High5! Code

Blame

Date:: Tue Sep 6 11:56:05 2022 UTC
Message:: change check_role() to query
Actions:: History | Blob | Raw File
  1 4db75ba3 2022-09-05 mischa <?php
  2 4db75ba3 2022-09-05 mischa // 
  3 4db75ba3 2022-09-05 mischa // OpenSMTPD Admin 
  4 4db75ba3 2022-09-05 mischa // by Mischa Peters <mischa at high5 dot nl>
  5 4db75ba3 2022-09-05 mischa // Copyright (c) 2022 High5!
  6 4db75ba3 2022-09-05 mischa // License Info: LICENSE.TXT
  7 4db75ba3 2022-09-05 mischa //
  8 4db75ba3 2022-09-05 mischa // File: admin.php
  9 4db75ba3 2022-09-05 mischa //
 10 4db75ba3 2022-09-05 mischa // Template File: admin_admin.tpl
 11 4db75ba3 2022-09-05 mischa //
 12 4db75ba3 2022-09-05 mischa //
 13 4db75ba3 2022-09-05 mischa // Template Variables:
 14 4db75ba3 2022-09-05 mischa //
 15 4db75ba3 2022-09-05 mischa // action
 16 4db75ba3 2022-09-05 mischa // message
 17 4db75ba3 2022-09-05 mischa // username
 18 4db75ba3 2022-09-05 mischa // domains
 19 4db75ba3 2022-09-05 mischa //
 20 4db75ba3 2022-09-05 mischa // POST / GET Variables:
 21 4db75ba3 2022-09-05 mischa //
 22 4db75ba3 2022-09-05 mischa // username
 23 4db75ba3 2022-09-05 mischa // password1
 24 4db75ba3 2022-09-05 mischa // password2
 25 4db75ba3 2022-09-05 mischa // domains
 26 4db75ba3 2022-09-05 mischa //
 27 4db75ba3 2022-09-05 mischa require_once './functions.inc.php';
 28 4db75ba3 2022-09-05 mischa include './languages/' . check_language() . '.lang';
 29 4db75ba3 2022-09-05 mischa 
 30 4db75ba3 2022-09-05 mischa $SESSID_USERNAME = check_session();
 31 1575a178 2022-09-06 mischa $ROLE = check_role($SESSID_USERNAME);
 32 4db75ba3 2022-09-05 mischa 
 33 080e0cc0 2022-09-05 mischa if ($ROLE != ADMIN_ROLE) {
 34 4db75ba3 2022-09-05 mischa 	header("Location: list-domain.php");
 35 4db75ba3 2022-09-05 mischa 	die();;
 36 4db75ba3 2022-09-05 mischa }
 37 4db75ba3 2022-09-05 mischa 
 38 4db75ba3 2022-09-05 mischa $list_domains = list_domains();
 39 4db75ba3 2022-09-05 mischa $list_admins = list_admins();
 40 4db75ba3 2022-09-05 mischa 
 41 4db75ba3 2022-09-05 mischa if ($_SERVER['REQUEST_METHOD'] == "GET") {
 42 4db75ba3 2022-09-05 mischa 	$action = filter_input(INPUT_GET, 'action', FILTER_DEFAULT) ?? 'add';
 43 4db75ba3 2022-09-05 mischa 	if ($action == 'edit') {
 44 4db75ba3 2022-09-05 mischa 		$username = filter_input(INPUT_GET, 'username', FILTER_VALIDATE_EMAIL);
 45 4db75ba3 2022-09-05 mischa 		$domains['domains'] = array_column(list_domains($username), 'domain');
 46 4db75ba3 2022-09-05 mischa 	}
 47 4db75ba3 2022-09-05 mischa }
 48 4db75ba3 2022-09-05 mischa 
 49 4db75ba3 2022-09-05 mischa if ($_SERVER['REQUEST_METHOD'] == "POST") {
 50 4db75ba3 2022-09-05 mischa 	$action = filter_input(INPUT_GET, 'action', FILTER_DEFAULT) ?? 'add';
 51 4db75ba3 2022-09-05 mischa 	$username = filter_input(INPUT_POST, 'username', FILTER_VALIDATE_EMAIL);
 52 4db75ba3 2022-09-05 mischa 	$password1 = filter_input(INPUT_POST, 'password1', FILTER_DEFAULT);
 53 4db75ba3 2022-09-05 mischa 	$password2 = filter_input(INPUT_POST, 'password2', FILTER_DEFAULT);
 54 4db75ba3 2022-09-05 mischa 	$domains = filter_input_array(INPUT_POST, array('domains' => array('filter' => FILTER_VALIDATE_DOMAIN, 'flags' => FILTER_REQUIRE_ARRAY)));
 55 4db75ba3 2022-09-05 mischa 
 56 4db75ba3 2022-09-05 mischa 
 57 4db75ba3 2022-09-05 mischa 	if ($action == 'add') {
 58 4db75ba3 2022-09-05 mischa 		if (empty($username) || in_array($username, array_column($list_admins, 'username'))) {
 59 4db75ba3 2022-09-05 mischa 			$message = $LANG['AdminAdd_admin_username_error'];
 60 4db75ba3 2022-09-05 mischa 		}
 61 4db75ba3 2022-09-05 mischa 
 62 4db75ba3 2022-09-05 mischa 		if (empty($password1) || $password1 != $password2) {
 63 4db75ba3 2022-09-05 mischa 			$message = $LANG['AdminAdd_admin_password_error'];
 64 4db75ba3 2022-09-05 mischa 		}
 65 4db75ba3 2022-09-05 mischa 
 66 4db75ba3 2022-09-05 mischa 		if (empty($domains['domains'])) {
 67 4db75ba3 2022-09-05 mischa 			$message = $LANG['AdminAdd_admin_domain_error'];
 68 4db75ba3 2022-09-05 mischa 		}
 69 4db75ba3 2022-09-05 mischa 
 70 4db75ba3 2022-09-05 mischa 		if (empty($message)) {
 71 4db75ba3 2022-09-05 mischa 			$hashed = bcrypt($password1);
 72 4db75ba3 2022-09-05 mischa 			try {
 73 4db75ba3 2022-09-05 mischa 				$dbh = pdo_connect();
 74 4db75ba3 2022-09-05 mischa 				$sth = $dbh->prepare("INSERT INTO admin (username,password,created,modified) VALUES (?,?,NOW(),NOW())");
 75 4db75ba3 2022-09-05 mischa 				$sth->bindParam(1, $username, PDO::PARAM_STR);
 76 4db75ba3 2022-09-05 mischa 				$sth->bindParam(2, $hashed, PDO::PARAM_STR);
 77 4db75ba3 2022-09-05 mischa 				$sth->execute();
 78 4db75ba3 2022-09-05 mischa 				foreach ($domains['domains'] as $row) {
 79 4db75ba3 2022-09-05 mischa 					$sth = $dbh->prepare("INSERT INTO domain_admins (username,domain,created) VALUES (?,?,NOW())");
 80 4db75ba3 2022-09-05 mischa 					$sth->bindParam(1, $username, PDO::PARAM_STR);
 81 4db75ba3 2022-09-05 mischa 					$sth->bindParam(2, $row, PDO::PARAM_STR);
 82 4db75ba3 2022-09-05 mischa 					$sth->execute();
 83 4db75ba3 2022-09-05 mischa 				}
 84 4db75ba3 2022-09-05 mischa 				$message = $LANG['AdminAdd_admin_result_succes'] . "<br />($username)</br />";
 85 4db75ba3 2022-09-05 mischa 			} catch(PDOException $e) {
 86 4db75ba3 2022-09-05 mischa 				$message = $LANG['AdminAdd_admin_result_error'] . "<br />($username)<br />";
 87 4db75ba3 2022-09-05 mischa 			}	
 88 4db75ba3 2022-09-05 mischa 		}
 89 4db75ba3 2022-09-05 mischa 	}
 90 4db75ba3 2022-09-05 mischa 
 91 4db75ba3 2022-09-05 mischa 	if (in_array($username, array_column($list_admins, 'username')) && $action == 'edit') {
 92 4db75ba3 2022-09-05 mischa 		if ($password1 != $password2) {
 93 4db75ba3 2022-09-05 mischa 			$message = $LANG['AdminAdd_admin_password_error'];
 94 4db75ba3 2022-09-05 mischa 		}
 95 4db75ba3 2022-09-05 mischa 		if (empty($message) && !empty($password1)) {
 96 4db75ba3 2022-09-05 mischa 			$hashed = bcrypt($password1);
 97 4db75ba3 2022-09-05 mischa 			try {
 98 4db75ba3 2022-09-05 mischa 				$dbh = pdo_connect();
 99 4db75ba3 2022-09-05 mischa 				$sth = $dbh->prepare("UPDATE admin SET password=?,modified=NOW() WHERE username=?");
100 4db75ba3 2022-09-05 mischa 				$sth->bindParam(1, $hashed, PDO::PARAM_STR);
101 4db75ba3 2022-09-05 mischa 				$sth->bindParam(2, $username, PDO::PARAM_STR);
102 4db75ba3 2022-09-05 mischa 				$sth->execute();
103 4db75ba3 2022-09-05 mischa 			} catch(PDOException $e) {
104 4db75ba3 2022-09-05 mischa 				$message = $LANG['AdminEdit_admin_result_error'] . "<br />($username)<br />";
105 4db75ba3 2022-09-05 mischa 			}	
106 4db75ba3 2022-09-05 mischa 		}
107 4db75ba3 2022-09-05 mischa 
108 4db75ba3 2022-09-05 mischa 		if (empty($domains['domains'])) {
109 4db75ba3 2022-09-05 mischa 			$message = $LANG['AdminAdd_admin_domain_error'];
110 4db75ba3 2022-09-05 mischa 		}
111 4db75ba3 2022-09-05 mischa 		if (empty($message)) {
112 4db75ba3 2022-09-05 mischa 			try {
113 4db75ba3 2022-09-05 mischa 				$dbh = pdo_connect();
114 4db75ba3 2022-09-05 mischa 				$sth = $dbh->prepare("SELECT COUNT(*) FROM domain_admins WHERE username=?");
115 4db75ba3 2022-09-05 mischa 				$sth->execute(array($username));
116 4db75ba3 2022-09-05 mischa 				$count_domain_admins = $sth->fetchColumn();
117 4db75ba3 2022-09-05 mischa 
118 4db75ba3 2022-09-05 mischa 				$sth = $dbh->prepare("DELETE FROM domain_admins WHERE username=?");
119 4db75ba3 2022-09-05 mischa 				$sth->execute(array($username));
120 4db75ba3 2022-09-05 mischa 				if ($sth->rowCount() != $count_domain_admins) {
121 4db75ba3 2022-09-05 mischa 					throw new RuntimeException('Unable to delete entries from the domain_admins table.');
122 4db75ba3 2022-09-05 mischa 				}
123 4db75ba3 2022-09-05 mischa 
124 4db75ba3 2022-09-05 mischa 				foreach ($domains['domains'] as $row) {
125 4db75ba3 2022-09-05 mischa 					$sth = $dbh->prepare("INSERT INTO domain_admins (username,domain,created) VALUES (?,?,NOW())");
126 4db75ba3 2022-09-05 mischa 					$sth->bindParam(1, $username, PDO::PARAM_STR);
127 4db75ba3 2022-09-05 mischa 					$sth->bindParam(2, $row, PDO::PARAM_STR);
128 4db75ba3 2022-09-05 mischa 					$sth->execute();
129 4db75ba3 2022-09-05 mischa 				}
130 4db75ba3 2022-09-05 mischa 				header("Location: list-admin.php");
131 4db75ba3 2022-09-05 mischa 			} catch (RuntimeException $e) {
132 4db75ba3 2022-09-05 mischa 				$message = $LANG['AdminEdit_admin_result_error'];
133 4db75ba3 2022-09-05 mischa 			} catch (PDOException $e) {
134 4db75ba3 2022-09-05 mischa 				$message = $LANG['AdminEdit_admin_result_error'];
135 4db75ba3 2022-09-05 mischa 			}
136 4db75ba3 2022-09-05 mischa 		}
137 4db75ba3 2022-09-05 mischa 	}
138 4db75ba3 2022-09-05 mischa }
139 4db75ba3 2022-09-05 mischa include './templates/header.tpl';
140 4db75ba3 2022-09-05 mischa include './templates/menu.tpl';
141 4db75ba3 2022-09-05 mischa include './templates/admin.tpl';
142 4db75ba3 2022-09-05 mischa include './templates/footer.tpl';
143 4db75ba3 2022-09-05 mischa ?>