/** * Update data source */ function sumo_update_datasource_data($data = array()) { if (!empty($data)) { global $SUMO; $query = "UPDATE " . SUMO_TABLE_DATASOURCES . " \n\t\t\t\tSET\n\t\t\t \tname='" . $data['name'] . "', \n\t\t\t \ttype='" . $data['type'] . "', \n\t\t\t \thost='" . $data['host'] . "',\n\t\t\t \tport=" . $data['port'] . ",\n\t\t\t \tusername='******'username'] . "',\n\t\t\t \tpassword='******'password'] . "',\n\t\t\t \tdb_name='" . $data['db_name'] . "',\n\t\t\t \tdb_table='" . $data['db_table'] . "',\n\t\t\t \tdb_field_user='******'db_field_user'] . "',\n\t\t\t \tdb_field_password='******'db_field_password'] . "',\n\t\t\t \tenctype='" . $data['enctype'] . "',\n\t\t\t \tldap_base='" . $data['ldap_base'] . "'\n\t\t\t WHERE id=" . $data['id'] . " AND id<>1"; $SUMO['DB']->Execute($query); // if data source updated if (sumo_verify_datasource_exist('id', $data['id'])) { sumo_write_log('I09006X', array($data['id'], $data['name'], $SUMO['user']['user']), 3, 3, 'system', FALSE); return TRUE; } else { return FALSE; } } else { return FALSE; } }
/** * Verify password of current user * * Return: * * FALSE: password error * TRUE: password ok * * @global resource $SUMO * @author Alberto Basso <*****@*****.**> */ function sumo_verify_datasource_authentication($id = FALSE) { global $SUMO; if (!$_SESSION['ds_connect'][$id]) { $ldap = sumo_get_datasource_info($id); if (!$ldap['port']) { $ldap['port'] = 389; } // $ds is a valid link identifier for a directory server $ds = ldap_connect($ldap['host'], $ldap['port']); $dn = $ldap['ldap_base']; if ($ds && $ldap['host']) { // Encryption type switch ($SUMO['user']['datasource_enctype']) { case 'md5': $password = md5($_SESSION['user']['password']); break; case 'crc32': $password = crc32($_SESSION['user']['password']); break; default: $password = $_SESSION['user']['password']; break; } $sr = ldap_search($ds, $dn, "uid=" . $SUMO['user']['user']); $info = ldap_get_entries($ds, $sr); $ldapbind = ldap_bind($ds, $info[0]["dn"], $password); // verify binding $_SESSION['ds_connect'][$id] = $ldapbind && $info["count"] == 1 ? true : false; ldap_unbind($ds); ldap_close($ds); } else { sumo_write_log('W00047X', $ldap['name'], '0,1', 2); } } return $_SESSION['ds_connect'][$id] ? true : false; }
/** * Update Node data */ function sumo_update_node_data($data = array()) { if (!empty($data)) { global $SUMO; // preserve current node $data['active'] = sumo_verify_node_local($data['host']) ? 1 : $data['active']; $query = "UPDATE " . SUMO_TABLE_NODES . " \n\t\t\t\t SET\t\t\t\t \t\n\t\t\t\t \tactive=" . $data['active'] . ", \n\t\t\t\t \thost='" . $data['host'] . "', \n\t\t\t\t \tport=" . $data['port'] . ",\n\t\t\t\t \tname='" . $data['name'] . "', \t\t\t\t \t\n\t\t\t\t \tprotocol='" . $data['protocol'] . "', \n\t\t\t\t \tsumo_path='" . $data['sumo_path'] . "' \n\t\t\t\t WHERE id=" . $data['id']; $SUMO['DB']->Execute($query); // if node updated if (sumo_verify_node_exist($data)) { sumo_write_log('I09010X', array($data['name'], $data['host'], $SUMO['user']['user']), 3, 3, 'system', FALSE); return TRUE; } else { return FALSE; } } else { return FALSE; } }
/** * Erase Account * * @author Alberto Basso */ function sumo_delete_account($reg_code = '') { global $SUMO, $sumo_reg_data; if (!$reg_code) { $reg_code = $sumo_reg_data['reg_code']; } $query1 = "SELECT * FROM " . SUMO_TABLE_USERS_TEMP . " \r\n\t\t\t WHERE reg_code='" . $reg_code . "' \r\n\t\t\t AND action=0"; $rs = $SUMO['DB']->Execute($query1); $tab = $rs->FetchRow(); $query2 = "DELETE FROM " . SUMO_TABLE_USERS . " \r\n\t\t\t WHERE email='" . $tab['email'] . "' \r\n\t\t\t AND username='******'username'] . "'\r\n\t\t\t AND username<>'sumo'"; $query3 = "DELETE FROM " . SUMO_TABLE_USERS_TEMP . " \r\n\t\t\t WHERE email='" . $tab['email'] . "' \r\n\t\t\t AND username='******'username'] . "' \r\n\t\t\t AND reg_code='" . $reg_code . "' \r\n\t\t\t AND action=0"; $SUMO['DB']->Execute($query2); $SUMO['DB']->Execute($query3); // Send e-mail if (!$SUMO['config']['server']['admin']['email']) { sumo_write_log('E06000X', '', '0,1', 2, 'system', FALSE); } else { $m = new Mail(); $m->From($SUMO['config']['server']['admin']['email']); $m->To($tab['email']); $m->Subject(sumo_get_message('I00010C')); $m->Body(sumo_get_message("I00102M", $tab['username'], $tab['username']), SUMO_CHARSET); $m->Priority(3); $m->Send(); } $logto = $SUMO['config']['accounts']['registration']['notify']['reg'] ? 3 : '0,1'; sumo_write_log('I104', array($tab['username'], $tab['email']), $logto, 2); }
case 'UNDEFINEDDS': $sumo_message = sumo_get_message('E00125C'); $datasource = sumo_get_datasource_info($SUMO['user']['datasource_id']); sumo_write_log("E00125X", $datasource['name'], '0,1', 2); session_destroy(); break; case 'IPDENIED': $update_req = TRUE; $sumo_message = sumo_get_message('W00004C', $SUMO['client']['ip']); sumo_write_log('W00045X', array($SUMO['client']['ip'], $SUMO['user']['user'], $SUMO['client']['country'], $SUMO['page']['url']), '0,1', 2, 'errors'); session_destroy(); break; case 'GROUPDENIED': $update_req = TRUE; $sumo_message = sumo_get_message('W00005C'); sumo_write_log('W00046X', array($SUMO['user']['user'], $SUMO['user']['group'], $SUMO['page']['url'], $SUMO['page']['group']), '0,1', 2, 'errors'); session_destroy(); break; case 'SESSIONENDED': $sumo_message = sumo_get_message('I00005C'); sumo_user_logout(); break; case 'ACCOUNTEXPIRED': $sumo_message = sumo_get_message('E00102C'); session_destroy(); break; case 'LOGIN': sumo_user_login(); if ($SUMO['config']['accesspoints']['stats']['enabled']) { sumo_update_accesspoints_stats('access'); }
/** * Update application settings */ function sumo_update_config($name = '', $data = array()) { if (!empty($data)) { global $SUMO; // Server if ($name == 'server') { $xml['config'] = array_merge($SUMO['config'], $data); $xml['config']['server']['version'] = SUMO_VERSION; $xml['config']['server']['updated'] = $SUMO['config']['server']['updated']; $xml['config']['server']['charset'] = $SUMO['config']['server']['charset']; } // Create XML $xml_data = sumo_array_toxml($xml, $SUMO['config']['server']['charset'], FALSE); // Fix: prevent database optimization hits too low if ($name == 'server') { if ($xml['config']['database']['optimize_hits'] < 1000) { $xml['config']['database']['optimize_hits'] = 1000; } } $query = "UPDATE " . SUMO_TABLE_CONFIGS . " \n\t\t\t SET data='" . addcslashes($xml_data, "'") . "'\n\t\t \t WHERE name='" . $name . "'"; $SUMO['DB']->Execute($query); $SUMO['DB']->CacheFlush(); sumo_write_log('I06001X', array($name, $SUMO['user']['user']), 3, 3); return TRUE; } else { return FALSE; } }
/** * Verify current user permissions * * @global resource $SUMO * @param int $level * @param array $group * @param array $user * @author Alberto Basso <*****@*****.**> */ function sumo_verify_permissions($level = false, $group = false, $user = false, $log = true) { global $SUMO; $permit = false; // verify all conditions if ($level && $group && $user) { if (sumo_verify_current_group_level($level, $group) && sumo_verify_current_user($user)) { $permit = true; } } //verify group and level if ($level && $group && !$user) { if (sumo_verify_current_group_level($level, $group)) { $permit = true; } } // verify group and user if (!$level && $group && $user) { if (sumo_verify_current_group($group) && sumo_verify_current_user($user)) { $permit = true; } } // verify only group if (!$level && $group && !$user) { if (sumo_verify_current_group($group)) { $permit = true; } } // verify only user if (!$level && !$group && $user) { if (sumo_verify_current_user($user)) { $permit = true; } } // Access violations log if (!$permit && $SUMO['config']['security']['access_violations'] && $log) { if (is_array($group)) { $group = implode(",", $group); } sumo_write_log('E00122X', array($SUMO['user']['user'], "[MODULE: {$_SESSION['module']} ACTION:{$_SESSION['action']} USER:{$user} GROUP:{$group} LEVEL:{$level}]"), '0,1', 2, 'errors', FALSE); } return $permit; }
/** * Delete group */ function sumo_delete_group($id = 0) { $id = intval($id); if ($id > 0) { global $SUMO; $group = sumo_get_group_info($id); $SUMO['DB']->CacheFlush(); $query = "DELETE FROM " . SUMO_TABLE_GROUPS . " \r\n\t\t\t\t WHERE id=" . $id; $SUMO['DB']->Execute($query); sumo_write_log('I02003X', array($group['usergroup'], $SUMO['user']['user']), '0,1', 2, 'system', false); } }
/** * Update user group */ function sumo_update_user_group($id = 0, $group = FALSE) { $group_level = explode(":", $group); $id = intval($id); if ($id > 0 && sumo_validate_group($group) && sumo_verify_permissions($group_level[1], $group_level[0])) { global $SUMO; $query1 = "SELECT usergroup FROM " . SUMO_TABLE_USERS . "\n\t\t\t\t WHERE id=" . $id; $rs = $SUMO['DB']->Execute($query1); $tab = $rs->FetchRow(); $new_group = sumo_get_normalized_group(str_replace($group, '', $tab[0])); $query2 = "UPDATE " . SUMO_TABLE_USERS . "\n\t\t\t\t SET usergroup='" . $new_group . "',\n\t\t\t\t \t\tmodified=" . $SUMO['server']['time'] . "\n\t\t\t\t WHERE id=" . $id; $SUMO['DB']->CacheFlush("SELECT * FROM " . SUMO_TABLE_USERS . "\n\t\t\t\t\t\t \t\t WHERE id=" . $id); $SUMO['DB']->Execute($query1); $SUMO['DB']->Execute($query2); sumo_write_log('I01002X', array($group, $id, $SUMO['user']['user']), '0,1', 3, 'system', FALSE); return TRUE; } else { return FALSE; } }
/** * Update accesspoint data */ function sumo_update_accesspoint_data($data = array()) { if (!empty($data)) { global $SUMO; $id = intval($data['id']); $node = $data['node'] ? intval($data['node']) : "NULL"; $path = $data['path']; $group = $data['group']; $reg_group = $data['reg_group']; $theme = $data['theme']; $http_auth = $data['http_auth'] == 'on' || $data['http_auth'] == 1 ? 1 : 0; $filtering = $data['filtering'] == 'on' || $data['filtering'] == 1 ? 1 : 0; $pwd_encrypt = $data['pwd_encrypt'] == 'on' || $data['pwd_encrypt'] == 1 ? 1 : 0; $change_pwd = $data['change_pwd'] == 'on' || $data['change_pwd'] == 1 ? 1 : 0; $registration = $data['registration'] == 'on' || $data['registration'] == 1 ? 1 : 0; // AP names $languages = sumo_get_available_languages(); $names = ""; for ($l = 0; $l < count($languages); $l++) { $names[$l] = $languages[$l] . ":" . $data['name'][$languages[$l]]; } $name = implode(";", $names); $filtering = sumo_verify_is_console($path) ? 1 : $filtering; /** * Kill all sessions at path where pwd_encrypt * or http_auth it has been changed */ $accesspoint = sumo_get_accesspoint_info($id, 'id', FALSE); $nodeinfo = sumo_get_node_info($node); if ($accesspoint['pwd_encrypt'] != $pwd_encrypt || $accesspoint['http_auth'] != $http_auth) { $query = "DELETE FROM " . SUMO_TABLE_SESSIONS . " \r\n\t\t\t\t\t WHERE node='" . $nodeinfo['ip'] . "' AND url LIKE '%" . $path . "'"; $SUMO['DB']->Execute($query); } // Delete cached data #if($path) $SUMO['DB']->CacheFlush("SELECT * FROM ".SUMO_TABLE_ACCESSPOINTS." # WHERE path='".$path."'"); if ($node >= 1) { $record['node'] = "node=" . $node; } if ($path) { $record['path'] = "path='" . $path . "'"; } if ($name) { $record['name'] = "name='" . $name . "'"; } if ($group) { $record['group'] = "usergroup='" . sumo_get_ordered_groups($group) . "'"; } if ($reg_group) { $record['reg_group'] = "reg_group='" . $reg_group . "'"; } if ($theme) { $record['theme'] = "theme='" . $theme . "'"; } $record['http_auth'] = "http_auth=" . $http_auth; $record['filtering'] = "filtering=" . $filtering; $record['pwd_encrypt'] = "pwd_encrypt=" . $pwd_encrypt; $record['change_pwd'] = "change_pwd=" . $change_pwd; $record['registration'] = "registration=" . $registration; $record['updated'] = "updated=" . $SUMO['server']['time']; // Create fields for query $new_record = array_values($record); for ($r = 0; $r < count($new_record); $r++) { if ($new_record[$r]) { $records[$r] = $new_record[$r]; } } $update = implode(', ', $records); $select = implode(' AND ', $records); // create query $query = "UPDATE " . SUMO_TABLE_ACCESSPOINTS . " \r\n\t\t\t\t SET " . $update . " \r\n\t\t\t\t WHERE id=" . $id; $SUMO['DB']->CacheFlush(); $SUMO['DB']->Execute($query); // verify query success $query = "SELECT COUNT(id) FROM " . SUMO_TABLE_ACCESSPOINTS . " \r\n\t\t\t\t WHERE id=" . $id . " \r\n\t\t\t\t AND " . $select; $rs = $SUMO['DB']->Execute($query); $tab = $rs->FetchRow(); // if updated: if ($tab[0] == 1) { if ($nodeinfo['ip'] == '') { $nodeinfo['ip'] = 'UNDEFINED'; } $apname = sumo_get_accesspoint_name($name, $SUMO['config']['server']['language']); sumo_write_log('I07000X', array($id, $apname, $nodeinfo['ip'], $SUMO['user']['user']), 3, 3, 'system', FALSE); return TRUE; } else { return FALSE; } } }
/** * Update intranet IP */ function sumo_update_intranet_ip_data($data = array()) { if (!empty($data)) { global $SUMO; $query = "UPDATE " . SUMO_TABLE_INTRANETIP . " \n\t\t\t\t SET\t\t\t\t \t\n\t\t\t\t \ttype='" . $data['type'] . "',\n\t\t\t\t \tip='" . $data['ip'] . "' \n\t\t\t\t WHERE id=" . $data['id']; $SUMO['DB']->Execute($query); // if intranet IP updated if (sumo_verify_intranet_ip_exist($data['ip'])) { sumo_write_log('I09007X', array($data['ip'], $SUMO['user']['user']), 3, 3, 'system', FALSE); return TRUE; } else { return FALSE; } } else { return FALSE; } }