webinterface.git

@@ -8,19 +8,10 @@ require_once('class/domain.php');

 require_role(array(ROLE_SYSTEMUSER, ROLE_CUSTOMER));

-switch ($_SESSION['role'])

-{

-  case ROLE_SYSTEMUSER:

-    $user_domains = get_domain_list($_SESSION['userinfo']['customerno'], $_SESSION['userinfo']['uid']);

-    $info = 'userinfo';

-    break;

-  case ROLE_CUSTOMER:

+if ($_SESSION['role'] & ROLE_CUSTOMER)

   $user_domains = get_domain_list($_SESSION['customerinfo']['customerno']);

-    break;

-  default:

-    $info = NULL;

-    break;

-}

+else

+  $user_domains = get_domain_list($_SESSION['userinfo']['customerno'], $_SESSION['userinfo']['uid']);

 $title = "Domainüberblick";

@@ -4,13 +4,10 @@ $menu = array();

 $role = $_SESSION['role'];

-switch ($role)

+

+if (($role & ROLE_CUSTOMER) || ($role & ROLE_SYSTEMUSER))

 {

-  case ROLE_ANONYMOUS:

-    break;

-  default:

   $menu["domains_domains"] = array("label" => "Domains", "file" => "domains.php", "weight" => 1);

-    

 }

 if (empty($menu))

@@ -4,11 +4,9 @@ $menu = array();

 $role = $_SESSION['role'];

-switch ($role)

+if ($role & ROLE_SYSTEMUSER)

 {

-  case ROLE_SYSTEMUSER:

   $menu["imap_accounts"] = array("label" => "IMAP/POP3", "file" => "accounts.php", "weight" => 10);

-    

 }

 if (empty($menu))

@@ -12,15 +12,11 @@ if ($_POST['password1'] != '')

 {

   check_form_token('index_chpass');

   $result = NULL;

-  switch ($_SESSION['role'])

-  {

-    case ROLE_SYSTEMUSER:

+  if ($_SESSION['role'] & ROLE_SYSTEMUSER)

     $result = find_role($_SESSION['userinfo']['uid'], $_POST['old_password']);

-      break;

-    case ROLE_CUSTOMER:

+  else

     $result = find_role($_SESSION['customerinfo']['customerno'], $_POST['old_password']);

-      break;

-  }

+

   if ($result == NULL)

     input_error('Das bisherige Passwort ist nicht korrekt!');

   elseif ($_POST['password2'] != $_POST['password1'])

@@ -38,7 +34,7 @@ if ($_POST['password1'] != '')

     elseif ($result === ROLE_CUSTOMER)

       set_customer_password($_SESSION['customerinfo']['customerno'], $_POST['password1']);

     else

-      system_failure("WTF?!");

+      system_failure("WTF?! (\$result={$result})");

     if (! $debugmode)

       header('Location: index.php');

@@ -49,7 +45,7 @@ if ($_POST['password1'] != '')

-if ($_SESSION['role'] == ROLE_SYSTEMUSER)

+if ($_SESSION['role'] & ROLE_SYSTEMUSER)

   warning('Beachten Sie: Wenn Sie hier Ihr Passwort ändern, betrifft dies auch Ihr Anmelde-Passwort am Server (SSH).');

 output('<h3>Passwort &auml;ndern</h3>

@@ -24,6 +24,14 @@ case ROLE_SYSTEMUSER:

 case ROLE_CUSTOMER:

   $role = "{$_SESSION['customerinfo']['name']}, angemeldet als Kunde";

   break;

+case ROLE_CUSTOMER | ROLE_SYSTEMUSER:

+  $role = "{$_SESSION['customerinfo']['name']}, angemeldet als Kunde und Benutzer";

+  break;

+case ROLE_CUSTOMER | ROLE_SYSTEMUSER | ROLE_SYSADMIN:

+  $role = "{$_SESSION['customerinfo']['name']}, angemeldet als Kunde, Benutzer und Administrator";

+  break;

+default:

+  system_failure('Interner Fehler (»Unbekannte Rolle: '.$_SESSION['role'].'«)');

 }

@@ -3,9 +3,8 @@ $menu = array();

 $role = $_SESSION['role'];

-switch ($role)

+if ($role & ROLE_SYSTEMUSER)

 {

-  case ROLE_SYSTEMUSER:

   $menu["mysql_databases"] = array("label" => "MySQL-Datenbank", "file" => "databases.php", "weight" => 20);

 }

@@ -4,11 +4,9 @@ $menu = array();

 $role = $_SESSION['role'];

-switch ($role)

+if ($role & ROLE_CUSTOMER)

 {

-  case ROLE_CUSTOMER:

   $menu["systemuser"] = array("label" => "Benutzeraccounts", "file" => "accounts.php", "weight" => 30);

-    

 }

 if (empty($menu))

@@ -9,13 +9,13 @@ require_once('inc/db_connect.php');

 define('ROLE_ANONYMOUS', 0);

 define('ROLE_DOMAINADMIN', 1);

 define('ROLE_SYSTEMUSER', 2);

-define('ROLE_CUSTOMER', 3);

-define('ROLE_SYSADMIN', 4);

+define('ROLE_CUSTOMER', 4);

+define('ROLE_SYSADMIN', 8);

 // Gibt die Rolle aus, wenn das Passwort stimmt

-function find_role($login, $password)

+function find_role($login, $password, $i_am_admin = False)

 {

   $login = mysql_real_escape_string($login);

   // Domain-Admin?  <not implemented>

@@ -23,19 +23,29 @@ function find_role($login, $password)

   $uid = (int) $login;

   if ($uid == 0)

     $uid = 'NULL';

-  $result = db_query("SELECT passwort AS password FROM system.v_useraccounts LEFT JOIN system.passwoerter USING (uid) WHERE uid={$uid} OR username='{$login}' LIMIT 1;");

+  $result = db_query("SELECT passwort AS password, (u.uid = (SELECT min(uid) FROM system.v_useraccounts AS acc WHERE acc.kunde=u.kunde)) AS  `primary`, ((SELECT acc.uid FROM system.v_useraccounts AS acc LEFT JOIN system.gruppenzugehoerigkeit USING (uid) LEFT JOIN system.gruppen AS g ON (g.gid=gruppenzugehoerigkeit.gid) WHERE g.name='admin' AND acc.uid=u.uid) IS NOT NULL) AS admin FROM system.v_useraccounts AS u LEFT JOIN system.passwoerter USING(uid) WHERE u.uid={$uid} OR username='{$login}' LIMIT 1;");

   if (@mysql_num_rows($result) > 0)

   {

-    $db_password = mysql_fetch_object($result)->password;

+    $entry = mysql_fetch_object($result);

+    $db_password = $entry->password;

     $hash = crypt($password, $db_password);

-    if ($hash == $db_password)

-      return ROLE_SYSTEMUSER;

+    if ($hash == $db_password || $i_am_admin)

+    {

+      $role = ROLE_SYSTEMUSER;

+      if ($entry->primary)

+        $role = $role | ROLE_CUSTOMER;

+      if ($entry->admin)

+        $role = $role | ROLE_SYSADMIN;

+      return $role;

+    }

   }

   // Customer?

   $customerno = (int) $login;

   $pass = sha1($password);

   $result = db_query("SELECT passwort AS password FROM kundendaten.kunden WHERE status=0 AND id={$customerno} AND passwort='{$pass}';");

+  if ($i_am_admin)

+    $result = db_query("SELECT passwort AS password FROM kundendaten.kunden WHERE status=0 AND id={$customerno}");

   if (@mysql_num_rows($result) > 0)

   {

     return ROLE_CUSTOMER;

@@ -46,11 +56,23 @@ function find_role($login, $password)

 }

-function get_customer_info($customerno)

+function get_customer_info($customer)

 {

+  if (! $_SESSION['role'] & ROLE_CUSTOMER)

+    return array();

   $ret = array();

-  $customerno = (int) $customerno;

+  $customerno = (int) $customer;

+  if ($customerno != 0)

+  {

+    DEBUG('Looking up customerinfo for customer no. '.$customerno);

     $result = db_query("SELECT id, anrede, firma, CONCAT_WS(' ', vorname, nachname) AS name FROM kundendaten.kunden WHERE id={$customerno} LIMIT 1;");

+  }

+  else

+  {

+    $username = mysql_real_escape_string($customer);

+    DEBUG('looking up customer info for username '.$username);

+    $result = db_query("SELECT id, anrede, firma, CONCAT_WS(' ', vorname, nachname) AS name FROM kundendaten.kunden AS k JOIN system.v_useraccounts AS u ON (u.kunde=k.id) WHERE u.username='{$username}'");

+  }

   if (@mysql_num_rows($result) == 0)

     system_failure("Konnte Kundendaten nicht auslesen!");

   $data = mysql_fetch_object($result);

@@ -127,4 +149,26 @@ function set_systemuser_password($uid, $newpass)

   logger("session/checkuser.php", "pwchange", "changed user's password.");

 }

+

+function setup_session($role, $useridentity)

+{

+  session_regenerate_id();

+  $_SESSION['role'] = $role;

+  if ($role & ROLE_SYSTEMUSER)

+  {

+    DEBUG("We are system user");

+    $info = get_user_info($useridentity);

+    $_SESSION['userinfo'] = $info;

+    logger("session/start.php", "login", "logged in user »{$info['username']}«");

+    $useridentity = $info['customerno'];

+  }

+  if ($role & ROLE_CUSTOMER)

+  {

+    $info = get_customer_info($useridentity);

+    $_SESSION['customerinfo'] = $info;

+    set_customer_lastlogin($info['customerno']);

+    logger("session/start.php", "login", "logged in customer no »{$info['customerno']}«");

+  }

+}

+

 ?>

@@ -32,23 +32,7 @@ if (isset($_POST['username']) && isset($_POST['password']))

   }

   else

   {

-    session_regenerate_id();

-    $_SESSION['role'] = $role;

-

-    switch ($role)

-    {

-    case ROLE_SYSTEMUSER:

-      $info = get_user_info($_POST['username']);

-      $_SESSION['userinfo'] = $info;

-      logger("session/start.php", "login", "logged in user »{$info['username']}«");

-      break;

-    case ROLE_CUSTOMER:

-      $info = get_customer_info($_POST['username']);

-      $_SESSION['customerinfo'] = $info;

-      set_customer_lastlogin($info['customerno']);

-      logger("session/start.php", "login", "logged in customer no »{$info['customerno']}«");

-      break;

-    }

+    setup_session($role, $_POST['username']);

   }

   unset($_POST['username']);

   unset($_POST['password']);