makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 14:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Auth plug-in, say thanks to Sergey Kanareykin

Browse source 
git-svn-id: file:///svn/phpbb/trunk@2828 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
Paul S. Owen 2002-08-06 16:56:14 +00:00
parent 685c8b0669
commit f8ea2a46a8
6 changed files with 330 additions and 284 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
phpBB/includes/auth/auth_apache.php Normal file
View file

@ -0,0 +1,27 @@
<?php
//
// Authentication plug-ins is largely down to
// Sergey Kanareykin, our thanks to him.
//
function login_apache(&$username, &$password)
{
global $HTTP_SERVER_VARS, $HTTP_ENV_VARS;
$php_auth_user = ( !empty($HTTP_SERVER_VARS['PHP_AUTH_USER']) ) ? $HTTP_SERVER_VARS['PHP_AUTH_USER'] : $HTTP_GET_VARS['PHP_AUTH_USER']
$php_auth_pw = ( !empty($HTTP_SERVER_VARS['PHP_AUTH_PW']) ) ? $HTTP_SERVER_VARS['PHP_AUTH_PW'] : $HTTP_GET_VARS['PHP_AUTH_PW']
if ( $php_auth_user && $php_auth_pw )
{
$sql = "SELECT user_id, username, user_password, user_email, user_active
FROM " . USERS_TABLE . "
WHERE username = '" . str_replace("\'", "''", $username) . "'";
$result = $db->sql_query($sql);
return ( $row = $db->sql_fetchrow($result) ? $row : false;
}
return false;
}
?>

29
phpBB/includes/auth/auth_db.php Normal file
View file

@ -0,0 +1,29 @@
<?php
//
// Authentication plug-ins is largely down to
// Sergey Kanareykin, our thanks to him.
//
function login_db(&$username, &$password)
{
global $db, $board_config;
$sql = "SELECT user_id, username, user_password, user_email, user_active
FROM " . USERS_TABLE . "
WHERE username = '" . str_replace("\'", "''", $username) . "'";
$result = $db->sql_query($sql);
if ( $row = $db->sql_fetchrow($result) )
{
$db->sql_freeresult($result);
if ( md5($password) == $row['user_password'] && $row['user_active'] )
{
return $row;
}
}
return false;
}
?>

44
phpBB/includes/auth/auth_ldap.php Normal file
View file

@ -0,0 +1,44 @@
<?php
//
// Authentication plug-ins is largely down to
// Sergey Kanareykin, our thanks to him.
//
function login_ldap(&$username, &$password)
{
global $board_config;
if ( !extension_loaded('ldap') )
{
return 'LDAP extension not available';
}
if ( !($ldap = @ldap_connect($board_config['ldap_server'])) )
{
return 'Could not connect to LDAP server';
}
$search = @ldap_search($ldap, $board_config['ldap_base_dn'], $board_config['ldap_uid'] . '=' . $username, array($board_config['ldap_uid']));
$result = @ldap_get_entries($ldap, $search);
if ( is_array($result) && count($result) > 1 )
{
if ( @ldap_bind($ldap, $result[0]['dn'], $password) )
{
@ldap_close($ldap);
$sql = "SELECT user_id, username, user_password, user_email, user_active
FROM " . USERS_TABLE . "
WHERE username = '" . str_replace("\'", "''", $username) . "'";
$result = $db->sql_query($sql);
return ( $row = $db->sql_fetchrow($result) ? $row : false;
}
}
@ldap_close($ldap);
return false;
}
?>

10
phpBB/includes/auth/index.htm Normal file
View file

@ -0,0 +1,10 @@
<html>
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
</body>
</html>

284
phpBB/includes/session.php
View file

@ -21,7 +21,7 @@
class session { class session {
var $userdata; var $session_id = '';
var $load; var $load;
function start($update = true) function start($update = true)
@ -29,22 +29,22 @@ class session {
global $SID, $db, $board_config, $user_ip; global $SID, $db, $board_config, $user_ip;
global $HTTP_SERVER_VARS, $HTTP_ENV_VARS, $HTTP_COOKIE_VARS, $HTTP_GET_VARS; global $HTTP_SERVER_VARS, $HTTP_ENV_VARS, $HTTP_COOKIE_VARS, $HTTP_GET_VARS;
$user_browser = ( !empty($HTTP_SERVER_VARS['HTTP_USER_AGENT']) ) ? $HTTP_SERVER_VARS['HTTP_USER_AGENT'] : $HTTP_ENV_VARS['HTTP_USER_AGENT'];
$user_page = ( !empty($HTTP_SERVER_VARS['PHP_SELF']) ) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_ENV_VARS['PHP_SELF'];
$user_page .= '&' . ( ( !empty($HTTP_SERVER_VARS['QUERY_STRING']) ) ? $HTTP_SERVER_VARS['QUERY_STRING'] : $HTTP_ENV_VARS['QUERY_STRING'] );
$current_time = time(); $current_time = time();
$session_browser = ( !empty($HTTP_SERVER_VARS['HTTP_USER_AGENT']) ) ? $HTTP_SERVER_VARS['HTTP_USER_AGENT'] : $HTTP_ENV_VARS['HTTP_USER_AGENT'];
$this_page = ( !empty($HTTP_SERVER_VARS['PHP_SELF']) ) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_ENV_VARS['PHP_SELF'];
$this_page .= '&' . ( ( !empty($HTTP_SERVER_VARS['QUERY_STRING']) ) ? $HTTP_SERVER_VARS['QUERY_STRING'] : $HTTP_ENV_VARS['QUERY_STRING'] );
if ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid']) || isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_data']) ) if ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid']) || isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_data']) )
{ {
$sessiondata = ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_data']) ) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_data'])) : ''; $sessiondata = ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_data']) ) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_data'])) : '';
$session_id = ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid']) ) ? $HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid'] : ''; $this->session_id = ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid']) ) ? $HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE; $SID = '?sid=';
} }
else else
{ {
$sessiondata = ''; $sessiondata = '';
$session_id = ( isset($HTTP_GET_VARS['sid']) ) ? $HTTP_GET_VARS['sid'] : ''; $this->session_id = ( isset($HTTP_GET_VARS['sid']) ) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET; $SID = '?sid=' . $this->session_id;
} }
// //
@ -63,49 +63,48 @@ class session {
} }
} }
if ( !empty($session_id) )
{
// //
// session_id exists so go ahead and attempt to grab all data in preparation // session_id exists so go ahead and attempt to grab all data in preparation
// //
if ( !empty($this->session_id) )
{
$sql = "SELECT u.*, s.* $sql = "SELECT u.*, s.*
FROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u FROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u
WHERE s.session_id = '$session_id' WHERE s.session_id = '" . $this->session_id . "'
AND u.user_id = s.session_user_id"; AND u.user_id = s.session_user_id";
$result = $db->sql_query($sql); $result = $db->sql_query($sql);
$this->userdata = $db->sql_fetchrow($result); $userdata = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
// //
// Did the session exist in the DB? // Did the session exist in the DB?
// //
if ( isset($this->userdata['user_id']) ) if ( isset($userdata['user_id']) )
{ {
// //
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24 // Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with // bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security. // load balanced et al proxies while retaining some reliance on IP security.
// //
$ip_check_s = explode('.', $this->userdata['session_ip']); $ip_check_s = explode('.', $userdata['session_ip']);
$ip_check_u = explode('.', $user_ip); $ip_check_u = explode('.', $user_ip);
if ( $ip_check_s[0].'.'.$ip_check_s[1].'.'.$ip_check_s[2] == $ip_check_u[0].'.'.$ip_check_u[1].'.'.$ip_check_u[2] ) if ( $ip_check_s[0].'.'.$ip_check_s[1].'.'.$ip_check_s[2] == $ip_check_u[0].'.'.$ip_check_u[1].'.'.$ip_check_u[2] )
{ {
$SID = '?sid=' . ( ( $sessionmethod == SESSION_METHOD_GET ) ? $session_id : '' );
// //
// Only update session DB a minute or so after last update or if page changes // Only update session DB a minute or so after last update or if page changes
// //
if ( ( $current_time - $this->userdata['session_time'] > 60 || $this->userdata['session_page'] != $this_page ) && $update ) if ( ( $current_time - $userdata['session_time'] > 60 || $userdata['session_page'] != $user_page ) && $update )
{ {
$sql = "UPDATE " . SESSIONS_TABLE . " $sql = "UPDATE " . SESSIONS_TABLE . "
SET session_time = $current_time, session_page = '$this_page' SET session_time = $current_time, session_page = '$user_page'
WHERE session_id = '" . $this->userdata['session_id'] . "'"; WHERE session_id = '" . $this->session_id . "'";
$db->sql_query($sql); $db->sql_query($sql);
// //
// Garbage collection ... remove old sessions updating user information // Garbage collection ... remove old sessions updating user information
// if necessary // if necessary. It means (potentially) lots of queries but only infrequently
// //
if ( $current_time - $board_config['session_gc'] > $board_config['session_last_gc'] ) if ( $current_time - $board_config['session_gc'] > $board_config['session_last_gc'] )
{ {
@ -113,10 +112,7 @@ class session {
} }
} }
setcookie($board_config['cookie_name'] . '_data', serialize($sessiondata), $current_time + 31536000, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']); return $userdata;
setcookie($board_config['cookie_name'] . '_sid', $session_id, 0, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']);
return $this->userdata;
} }
} }
} }
@ -128,12 +124,13 @@ class session {
$autologin = ( isset($sessiondata['autologinid']) ) ? $sessiondata['autologinid'] : ''; $autologin = ( isset($sessiondata['autologinid']) ) ? $sessiondata['autologinid'] : '';
$user_id = ( isset($sessiondata['userid']) ) ? intval($sessiondata['userid']) : ANONYMOUS; $user_id = ( isset($sessiondata['userid']) ) ? intval($sessiondata['userid']) : ANONYMOUS;
$this->userdata = $this->create($session_id, $user_id, $autologin, $this_page, $session_browser); return $this->create($user_id, $autologin, $user_page, $user_browser);
return $this->userdata;
} }
function create(&$session_id, &$user_id, &$autologin, &$this_page, &$session_browser) //
// Create a new session
//
function create(&$user_id, &$autologin, &$user_page, &$user_browser)
{ {
global $SID, $db, $board_config, $user_ip; global $SID, $db, $board_config, $user_ip;
@ -148,73 +145,66 @@ class session {
case 'mysql': case 'mysql':
case 'mysql4': case 'mysql4':
$sql = "SHOW PROCESSLIST"; $sql = "SHOW PROCESSLIST";
$result = $db->sql_query($sql);
$current_sessions = 0;
while ( $db->sql_fetchrow($result) ) $current_sessions++;
break; break;
default: default:
$sql = "SELECT COUNT(*) AS sessions $sql = "SELECT COUNT(*) AS sessions
FROM " . SESSIONS_TABLE . " FROM " . SESSIONS_TABLE . "
WHERE session_time >= " . ( $current_time - 3600 ); WHERE session_time >= " . ( $current_time - 3600 );
}
$result = $db->sql_query($sql); $result = $db->sql_query($sql);
switch ( SQL_LAYER )
{
case 'mysql':
case 'mysql4':
$current_sessions = 0;
while ( $db->sql_fetchrow($result) ) $current_sessions++;
break;
default:
$row = $db->sql_fetchrow[$result]; $row = $db->sql_fetchrow[$result];
$current_sessions = ( isset($row['sessions']) ) ? $row['sessions'] : 0; $current_sessions = ( isset($row['sessions']) ) ? $row['sessions'] : 0;
} }
$db->sql_freeresult($result);
if ( intval($board_config['active_sessions']) && $current_sessions > intval($board_config['active_sessions']) ) if ( intval($board_config['active_sessions']) && $current_sessions > intval($board_config['active_sessions']) )
{ {
message_die(GENERAL_MESSAGE, 'Board_unavailable', 'Information'); message_die(MESSAGE, 'Board_unavailable');
} }
//
// Grab user data
//
$sql = "SELECT * $sql = "SELECT *
FROM " . USERS_TABLE . " FROM " . USERS_TABLE . "
WHERE user_id = $user_id"; WHERE user_id = $user_id";
$result = $db->sql_query($sql); $result = $db->sql_query($sql);
$this->userdata = $db->sql_fetchrow($result); $userdata = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
// //
// Check autologin request, is it valid? // Check autologin request, is it valid?
// //
if ( $this->userdata['user_password'] != $autologin || !$this->userdata['user_active'] || $user_id == ANONYMOUS ) if ( $userdata['user_password'] != $autologin || !$userdata['user_active'] || $user_id == ANONYMOUS )
{ {
$autologin = ''; $autologin = '';
$this->userdata['user_id'] = $user_id = ANONYMOUS; $userdata['user_id'] = $user_id = ANONYMOUS;
} }
$user_ip_parts = explode('.', $user_ip);
$sql = "SELECT ban_ip, ban_userid, ban_email $sql = "SELECT ban_ip, ban_userid, ban_email
FROM " . BANLIST_TABLE . " FROM " . BANLIST_TABLE . "
WHERE ( ban_end >= $current_time WHERE ban_end >= $current_time
OR ban_end = 0 ) OR ban_end = 0";
AND ban_ip IN (
'" . $user_ip_parts[0] . ".',
'" . $user_ip_parts[0] . "." . $user_ip_parts[1] . ".',
'" . $user_ip_parts[0] . "." . $user_ip_parts[1] . "." . $user_ip_parts[2] . ".',
'" . $user_ip_parts[0] . "." . $user_ip_parts[1] . "." . $user_ip_parts[2] . "." . $user_ip_parts[3] . "')
OR ban_userid = " . $this->userdata['user_id'];
if ( $user_id != ANONYMOUS )
{
$sql .= " OR ban_email LIKE '" . str_replace('\\\'', '\\\'\\\'', $this->userdata['user_email']) . "'
OR ban_email LIKE '" . substr(str_replace('\\\'', '\\\'\\\'', $this->userdata['user_email']), strpos(str_replace('\\\'', '\\\'\\\'', $this->userdata['user_email']), '@')) . "'";
}
$result = $db->sql_query($sql); $result = $db->sql_query($sql);
if ( $ban_info = $db->sql_fetchrow($result) ) if ( $row = $db->sql_fetchrow($result) )
{ {
if ( $ban_info['ban_ip'] || $ban_info['ban_userid'] || $ban_info['ban_email'] ) do
{
if ( ( $row['user_id'] == $userdata['user_id'] ||
( $row['ban_ip'] && preg_match('#^' . str_replace('*', '.*?', $row['ban_ip']) . '$#i', $user_ip) ) ||
( $row['ban_email'] && preg_match('#^' . str_replace('*', '.*?', $row['ban_email']) . '$#i', $userdata['user_email']) ) )
&& !$userdata['user_founder'] )
{ {
message_die(MESSAGE, 'You_been_banned'); message_die(MESSAGE, 'You_been_banned');
} }
} }
while ( $row = $db->sql_fetchrow($result) );
}
$db->sql_freeresult($result);
// //
// Create or update the session // Create or update the session
@ -222,50 +212,45 @@ class session {
$db->sql_return_on_error(true); $db->sql_return_on_error(true);
$sql = "UPDATE " . SESSIONS_TABLE . " $sql = "UPDATE " . SESSIONS_TABLE . "
SET session_user_id = $user_id, session_start = $current_time, session_time = $current_time, session_browser = '$session_browser', session_page = '$this_page' SET session_user_id = $user_id, session_start = $current_time, session_time = $current_time, session_browser = '$user_browser', session_page = '$user_page'
WHERE session_id = '$session_id'"; WHERE session_id = '" . $this->session_id . "'";
if ( !$db->sql_query($sql) || !$db->sql_affectedrows() ) if ( !($result = $db->sql_query($sql)) || !$db->sql_affectedrows() )
{ {
$db->sql_return_on_error(false); $db->sql_return_on_error(false);
$session_id = md5(uniqid($user_ip)); $this->session_id = md5(uniqid($user_ip));
$sql = "INSERT INTO " . SESSIONS_TABLE . " $sql = "INSERT INTO " . SESSIONS_TABLE . "
(session_id, session_user_id, session_start, session_time, session_ip, session_browser, session_page) (session_id, session_user_id, session_start, session_time, session_ip, session_browser, session_page)
VALUES ('$session_id', $user_id, $current_time, $current_time, '$user_ip', '$session_browser', '$this_page')"; VALUES ('" . $this->session_id . "', $user_id, $current_time, $current_time, '$user_ip', '$user_browser', '$user_page')";
$db->sql_query($sql); $db->sql_query($sql);
} }
$db->sql_return_on_error(false); $db->sql_return_on_error(false);
$SID = '?sid=' . $session_id; $userdata['session_id'] = $session_id;
$sessiondata['autologinid'] = ( $autologin && $user_id != ANONYMOUS ) ? $autologin : ''; $sessiondata['autologinid'] = ( $autologin && $user_id != ANONYMOUS ) ? $autologin : '';
$sessiondata['userid'] = $user_id; $sessiondata['userid'] = $user_id;
setcookie($board_config['cookie_name'] . '_data', serialize($sessiondata), $current_time + 31536000, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']); setcookie($board_config['cookie_name'] . '_data', serialize($sessiondata), $current_time + 31536000, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']);
setcookie($board_config['cookie_name'] . '_sid', $session_id, 0, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']); setcookie($board_config['cookie_name'] . '_sid', $this->session_id, 0, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']);
$SID = '?sid=' . $this->session_id;
$this->userdata['session_id'] = $session_id; return $userdata;
return $this->userdata;
} }
//
// Destroy a session
//
function destroy(&$userdata) function destroy(&$userdata)
{ {
global $SID, $db, $board_config, $user_ip; global $SID, $db, $board_config;
global $HTTP_SERVER_VARS, $HTTP_ENV_VARS, $HTTP_COOKIE_VARS, $HTTP_GET_VARS; global $HTTP_COOKIE_VARS, $HTTP_GET_VARS;
if ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid']) )
{
$session_id = ( isset($HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid']) ) ? $HTTP_COOKIE_VARS[$board_config['cookie_name'] . '_sid'] : '';
}
else
{
$session_id = ( isset($HTTP_GET_VARS['sid']) ) ? $HTTP_GET_VARS['sid'] : '';
}
$sessiondata = array();
$current_time = time(); $current_time = time();
setcookie($board_config['cookie_name'] . '_data', '', $current_time - 31536000, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']);
setcookie($board_config['cookie_name'] . '_sid', '', $current_time - 31536000, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']);
// //
// Delete existing session, update last visit info first! // Delete existing session, update last visit info first!
// //
@ -275,18 +260,19 @@ class session {
$db->sql_query($sql); $db->sql_query($sql);
$sql = "DELETE FROM " . SESSIONS_TABLE . " $sql = "DELETE FROM " . SESSIONS_TABLE . "
WHERE session_id = '" . $userdata['session_id'] . "' WHERE session_id = '" . $this->session_id . "'
AND session_user_id = " . $userdata['user_id']; AND session_user_id = " . $userdata['user_id'];
$db->sql_query($sql); $db->sql_query($sql);
$SID = '?sid='; $SID = '?sid=';
$this->session_id = '';
setcookie($board_config['cookie_name'] . '_data', '', $current_time - 31536000, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']);
setcookie($board_config['cookie_name'] . '_sid', '', $current_time - 31536000, $board_config['cookie_path'], $board_config['cookie_domain'], $board_config['cookie_secure']);
return true; return true;
} }
//
// Garbage collection
//
function gc(&$current_time) function gc(&$current_time)
{ {
global $db, $board_config, $user_ip; global $db, $board_config, $user_ip;
@ -328,14 +314,10 @@ class session {
return; return;
} }
function get_cookies()
{
}
function set_cookies()
{
}
//
//
//
function configure($userdata, $lang_set = false) function configure($userdata, $lang_set = false)
{ {
global $db, $template, $lang, $board_config, $theme, $images; global $db, $template, $lang, $board_config, $theme, $images;
@ -456,7 +438,7 @@ class auth {
return; return;
} }
function get_acl($forum_id = false, $auth_main = false, $auth_type = false) function get_acl($forum_id, $auth_main = false, $auth_type = false)
{ {
if ( $auth_main && $auth_type ) if ( $auth_main && $auth_type )
{ {
@ -472,16 +454,15 @@ class auth {
function get_acl_admin($auth_type = false) function get_acl_admin($auth_type = false)
{ {
if ( $auth_type ) return $this->get_acl(0, 'admin', $auth_type);
{
return $this->acl[0]['admin'][$auth_type];
}
else if ( !$auth_type && is_array($this->acl[0]['admin']) )
{
return ( array_sum($this->acl[0]['admin']) ) ? true : false;
} }
return false; function get_acl_user($forum_id, $user_id, $acl = false)
{
}
function get_acl_group($forum_id, $group_id, $acl = false)
{
} }
function set_acl($forum_id, $user_id = false, $group_id = false, $auth = false, $dependencies = array()) function set_acl($forum_id, $user_id = false, $group_id = false, $auth = false, $dependencies = array())
@ -497,15 +478,30 @@ class auth {
'mod' => array( 'mod' => array(
'forum' => array( 'forum' => array(
'list' => 1, 'list' => 1,
'read' => 1,
'post' => 1, 'post' => 1,
'reply' => 1, 'reply' => 1,
'edit' => 1, 'edit' => 1,
'delete' => 1, 'delete' => 1,
'poll' => 1,
'vote' => 1, 'vote' => 1,
'edit' => 1, 'announce' => 1,
'sticky' => 1,
'attach' => 1,
'download' => 1,
'html' => 1,
'bbcode' => 1,
'smilies' => 1,
'img' => 1,
'flash' => 1,
'sigs' => 1,
'search' => 1, 'search' => 1,
'email' => 1,
'rate' => 1,
'print' => 1,
'ignoreflood' => 1,
'ignorequeue' => 1 'ignorequeue' => 1
) ),
), ),
'admin' => array( 'admin' => array(
'forum' => array( 'forum' => array(
@ -542,8 +538,7 @@ class auth {
'split' => 1, 'split' => 1,
'merge' => 1, 'merge' => 1,
'approve' => 1, 'approve' => 1,
'unrate' => 1, 'unrate' => 1
'auth' => 1
) )
) )
)); ));
@ -553,7 +548,7 @@ class auth {
// //
// //
// //
$sql = ( $user_id !== false ) ? "SELECT a.user_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . ACL_USERS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.user_id = $user_id" : "SELECT ug.user_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . USER_GROUP_TABLE . " ug, " . ACL_USERS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.user_id = ug.user_id AND ug.group_id = $group_id"; $sql = ( $user_id !== false ) ? "SELECT a.user_id, o.auth_type, o.auth_option_id, o.auth_option, a.auth_allow_deny FROM " . ACL_USERS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o, " . USERS_TABLE . " u WHERE a.auth_option_id = o.auth_option_id $forum_sql AND u.user_id = a.user_id AND a.user_id = $user_id" : "SELECT ug.user_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . USER_GROUP_TABLE . " ug, " . ACL_USERS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o, " . USERS_TABLE . " u WHERE a.auth_option_id = o.auth_option_id $forum_sql AND u.user_id = a.user_id AND a.user_id = ug.user_id AND ug.group_id = $group_id";
$result = $db->sql_query($sql); $result = $db->sql_query($sql);
$current_user_auth = array(); $current_user_auth = array();
@ -561,13 +556,13 @@ class auth {
{ {
do do
{ {
$current_user_auth[$row['user_id']][$row['auth_type']][$row['auth_option']] = $row['auth_allow_deny']; $current_user_auth[$row['user_id']][$row['auth_type']][$row['auth_option_id']] = $row['auth_allow_deny'];
} }
while ( $row = $db->sql_fetchrow($result) ); while ( $row = $db->sql_fetchrow($result) );
} }
$db->sql_freeresult($result); $db->sql_freeresult($result);
$sql = ( $group_id !== false ) ? "SELECT a.group_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . ACL_GROUPS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.group_id = $group_id" : "SELECT ug.group_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . USER_GROUP_TABLE . " ug, " . ACL_GROUPS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.group_id = ug.group_id AND ug.user_id = $user_id"; $sql = ( $group_id !== false ) ? "SELECT a.group_id, o.auth_type, o.auth_option_id, o.auth_option, a.auth_allow_deny FROM " . ACL_GROUPS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.group_id = $group_id" : "SELECT ug.group_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . USER_GROUP_TABLE . " ug, " . ACL_GROUPS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.group_id = ug.group_id AND ug.user_id = $user_id";
$result = $db->sql_query($sql); $result = $db->sql_query($sql);
$current_group_auth = array(); $current_group_auth = array();
@ -575,12 +570,14 @@ class auth {
{ {
do do
{ {
$current_group_auth[$row['group_id']][$row['auth_type']][$row['auth_option']] = $row['auth_allow_deny']; $current_group_auth[$row['group_id']][$row['auth_type']][$row['auth_option_id']] = $row['auth_allow_deny'];
} }
while ( $row = $db->sql_fetchrow($result) ); while ( $row = $db->sql_fetchrow($result) );
} }
$db->sql_freeresult($result); $db->sql_freeresult($result);
print_r($current_user_auth);
foreach ( $auth as $auth_type => $auth_option_ary ) foreach ( $auth as $auth_type => $auth_option_ary )
{ {
foreach ( $auth_option_ary as $auth_option => $allow ) foreach ( $auth_option_ary as $auth_option => $allow )
@ -591,12 +588,12 @@ class auth {
{ {
foreach ( $current_user_auth as $user => $user_auth_ary ) foreach ( $current_user_auth as $user => $user_auth_ary )
{ {
$sql_ary[] = ( !isset($user_auth_ary[$auth_type][$auth_option]) ) ? "User => I => $auth_option => $allow" : ( ( $user_auth_ary[$auth_type][$auth_option] != $allow ) ? "User => U => $auth_option => $allow" : "User => NOWT => $auth_option " ); $sql_ary[] = ( !isset($user_auth_ary[$auth_type][$auth_option]) ) ? "INSERT INTO " . ACL_USERS_TABLE . " (user_id, forum_id, auth_option_id, auth_allow_deny) VALUES ($user_id, $forum_id, $auth_option, $allow)" : ( ( $user_auth_ary[$auth_type][$auth_option] != $allow ) ? "UPDATE " . ACL_USERS_TABLE . " SET auth_allow_deny = $allow WHERE user_id = $user_id AND forum_id = $forum_id and auth_option_id = $auth_option" : '' );
} }
} }
else else
{ {
$sql_ary[] = "User => I => $auth_option => $allow"; $sql_ary[] = "INSERT INTO " . ACL_USERS_TABLE . " (user_id, forum_id, auth_option_id, auth_allow_deny) VALUES ($user_id, $forum_id, $auth_option, $allow)";
} }
} }
@ -606,12 +603,12 @@ class auth {
{ {
foreach ( $current_group_auth as $group => $group_auth_ary ) foreach ( $current_group_auth as $group => $group_auth_ary )
{ {
$sql_ary[] = ( !isset($group_auth_ary[$auth_type][$auth_option]) ) ? "Group => I => $auth_option => $allow" : ( ( $group_auth_ary[$auth_type][$auth_option] != $allow ) ? "Group => U => $auth_option => $allow" : "Group => NOWT => $auth_option " ); $sql_ary[] = ( !isset($group_auth_ary[$auth_type][$auth_option]) ) ? "INSERT INTO " . ACL_GROUPS_TABLE . " (group_id, forum_id, auth_option_id, auth_allow_deny) VALUES ($group_id, $forum_id, $auth_option, $allow)" : ( ( $group_auth_ary[$auth_type][$auth_option] != $allow ) ? "UPDATE " . ACL_GROUPS_TABLE . " SET auth_allow_deny = $allow WHERE group_id = $group_id AND forum_id = $forum_id and auth_option_id = $auth_option" : '' );
} }
} }
else else
{ {
$sql_ary[] = "Group => I => $auth_option => $allow"; $sql_ary[] = "INSERT INTO " . ACL_GROUPS_TABLE . " (group_id, forum_id, auth_option_id, auth_allow_deny) VALUES ($group_id, $forum_id, $auth_option, $allow)";
} }
} }
} }
@ -619,10 +616,25 @@ class auth {
print_r($sql_ary); print_r($sql_ary);
// //
// Need to update prefetch table ... the fun bit // Need to update prefetch table ... the fun bit
// //
$sql = ( $user_id !== false ) ? "SELECT a.user_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . ACL_PREFETCH_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.user_id = $user_id" : "SELECT ug.user_id, o.auth_type, o.auth_option, a.auth_allow_deny FROM " . USER_GROUP_TABLE . " ug, " . ACL_USERS_TABLE . " a, " . ACL_OPTIONS_TABLE . " o WHERE a.auth_option_id = o.auth_option_id $forum_sql AND a.user_id = ug.user_id AND ug.group_id = $group_id";
$result = $db->sql_query($sql);
$prefetch_auth = array();
if ( $row = $db->sql_fetchrow($result) )
{
do
{
$prefetch_auth[$row['user_id']][$row['auth_type']][$row['auth_option']] = $row['auth_allow_deny'];
}
while ( $row = $db->sql_fetchrow($result) );
}
$db->sql_freeresult($result);
print_r($prefetch_auth);
foreach ( $auth as $auth_type => $auth_option_ary ) foreach ( $auth as $auth_type => $auth_option_ary )
{ {
foreach ( $dependencies[$auth_type] as $dep_sub_type => $dep_sub_type_ary ) foreach ( $dependencies[$auth_type] as $dep_sub_type => $dep_sub_type_ary )
@ -640,42 +652,42 @@ class auth {
} }
// //
// Centralised login? May stay, may not ... depends if needed // Authentication plug-ins is largely down to
// Sergey Kanareykin, our thanks to him.
// //
class login
{
function login($username, $password, $autologin = false) function login($username, $password, $autologin = false)
{ {
global $SID, $db, $board_config, $lang, $user_ip, $userdata; global $SID, $db, $board_config, $lang, $user_ip, $session;
global $HTTP_SERVER_VARS, $HTTP_ENV_VARS; global $HTTP_SERVER_VARS, $HTTP_ENV_VARS, $phpEx;
$this_page = ( !empty($HTTP_SERVER_VARS['PHP_SELF']) ) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_ENV_VARS['PHP_SELF']; $user_page = ( !empty($HTTP_SERVER_VARS['PHP_SELF']) ) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_ENV_VARS['PHP_SELF'];
$this_page .= '&' . ( ( !empty($HTTP_SERVER_VARS['QUERY_STRING']) ) ? $HTTP_SERVER_VARS['QUERY_STRING'] : $HTTP_ENV_VARS['QUERY_STRING'] ); $user_page .= '&' . ( ( !empty($HTTP_SERVER_VARS['QUERY_STRING']) ) ? $HTTP_SERVER_VARS['QUERY_STRING'] : $HTTP_ENV_VARS['QUERY_STRING'] );
$session_browser = ( !empty($HTTP_SERVER_VARS['HTTP_USER_AGENT']) ) ? $HTTP_SERVER_VARS['HTTP_USER_AGENT'] : $HTTP_ENV_VARS['HTTP_USER_AGENT']; $this_browser = ( !empty($HTTP_SERVER_VARS['HTTP_USER_AGENT']) ) ? $HTTP_SERVER_VARS['HTTP_USER_AGENT'] : $HTTP_ENV_VARS['HTTP_USER_AGENT'];
$sql = "SELECT user_id, username, user_password, user_email, user_active, user_level $method = trim($board_config['auth_method']);
FROM " . USERS_TABLE . "
WHERE username = '" . str_replace("\'", "''", $username) . "'";
$result = $db->sql_query($sql);
if ( $row = $db->sql_fetchrow($result) ) if ( file_exists('includes/auth/auth_' . $method . '.' . $phpEx) )
{ {
if ( $board_config['ldap_enable'] && extension_loaded('ldap') ) include_once('includes/auth/auth_' . $method . '.' . $phpEx);
$method = 'login_' . $method;
if ( function_exists($method) )
{ {
if ( !($ldap_id = @ldap_connect($board_config['ldap_hostname'])) ) if ( !($user = $method($username, $password)) )
{ {
@ldap_unbind($ldap_id); return false;
} }
}
else
{
if ( md5($password) == $row['user_password'] && $row['user_active'] )
{
$autologin = ( isset($autologin) ) ? md5($password) : ''; $autologin = ( isset($autologin) ) ? md5($password) : '';
$userdata = $session->create($session_id, $user_id, $autologin, $this_page, $session_browser);
} return ( $user['user_active'] ) ? $session->create($user['user_id'], $autologin, $user_page, $this_browser) : false;
} }
} }
return $result; message_die(ERROR, 'Authentication method not found');
}
} }
?> ?>

132
phpBB/login.php
View file

@ -8,7 +8,6 @@
* *
* $Id$ * $Id$
* *
*
***************************************************************************/ ***************************************************************************/
/*************************************************************************** /***************************************************************************
@ -20,12 +19,9 @@
* *
***************************************************************************/ ***************************************************************************/
//
// Allow people to reach login page if
// board is shut down
//
define('IN_LOGIN', true); define('IN_LOGIN', true);
define('IN_PHPBB', true); define('IN_PHPBB', true);
$phpbb_root_path = './'; $phpbb_root_path = './';
include($phpbb_root_path . 'extension.inc'); include($phpbb_root_path . 'extension.inc');
include($phpbb_root_path . 'common.'.$phpEx); include($phpbb_root_path . 'common.'.$phpEx);
@ -34,60 +30,43 @@ include($phpbb_root_path . 'common.'.$phpEx);
// Set page ID for session management // Set page ID for session management
// //
$userdata = $session->start(); $userdata = $session->start();
$session->configure($userdata);
$acl = new auth('list', $userdata); $acl = new auth('list', $userdata);
$session->configure($userdata);
// //
// End session management // End session management
// //
// //
// Configure style, language, etc. // This appears to work for IIS5 CGI under Win2K. Uses getenv since this doesn't exist for
// ISAPI mode and therefore the normal Location redirector is used in preference
// //
$header_location = ( @preg_match('/Microsoft|WebSTAR|Xitami/', getenv('SERVER_SOFTWARE')) ) ? 'Refresh: 0; URL=' : 'Location: '; $header_location = ( @preg_match('/Microsoft|WebSTAR|Xitami/', getenv('SERVER_SOFTWARE')) ) ? 'Refresh: 0; URL=' : 'Location: ';
if ( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) || isset($HTTP_POST_VARS['logout']) || isset($HTTP_GET_VARS['logout']) ) extract($HTTP_GET_VARS);
{ extract($HTTP_POST_VARS);
$redirect = ( isset($redirect) ) ? $HTTP_SERVER_VARS['QUERY_STRING'] : '';
// //
// This appears to work for IIS5 CGI under Win2K. Uses getenv // Do the login/logout/form/whatever
// since this doesn't exist for ISAPI mode and therefore the
// normal Location redirector is used in preference
// //
if ( ( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) ) && !$userdata['session_logged_in'] ) if ( isset($login) || isset($logout) )
{ {
$redirect = ( !empty($HTTP_POST_VARS['redirect']) ) ? $HTTP_POST_VARS['redirect'] : 'index.'.$phpEx; if ( isset($login) && $userdata['user_id'] == ANONYMOUS )
$username = ( isset($HTTP_POST_VARS['username']) ) ? $HTTP_POST_VARS['username'] : '';
$password = ( isset($HTTP_POST_VARS['password']) ) ? $HTTP_POST_VARS['password'] : '';
$sql = "SELECT user_id, username, user_email, user_password, user_active
FROM " . USERS_TABLE . "
WHERE username = '" . str_replace("\'", "''", $username) . "'";
$result = $db->sql_query($sql);
if ( $row = $db->sql_fetchrow($result) )
{ {
if ( $row['user_level'] != ADMIN && $board_config['board_disable'] ) $autologin = ( !empty($autologin) ) ? true : false;
//
// Is the board disabled? Are we an admin? No, then back to the index we go
//
if ( $board_config['board_disable'] && !$acl->get_acl_admin() )
{ {
header($header_location . "index.$phpEx$SID"); header($header_location . "index.$phpEx$SID");
exit; exit;
} }
else
{
if ( md5($password) == $row['user_password'] && $row['user_active'] )
{
$autologin = ( isset($HTTP_POST_VARS['autologin']) ) ? md5($password) : '';
$this_page = ( !empty($HTTP_SERVER_VARS['PHP_SELF']) ) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_ENV_VARS['PHP_SELF'];
$this_page .= '&' . ( ( !empty($HTTP_SERVER_VARS['QUERY_STRING']) ) ? $HTTP_SERVER_VARS['QUERY_STRING'] : $HTTP_ENV_VARS['QUERY_STRING'] );
$session_browser = ( !empty($HTTP_SERVER_VARS['HTTP_USER_AGENT']) ) ? $HTTP_SERVER_VARS['HTTP_USER_AGENT'] : $HTTP_ENV_VARS['HTTP_USER_AGENT'];
$userdata = $session->create($userdata['session_id'], $row['user_id'], $autologin, $this_page, $session_browser); if ( new login($username, $password, $autologin) )
header($header_location . $redirect . $SID);
exit;
}
else
{ {
$template->assign_vars(array( $template->assign_vars(array(
'META' => '<meta http-equiv="refresh" content="3;url=' . "login.$phpEx$SID&amp;redirect=$redirect" . '">') 'META' => '<meta http-equiv="refresh" content="3;url=' . "login.$phpEx$SID&amp;redirect=$redirect" . '">')
@ -97,81 +76,28 @@ if ( isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login']) || isset(
message_die(MESSAGE, $message); message_die(MESSAGE, $message);
} }
} }
} else if ( $userdata['user_id'] != ANONYMOUS )
else
{
$template->assign_vars(array(
'META' => '<meta http-equiv="refresh" content="3;url=' . "login.$phpEx$SID&amp;redirect=$redirect" . '">')
);
$message = $lang['Error_login'] . '<br /><br />' . sprintf($lang['Click_return_login'], '<a href="' . "login.$phpEx$SID&amp;redirect=$redirect" . '">', '</a>') . '<br /><br />' . sprintf($lang['Click_return_index'], '<a href="' . "index.$phpEx$SID" . '">', '</a>');
message_die(MESSAGE, $message);
}
}
else if ( ( isset($HTTP_GET_VARS['logout']) || isset($HTTP_POST_VARS['logout']) ) && $userdata['user_id'] != ANONYMOUS )
{ {
$session->destroy($userdata); $session->destroy($userdata);
} }
header($header_location . $redirect . $SID); //
// Redirect to wherever we're supposed to go ...
//
$redirect_url = ( $redirect ) ? preg_replace('/^.*?redirect=(.*?)&(.*?)$/', '\\1' . $SID . '&\\2', $redirect) : 'index.'.$phpEx;
header($header_location . $redirect_url);
exit; exit;
} }
else
{
//
// Do a full login page dohickey if
// user not already logged in
//
if ( $userdata['user_id'] == ANONYMOUS ) if ( $userdata['user_id'] == ANONYMOUS )
{ {
if ( isset($HTTP_POST_VARS['redirect']) || isset($HTTP_GET_VARS['redirect']) )
{
$forward_to = $HTTP_SERVER_VARS['QUERY_STRING'];
if ( preg_match('/^redirect=(.*)$/si', $forward_to, $forward_matches) )
{
$forward_to = ( !empty($forward_matches[3]) ) ? $forward_matches[3] : $forward_matches[1];
$forward_match = explode('&', $forward_to);
if ( count($forward_match) > 1 )
{
$forward_page = '';
for($i = 1; $i < count($forward_match); $i++)
{
if ( !ereg('sid=', $forward_match[$i]) )
{
if ( $forward_page != '' )
{
$forward_page .= '&';
}
$forward_page .= $forward_match[$i];
}
}
$forward_page = $forward_match[0] . '?' . $forward_page;
}
else
{
$forward_page = $forward_match[0];
}
}
}
else
{
$forward_page = '';
}
$template->assign_vars(array( $template->assign_vars(array(
'USERNAME' => ( $userdata['user_id'] != ANONYMOUS ) ? $userdata['username'] : '',
'L_ENTER_PASSWORD' => $lang['Enter_password'], 'L_ENTER_PASSWORD' => $lang['Enter_password'],
'L_SEND_PASSWORD' => $lang['Forgotten_password'], 'L_SEND_PASSWORD' => $lang['Forgotten_password'],
'U_SEND_PASSWORD' => "profile.$phpEx$SID&amp;mode=sendpassword", 'U_SEND_PASSWORD' => "profile.$phpEx$SID&amp;mode=sendpassword",
'S_HIDDEN_FIELDS' => '<input type="hidden" name="redirect" value="' . $forward_page . '" />') 'S_HIDDEN_FIELDS' => '<input type="hidden" name="redirect" value="' . $redirect . '" />')
); );
$page_title = $lang['Login']; $page_title = $lang['Login'];
@ -190,6 +116,4 @@ else
exit; exit;
} }
}
?> ?>