session/checkuser.php (958c3e6) - webinterface.git

checkuser.php

<?php
/*
This file belongs to the Webinterface of schokokeks.org Hosting

Written by schokokeks.org Hosting, namely
  Bernd Wurst <bernd@schokokeks.org>
  Hanno Böck <hanno@schokokeks.org>

This code is published under a 0BSD license.

Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
*/

require_once('inc/base.php');
require_once('inc/security.php');
require_once('inc/debug.php');
require_once('inc/error.php');

define('ROLE_ANONYMOUS', 0);
define('ROLE_MAILACCOUNT', 1);
define('ROLE_VMAIL_ACCOUNT', 2);
define('ROLE_SYSTEMUSER', 4);
define('ROLE_CUSTOMER', 8);
define('ROLE_SYSADMIN', 16);
define('ROLE_SUBUSER', 32);

// Gibt die Rolle aus, wenn das Passwort stimmt

// Customer?
    $customerno = (int) $login;
    $result = db_query("SELECT passwort FROM kundendaten.kunden WHERE status=0 AND id=:customerno", [":customerno" => $customerno]);
    if ($result->rowCount() > 0) {
        $pwhash = $result->fetch()['passwort'];
        if ($i_am_admin || legacy_pw_verify($password, $pwhash)) {
            logger(LOG_INFO, "session/checkuser", "login", "logged in customer »{$customerno}«.");
            return ROLE_CUSTOMER;
        }
        logger(LOG_WARNING, "session/checkuser", "login", "wrong password for existing customer »{$customerno}«.");
    }

// Sub-User

$result = db_query("SELECT password FROM system.subusers WHERE username=?", [$login]);
    if (@$result->rowCount() > 0) {
        $entry = $result->fetch(PDO::FETCH_OBJ);
        $db_password = $entry->password;
        if (legacy_pw_verify($password, $db_password) || $i_am_admin) {
            logger(LOG_INFO, "session/checkuser", "login", "logged in virtual subuser »{$login}«.");
            return ROLE_SUBUSER;
        }
        logger(LOG_WARNING, "session/checkuser", "login", "wrong password for existing subuser »{$login}«.");
    }

// Mail-Account
    $account = $login;
    if (!strstr($account, '@')) {
        $account .= '@' . config('masterdomain');
    }
    if (!$i_am_admin && have_module('webmailtotp')) {
        require_once('modules/webmailtotp/include/totp.php');
        if (account_has_totp($account)) {
            if (check_webmail_password($account, $password)) {
                $_SESSION['totp_username'] = $account;
                $_SESSION['totp'] = true;
                show_page('totp-login');
                die();
            } else {
                return null;
            }
        }
    }
    $result = db_query("SELECT cryptpass FROM mail.courier_mailaccounts WHERE account=?", [$account]);
    if (@$result->rowCount() > 0) {
        $entry = $result->fetch(PDO::FETCH_OBJ);
        $db_password = $entry->cryptpass;
        if (password_verify($password, $db_password) || $i_am_admin) {
            logger(LOG_INFO, "session/checkuser", "login", "logged in e-mail-account »{$account}«.");
            return ROLE_MAILACCOUNT;
        }
        logger(LOG_WARNING, "session/checkuser", "login", "wrong password for existing e-mail-account »{$account}«.");
    }

// virtueller Mail-Account
    $account = $login;
    $result = db_query("SELECT cryptpass FROM mail.courier_virtual_accounts WHERE account=?", [$account]);
    if (@$result->rowCount() > 0) {
        $entry = $result->fetch(PDO::FETCH_OBJ);
        $db_password = $entry->cryptpass;
        if (password_verify($password, $db_password) || $i_am_admin) {
            logger(LOG_INFO, "session/checkuser", "login", "logged in virtual e-mail-account »{$account}«.");
            return ROLE_VMAIL_ACCOUNT;
        }
        logger(LOG_WARNING, "session/checkuser", "login", "wrong password for existing virtual e-mail-account »{$account}«.");
    }

// Nothing?
    return null;
}

return $ret;
}

function set_customer_verified($customerno)
{
    $customerno = (int) $customerno;
    db_query("UPDATE kundendaten.kunden SET status=0 WHERE id=?", [$customerno]);
    logger(LOG_INFO, "session/checkuser", "register", "set customer's status to 0.");
}

function set_customer_lastlogin($customerno)
{
    $customerno = (int) $customerno;
    db_query("UPDATE kundendaten.kunden SET lastlogin=NOW() WHERE id=?", [$customerno]);
}

function set_customer_password($customerno, $newpass)
{
    $customerno = (int) $customerno;
    $newpass = sha1($newpass);
    db_query("UPDATE kundendaten.kunden SET passwort=:newpass WHERE id=:customerno", [":newpass" => $newpass, ":customerno" => $customerno]);
    logger(LOG_INFO, "session/checkuser", "pwchange", "changed customer's password.");
}

function set_subuser_password($subuser, $newpass)
{
    $args = [":subuser" => $subuser,
                ":uid" => (int) $_SESSION['userinfo']['uid'],
                ":newpass" => gen_pw_hash($newpass), ];
    db_query("UPDATE system.subusers SET password=:newpass WHERE username=:subuser AND uid=:uid", $args);
    logger(LOG_INFO, "session/checkuser", "pwchange", "changed subuser's password.");
}

function set_systemuser_password($uid, $newpass)
{
    $uid = (int) $uid;
    require_once('inc/base.php');
    $newpass = gen_pw_hash($newpass);
    db_query("UPDATE system.passwoerter SET passwort=:newpass WHERE uid=:uid", [":newpass" => $newpass, ":uid" => $uid]);
    logger(LOG_INFO, "session/checkuser", "pwchange", "changed user's password.");
}

function user_for_mailaccount($account)
{
    $result = db_query("SELECT uid FROM mail.courier_mailaccounts WHERE account=?", [$account]);
    if ($result->rowCount() != 1) {
        system_failure('Diese Adresse ist herrenlos?!');
    }
    $tmp = $result->fetch();
    return $tmp['uid'];
}

function user_for_vmail_account($account)
{
    $result = db_query("SELECT useraccount FROM mail.v_vmail_accounts WHERE CONCAT_WS('@', local, domainname)=?", [$account]);
    if ($result->rowCount() != 1) {
        system_failure('Diese Adresse ist herrenlos?!');
    }
    $tmp = $result->fetch();
    return $tmp['useraccount'];
}

webinterface.git

Use legacy_pw_verify for customer login to allow both old-style and modern hashes