session/checkuser.php (c2de282) - webinterface.git

checkuser.php

<?php

require_once('inc/base.php');
require_once('inc/debug.php');
require_once('inc/error.php');

require_once('inc/db_connect.php');

define('ROLE_ANONYMOUS', 0);
define('ROLE_MAILACCOUNT', 1);
define('ROLE_VMAIL_ACCOUNT', 2);
define('ROLE_SYSTEMUSER', 4);
define('ROLE_CUSTOMER', 8);
define('ROLE_SYSADMIN', 16);

// Gibt die Rolle aus, wenn das Passwort stimmt

// Customer?
  $customerno = (int) $login;
  $pass = sha1($password);
  $result = db_query("SELECT passwort AS password FROM kundendaten.kunden WHERE status=0 AND id={$customerno} AND passwort='{$pass}';");
  if ($i_am_admin)
    $result = db_query("SELECT passwort AS password FROM kundendaten.kunden WHERE status=0 AND id={$customerno}");
  if (@mysql_num_rows($result) > 0)
  {
    return ROLE_CUSTOMER;
  }

// Mail-Account
  $account = $login;
  if (! strstr($account, '@')) {
    $account .= '@'.config('masterdomain');
  }
  $result = db_query("SELECT cryptpass FROM mail.courier_mailaccounts WHERE account='{$account}' LIMIT 1;");
  if (@mysql_num_rows($result) > 0)
  {
    $entry = mysql_fetch_object($result);
    $db_password = $entry->cryptpass;
    $hash = crypt($password, $db_password);
    if ($hash == $db_password || $i_am_admin)
    {
      logger(LOG_INFO, "session/checkuser", "login", "logged in e-mail-account »{$account}«.");
      return ROLE_MAILACCOUNT;
    }
    logger(LOG_WARNING, "session/checkuser", "login", "wrong password for existing e-mail-account »{$account}«.");
  }
  
  // virtueller Mail-Account
  $account = $login;
  $result = db_query("SELECT cryptpass FROM mail.courier_virtual_accounts WHERE account='{$account}' LIMIT 1;");
  if (@mysql_num_rows($result) > 0)
  {
    $entry = mysql_fetch_object($result);
    $db_password = $entry->cryptpass;
    $hash = crypt($password, $db_password);
    if ($hash == $db_password || $i_am_admin)
    {
      logger(LOG_INFO, "session/checkuser", "login", "logged in virtual e-mail-account »{$account}«.");
      return ROLE_VMAIL_ACCOUNT;
    }
    logger(LOG_WARNING, "session/checkuser", "login", "wrong password for existing virtual e-mail-account »{$account}«.");
  }

// Nothing?
  return NULL;
}

function set_customer_verified($customerno)
{
  $customerno = (int) $customerno;
  db_query("UPDATE kundendaten.kunden SET status=0 WHERE id={$customerno};");
  logger(LOG_INFO, "session/checkuser", "register", "set customer's status to 0.");
}

function set_customer_lastlogin($customerno)
{
  $customerno = (int) $customerno;
  db_query("UPDATE kundendaten.kunden SET lastlogin=NOW() WHERE id={$customerno};");
}

function set_customer_password($customerno, $newpass)
{
  $customerno = (int) $customerno;
  $newpass = sha1($newpass);
  db_query("UPDATE kundendaten.kunden SET passwort='$newpass' WHERE id='".$customerno."' LIMIT 1");
  logger(LOG_INFO, "session/checkuser", "pwchange", "changed customer's password.");
}

function set_systemuser_password($uid, $newpass)
{
  $uid = (int) $uid;
  require_once('inc/base.php');
  $salt = random_string(8);
  $newpass = crypt($newpass, "\$1\${$salt}\$");
  db_query("UPDATE system.passwoerter SET passwort='$newpass' WHERE uid='".$uid."' LIMIT 1");
  logger(LOG_INFO, "session/checkuser", "pwchange", "changed user's password.");
}

}

webinterface.git

Warnung gefixed