From b5771e501defa7267ace6ded6617af8fe6adccf6 Mon Sep 17 00:00:00 2001 From: e107steved Date: Fri, 13 Jun 2008 20:20:23 +0000 Subject: [PATCH] Password options for logon, email login option, random user name/PW generation, Bugtracker #4393 and possibly others previously added to 0.7 --- class2.php | 43 +- e107_admin/auth.php | 118 +++- e107_admin/prefs.php | 215 ++++--- e107_admin/sql/core_sql.php | 8 +- e107_admin/users.php | 60 +- e107_files/chap_script.js | 408 +++++++++++++ e107_files/def_e107_prefs.php | 18 +- .../shortcode/batch/signup_shortcodes.php | 10 +- e107_files/utilities/passcalc.php | 126 ++++ e107_files/utilities/passconv.php | 296 ++++++++++ e107_handlers/admin_log_class.php | 6 +- e107_handlers/login.php | 537 +++++++++++------- e107_handlers/user_extended_class.php | 31 +- e107_handlers/user_handler.php | 362 ++++++++++++ e107_languages/English/admin/lan_prefs.php | 33 +- e107_languages/English/admin/lan_users.php | 10 +- e107_languages/English/lan_login.php | 7 +- e107_languages/English/lan_signup.php | 14 +- e107_languages/English/lan_usersettings.php | 18 +- e107_plugins/login_menu/login_menu.php | 16 +- .../login_menu/login_menu_shortcodes.php | 16 +- .../login_menu/login_menu_template.php | 25 +- e107_themes/templates/header_default.php | 51 +- e107_themes/templates/login_template.php | 41 +- fpw.php | 41 +- login.php | 18 +- signup.php | 123 ++-- usersettings.php | 243 +++++--- 28 files changed, 2336 insertions(+), 558 deletions(-) create mode 100644 e107_files/chap_script.js create mode 100644 e107_files/utilities/passcalc.php create mode 100644 e107_files/utilities/passconv.php create mode 100644 e107_handlers/user_handler.php diff --git a/class2.php b/class2.php index 7bd7759f1..d905156be 100644 --- a/class2.php +++ b/class2.php @@ -11,8 +11,8 @@ | GNU General Public License (http://gnu.org). | | $Source: /cvs_backup/e107_0.8/class2.php,v $ -| $Revision: 1.59 $ -| $Date: 2008-05-29 21:12:42 $ +| $Revision: 1.60 $ +| $Date: 2008-06-13 20:20:20 $ | $Author: e107steved $ +----------------------------------------------------------------------------+ */ @@ -429,6 +429,15 @@ $tp->sch_load(); if ($pref['user_tracking'] == "session") { session_start(); + if (!isset($_SESSION['challenge'])) + { // New session + $_SESSION['challenge'] = sha1(time().session_id()); // Create a unique challenge string for CHAP login + } + $ubrowser = md5('E107'.$_SERVER['HTTP_USER_AGENT']); + if (!isset($_SESSION['ubrowser'])) + { + $_SESSION['ubrowser'] = $ubrowser; + } } define("e_SELF", ($pref['ssl_enabled'] == '1' ? "https://".$_SERVER['HTTP_HOST'] : "http://".$_SERVER['HTTP_HOST']) . ($_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_SERVER['SCRIPT_FILENAME'])); @@ -765,12 +774,14 @@ if ($pref['maintainance_flag'] && ADMIN == FALSE && strpos(e_SELF, "admin.php") $sql->db_Mark_Time('(Start: Login/logout/ban/tz)'); -if (isset($_POST['userlogin']) || isset($_POST['userlogin_x'])) { +if (isset($_POST['userlogin']) || isset($_POST['userlogin_x'])) +{ e107_require_once(e_HANDLER."login.php"); - $usr = new userlogin($_POST['username'], $_POST['userpass'], $_POST['autologin']); + $usr = new userlogin($_POST['username'], $_POST['userpass'], $_POST['autologin'],varset($_POST['hashchallenge'],'')); } -if (e_QUERY == 'logout') +if ((e_QUERY == 'logout') || (($pref['user_tracking'] == "session") && isset($_SESSION['ubrowser']) && ($_SESSION['ubrowser'] != $ubrowser))) +//if (e_QUERY == 'logout') { if (USER) { @@ -1272,6 +1283,7 @@ function init_session() { if (!isset($_COOKIE[e_COOKIE]) && !isset($_SESSION[e_COOKIE]) && !isset($_E107['cli'])) { define("USER", FALSE); + define('USERID', 0); define("USERTHEME", FALSE); define("ADMIN", FALSE); define("GUEST", TRUE); @@ -1289,12 +1301,14 @@ function init_session() { list($uid, $upw)= explode(".", $cli_log); } - if (empty($uid) || empty($upw)) { + if (empty($uid) || empty($upw)) + { cookie(e_COOKIE, "", (time() - 2592000)); $_SESSION[e_COOKIE] = ""; session_destroy(); define("ADMIN", FALSE); define("USER", FALSE); + define('USERID', 0); define("USERCLASS", ""); define("LOGINMESSAGE",CORE_LAN10."

"); return (FALSE); @@ -1344,25 +1358,32 @@ function init_session() { $user_pref = ($result['user_prefs']) ? unserialize($result['user_prefs']) : ''; - if (isset($_POST['settheme'])) { + if (isset($_POST['settheme'])) + { $user_pref['sitetheme'] = ($pref['sitetheme'] == $_POST['sitetheme'] ? "" : $_POST['sitetheme']); save_prefs("user"); } define("USERTHEME", (isset($user_pref['sitetheme']) && file_exists(e_THEME.$user_pref['sitetheme']."/theme.php") ? $user_pref['sitetheme'] : FALSE)); global $ADMIN_DIRECTORY, $PLUGINS_DIRECTORY; - if ($result['user_admin']) { + if ($result['user_admin']) + { define("ADMIN", TRUE); define("ADMINID", $result['user_id']); define("ADMINNAME", $result['user_name']); define("ADMINPERMS", $result['user_perms']); define("ADMINEMAIL", $result['user_email']); define("ADMINPWCHANGE", $result['user_pwchange']); - } else { + } + else + { define("ADMIN", FALSE); } - } else { + } + else + { define("USER", FALSE); + define('USERID', 0); define("USERTHEME", FALSE); define("ADMIN", FALSE); define("CORRUPT_COOKIE", TRUE); @@ -1375,6 +1396,8 @@ function init_session() { define('e_NOBODY_REGEXP', "(^|,)".e_UC_NOBODY."(,|$)"); } + + $sql->db_Mark_Time('Start: Go online'); if(!isset($_E107['no_online']) && varset($pref['track_online'])) { diff --git a/e107_admin/auth.php b/e107_admin/auth.php index 27420026a..92fa8ec08 100644 --- a/e107_admin/auth.php +++ b/e107_admin/auth.php @@ -11,9 +11,9 @@ | GNU General Public License (http://gnu.org). | | $Source: /cvs_backup/e107_0.8/e107_admin/auth.php,v $ -| $Revision: 1.2 $ -| $Date: 2007-08-25 05:48:53 $ -| $Author: e107coders $ +| $Revision: 1.3 $ +| $Date: 2008-06-13 20:20:20 $ +| $Author: e107steved $ +----------------------------------------------------------------------------+ */ @@ -49,21 +49,51 @@ else } } - $row = $authresult = $obj->authcheck($_POST['authname'], $_POST['authpass']); - if ($row[0] == "authfail") { + require_once(e_HANDLER.'user_handler.php'); + $row = $authresult = $obj->authcheck($_POST['authname'], $_POST['authpass'], varset($_POST['hashchallenge'],'')); + if ($row[0] == "authfail") + { + $admin_log->e_log_event(4,__FILE__."|".__FUNCTION__."@".__LINE__,"LOGIN",LAN_ROLL_LOG_11,"U: ".$tp->toDB($_POST['authname']),FALSE,LOG_TO_ROLLING); echo "\n"; header("location: ../index.php"); exit; - } else { + } + else + { + $cookieval = $row['user_id'].".".md5($row['user_password']); - $userpass = md5($_POST['authpass']); - $cookieval = $row['user_id'].".".md5($userpass); +// $sql->db_Select("user", "*", "user_name='".$tp -> toDB($_POST['authname'])."'"); +// list($user_id, $user_name, $userpass) = $sql->db_Fetch(); - $sql->db_Select("user", "*", "user_name='".$tp -> toDB($_POST['authname'])."'"); - list($user_id, $user_name, $userpass) = $sql->db_Fetch(); - if ($pref['user_tracking'] == "session") { + // Calculate class membership - needed for a couple of things + // Problem is that USERCLASS_LIST just contains 'guest' and 'everyone' at this point + $class_list = explode(',',$row['user_class']); + if ($row['user_admin'] && strlen($row['user_perms'])) + { + $class_list[] = e_UC_ADMIN; + if (strpos($row['user_perms'],'0') === 0) + { + $class_list[] = e_UC_MAINADMIN; + } + } + $class_list[] = e_UC_MEMBER; + $class_list[] = e_UC_PUBLIC; + + $user_logging_opts = array_flip(explode(',',varset($pref['user_audit_opts'],''))); + if (isset($user_logging_opts[USER_AUDIT_LOGIN]) && in_array(varset($pref['user_audit_class'],''),$class_list)) + { // Need to note in user audit trail + $admin_log->user_audit(USER_AUDIT_LOGIN,'', $user_id,$user_name); + } + + $edata_li = array("user_id" => $row['user_id'], "user_name" => $row['user_name'], 'class_list' => implode(',',$class_list)); + $e_event->trigger("login", $edata_li); + + if ($pref['user_tracking'] == "session") + { $_SESSION[$pref['cookie_name']] = $cookieval; - } else { + } + else + { cookie($pref['cookie_name'], $cookieval, (time()+3600 * 24 * 30)); } echo "\n"; @@ -73,7 +103,8 @@ else $e_sub_cat = 'logout'; require_once(e_ADMIN."header.php"); - if (ADMIN == FALSE) { + if (ADMIN == FALSE) + { $obj = new auth; $obj->authform(); require_once(e_ADMIN."footer.php"); @@ -84,7 +115,6 @@ else //------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------// class auth { - function authform() { /* @@ -95,24 +125,32 @@ class auth # - scope public */ - global $use_imagecode, $sec_img,$imode; + global $use_imagecode, $sec_img,$imode, $pref; $text = "
-
\n + \n" : "\n" )." ".ADLAN_89." - \n + \n ".ADLAN_90." - \n + \n"; + if (isset($_SESSION['challenge']) && varset($pref['password_CHAP'],0)) $text .= "\n\n"; + $text .= " "; - if ($use_imagecode) { + if ($use_imagecode) + { $text .= " ".ADLAN_152." @@ -139,7 +177,7 @@ class auth $au->tablerender(ADLAN_92, $text); } - function authcheck($authname, $authpass) + function authcheck($authname, $authpass, $authresponse = '') { /* # Admin auth check @@ -148,28 +186,50 @@ class auth # - return boolean if fail, else result array # - scope public */ - global $tp; + global $tp, $pref; $sql_auth = new db; - $authname = $tp -> toDB(preg_replace("/\sOR\s|\=|\#/", "", $authname)); - if ($sql_auth->db_Select("user", "*", "user_loginname='$authname' AND user_admin='1' ")) + $reason = ''; + $user_info = new UserHandler; + + $authname = $tp -> toDB(preg_replace("/\sOR\s|\=|\#/", "", trim($authname))); + $authpass = trim($authpass); + if (($authpass == '') || ($authname == '')) $reason = 'np'; + if (strlen($authname) > varset($pref['loginname_maxlength'],30)) $reason = 'lu'; + + if (!$reason) + { + if ($sql_auth->db_Select("user", "*", "user_loginname='{$authname}' AND user_admin='1' ")) { $row = $sql_auth->db_Fetch(); } + elseif ($sql_auth->db_Select("user", "*", "user_name='{$authname}' AND user_admin='1' ")) + { + $row = $sql_auth->db_Fetch(); + $authname = $row['user_loginname']; + } else { - if ($sql_auth->db_Select("user", "*", "user_name='$authname' AND user_admin='1' ")) + $reason = 'iu'; + } + } + if (!$reason && ($row['user_id'])) + { // Can validate password + if (($authresponse && isset($_SESSION['challenge'])) && ($authresponse != $_SESSION['challenge'])) + { // Verify using CHAP (can't handle login by email address - only loginname - although with this code it does still work if the password is stored unsalted) + if (($pass_result = $user_info->CheckCHAP($_SESSION['challenge'], $authresponse, $authname, $row['user_password'])) !== PASSWORD_INVALID) { - $row = $sql_auth->db_Fetch(); + return $$row; } } - if($row['user_id']) - { - if($row['user_password'] == md5($authpass)) + else + { // Plaintext password + if (($pass_result = $user_info->CheckPassword($authpass, $authname,$row['user_password'])) !== PASSWORD_INVALID) { return $row; } } - return array("authfail"); + } + return array("authfail", "reason" => $reason); } } diff --git a/e107_admin/prefs.php b/e107_admin/prefs.php index 91aab5b4f..128c259e0 100644 --- a/e107_admin/prefs.php +++ b/e107_admin/prefs.php @@ -11,8 +11,8 @@ | GNU General Public License (http://gnu.org). | | $Source: /cvs_backup/e107_0.8/e107_admin/prefs.php,v $ -| $Revision: 1.13 $ -| $Date: 2008-03-23 21:53:34 $ +| $Revision: 1.14 $ +| $Date: 2008-06-13 20:20:20 $ | $Author: e107steved $ +----------------------------------------------------------------------------+ */ @@ -440,36 +440,41 @@ $text .= "
"; // =========== Registration Preferences. ================== $text .= "