public function isValid() { global $cfg; $db = Database::getInstance($cfg['MVC']['dsn']); $rules = $db->getAll("SELECT vrclassname, description, fieldname, \r\n\t\t\tfieldvalidators.modulename FROM fieldvalidators, formfields \r\n\t\t\tWHERE formfields.ruleid = fieldvalidators.ruleid\r\n\t\t\tAND formname = '{$this->formName}'"); //This statement has been removed from the where clause: //modulename = '{$this->fieldData['moduleName']}' AND $invalidFields = array(); $sess = Session::getInstance(); // Validate the submitted fields foreach ($rules as $rule) { MVCUtils::includeValidator($rule['vrclassname'], $rule['modulename']); eval("\$validatorObj = new {$rule['vrclassname']}(\$this->fieldData);"); $vResult = $validatorObj->isValid($this->fieldData[$rule['fieldname']]); if ($vResult !== true) { //Put the errors: // a) straight into the errors array for backwards compatibility // b) into a sub array, whose key is the submitted value for // errorFormName, otherwise use the form name $invalidFields[$rule['fieldname']] = $vResult; if (!$this->errorFormName) { $invalidFields[$this->formName][$rule['fieldname']] = $vResult; } else { $invalidFields[$this->errorFormName][$rule['fieldname']] = $vResult; } } if ($sess->keyExists('auth_user')) { BasicLogger::logMessage($sess->getValue('auth_user'), self::module, "debug"); } } if (!checkdate($this->fieldData['month'], $this->fieldData['day'], $this->fieldData['year']) || !is_numeric($this->fieldData['month']) || !is_numeric($this->fieldData['day']) || !is_numeric($this->fieldData['year'])) { $invalidFields[$this->formName]['form'] = "Invalid Date"; } return $invalidFields; }
/** * * The username to be logged in is taken from the $fieldData class * variable */ public function isValid(&$password) { $user = $this->fieldData['authUser']; $auth = Auth::getInstance(); $flag = false; BasicLogger::logMessage("checking login for '{$user}'", self::module, 'debug'); if ($auth->attemptLogin($user, $password)) { BasicLogger::logMessage("successful login for '{$user}'", self::module, 'debug'); $flag = true; } else { BasicLogger::logMessage("failed login for '{$user}'", self::module, 'debug'); $flag = "Invalid username or password"; } if (is_null($auth->getUserID())) { $Nuser = array(); $Nuser['username'] = $auth->getUser(); $Nuser['enabled'] = 't'; $Nuser['id'] = "#id#"; $db = Database::getInstance($cfg['Auth']['dsn']); $userID = $db->insert('users', $Nuser, true); if (isset($cfg['Auth']['defaultNewUserGroup'])) { $group = array(); $group['groupid'] = $cfg['Auth']['defaultNewUserGroup']; $group['userid'] = $userID; $db->insert('usersgroups', $group, true); } $auth->attemptLogin(); BasicLogger::logMessage("new user created for for '{$user}'", self::module, 'debug'); } return $flag; }
protected function processInvalid() { //Called when a bad username/password is submitted. if (isset($this->fieldData['fieldData'])) { $user = $this->fieldData['fieldData']; BasicLogger::logMessage("A login attempt failed for user '{$user}'."); } }
public static function smarty_resource_rfile_source($templateName, &$source, &$smarty) { $file = MVCUtils::findTemplate($templateName); if ($file === false) { BasicLogger::logMessage("Failed to return source for template '{$templateName}'", self::module, 'debug'); return false; } else { BasicLogger::logMessage("Source returned for remplate '{$templateName}'", self::module, 'debug'); $source = file_get_contents($file); return true; } }
/** * * The username to be logged in is taken from the $fieldData class * variable */ public function isValid(&$password) { $user = $this->fieldData['authUser']; $auth = Auth::getInstance(); BasicLogger::logMessage("checking login for '{$user}'", self::module, 'debug'); if ($auth->attemptLogin($user, $password)) { BasicLogger::logMessage("successful login for '{$user}'", self::module, 'debug'); return true; } else { BasicLogger::logMessage("failed login for '{$user}'", self::module, 'debug'); return "Invalid username or password"; } }
/** * Checks authorisation for a template * */ protected function checkAuth() { global $cfg; $auth = Auth::getInstance(); if (!$auth->isLoggedIn()) { BasicLogger::logMessage("Logging in user as default", self::module, 'debug'); $auth->attemptLogin($cfg['Auth']['anonuser']); } else { $auth->attemptLogin(); } BasicLogger::logMessage("logged in as '{$auth->getUser()}'", self::module, 'debug'); return AuthUtil::templateAccessAllowed(end($this->templateIDStack), $auth->getUser()); }
/** * Define a smarty function * * This function defines a smarty function, which can be accessed within * a template in the form {funcName arg1="val1" arg2="val2" ...}. The * following is roughly taken from smarty.php.net: * * The php-function callback impl can be either * * 1. an array of the form array(&$object, $method) with &$object being a reference to an object and $method being a string containing the mehod-name * 2. an array of the form array(&$class, $method) with $class being a classname and $method being a class method of that class. * */ protected function assignSmartyFunction($name, $impl) { //Run checks to ensure the class or object exists //There are no checks to see if the method exists list($classOrObject, $method) = $impl; $isObj = is_object($classOrObject); if (is_string($classOrObject)) { $isClass = class_exists($classOrObject); } else { $isClass = false; } if (!$isObj && !$isClass) { throw LoggedException("The class/object you passed does not exist/is not instantiated", null, module, "error"); } //Register the function $this->smarty->register_function($name, $impl); BasicLogger::logMessage("Registered smarty function '{$name}'", 'debug', self::module); }
/** * * @param string $username The username of the user * @param string $password The plain password (non-md5) * @return boolean True if userexists and user/pass match */ protected function checkUserPass($username, $password) { global $cfg; //ldapserver $ds = @ldap_connect($cfg['Auth']['LDAPDS']); $ldapUser = "******" . $username . "," . $cfg['Auth']['LDAPsr']; if ($ds) { ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3); $ldapbind = @ldap_bind($ds, $ldapUser, $password); ldap_close($ds); if ($ldapbind) { return true; } else { return false; } } else { BasicLogger::logMessage("Unable to connect to LDAP server", self::module, "notice"); return false; } }
public final function SMARTY_use($params) { global $cfg; $errorFlag = false; //Check that the function has been specified if (array_key_exists('func', $params)) { //Split the function name (about the '::') $modInfo = explode("::", $params['func']); //Check that the splitting worked, and it was only split in 2 bits if ($modInfo != false && count($modInfo) == 2) { //Check that the specified file exists if (file_exists($cfg['general']['toolkitRoot'] . "/" . $modInfo[0] . "/" . $modInfo[0] . ".class.php")) { include_once $cfg['general']['toolkitRoot'] . "/" . $modInfo[0] . "/" . $modInfo[0] . ".class.php"; //Check that the class and method have the expected names if (is_callable(array($modInfo[0], 'SMARTY_' . $modInfo[1]))) { //Pass the method both the form data and //$params combined into the fieldData parameter if (is_null($this->fieldData)) { $fieldD = $params; } else { $fieldD = array_merge($this->fieldData, $params); } $code = '$return = ' . $modInfo[0] . '::SMARTY_' . $modInfo[1] . '($fieldD,$this->invalidFields,$this->templateIDStack);'; eval($code); //A return value of false indicates an error if ($return === false) { $errorFlag = true; } } } else { $errorFlag = true; } } else { $errorFlag = true; } if ($errorFlag == false) { return $return; } else { BasicLogger::logMessage("Error in Function Call : " . $params['func'] . ".\n\t\t\t\t\tEither the Module / Function does not exist or the passed\n\t\t\t\t\tparameters are incorrect.", self::module); if ($cfg['Logger']['level'] == "debug") { return "Error in Function Call : " . $params['func'] . ".\n\t\t\t\t\tEither the Module / Function does not exist or the passed\n\t\t\t\t\tparameters are incorrect."; } else { return "Error in Function Call"; } } } else { BasicLogger::logMessage('No Module or function name defined, please use the format {use func="<ModuleName>::<FunctionName>" paramlist..}', $this->module); return "No function Defined"; } }
protected function processValid() { global $cfg; $db = Database::getInstance($cfg['DPS']['dsn']); $dirID = pg_escape_string($this->fieldData['dirID']); $auth = Auth::getInstance(); $userID = $auth->getUserID(); $uploaddir = $cfg['DPS']['dir']['uploadDir']; if (!is_dir($uploaddir)) { $this->errors['form'] = "Upload direcotry does not exist. Please\n contact the administrator."; BasicLogger::logMessage("{$uploaddir} is not a directory.", "DPS", "debug"); DPSUserFileDirectoryModel::processInvalid(); return; } if (!is_writeable($uploaddir)) { $this->errors['form'] = "Upload directory is not writeable. Please\n contact the administrator."; BasicLogger::logMessage("{$uploaddir} is not writeable.", "DPS", "debug"); DPSUserFileDirectoryModel::processInvalid(); return; } // Generate MD5 hash for uploaded file $fname = md5($_FILES['ufile']['name'] . time() . $_FILES['ufile']['tmp_name']); $uploadfile = $uploaddir . "/" . $fname; // Move the uploaded file from the system tmp dir to the DPS/uploads dir. if (move_uploaded_file($_FILES['ufile']['tmp_name'], $uploadfile . ".wav")) { // Determine various properties of file if ($this->fieldData['type'] == "advert") { $type = "3"; $typeID = $cfg['DPS']['AdvertTypeID']; } else { if ($this->fieldData['type'] == "pre-rec") { $type = "4"; $typeID = $cfg['DPS']['PrerecTypeID']; } else { $type = "2"; $typeID = $cfg['DPS']['JingleTypeID']; } } $package = $this->fieldData['package']; // Try to write info file for upload if ($handle = fopen($uploadfile . ".info", "w")) { $info = "uid: {$fname}\n" . "title: " . $this->fieldData['name'] . "\n" . "artists: \n" . "album: {$package}\n" . "tracknum: \n" . "genres: \n" . "released: \n" . "lengthfr: \n" . "mcn: \n" . "reclibid: \n" . "origin: " . $auth->getUser() . "\n" . "type: {$type}\n" . "cdpresult: N/A website upload\n" . "reclibinsert: \n"; // if successful in writing info, run the import script if (fwrite($handle, $info) !== FALSE) { exec(escapeshellcmd($cfg['DPS']['dir']['scriptsDir'] . '/dpswebimport.pl ') . escapeshellarg($fname), $id); $id = $id[0]; // import script returns an ID of the new file in the database if (is_numeric($id) && $id != '') { //insert into db directory, user, group and permissions stuff $audioDir['audioid'] = $id; $audioDir['dirid'] = $dirID; $audioDir['linktype'] = 0; $audioUser['audioid'] = $id; $audioUser['userid'] = $userID; $audioUser['permissions'] = $cfg['DPS']['fileRWO']; $audio['type'] = $typeID; $where = "audioid = " . $id; $db->delete('audiodir', $where, true); $where = "id = " . $id; $db->update('audio', $audio, $where, true); $db->insert('audiodir', $audioDir, true); $db->insert('audiousers', $audioUser, true); $gperm['groupid'] = $cfg['Auth']['AdminGroup']; $gperm['audioid'] = $id; $gperm['permissions'] = 'B' . $cfg['DPS']['fileRWO'] . 'B'; $db->insert('audiogroups', $gperm, false); } else { // failed to import the file BasicLogger::logMessage("Error recieved when uploading file: '" . $id . "'", "DPS", 'error'); $this->errors['form'] = "Unable to import file (file may be of invalid type): " . $id; exec("rm {$uploadfile}.wav"); exec("rm {$uploadfile}.info"); DPSUserFileDirectoryModel::processInvalid(); } } else { // failed to write the info file BasicLogger::logMessage("Error recieved when uploading file: Unable to write to {$fname}.info'", 'error'); $this->errors['form'] = "Unable to write to info file"; exec("rm {$uploadfile}.wav"); DPSUserFileDirectoryModel::processInvalid(); } fclose($handle); } else { // failed to open the info file to write into it BasicLogger::logMessage("Error recieved when uploading file: Unable to open {$fname}.info file to write'", 'error'); $this->errors['form'] = "Unable to open info file for writing"; exec("rm {$uploadfile}.wav"); DPSUserFileDirectoryModel::processInvalid(); } } else { // failed to move file into uploads directory if ($_FILES['ufile']['error'] == 1) { $this->errors['form'] = "File too large for upload to this server."; } else { if ($_FILES['ufile']['error'] == 2) { $this->errors['form'] = "File too large for upload via this form."; } else { if ($_FILES['ufile']['error'] == 3) { $this->errors['form'] = "The file was only partially uploaded."; } else { if ($_FILES['ufile']['error'] == 4) { $this->errors['form'] = "No file was uploaded."; } else { if ($_FILES['ufile']['error'] == 6) { $this->errors['form'] = "Missing temporary directory to upload file."; } else { if ($_FILES['ufile']['error'] == 7) { $this->errors['form'] = "Failed to write to disk."; } else { // otherwise throw a boring general error BasicLogger::logMessage("Error recieved when uploading file: Unable to move file for processing ({$_FILES['ufile']['error']}", 'error'); $this->errors['form'] = "Unable to movefile for processing"; } } } } } } DPSUserFileDirectoryModel::processInvalid(); } }
/** * Find a template * * This will look in the module for the specified template to try and find * a path to the template. If it cannot be found, each module will be * serched for the file. The the full path to the requested template will * be returned. * * @param mixed $template Either a template ID or file name * @return string The full path to the template including the file name, or false if not found */ public static function findTemplate($template) { //Make sure $template is a name, not id if (is_numeric($template)) { $template = self::getTemplateFileName($template); } $fullPath = false; //Check for windows and unix-type full path if (stristr('[A-Z]:', $template) !== false) { $fullPath = true; } else { if (substr($template, 0, 1) == '/') { $fullPath = true; } } if ($fullPath && file_exists($template)) { return $template; } static $cache = array(); global $cfg; //Check for cached result if (isset($cache[$template])) { return $cache[$template]; //if cached, execution stops here } //Get the module in which the template reisdes $module = MVCUtils::getTemplateModule($template); //If the template was found in the database then look for it in the //module specified in the database. if (!is_null($module)) { //Generate the path of the template file $path = $cfg['general']['toolkitRoot'] . "/{$module}/templates/{$template}"; $path = realpath($path); //Check the template exists where it should if (!file_exists($path)) { BasicLogger::logMessage("Template '{$template}' could not be found. I was looking here: {$path}", self::module, 'error'); return false; } //Cache the return value $cache[$template] = $path; return $path; //If the template was not found in the database then start searching //each modules template directory. The is because templates can //request to include a file which is not in the database. This could //be more efficiet if there was some method of knowing the directory //of the parent template, because only that directory would then need //to be searched } else { foreach ($cfg['modules'] as $module) { $path = $cfg['general']['toolkitRoot'] . '/' . $module . '/templates/'; //Convert relative paths to full paths $path = realpath($path); if (strlen($path) > 0) { //Recursively search the directory $path = self::findFile($path, $template); if ($path !== false) { //cache the return value $cache[$template] = $path; return $path; } } } return false; } /* //If execution has got this far then the file has not been found BasicLogger::logMessage("Template '$template' could not be found", self::module, 'error'); return false;*/ }
/** * Determine a users permission for a template * * This will return the permissions for the user specified by $user for * the template specified by $templateID. These permissions found using * calls to {@link getDetailedUserrealmAccess} * * @param mixed $user The user id or name * @param int $templateID The template ID * @return boolean True/false if access is allowed/denied respectively */ public static function templateAccessAllowed($templateID, $user) { global $cfg; BasicLogger::logMessage("Checking template access for user: {$user} for templateID: {$templateID}", self::module, "debug"); $db = Database::getInstance($cfg['Auth']['dsn']); if (eval("return " . $cfg['Auth']['authUtilClassModule'] . "::isUserID({$user});")) { $uid = $user; } else { $uid = AuthUtil::getUserID($user); } $ridsql = "SELECT realmid FROM templates WHERE templateid = '{$templateID}'"; $realm = $db->getOne($ridsql); $allow = false; $realmPath = eval("return " . $cfg['Auth']['authUtilClassModule'] . "::getRealmPath({$realm});"); $access = AuthUtil::getDetailedUserrealmAccess($realmPath, $uid); if ($access) { $allow = true; } BasicLogger::logMessage("Template access for user: {$user} for templateID: {$templateID} is {$allow}", self::module, "debug"); return $allow; }
public function attemptLogin($user = null, $password = null) { $this->setUser($user); $this->password = $password; global $cfg; $loggedIn = false; $this->failureReason = 0; $sess = Session::getInstance(); //If this is the anon user then login without checking if ($this->user == $cfg['Auth']['anonuser']) { $sess->setValue('auth_user', $cfg['Auth']['anonuser']); $this->loggedIn = true; //Set login_time session value $sess->setValue('auth_lastRequestTime', gmmktime()); return true; } else { //Dont both trying to login if user or pass is not passed set if (!is_null($this->user) && !is_null($this->password)) { if ($this->checkUserPass($this->user, $this->password)) { //Set auth_user session value if ($sess->keyExists('auth_user')) { } $sess->setValue('auth_user', $this->user); if ($sess->keyExists('auth_user')) { } //Set login_time session value $sess->setValue('auth_lastRequestTime', gmmktime()); $loggedIn = true; } else { //Login failed. Attempt login without new user data. //This will either log the user in as the anon user, //or based upon session data $this->attemptLogin(); $this->failureReason = 1; } //Check that session has not been inactive for too long } elseif ($sess->getValue('auth_lastRequestTime') < gmmktime() - $cfg['Auth']['lifetime']) { BasicLogger::logMessage("Session timed out", self::module, "notice"); //...if it has then delete session vars $sess->removeValue('auth_user'); $sess->removeValue('auth_lastRequestTime'); $this->attemptLogin($cfg['Auth']['anonuser']); //Not requested, but just to be explicit, set loggedIn to false. $loggedIn = false; $this->failureReason = 2; //Check to see if user has been previous authenticated during session } elseif ($this->isSessionLoggedIn()) { //Store username to class variable for other methods to use $this->setUser($sess->getValue('auth_user')); $sess->setValue('auth_lastRequestTime', gmmktime()); $loggedIn = true; } else { BasicLogger::logMessage("uncaught auth failure in attempt login", self::module, "notice"); //Uncaught failure reason $this->failureReason = 3; } $this->loggedIn = $loggedIn; return $loggedIn; } }
protected function purgeExpiredSessions() { global $cfg; if ($cfg['Session']['deleteExpiredProb'] >= rand(0, 1)) { $sql = "SELECT sessionid from sessions where lastaccess < ?"; /*$sql = "DELETE sessions, sessionvalues FROM sessions, sessionvalues WHERE sessions.sessionid = sessionvalues.sessionid AND sessions.lastaccess < ?"; */ $db = Database::getInstance($cfg['Session']['dsn']); $time = "'" . (gmmktime() - $cfg['Session']['lifetime']) . "'"; $result = $db->getAll($sql, array($time)); foreach ($result as $row) { $sesID = $row['sessionid']; $where = "sessionid = " . $sesID; $db->delete('sessionvalues', $where, true); $db->delete('sessions', $where, true); } BasicLogger::logMessage("Purged expired sessions", self::module, 'notice'); } }