require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php';
Request::checkReferer('POST');
if (!SP\Init::isLoggedIn()) {
SP\Util::logout();
}
$sk = SP\Request::analyze('sk', false);
if (!$sk || !SessionUtil::checkSessionKey($sk)) {
die(_('CONSULTA INVÁLIDA'));
}
if (!SP\Util::fileIsEnabled()) {
exit(_('Gestión de archivos deshabilitada'));
}
$action = SP\Request::analyze('action');
$accountId = SP\Request::analyze('accountId', 0);
$fileId = SP\Request::analyze('fileId', 0);
$log = new \SP\Log();
if ($action == 'upload') {
if (!is_array($_FILES["inFile"]) || $accountId === 0) {
\SP\Response::printJSON(_('CONSULTA INVÁLIDA'));
}
$log->setAction(_('Subir Archivo'));
$allowedExts = strtoupper(SP\Config::getValue('files_allowed_exts'));
$allowedSize = SP\Config::getValue('files_allowed_size');
if ($allowedExts) {
// Extensiones aceptadas
$extsOk = explode(",", $allowedExts);
} else {
$log->addDescription(_('No hay extensiones permitidas'));
$log->writeLog();
\SP\Response::printJSON($log->getDescription());
}
return;
}
$userLogin = SP\Request::analyze('user');
$userPass = SP\Request::analyzeEncrypted('pass');
$masterPass = SP\Request::analyzeEncrypted('mpass');
if (!$userLogin || !$userPass) {
SP\Response::printJSON(_('Usuario/Clave no introducidos'));
}
$User = new SP\User();
$User->setUserLogin($userLogin);
$User->setUserPass($userPass);
if ($resLdap = SP\Auth::authUserLDAP($userLogin, $userPass)) {
$User->setUserName(SP\Auth::$userName);
$User->setUserEmail(SP\Auth::$userEmail);
}
$Log = new \SP\Log(_('Inicio sesión'));
// Autentificamos por LDAP
if ($resLdap === true) {
$Log->addDescription('(LDAP)');
$Log->addDescription(sprintf('%s: %s', _('Servidor Login'), \SP\Ldap::getLdapServer()));
// Verificamos si el usuario existe en la BBDD
if (!UserLdap::checkLDAPUserInDB($userLogin)) {
// Creamos el usuario de LDAP en MySQL
if (!\SP\UserLdap::newUserLDAP($User)) {
$Log->addDescription(_('Error al guardar los datos de LDAP'));
$Log->writeLog();
SP\Response::printJSON(_('Error interno'));
}
} else {
// Actualizamos la clave del usuario en MySQL
if (!UserLdap::updateLDAPUserInDB($User)) {
$sk = SP\Request::analyze('sk', false);
if (!$sk || !SessionUtil::checkSessionKey($sk)) {
SP\Response::printJSON(_('CONSULTA INVÁLIDA'));
}
$actionId = SP\Request::analyze('actionId', 0);
$onCloseAction = SP\Request::analyze('onCloseAction');
$activeTab = SP\Request::analyze('activeTab', 0);
$exportPassword = SP\Request::analyzeEncrypted('exportPwd');
$exportPasswordR = SP\Request::analyzeEncrypted('exportPwdR');
$doActionOnClose = "sysPassUtil.Common.doAction({$actionId},'',{$activeTab});";
if ($actionId === SP\Controller\ActionsInterface::ACTION_CFG_BACKUP) {
if (SP\Util::demoIsEnabled()) {
SP\Response::printJSON(_('Ey, esto es una DEMO!!'));
}
if (!SP\Backup::doBackup()) {
SP\Log::writeNewLogAndEmail(_('Realizar Backup'), _('Error al realizar el backup'));
SP\Response::printJSON(_('Error al realizar el backup') . ';;' . _('Revise el registro de eventos para más detalles'));
}
SP\Log::writeNewLogAndEmail(_('Realizar Backup'), _('Copia de la aplicación y base de datos realizada correctamente'));
SP\Response::printJSON(_('Proceso de backup finalizado'), 0, $doActionOnClose);
} elseif ($actionId === SP\Controller\ActionsInterface::ACTION_CFG_EXPORT) {
if (!empty($exportPassword) && $exportPassword !== $exportPasswordR) {
SP\Response::printJSON(_('Las claves no coinciden'));
}
if (!\SP\XmlExport::doExport($exportPassword)) {
SP\Log::writeNewLogAndEmail(_('Realizar Exportación'), _('Error al realizar la exportación de cuentas'));
SP\Response::printJSON(_('Error al realizar la exportación') . ';;' . _('Revise el registro de eventos para más detalles'));
}
SP\Log::writeNewLogAndEmail(_('Realizar Exportación'), _('Exportación de cuentas realizada correctamente'));
SP\Response::printJSON(_('Proceso de exportación finalizado'), 0, $doActionOnClose);
}
use SP\UserUtil;
define('APP_ROOT', '..');
require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php';
SP\Request::checkReferer('POST');
if (!SP\Init::isLoggedIn()) {
SP\Response::printJSON(_('La sesión no se ha iniciado o ha caducado'), 10);
}
$sk = SP\Request::analyze('sk', false);
if (!$sk || !SessionUtil::checkSessionKey($sk)) {
SP\Response::printJSON(_('CONSULTA INVÁLIDA'));
}
$frmAccountId = SP\Request::analyze('accountid', 0);
$frmDescription = SP\Request::analyze('description');
if (!$frmDescription) {
SP\Response::printJSON(_('Es necesaria una descripción'));
}
$accountRequestData = SP\Account::getAccountRequestData($frmAccountId);
$recipients = array(UserUtil::getUserEmail($accountRequestData->account_userId), UserUtil::getUserEmail($accountRequestData->account_userEditId));
$requestUsername = SP\Session::getUserName();
$requestLogin = SP\Session::getUserLogin();
$log = new \SP\Log(_('Solicitud de Modificación de Cuenta'));
$log->addDescription(SP\Html::strongText(_('Solicitante') . ': ') . $requestUsername . ' (' . $requestLogin . ')');
$log->addDescription(SP\Html::strongText(_('Cuenta') . ': ') . $accountRequestData->account_name);
$log->addDescription(SP\Html::strongText(_('Cliente') . ': ') . $accountRequestData->customer_name);
$log->addDescription(SP\Html::strongText(_('Descripción') . ': ') . $frmDescription);
$mailto = implode(',', $recipients);
if (strlen($mailto) > 1 && SP\Util::mailrequestIsEnabled() && SP\Email::sendEmail($log, $mailto)) {
$log->writeLog();
SP\Response::printJSON(_('Solicitud enviada'), 0, "doAction('" . \SP\Controller\ActionsInterface::ACTION_ACC_SEARCH . "');");
}
SP\Response::printJSON(_('Error al enviar la solicitud'));
define('APP_ROOT', '..');
require_once APP_ROOT . DIRECTORY_SEPARATOR . 'inc' . DIRECTORY_SEPARATOR . 'Base.php';
SP\Request::checkReferer('POST');
$sk = SP\Request::analyze('sk', false);
if (!$sk || !SessionUtil::checkSessionKey($sk)) {
SP\Response::printJSON(_('CONSULTA INVÁLIDA'));
}
$userLogin = SP\Request::analyze('login');
$userEmail = SP\Request::analyze('email');
$userPass = SP\Request::analyzeEncrypted('pass');
$userPassR = SP\Request::analyzeEncrypted('passR');
$hash = SP\Request::analyze('hash');
$time = SP\Request::analyze('time');
$message['action'] = _('Recuperación de Clave');
if ($userLogin && $userEmail) {
$log = new \SP\Log(_('Recuperación de Clave'));
if (SP\Auth::mailPassRecover($userLogin, $userEmail)) {
$log->addDescription(SP\Html::strongText(_('Solicitado para') . ': ') . ' ' . $userLogin . ' (' . $userEmail . ')');
SP\Response::printJSON(_('Solicitud enviada') . ';;' . _('En breve recibirá un correo para completar la solicitud.'), 0, 'goLogin();');
} else {
$log->addDescription('ERROR');
$log->addDescription(SP\Html::strongText(_('Solicitado para') . ': ') . ' ' . $userLogin . ' (' . $userEmail . ')');
SP\Response::printJSON(_('No se ha podido realizar la solicitud. Consulte con el administrador.'));
}
$log->writeLog();
SP\Email::sendEmail($log);
} elseif ($userPass && $userPassR && $userPass === $userPassR) {
$userId = UserPassRecover::checkHashPassRecover($hash);
if ($userId) {
if (UserPass::updateUserPass($userId, $userPass) && UserPassRecover::updateHashPassRecover($hash)) {
\SP\Log::writeNewLogAndEmail(_('Modificar Clave Usuario'), SP\Html::strongText(_('Login') . ': ') . UserUtil::getUserLoginById($userId));
SP\Response::printJSON(_('La sesión no se ha iniciado o ha caducado'), 10);
}
$accountId = SP\Request::analyze('accountid', false);
$isHistory = SP\Request::analyze('isHistory', false);
if (!$accountId) {
return;
}
$account = !$isHistory ? new SP\Account() : new SP\AccountHistory();
$account->setAccountParentId(\SP\Session::getAccountParentId());
$account->setAccountId($accountId);
$accountData = $account->getAccountPassData();
if ($isHistory && !$account->checkAccountMPass()) {
SP\Response::printJSON(_('La clave maestra no coincide'));
}
if (!SP\Acl::checkAccountAccess(SP\Acl::ACTION_ACC_VIEW_PASS, $account->getAccountDataForACL()) || !SP\Acl::checkUserAccess(SP\Acl::ACTION_ACC_VIEW_PASS)) {
SP\Response::printJSON(_('No tiene permisos para acceder a esta cuenta'));
} elseif (!UserPass::checkUserUpdateMPass()) {
SP\Response::printJSON(_('Clave maestra actualizada') . '<br>' . _('Reinicie la sesión para cambiarla'));
}
$accountClearPass = SP\Crypt::getDecrypt($accountData->pass, $accountData->iv);
if (!$isHistory) {
$account->incrementDecryptCounter();
$log = new \SP\Log(_('Ver Clave'));
$log->addDescription(_('ID') . ': ' . $accountId);
$log->addDescription(_('Cuenta') . ': ' . $accountData->customer_name . " / " . $accountData->name);
$log->writeLog();
}
//$accountPass = htmlspecialchars(trim($accountClearPass));
$useImage = intval(\SP\Util::accountPassToImageIsEnabled());
$data = array('title' => _('Clave de Cuenta'), 'acclogin' => $accountData->login, 'accpass' => !$useImage ? trim($accountClearPass) : \SP\ImageUtil::convertText($accountClearPass), 'useimage' => $useImage);
SP\Response::printJSON($data, 0);
$AccountHistory = new SP\AccountHistory();
if (!$AccountHistory->updateAccountsMasterPass($currentMasterPass, $newMasterPass, $hashMPass)) {
SP\Response::printJSON(_('Errores al actualizar las claves de las cuentas del histórico'));
}
if (!\SP\CustomFields::updateCustomFieldsCrypt($currentMasterPass, $newMasterPass)) {
SP\Response::printJSON(_('Errores al actualizar datos de campos personalizados'));
}
}
if (SP\Util::demoIsEnabled()) {
SP\Response::printJSON(_('Ey, esto es una DEMO!!'));
}
// ConfigDB::readConfig();
ConfigDB::setCacheConfigValue('masterPwd', $hashMPass);
ConfigDB::setCacheConfigValue('lastupdatempass', time());
if (ConfigDB::writeConfig()) {
SP\Log::writeNewLogAndEmail(_('Actualizar Clave Maestra'));
SP\Response::printJSON(_('Clave maestra actualizada'), 0);
} else {
SP\Response::printJSON(_('Error al guardar el hash de la clave maestra'));
}
} elseif ($actionId === SP\Controller\ActionsInterface::ACTION_CFG_ENCRYPTION_TEMPPASS) {
$tempMasterMaxTime = SP\Request::analyze('tmpass_maxtime', 3600);
$tempMasterPass = CryptMasterPass::setTempMasterPass($tempMasterMaxTime);
if ($tempMasterPass !== false && !empty($tempMasterPass)) {
SP\Email::sendEmail(new \SP\Log(_('Generar Clave Temporal'), SP\Html::strongText(_('Clave') . ': ') . $tempMasterPass));
SP\Response::printJSON(_('Clave Temporal Generada'), 0, $doActionOnClose);
} else {
SP\Response::printJSON(_('Error al generar clave temporal'));
}
} else {
SP\Response::printJSON(_('Acción Inválida'));