$Settings->setSetting('lastbatch', $batchID);
$failedUsers = 0;
for ($i = 0; $i < $user['numberoftickets']; $i++) {
// Creating lots of users at once could timeout a script. Maybe add a set_time_limit(1) on each loop?
if ($Settings->getSetting('simpleUsername')) {
$username = \Grase\Util::randomLowercase($Settings->getSetting('usernameLength'));
} else {
$username = \Grase\Util::randomUsername($Settings->getSetting('usernameLength'));
}
if ($Settings->getSetting('numericPassword')) {
$password = \Grase\Util::randomNumericPassword($Settings->getSetting('passwordLength'));
} else {
$password = \Grase\Util::randomPassword($Settings->getSetting('passwordLength'));
}
// Attempt to create user. Will error if it's not a unique username
if (DatabaseFunctions::getInstance()->createUser($username, $password, $MaxMb, $MaxTime, expiry_for_group($group, $groupSettings), $groupSettings[$group]['ExpireAfter'], \Grase\Clean::text($_POST['Group']), \Grase\Clean::text($_POST['Comment']))) {
AdminLog::getInstance()->log("Created new user {$username}");
$Settings->addUserToBatch($batchID, $username);
$createdUsernames[] = $username;
} else {
// Failed to create. Most likely not a unique username.
// Try again but only for so long (i.e. all usernames are in use)
$i--;
// This really chokes up the logs, maybe don't log this? TODO
AdminLog::getInstance()->log("Failed to created new user {$username}. Probably duplicate username");
$failedUsers++;
if ($failedUsers > 20) {
AdminLog::getInstance()->log("Too many failed usernames, stopping batch creation");
$error[] = sprintf(T_("Too many users failed to create. Batch creation stopped. %s users have been successfully created"), $i);
break;
}
}
if (!(isset($vouchermaxmb[$key]) || isset($vouchermaxtime[$key]))) {
$warning[] = T_("It is not recommended having vouchers without a data or time limit");
}
// validate limits
//$error[] = validate_datalimit($groupdatalimit[$key]);
// Silence warnings (@) as we don't care if they are set or not'
if (!\Grase\Validate::numericLimit($vouchermaxtime[$key])) {
$error[] = sprintf(T_("Invalid value '%s' for Time Limit"), $vouchermaxtime[$key]);
}
if (!\Grase\Validate::numericLimit($vouchermaxmb[$key])) {
$error[] = sprintf(T_("Invalid value '%s' for Data Limit"), $vouchermaxmb[$key]);
}
// TODO validate groupname, it already comes in in the correct format though
$error = array_filter($error);
$vouchersettings[\Grase\Clean::groupName($name)] = array_filter(array('VoucherName' => \Grase\Clean::groupName($name), 'VoucherLabel' => \Grase\Clean::text($name), 'VoucherPrice' => @clean_number($voucherprice[$key]), 'VoucherGroup' => $vouchergroup[$key], 'MaxMb' => @clean_number($vouchermaxmb[$key]), 'MaxTime' => @clean_int($vouchermaxtime[$key]), 'Description' => @\Grase\Clean::text($voucherdesc[$key]), 'TopupVoucher' => $vouchertopup[$key] ? TRUE : FALSE, 'InitVoucher' => $voucherinit[$key] ? TRUE : FALSE));
}
if (sizeof($error) == 0) {
// No errors. Save groups
//$Settings->setSetting("groups", serialize($groupexpiries));
foreach ($vouchersettings as $attributes) {
//$Settings->setGroup($attributes);
$Settings->setVoucher($attributes);
}
// Delete vouchers no longer referenced
foreach ($Settings->getVoucher() as $oldvoucher => $oldvouchersettings) {
if (!isset($vouchersettings[$oldvoucher])) {
$Settings->deleteVoucher($oldvoucher);
}
}
$success[] = T_("Vouchers updated");
// Load all templates
foreach ($templateOptions as $template => $attributes) {
$templateOptions[$template]['value'] = $Settings->getTemplate($template);
}
}
// Options for login Config that can only be one
$singleLoginOptions = array('hideheader' => array("label" => T_("Login Screen Title"), "description" => T_("Hide Title (header) from login screen"), "type" => "bool"), 'hidemenu' => array("label" => T_("Login Screen Menu"), "description" => T_("Hide Menubar from login screen"), "type" => "bool"), 'hidefooter' => array("label" => T_("Login Screen Footer"), "description" => T_("Hide footer from login screen.\n Please consider adding a link back to http://grasehotspot.org if you are hiding the footer"), "type" => "bool"), 'hidehelplink' => array("label" => T_("Help Link"), "description" => T_("Hide Help link from menu and footer"), "type" => "bool"), 'disablejavascript' => array("label" => T_("Disable Javascript Login"), "description" => T_("Force all logins to be through the less secure non-javascript method"), "type" => "bool"), 'disableallcss' => array("label" => T_("Disable All Default CSS"), "description" => T_("All css files will be excluded from the login pages, and only the css below (Main CSS) will be used"), "type" => "bool"), 'logintitle' => array("label" => T_("Page Title"), "description" => T_("The page title that is displayed on the login page"), "type" => "text"), 'autocreategroup' => array("label" => T_("Free Login Group"), "description" => T_("The group to create 'Free Login' users in. Leave blank to disable free logins"), "type" => "text"), 'freeloginbuttontext' => array("label" => T_("Free Login Button Text"), "description" => T_("Text to show on the Free Login button if enabled above. Defaults to 'Free Access'"), "type" => "text"), 'hidenormallogin' => array("label" => T_("Hide Username/Password (Voucher) login form"), "description" => T_("Hides the login form (username/password fields). Useful if you only want a free login button"), "type" => "bool"));
// Templates
$templateOptions = array('termsandconditions' => array("label" => T_("Terms and Conditions"), "description" => T_("Terms and Conditions of use (HTML) - Leave empty to not display"), "type" => "html"), 'maincss' => array("label" => T_("Main CSS"), "description" => T_("Cascading style sheet that is applied to all portal pages (use !important to override a style if your\n settings here don't seem to work, it may be that the builtin css has a more specific selector than your one\n here, look at radmin.css for id's and classes)"), "type" => "css"), 'helptext' => array("label" => T_("Help and Information Page"), "description" => T_("Help and Information page contents, leaving this blank does not remove the link, see above options for removing the link."), "type" => "html"), 'aboveloginhtml' => array("label" => T_("HTML Above login form"), "description" => T_("HTML to insert above login form (and free login)"), "type" => "html"), 'belowloginhtml' => array("label" => T_("HTML Below login form"), "description" => T_("HTML to insert below login form"), "type" => "html"), 'loggedinnojshtml' => array("label" => T_("Logged In HTML"), "description" => T_("HTML for successful login when not using javascript"), "type" => "html"));
loadLoginOptions($Settings);
if (isset($_POST['submit'])) {
foreach ($singleLoginOptions as $singleOption => $attributes) {
switch ($attributes['type']) {
default:
case "string":
$postValue = trim(\Grase\Clean::text($_POST[$singleOption]));
break;
case "int":
$postValue = trim(clean_int($_POST[$singleOption]));
break;
case "number":
$postValue = trim(clean_number($_POST[$singleOption]));
break;
case "bool":
if (isset($_POST[$singleOption])) {
$postValue = 'TRUE';
} else {
$postValue = 'FALSE';
}
break;
}
$user['mac'] = $user['Username'];
$user['Password'] = DatabaseFunctions::getInstance()->getChilliConfigSingle('macpasswd');
}
$user['MaxMb'] = $_POST['MaxMb'];
$user['Max_Mb'] = clean_number($_POST['Max_Mb']);
if ($_POST['Max_Mb'] == 'inherit') {
$user['Max_Mb'] = 'inherit';
}
$user['MaxTime'] = $_POST['MaxTime'];
$user['Max_Time'] = clean_int($_POST['Max_Time']);
if ($_POST['Max_Time'] == 'inherit') {
$user['Max_Time'] = 'inherit';
}
$user['Group'] = \Grase\Clean::text($_POST['Group']);
$user['Expiration'] = expiry_for_group(\Grase\Clean::text($_POST['Group']));
$user['Comment'] = \Grase\Clean::text($_POST['Comment']);
// Validate details
$error = validate_form($user, $type);
if ($error) {
$templateEngine->assign("user", $user);
$templateEngine->assign("error", $error);
$templateEngine->displayPage($templateFile);
exit;
} else {
// Load group settings so we can use Expiry, MaxMb and MaxTime
$groupSettings = $Settings->getGroup($user['Group']);
// TODO: Create function to make these the same across all locations
// Check if we are using the dropdown, or inherit to override the input field
if (is_numeric($user['Max_Mb'])) {
$user['MaxMb'] = $user['Max_Mb'];
} elseif ($user['Max_Mb'] == 'inherit') {
}
foreach ($selectNetworkOptions as $selectOption => $attributes) {
switch ($attributes['type']) {
case "string":
$postValue = trim(\Grase\Clean::text($_POST[$selectOption]));
// TODO Validate from list of valid vars
break;
}
$networkOptions[$selectOption] = $postValue;
}
foreach ($multiNetworkOptions as $multiOption => $attributes) {
$postValue = array();
foreach ($_POST[$multiOption] as $value) {
switch ($attributes['type']) {
case "string":
$postValue[] = \Grase\Clean::text($value);
break;
case "int":
$postValue[] = clean_int($value);
break;
case "number":
$postValue[] = clean_number($value);
break;
case "ip":
if (trim($value)) {
$postValue[] = long2ip(ip2long(trim($value)));
}
break;
}
}
$postValue = array_filter($postValue);
require_once 'includes/pageaccess.inc.php';
require_once 'includes/session.inc.php';
require_once 'includes/misc_functions.inc.php';
$error = array();
$success = array();
/* TODO: most of this file is repetitive. Make it more like Chilli Settings, with arrays defining options and labels, and validation types, then do generic loop */
if (isset($_POST['submit'])) {
$newLocationName = \Grase\Clean::text($_POST['locationname']);
$newSupportContact = \Grase\Clean::text($_POST['supportcontact']);
$newSupportLink = \Grase\Clean::text($_POST['supportlink']);
$newMBOptions = clean_numberarray($_POST['mboptions']);
$newTimeOptions = clean_numberarray($_POST['timeoptions']);
$newBandwidthOptions = clean_numberarray($_POST['bwoptions']);
$newLocale = \Grase\Clean::text($_POST['locale']);
$newWebsiteName = \Grase\Clean::text($_POST['websitename']);
$newWebsiteLink = \Grase\Clean::text($_POST['websitelink']);
// Check for changed items
updateLocation($newLocationName);
updateSupportContactSetting($newSupportContact);
updateSupportLinkSetting($newSupportLink);
updateLocaleSetting($newLocale);
updateWebsiteName($newWebsiteName);
updateWebsiteLink($newWebsiteLink);
// New functions to file, dont do messy way like above. Value will always be valid, as the cleaning functions should make it a valid value. We should still check the value fits how we want it to (i.e. isn't empty). We don't need to check for error up update as when we have errors we'll never come back here
$new2timeoptions = checkGroupsTimeDropdowns($newTimeOptions);
if ($new2timeoptions != $newTimeOptions) {
$error[] = T_("Some time options are still in use by current groups and have been added back in");
}
$new2mboptions = checkGroupsDataDropdowns($newMBOptions);
if ($new2mboptions != $newMBOptions) {
$error[] = T_("Some data options are still in use by current groups and have been added back in");
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with GRASE Hotspot. If not, see <http://www.gnu.org/licenses/>.
*/
$PAGE = 'users';
require_once 'includes/pageaccess.inc.php';
require_once 'includes/session.inc.php';
require_once 'includes/misc_functions.inc.php';
$DBF = DatabaseFunctions::getInstance();
if (isset($_GET['user'])) {
$users = $DBF->getMultipleUsersDetails(array(\Grase\Clean::text($_GET['user'])));
if (!is_array($users)) {
$users = array();
}
$title = \Grase\Clean::text($_GET['user']) . ' Voucher';
} elseif (isset($_GET['batch'])) {
$batches = explode(',', $_GET['batch']);
$users = array();
foreach ($batches as $batch) {
$batch = clean_number($batch);
$usersInBatch = $DBF->getMultipleUsersDetails($Settings->getBatch($batch));
if (is_array($usersInBatch)) {
$users = array_merge($users, $usersInBatch);
}
}
// TODO: replace , with _ in below
$title = sprintf(T_('Batch_%s_details'), implode('-', $batches));
} elseif (isset($_GET['group'])) {
$groups = explode(',', $_GET['group']);
$users = array();
DatabaseFunctions::getInstance()->setUserExpiry($username, expiry_for_group(DatabaseFunctions::getInstance()->getUserGroup($username)));
// TODO: Check return for success
$success[] = T_("Group Changed");
AdminLog::getInstance()->log("Group changed for {$username}");
}
}
// Update comment if changed
if (\Grase\Clean::text($_POST['Comment']) != $user['Comment']) {
DatabaseFunctions::getInstance()->setUserComment($username, \Grase\Clean::text($_POST['Comment']));
// TODO: Check return for success
$success[] = T_("Comment Changed");
AdminLog::getInstance()->log("Comment changed for {$username}");
}
// Lock/Unlock update
if (\Grase\Clean::text($_POST['LockReason']) != $user['LockReason']) {
if (\Grase\Clean::text($_POST['LockReason']) == '') {
DatabaseFunctions::getInstance()->unlockUser($username);
$success[] = T_("User Account Unlocked");
AdminLog::getInstance()->log("Account {$username} unlocked");
} else {
// Using \Grase\Clean::username as the LockReason is processed by JSON from CoovaChilli from Radius and so ' and " don't carry well
DatabaseFunctions::getInstance()->lockUser($username, \Grase\Clean::username($_POST['LockReason']));
$success[] = T_("User Account Locked");
AdminLog::getInstance()->log("Account {$username} locked: " . \Grase\Clean::username($_POST['LockReason']));
}
}
// Increase Data Limit
if ($addMb) {
if (!\Grase\Validate::numericLimit($addMb)) {
$error[] = sprintf(T_("Invalid value '%s' for Data Limit"), $addMb);
} else {
function clean_number($number)
{
global $Settings;
//TODO Remove global
$fmt = new NumberFormatter($Settings->getSetting('locale'), NumberFormatter::DECIMAL);
$cleannum = $fmt->parse(preg_replace("/[^\\.,0-9]/", "", \Grase\Clean::text($number)));
return $cleannum;
}
if (!\Grase\Validate::bandwidthOptions($groupBandwidthDownLimit[$key], bandwidth_options())) {
$error[] = sprintf(T_("Invalid Bandwidth Limit '%s'"), $groupBandwidthDownLimit[$key]);
}
if (!\Grase\Validate::bandwidthOptions($groupBandwidthUpLimit[$key], bandwidth_options())) {
$error[] = sprintf(T_("Invalid Bandwidth Limit '%s'"), $groupBandwidthUpLimit[$key]);
}
//TODO we don't validate that it's not 0, relying on HTML5 to do that
$error[] = @validate_int($groupSimultaneousUse[$key], true);
// TODO: Validate Login-Time
$error[] = @validate_uucptimerange($groupLoginTime[$key]);
$error = array_filter($error);
if (isset($groupRecurTime[$key]) xor isset($groupRecurTimeLimit[$key])) {
$error[] = sprintf(T_("Need both a time limit and recurrance for '%s'"), \Grase\Clean::text($name));
}
$groups[\Grase\Clean::groupName($name)] = array_filter(array('DataRecurTime' => \Grase\Clean::text($groupRecurData[$key]), 'DataRecurLimit' => clean_number($groupRecurDataLimit[$key]), 'TimeRecurTime' => @\Grase\Clean::text($groupRecurTime[$key]), 'TimeRecurLimit' => @clean_int($groupRecurTimeLimit[$key]), 'BandwidthDownLimit' => @clean_int($groupBandwidthDownLimit[$key]), 'BandwidthUpLimit' => @clean_int($groupBandwidthUpLimit[$key]), 'SimultaneousUse' => @clean_int($groupSimultaneousUse[$key]), 'LoginTime' => @$groupLoginTime[$key], 'IdleTimeout' => @clean_int($groupIdleTimeout[$key])));
$groupSettings[\Grase\Clean::groupName($name)] = array_filter(array('GroupName' => \Grase\Clean::groupName($name), 'Comment' => \Grase\Clean::text($groupComment[$key]), 'GroupLabel' => \Grase\Clean::text($name), 'Expiry' => @$groupExpiry[$key], 'ExpireAfter' => @$groupExpireAfter[$key], 'MaxMb' => @clean_number($groupDataLimit[$key]), 'MaxTime' => @clean_int($groupTimeLimit[$key])));
}
if (sizeof($error) == 0) {
// No errors. Save groups
foreach ($groupSettings as $attributes) {
$Settings->setGroup($attributes);
}
// Delete groups no longer referenced
foreach ($Settings->getGroup() as $oldgroup => $oldgroupsettings) {
if (!isset($groupSettings[$oldgroup])) {
$Settings->deleteGroup($oldgroup);
}
}
// Delete groups from radgroupreply not in groupExpiries...
// Deleting groups out of radgroupreply will modify current users
// Need to do check for any users still using group, if no user then delete