INVALID" => "Username or password is invalid", + "ACCOUNT_ALREADY_ACTIVE" => "Your account is already activated", + "ACCOUNT_INACTIVE" => "Your account is in-active. Check your emails / spam folder for account activation instructions", + "ACCOUNT_USER_CHAR_LIMIT" => "Your username must be between %m1% and %m2% characters in length", + "ACCOUNT_DISPLAY_CHAR_LIMIT" => "Your display name must be between %m1% and %m2% characters in length", + "ACCOUNT_PASS_CHAR_LIMIT" => "Your password must be between %m1% and %m2% characters in length", + "ACCOUNT_TITLE_CHAR_LIMIT" => "Titles must be between %m1% and %m2% characters in length", + "ACCOUNT_PASS_MISMATCH" => "Your password and confirmation password must match", + "ACCOUNT_DISPLAY_INVALID_CHARACTERS" => "Display name can only include alpha-numeric characters", + "ACCOUNT_USERNAME_IN_USE" => "Username %m1% is already in use", + "ACCOUNT_DISPLAYNAME_IN_USE" => "Display name %m1% is already in use", + "ACCOUNT_EMAIL_IN_USE" => "Email %m1% is already in use", + "ACCOUNT_LINK_ALREADY_SENT" => "An activation email has already been sent to this email address in the last %m1% hour(s)", + "ACCOUNT_NEW_ACTIVATION_SENT" => "We have emailed you a new activation link, please check your email", + "ACCOUNT_SPECIFY_NEW_PASSWORD" => "Please enter your new password", + "ACCOUNT_SPECIFY_CONFIRM_PASSWORD" => "Please confirm your new password", + "ACCOUNT_NEW_PASSWORD_LENGTH" => "New password must be between %m1% and %m2% characters in length", + "ACCOUNT_PASSWORD_INVALID" => "Current password doesn't match the one we have on record", + "ACCOUNT_DETAILS_UPDATED" => "Account details updated", + "ACCOUNT_ACTIVATION_MESSAGE" => "You will need to activate your account before you can login. Please follow the link below to activate your account. \n\n + %m1%activate-account.php?token=%m2%", + "ACCOUNT_ACTIVATION_COMPLETE" => "You have successfully activated your account. You can now login <a href=\"login.php\">here</a>.", + "ACCOUNT_REGISTRATION_COMPLETE_TYPE1" => "You have successfully registered. You can now login <a href=\"login.php\">here</a>.", + "ACCOUNT_REGISTRATION_COMPLETE_TYPE2" => "You have successfully registered. You will soon receive an activation email. + You must activate your account before logging in.", + "ACCOUNT_PASSWORD_NOTHING_TO_UPDATE" => "You cannot update with the same password", + "ACCOUNT_PASSWORD_UPDATED" => "Account password updated", + "ACCOUNT_EMAIL_UPDATED" => "Account email updated", + "ACCOUNT_TOKEN_NOT_FOUND" => "Token does not exist / Account is already activated", + "ACCOUNT_USER_INVALID_CHARACTERS" => "Username can only include alpha-numeric characters", + "ACCOUNT_DELETIONS_SUCCESSFUL" => "You have successfully deleted %m1% users", + "ACCOUNT_MANUALLY_ACTIVATED" => "%m1%'s account has been manually activated", + "ACCOUNT_DISPLAYNAME_UPDATED" => "Displayname changed to %m1%", + "ACCOUNT_TITLE_UPDATED" => "%m1%'s title changed to %m2%", + "ACCOUNT_PERMISSION_ADDED" => "Added access to %m1% permission levels", + "ACCOUNT_PERMISSION_REMOVED" => "Removed access from %m1% permission levels", + "ACCOUNT_INVALID_USERNAME" => "Invalid username", + )); + +//Configuration +$lang = array_merge($lang,array( + "CONFIG_NAME_CHAR_LIMIT" => "Site name must be between %m1% and %m2% characters in length", + "CONFIG_URL_CHAR_LIMIT" => "Site name must be between %m1% and %m2% characters in length", + "CONFIG_EMAIL_CHAR_LIMIT" => "Site name must be between %m1% and %m2% characters in length", + "CONFIG_ACTIVATION_TRUE_FALSE" => "Email activation must be either `true` or `false`", + "CONFIG_ACTIVATION_RESEND_RANGE" => "Activation Threshold must be between %m1% and %m2% hours", + "CONFIG_LANGUAGE_CHAR_LIMIT" => "Language path must be between %m1% and %m2% characters in length", + "CONFIG_LANGUAGE_INVALID" => "There is no file for the language key `%m1%`", + "CONFIG_TEMPLATE_CHAR_LIMIT" => "Template path must be between %m1% and %m2% characters in length", + "CONFIG_TEMPLATE_INVALID" => "There is no file for the template key `%m1%`", + "CONFIG_EMAIL_INVALID" => "The email you have entered is not valid", + "CONFIG_INVALID_URL_END" => "Please include the ending / in your site's URL", + "CONFIG_UPDATE_SUCCESSFUL" => "Your site's configuration has been updated. You may need to load a new page for all the settings to take effect", + )); + +//Forgot Password +$lang = array_merge($lang,array( + "FORGOTPASS_INVALID_TOKEN" => "Your activation token is not valid", + "FORGOTPASS_NEW_PASS_EMAIL" => "We have emailed you a new password", + "FORGOTPASS_REQUEST_CANNED" => "Lost password request cancelled", + "FORGOTPASS_REQUEST_EXISTS" => "There is already a outstanding lost password request on this account", + "FORGOTPASS_REQUEST_SUCCESS" => "We have emailed you instructions on how to regain access to your account", + )); + +//Mail +$lang = array_merge($lang,array( + "MAIL_ERROR" => "Fatal error attempting mail, contact your server administrator", + "MAIL_TEMPLATE_BUILD_ERROR" => "Error building email template", + "MAIL_TEMPLATE_DIRECTORY_ERROR" => "Unable to open mail-templates directory. Perhaps try setting the mail directory to %m1%", + "MAIL_TEMPLATE_FILE_EMPTY" => "Template file is empty... nothing to send", + )); + +//Miscellaneous +$lang = array_merge($lang,array( + "CAPTCHA_FAIL" => "Failed security question", + "CONFIRM" => "Confirm", + "DENY" => "Deny", + "SUCCESS" => "Success", + "ERROR" => "Error", + "NOTHING_TO_UPDATE" => "Nothing to update", + "SQL_ERROR" => "Fatal SQL error", + "FEATURE_DISABLED" => "This feature is currently disabled", + "PAGE_PRIVATE_TOGGLED" => "This page is now %m1%", + "PAGE_ACCESS_REMOVED" => "Page access removed for %m1% permission level(s)", + "PAGE_ACCESS_ADDED" => "Page access added for %m1% permission level(s)", + )); + +//Permissions +$lang = array_merge($lang,array( + "PERMISSION_CHAR_LIMIT" => "Permission names must be between %m1% and %m2% characters in length", + "PERMISSION_NAME_IN_USE" => "Permission name %m1% is already in use", + "PERMISSION_DELETIONS_SUCCESSFUL" => "Successfully deleted %m1% permission level(s)", + "PERMISSION_CREATION_SUCCESSFUL" => "Successfully created the permission level `%m1%`", + "PERMISSION_NAME_UPDATE" => "Permission level name changed to `%m1%`", + "PERMISSION_REMOVE_PAGES" => "Successfully removed access to %m1% page(s)", + "PERMISSION_ADD_PAGES" => "Successfully added access to %m1% page(s)", + "PERMISSION_REMOVE_USERS" => "Successfully removed %m1% user(s)", + "PERMISSION_ADD_USERS" => "Successfully added %m1% user(s)", + "CANNOT_DELETE_NEWUSERS" => "You cannot delete the default 'new user' group", + "CANNOT_DELETE_ADMIN" => "You cannot delete the default 'admin' group", + )); +?> +\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/models/mail-templates/lost-password-request.txt b/core/backend/admin/modules/modul_normal-login/models/mail-templates/lost-password-request.txt @@ -0,0 +1,9 @@ +Hello #USERNAME# + +A lost password request has been submitted for your account on #DATE#. + +To confirm / deny this request click one of the below links + +#CONFIRM-URL# + +#DENY-URL# diff --git a/core/backend/admin/modules/modul_normal-login/models/mail-templates/new-registration.txt b/core/backend/admin/modules/modul_normal-login/models/mail-templates/new-registration.txt @@ -0,0 +1,6 @@ +Hello #USERNAME# + +Thank you for joining our website #WEBSITENAME# +#ACTIVATION-MESSAGE + +-Regards +\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/models/mail-templates/resend-activation.txt b/core/backend/admin/modules/modul_normal-login/models/mail-templates/resend-activation.txt @@ -0,0 +1,9 @@ +Hello #USERNAME# + +We have received a new activation request for your account. Please follow the link below to activate. + +If you did not request this e-mail, please disregard this message. + +#ACTIVATION-URL + +-Regards +\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/models/mail-templates/your-lost-password.txt b/core/backend/admin/modules/modul_normal-login/models/mail-templates/your-lost-password.txt @@ -0,0 +1,9 @@ +Hello #USERNAME# + +We have set up a temporary password for your account at #WEBSITENAME#. + +Please login at #WEBSITEURL#login.php as soon as possible and change this password to something you will remember. + +Your Password: #GENERATED-PASS# + +-Regards diff --git a/core/backend/admin/modules/modul_normal-login/models/site-templates/default.css b/core/backend/admin/modules/modul_normal-login/models/site-templates/default.css @@ -0,0 +1,112 @@ +html, body { + margin: 0px; + background: #fff; + font-family:Verdana, Arial, Helvetica, sans-serif; + font-size:0.95em; + color:#4d4948; +} + +h1 { + margin: 0; + text-align: center; + font-size: 150%; + padding: 0px; +} + +h2 { + margin: 0; + text-align: center; + font-size: 120%; + padding: 0px; +} + +h3 { + margin: 0; + font-size: 105%; + padding: 0px; +} + +a { + color:#4d4948; +} + +#top { + margin: 0 auto 0 auto; + background:url('images/top-bg.jpg') repeat-x; + width:100%; + height:115px; +} + +#logo { + margin: 0 auto 0 auto; + background:url('images/latest-build.gif'); + width: 155px; + height: 124px; +} + +#content { + margin: 0 auto 0 auto; + width: 95%; +} + +#content #left-nav { + width:15%; + float:left; + font-size:95%; +} + +#content #left-nav ul { + padding:0 0 50px 0; + margin:0; +} + +#content #left-nav ul li { + padding:0; + margin:0; + list-style:none; +} + +#content #left-nav ul li a { + text-decoration:none; +} + +#content #left-nav ul li a:hover { + color:#ff0505; + text-decoration:underline; +} + +#content #main { + float:left; + width:85%; + font-size:90%; +} + +#content #main #regbox { + padding: 0 0 0 0; +} + +#content #main #regbox label { + width:100px; + float:left; +} + +table.admin td { + vertical-align: top; +} + +#error { + display:block; + margin:5px; + color:#4d4948; + background-color:#fffebe; + border: 1px solid #cbcbcb; + font-size:90%; +} + +#success { + margin:5px; + color:#4d4948; + background-color:#bce9b5; + border: 1px solid #7ace6c; + font-size:90%; +} diff --git a/core/backend/admin/modules/modul_normal-login/models/site-templates/images/latest-build.gif b/core/backend/admin/modules/modul_normal-login/models/site-templates/images/latest-build.gif Binary files differ. diff --git a/core/backend/admin/modules/modul_normal-login/models/site-templates/images/top-bg.jpg b/core/backend/admin/modules/modul_normal-login/models/site-templates/images/top-bg.jpg Binary files differ. diff --git a/core/backend/admin/modules/modul_normal-login/navi.php b/core/backend/admin/modules/modul_normal-login/navi.php @@ -1,5 +0,0 @@ -<a href="./login.php">login</a></br> -<a href="./logout.php">logout</a></br> -<a href="./register.php">register</a></br> -<a href="./secret.php">show secret</a></br> -<a href="./inhalt.php">inhalt</a></br> diff --git a/core/backend/admin/modules/modul_normal-login/register.php b/core/backend/admin/modules/modul_normal-login/register.php @@ -1,18 +1,144 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" - "http://www.w3.org/TR/html4/strict.dtd"> -<html> - <head> - <title>register</title> - <meta http-equiv="content-type" content="text/html; charset=UTF-8"> - </head> - <body> - <form action='./register_handling.php' method='POST'> - Username: - <input type='text' name='username'/> - <br/> - Passwort - <input type="password" name="passwd"/> - <input type='submit' name="go" value="go"/> - </form> - </body> -</html> -\ No newline at end of file +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Prevent the user visiting the logged in page if he/she is already logged in +if(isUserLoggedIn()) { header("Location: account.php"); die(); } + +//Forms posted +if(!empty($_POST)) +{ + $errors = array(); + $email = trim($_POST["email"]); + $username = trim($_POST["username"]); + $displayname = trim($_POST["displayname"]); + $password = trim($_POST["password"]); + $confirm_pass = trim($_POST["passwordc"]); + $captcha = md5($_POST["captcha"]); + + + if ($captcha != $_SESSION['captcha']) + { + $errors[] = lang("CAPTCHA_FAIL"); + } + if(minMaxRange(5,25,$username)) + { + $errors[] = lang("ACCOUNT_USER_CHAR_LIMIT",array(5,25)); + } + if(!ctype_alnum($username)){ + $errors[] = lang("ACCOUNT_USER_INVALID_CHARACTERS"); + } + if(minMaxRange(5,25,$displayname)) + { + $errors[] = lang("ACCOUNT_DISPLAY_CHAR_LIMIT",array(5,25)); + } + if(!ctype_alnum($displayname)){ + $errors[] = lang("ACCOUNT_DISPLAY_INVALID_CHARACTERS"); + } + if(minMaxRange(8,50,$password) && minMaxRange(8,50,$confirm_pass)) + { + $errors[] = lang("ACCOUNT_PASS_CHAR_LIMIT",array(8,50)); + } + else if($password != $confirm_pass) + { + $errors[] = lang("ACCOUNT_PASS_MISMATCH"); + } + if(!isValidEmail($email)) + { + $errors[] = lang("ACCOUNT_INVALID_EMAIL"); + } + //End data validation + if(count($errors) == 0) + { + //Construct a user object + $user = new User($username,$displayname,$password,$email); + + //Checking this flag tells us whether there were any errors such as possible data duplication occured + if(!$user->status) + { + if($user->username_taken) $errors[] = lang("ACCOUNT_USERNAME_IN_USE",array($username)); + if($user->displayname_taken) $errors[] = lang("ACCOUNT_DISPLAYNAME_IN_USE",array($displayname)); + if($user->email_taken) $errors[] = lang("ACCOUNT_EMAIL_IN_USE",array($email)); + } + else + { + //Attempt to add the user to the database, carry out finishing tasks like emailing the user (if required) + if(!$user->userCakeAddUser()) + { + if($user->mail_failure) $errors[] = lang("MAIL_ERROR"); + if($user->sql_failure) $errors[] = lang("SQL_ERROR"); + } + } + } + if(count($errors) == 0) { + $successes[] = $user->success; + } +} + +require_once("models/header.php"); +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Register</h2> + +<div id='left-nav'>"; +include("left-nav.php"); +echo " +</div> + +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<div id='regbox'> +<form name='newUser' action='".$_SERVER['PHP_SELF']."' method='post'> + +<p> +<label>User Name:</label> +<input type='text' name='username' /> +</p> +<p> +<label>Display Name:</label> +<input type='text' name='displayname' /> +</p> +<p> +<label>Password:</label> +<input type='password' name='password' /> +</p> +<p> +<label>Confirm:</label> +<input type='password' name='passwordc' /> +</p> +<p> +<label>Email:</label> +<input type='text' name='email' /> +</p> +<p> +<label>Security Code:</label> +<img src='models/captcha.php'> +</p> +<label>Enter Security Code:</label> +<input name='captcha' type='text'> +</p> +<label> <br> +<input type='submit' value='Register'/> +</p> + +</form> +</div> + +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; +?> diff --git a/core/backend/admin/modules/modul_normal-login/register_handling.php b/core/backend/admin/modules/modul_normal-login/register_handling.php @@ -1,47 +0,0 @@ -<?php - //<body onload="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';"> - ############################### - # include files from root dir # - ############################### - $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); - $currentdir = getcwd(); - $root_2 = str_replace($root_1, '', $currentdir); - $root_3 = explode("/", $root_2); - if ($root_3[1] == 'core') { - $root = realpath($_SERVER["DOCUMENT_ROOT"]); - }else{ - $root = $root_1 . '/' . $root_3[1]; - } - include_once('./navi.php'); - if (isset($_POST['go'])) { - include_once($root . '/core/libs/GA/GoogleAuthenticator.php'); - $g = new GoogleAuthenticator(); - $ga_secret = $g->generateSecret(); - $username = $_POST['username']; - $passwdhash = hash('sha512',$_POST['passwd'].$username); - include($root . '/core/config/connect.db.inc.php'); - //Check if Database connection established - if (mysqli_connect_errno()) { - printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); - exit(); - } - $eintrag = "INSERT INTO user(name, passwdhash, ga_secret)VALUES('$username', '$passwdhash', '$ga_secret')"; - $eintragen = mysqli_query($connection, $eintrag); - print("registiert<br/>"); - //* - print "this is your secret for the GoogleAuthenticator: <div id='secret' style='visibility:hidden'>$ga_secret</div> \n"; - print("keep it secret!!!!<br/>"); - //*/ - //include('./secret.php'); -?> - <a href="#" onmousedown="document.getElementById('qr_code').style.visibility='visible'; document.getElementById('secret').style.visibility='visible';" onmouseup="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';" onmouseout="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">show QR Code and secret</a><br> - <br/> -<?php - //* - print('<img id="qr_code" src="'); - print $g->getURL($username,'loginsec',$ga_secret); - print('" style="visibility:hidden"> '); - //print('" alt="" visibility="hidden"> '); - //*/ - } -?> diff --git a/core/backend/admin/modules/modul_normal-login/resend-activation.php b/core/backend/admin/modules/modul_normal-login/resend-activation.php @@ -0,0 +1,166 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Forms posted +if(!empty($_POST) && $emailActivation) +{ + $email = $_POST["email"]; + $username = $_POST["username"]; + + //Perform some validation + //Feel free to edit / change as required + if(trim($email) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_EMAIL"); + } + //Check to ensure email is in the correct format / in the db + else if(!isValidEmail($email) || !emailExists($email)) + { + $errors[] = lang("ACCOUNT_INVALID_EMAIL"); + } + + if(trim($username) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_USERNAME"); + } + else if(!usernameExists($username)) + { + $errors[] = lang("ACCOUNT_INVALID_USERNAME"); + } + + if(count($errors) == 0) + { + //Check that the username / email are associated to the same account + if(!emailUsernameLinked($email,$username)) + { + $errors[] = lang("ACCOUNT_USER_OR_EMAIL_INVALID"); + } + else + { + $userdetails = fetchUserDetails($username); + + //See if the user's account is activation + if($userdetails["active"]==1) + { + $errors[] = lang("ACCOUNT_ALREADY_ACTIVE"); + } + else + { + if ($resend_activation_threshold == 0) { + $hours_diff = 0; + } + else { + $last_request = $userdetails["last_activation_request"]; + $hours_diff = round((time()-$last_request) / (3600*$resend_activation_threshold),0); + } + + if($resend_activation_threshold!=0 && $hours_diff <= $resend_activation_threshold) + { + $errors[] = lang("ACCOUNT_LINK_ALREADY_SENT",array($resend_activation_threshold)); + } + else + { + //For security create a new activation url; + $new_activation_token = generateActivationToken(); + + if(!updateLastActivationRequest($new_activation_token,$username,$email)) + { + $errors[] = lang("SQL_ERROR"); + } + else + { + $mail = new userCakeMail(); + + $activation_url = $websiteUrl."activate-account.php?token=".$new_activation_token; + + //Setup our custom hooks + $hooks = array( + "searchStrs" => array("#ACTIVATION-URL","#USERNAME#"), + "subjectStrs" => array($activation_url,$userdetails["display_name"]) + ); + + if(!$mail->newTemplateMsg("resend-activation.txt",$hooks)) + { + $errors[] = lang("MAIL_TEMPLATE_BUILD_ERROR"); + } + else + { + if(!$mail->sendMail($userdetails["email"],"Activate your ".$websiteName." Account")) + { + $errors[] = lang("MAIL_ERROR"); + } + else + { + //Success, user details have been updated in the db now mail this information out. + $successes[] = lang("ACCOUNT_NEW_ACTIVATION_SENT"); + } + } + } + } + } + } + } +} + +//Prevent the user visiting the logged in page if he/she is already logged in +if(isUserLoggedIn()) { header("Location: account.php"); die(); } + +require_once("models/header.php"); + +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>Resend Activation</h2> +<div id='left-nav'>"; + +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo "<div id='regbox'>"; + +//Show disabled if email activation not required +if(!$emailActivation) +{ + echo lang("FEATURE_DISABLED"); +} +else +{ + echo "<form name='resendActivation' action='".$_SERVER['PHP_SELF']."' method='post'> + <p> + <label>Username:</label> + <input type='text' name='username' /> + </p> + <p> + <label>Email:</label> + <input type='text' name='email' /> + </p> + <p> + <label> </label> + <input type='submit' value='Submit' class='submit' /> + </p> + </form>"; +} + +echo " +</div> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?> diff --git a/core/backend/admin/modules/modul_normal-login/secret.php b/core/backend/admin/modules/modul_normal-login/secret.php @@ -1,55 +0,0 @@ -<body onload="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';"> -<?php - ############################### - # include files from root dir # - ############################### - $root_1 = realpath($_SERVER["DOCUMENT_ROOT"]); - $currentdir = getcwd(); - $root_2 = str_replace($root_1, '', $currentdir); - $root_3 = explode("/", $root_2); - if ($root_3[1] == 'core') { - $root = realpath($_SERVER["DOCUMENT_ROOT"]); - }else{ - $root = $root_1 . '/' . $root_3[1]; - } - if (empty($_SERVER['HTTPS'])) { - print('<body style="background-color:red;font-size:30px"><div style="color:white"><div style="font-size:240px">Stop</div><p>You wanted do view this site without an SSL encryption. The Secret can be stolen</p><br/><a href="https://raspberrypi/login_sec/secret.php">Here is the SSL Site</a></div></body>'); - die(); - } - include('./navi.php'); - include('./check_auth.php'); - if (!$authokay) { - die('not allowed'); - } - include_once($root . '/core/libs/GA/GoogleAuthenticator.php'); - $g = new GoogleAuthenticator(); - include($root . '/core/config/connect.db.inc.php'); - //Check if Database connection established - if (mysqli_connect_errno()) { - printf("Verbindung fehlgeschlagen: %s\n", mysqli_connect_error()); - exit(); - } - $user_exist = false; - $abfrage = "SELECT name,ga_secret FROM user WHERE id = '$authinfo'"; - $ergebnis = mysqli_query($connection, $abfrage); - while($row = mysqli_fetch_object($ergebnis)){ - $user_exist = true; - $username = $row->name; - $ga_secret = $row->ga_secret; - } - if (!$user_exist) { - die('user $user not found!'); - } - print "this is your secret for the GoogleAuthenticator: <div id='secret' style='visibility:hidden'>$ga_secret</div> \n"; - print("keep it secret!!!!<br/>"); -?> -<a href="#" onmousedown="document.getElementById('qr_code').style.visibility='visible'; document.getElementById('secret').style.visibility='visible';" onmouseup="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';" onmouseout="document.getElementById('qr_code').style.visibility='hidden'; document.getElementById('secret').style.visibility='hidden';">show QR Code and secret</a><br> -<br/> -<?php - print('<img id="qr_code" src="'); - print $g->getURL($username,'loginsec',$ga_secret); - print('" visibility="hidden" style="visibility:hidden"> '); - //print('" alt="" visibility="hidden"> '); - -?> -</body> -\ No newline at end of file diff --git a/core/backend/admin/modules/modul_normal-login/user_settings.php b/core/backend/admin/modules/modul_normal-login/user_settings.php @@ -0,0 +1,152 @@ +<?php +/* +UserCake Version: 2.0.2 +http://usercake.com +*/ + +require_once("models/config.php"); +if (!securePage($_SERVER['PHP_SELF'])){die();} + +//Prevent the user visiting the logged in page if he is not logged in +if(!isUserLoggedIn()) { header("Location: login.php"); die(); } + +if(!empty($_POST)) +{ + $errors = array(); + $successes = array(); + $password = $_POST["password"]; + $password_new = $_POST["passwordc"]; + $password_confirm = $_POST["passwordcheck"]; + + $errors = array(); + $email = $_POST["email"]; + + //Perform some validation + //Feel free to edit / change as required + + //Confirm the hashes match before updating a users password + $entered_pass = generateHash($password,$loggedInUser->hash_pw); + + if (trim($password) == ""){ + $errors[] = lang("ACCOUNT_SPECIFY_PASSWORD"); + } + else if($entered_pass != $loggedInUser->hash_pw) + { + //No match + $errors[] = lang("ACCOUNT_PASSWORD_INVALID"); + } + if($email != $loggedInUser->email) + { + if(trim($email) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_EMAIL"); + } + else if(!isValidEmail($email)) + { + $errors[] = lang("ACCOUNT_INVALID_EMAIL"); + } + else if(emailExists($email)) + { + $errors[] = lang("ACCOUNT_EMAIL_IN_USE", array($email)); + } + + //End data validation + if(count($errors) == 0) + { + $loggedInUser->updateEmail($email); + $successes[] = lang("ACCOUNT_EMAIL_UPDATED"); + } + } + + if ($password_new != "" OR $password_confirm != "") + { + if(trim($password_new) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_NEW_PASSWORD"); + } + else if(trim($password_confirm) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_CONFIRM_PASSWORD"); + } + else if(minMaxRange(8,50,$password_new)) + { + $errors[] = lang("ACCOUNT_NEW_PASSWORD_LENGTH",array(8,50)); + } + else if($password_new != $password_confirm) + { + $errors[] = lang("ACCOUNT_PASS_MISMATCH"); + } + + //End data validation + if(count($errors) == 0) + { + //Also prevent updating if someone attempts to update with the same password + $entered_pass_new = generateHash($password_new,$loggedInUser->hash_pw); + + if($entered_pass_new == $loggedInUser->hash_pw) + { + //Don't update, this fool is trying to update with the same password ¬¬ + $errors[] = lang("ACCOUNT_PASSWORD_NOTHING_TO_UPDATE"); + } + else + { + //This function will create the new hash and update the hash_pw property. + $loggedInUser->updatePassword($password_new); + $successes[] = lang("ACCOUNT_PASSWORD_UPDATED"); + } + } + } + if(count($errors) == 0 AND count($successes) == 0){ + $errors[] = lang("NOTHING_TO_UPDATE"); + } +} + +require_once("models/header.php"); +echo " +<body> +<div id='wrapper'> +<div id='top'><div id='logo'></div></div> +<div id='content'> +<h1>UserCake</h1> +<h2>User Settings</h2> +<div id='left-nav'>"; +include("left-nav.php"); + +echo " +</div> +<div id='main'>"; + +echo resultBlock($errors,$successes); + +echo " +<div id='regbox'> +<form name='updateAccount' action='".$_SERVER['PHP_SELF']."' method='post'> +<p> +<label>Password:</label> +<input type='password' name='password' /> +</p> +<p> +<label>Email:</label> +<input type='text' name='email' value='".$loggedInUser->email."' /> +</p> +<p> +<label>New Pass:</label> +<input type='password' name='passwordc' /> +</p> +<p> +<label>Confirm Pass:</label> +<input type='password' name='passwordcheck' /> +</p> +<p> +<label> </label> +<input type='submit' value='Update' class='submit' /> +</p> +</form> +</div> +</div> +<div id='bottom'></div> +</div> +</body> +</html>"; + +?>
