1 <?php

     2 

     3 /*

     4  * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between

     5  * Version 1.0 (Banshee)

     6  * Copyright (C) 2006-2007 Dan Fuhry

     7  * sessions.php - everything related to security and user management

     8  *

     9  * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License

    10  * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

    11  *

    12  * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied

    13  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.

    14  */

    15  

    16 // Prepare a string for insertion into a MySQL database

    17 function filter($str) { return $db->escape($str); }

    18 

    19 /**

    20  * Anything and everything related to security and user management. This includes AES encryption, which is illegal in some countries.

    21  * Documenting the API was not easy - I hope you folks enjoy it.

    22  * @package Enano

    23  * @subpackage Session manager

    24  * @category security, user management, logins, etc.

    25  */

    26 

    27 class sessionManager {

    28   

    29   # Variables

    30   

    31   /**

    32    * Whether we're logged in or not

    33    * @var bool

    34    */

    35    

    36   var $user_logged_in = false;

    37   

    38   /**

    39    * Our current low-privilege session key

    40    * @var string

    41    */

    42   

    43   var $sid;

    44   

    45   /**

    46    * Username of currently logged-in user, or IP address if not logged in

    47    * @var string

    48    */

    49   

    50   var $username;

    51   

    52   /**

    53    * User ID of currently logged-in user, or -1 if not logged in

    54    * @var int

    55    */

    56   

    57   var $user_id;

    58   

    59   /**

    60    * Real name of currently logged-in user, or blank if not logged in

    61    * @var string

    62    */

    63   

    64   var $real_name;

    65   

    66   /**

    67    * E-mail address of currently logged-in user, or blank if not logged in

    68    * @var string

    69    */

    70   

    71   var $email;

    72   

    73   /**

    74    * User level of current user

    75    * USER_LEVEL_GUEST: guest

    76    * USER_LEVEL_MEMBER: regular user

    77    * USER_LEVEL_CHPREF: default - pseudo-level that allows changing password and e-mail address (requires re-authentication)

    78    * USER_LEVEL_MOD: moderator

    79    * USER_LEVEL_ADMIN: administrator

    80    * @var int

    81    */

    82   

    83   var $user_level;

    84   

    85   /**

    86    * High-privilege session key

    87    * @var string or false if not running on high-level authentication

    88    */

    89   

    90   var $sid_super;

    91   

    92   /**

    93    * The user's theme preference, defaults to $template->default_theme

    94    * @var string

    95    */

    96   

    97   var $theme;

    98   

    99   /**

   100    * The user's style preference, or style auto-detected based on theme if not logged in

   101    * @var string

   102    */

   103   

   104   var $style;

   105   

   106   /**

   107    * Signature of current user - appended to comments, etc.

   108    * @var string

   109    */

   110   

   111   var $signature;

   112   

   113   /**

   114    * UNIX timestamp of when we were registered, or 0 if not logged in

   115    * @var int

   116    */

   117   

   118   var $reg_time;

   119   

   120   /**

   121    * MD5 hash of the current user's password, if applicable

   122    * @var string OR bool false

   123    */

   124    

   125   var $password_hash;

   126   

   127   /**

   128    * The number of unread private messages this user has.

   129    * @var int

   130    */

   131   

   132   var $unread_pms = 0;

   133   

   134   /**

   135    * AES key used to encrypt passwords and session key info - irreversibly destroyed when disallow_password_grab() is called

   136    * @var string

   137    */

   138    

   139   var $private_key;

   140   

   141   /**

   142    * Regex that defines a valid username, minus the ^ and $, these are added later

   143    * @var string

   144    */

   145    

   146    var $valid_username = '([A-Za-z0-9 \!\@\(\)-]+)';

   147    

   148   /**

   149    * What we're allowed to do as far as permissions go. This changes based on the value of the "auth" URI param.

   150    * @var string

   151    */

   152    

   153   var $auth_level = -1;

   154   

   155   /**

   156    * State variable to track if a session timed out

   157    * @var bool

   158    */

   159   

   160   var $sw_timed_out = false;

   161   

   162   /**

   163    * Switch to track if we're started or not.

   164    * @access private

   165    * @var bool

   166    */

   167    

   168   var $started = false;

   169   

   170   /**

   171    * Switch to control compatibility mode (for older Enano websites being upgraded)

   172    * @access private

   173    * @var bool

   174    */

   175    

   176   var $compat = false;

   177   

   178   /**

   179    * Our list of permission types.

   180    * @access private

   181    * @var array

   182    */

   183    

   184   var $acl_types = Array();

   185   

   186   /**

   187    * The list of descriptions for the permission types

   188    * @var array

   189    */

   190    

   191   var $acl_descs = Array();

   192   

   193   /**

   194    * A list of dependencies for ACL types.

   195    * @var array

   196    */

   197    

   198   var $acl_deps = Array();

   199   

   200   /**

   201    * Our tell-all list of permissions.

   202    * @access private - or, preferably, protected

   203    * @var array

   204    */

   205    

   206   var $perms = Array();

   207   

   208   /**

   209    * A cache variable - saved after sitewide permissions are checked but before page-specific permissions.

   210    * @var array

   211    * @access private

   212    */

   213   

   214   var $acl_base_cache = Array();

   215   

   216   /**

   217    * Stores the scope information for ACL types.

   218    * @var array

   219    * @access private

   220    */

   221    

   222   var $acl_scope = Array();

   223   

   224   /**

   225    * Array to track which default permissions are being used

   226    * @var array

   227    * @access private

   228    */

   229    

   230   var $acl_defaults_used = Array();

   231   

   232   /**

   233    * Array to track group membership.

   234    * @var array

   235    */

   236    

   237   var $groups = Array();

   238   

   239   /**

   240    * Associative array to track group modship.

   241    * @var array

   242    */

   243    

   244   var $group_mod = Array();

   245   

   246   # Basic functions

   247    

   248   /**

   249    * Constructor.

   250    */

   251    

   252   function __construct()

   253   {

   254     global $db, $session, $paths, $template, $plugins; // Common objects

   255     include(ENANO_ROOT.'/config.php');

   256     unset($dbhost, $dbname, $dbuser, $dbpasswd);

   257     if(isset($crypto_key))

   258     {

   259       $this->private_key = $crypto_key;

   260       $this->private_key = hexdecode($this->private_key);

   261     }

   262     else

   263     {

   264       if(is_writable(ENANO_ROOT.'/config.php'))

   265       {

   266         // Generate and stash a private key

   267         // This should only happen during an automated silent gradual migration to the new encryption platform.

   268         $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);

   269         $this->private_key = $aes->gen_readymade_key();

   270         

   271         $config = file_get_contents(ENANO_ROOT.'/config.php');

   272         if(!$config)

   273         {

   274           die('$session->__construct(): can\'t get the contents of config.php');

   275         }

   276         

   277         $config = str_replace("?>", "\$crypto_key = '{$this->private_key}';\n?>", $config);

   278         // And while we're at it...

   279         $config = str_replace('MIDGET_INSTALLED', 'ENANO_INSTALLED', $config);

   280         $fh = @fopen(ENANO_ROOT.'/config.php', 'w');

   281         if ( !$fh ) 

   282         {

   283           die('$session->__construct(): Couldn\'t open config file for writing to store the private key, I tried to avoid something like this...');

   284         }

   285         

   286         fwrite($fh, $config);

   287         fclose($fh);

   288       }

   289       else

   290       {

   291         die_semicritical('Crypto error', '<p>No private key was found in the config file, and we can\'t generate one because we don\'t have write access to the config file. Please CHMOD config.php to 666 or 777 and reload this page.</p>');

   292       }

   293     }

   294     // Check for compatibility mode

   295     if(defined('IN_ENANO_INSTALL'))

   296     {

   297       $q = $db->sql_query('SELECT old_encryption FROM '.table_prefix.'users LIMIT 1;');

   298       if(!$q)

   299       {

   300         $error = mysql_error();

   301         if(strstr($error, "Unknown column 'old_encryption'"))

   302           $this->compat = true;

   303         else

   304           $db->_die('This should never happen and is a bug - the only error that was supposed to happen here didn\'t happen. (sessions.php in constructor, during compat mode check)');

   305       }

   306       $db->free_result();

   307     }

   308   }

   309   

   310   /**

   311    * PHP 4 compatible constructor.

   312    */

   313    

   314   function sessionManager()

   315   {

   316     $this->__construct();

   317   }

   318   

   319   /**

   320    * Wrapper function to sanitize strings for MySQL and HTML

   321    * @param string $text The text to sanitize

   322    * @return string

   323    */

   324   

   325   function prepare_text($text)

   326   {

   327     global $db;

   328     return $db->escape(htmlspecialchars($text));

   329   }

   330   

   331   /**

   332    * Makes a SQL query and handles error checking

   333    * @param string $query The SQL query to make

   334    * @return resource

   335    */

   336   

   337   function sql($query)

   338   {

   339     global $db, $session, $paths, $template, $plugins; // Common objects

   340     $result = $db->sql_query($query);

   341     if(!$result)

   342     {

   343       $db->_die('The error seems to have occurred somewhere in the session management code.');

   344     }

   345     return $result;

   346   }

   347   

   348   # Session restoration and permissions

   349   

   350   /**

   351    * Initializes the basic state of things, including most user prefs, login data, cookie stuff

   352    */

   353   

   354   function start()

   355   {

   356     global $db, $session, $paths, $template, $plugins; // Common objects

   357     if($this->started) return;

   358     $this->started = true;

   359     $user = false;

   360     if(isset($_COOKIE['sid']))

   361     {

   362       if($this->compat)

   363       {

   364         $userdata = $this->compat_validate_session($_COOKIE['sid']);

   365       }

   366       else

   367       {

   368         $userdata = $this->validate_session($_COOKIE['sid']);

   369       }

   370       if(is_array($userdata))

   371       {

   372         $data = RenderMan::strToPageID($paths->get_pageid_from_url());

   373         

   374         if(!$this->compat && $userdata['account_active'] != 1 && $data[1] != 'Special' && $data[1] != 'Admin')

   375         {

   376           $this->logout();

   377           $a = getConfig('account_activation');

   378           switch($a)

   379           {

   380             case 'none':

   381             default:

   382               $solution = 'Your account was most likely deactivated by an administrator. Please contact the site administration for further assistance.';

   383               break;

   384             case 'user':

   385               $solution = 'Please check your e-mail; you should have been sent a message with instructions on how to activate your account. If you do not receive an e-mail from this site within 24 hours, please contact the site administration for further assistance.';

   386               break;

   387             case 'admin':

   388               $solution = 'This website has been configured so that all user accounts must be activated by the administrator before they can be used, so your account will most likely be activated the next time the one of the administrators visits the site.';

   389               break;

   390           }

   391           die_semicritical('Account error', '<p>It appears that your user account has not yet been activated. '.$solution.'</p>');

   392         }

   393         

   394         $this->sid = $_COOKIE['sid'];

   395         $this->user_logged_in = true;

   396         $this->user_id =       intval($userdata['user_id']);

   397         $this->username =      $userdata['username'];

   398         $this->password_hash = $userdata['password'];

   399         $this->user_level =    intval($userdata['user_level']);

   400         $this->real_name =     $userdata['real_name'];

   401         $this->email =         $userdata['email'];

   402         $this->unread_pms =    $userdata['num_pms'];

   403         if(!$this->compat)

   404         {

   405           $this->theme =         $userdata['theme'];

   406           $this->style =         $userdata['style'];

   407           $this->signature =     $userdata['signature'];

   408           $this->reg_time =      $userdata['reg_time'];

   409         }

   410         // Small security risk here - it allows someone who has already authenticated as an administrator to store the "super" key in

   411         // the cookie. Change this to USER_LEVEL_MEMBER to override that. The same 15-minute restriction applies to this "exploit".

   412         $this->auth_level =    $userdata['auth_level'];

   413         if(!isset($template->named_theme_list[$this->theme]))

   414         {

   415           if($this->compat || !is_object($template))

   416           {

   417             $this->theme = 'oxygen';

   418             $this->style = 'bleu';

   419           }

   420           else

   421           {

   422             $this->theme = $template->default_theme;

   423             $this->style = $template->default_style;

   424           }

   425         }

   426         $user = true;

   427         

   428         if(isset($_REQUEST['auth']) && !$this->sid_super)

   429         {

   430           // Now he thinks he's a moderator. Or maybe even an administrator. Let's find out if he's telling the truth.

   431           if($this->compat)

   432           {

   433             $key = $_REQUEST['auth'];

   434             $super = $this->compat_validate_session($key);

   435           }

   436           else

   437           {

   438             $key = strrev($_REQUEST['auth']);

   439             $super = $this->validate_session($key);

   440           }

   441           if(is_array($super))

   442           {

   443             $this->auth_level = intval($super['auth_level']);

   444             $this->sid_super = $_REQUEST['auth'];

   445           }

   446         }

   447       }

   448     }

   449     if(!$user)

   450     {

   451       //exit;

   452       $this->register_guest_session();

   453     }

   454     if(!$this->compat)

   455     {

   456       // init groups

   457       $q = $this->sql('SELECT g.group_name,g.group_id,m.is_mod FROM '.table_prefix.'groups AS g

   458           LEFT JOIN '.table_prefix.'group_members AS m

   459             ON g.group_id=m.group_id

   460           WHERE ( m.user_id='.$this->user_id.' 

   461             OR g.group_name=\'Everyone\')

   462             ' . ( enano_version() == '1.0RC1' ? '' : 'AND ( m.pending != 1 OR m.pending IS NULL )' ) . '

   463           ORDER BY group_id ASC;'); // Make sure "Everyone" comes first so the permissions can be overridden

   464       if($row = $db->fetchrow())

   465       {

   466         do {

   467           $this->groups[$row['group_id']] = $row['group_name'];

   468           $this->group_mod[$row['group_id']] = ( intval($row['is_mod']) == 1 );

   469         } while($row = $db->fetchrow());

   470       }

   471       else

   472       {

   473         die('No group info');

   474       }

   475     }

   476     $this->check_banlist();

   477     

   478     if ( isset ( $_GET['printable'] ) )

   479     {

   480       $this->theme = 'printable';

   481       $this->style = 'default';

   482     }

   483     

   484   }

   485   

   486   # Logins

   487   

   488   /**

   489    * Attempts to perform a login using crypto functions

   490    * @param string $username The username

   491    * @param string $aes_data The encrypted password, hex-encoded

   492    * @param string $aes_key The MD5 hash of the encryption key, hex-encoded

   493    * @param string $challenge The 256-bit MD5 challenge string - first 128 bits should be the hash, the last 128 should be the challenge salt

   494    * @param int $level The privilege level we're authenticating for, defaults to 0

   495    * @return string 'success' on success, or error string on failure

   496    */

   497    

   498   function login_with_crypto($username, $aes_data, $aes_key, $challenge, $level = USER_LEVEL_MEMBER)

   499   {

   500     global $db, $session, $paths, $template, $plugins; // Common objects

   501     

   502     $privcache = $this->private_key;

   503     

   504     // Instanciate the Rijndael encryption object

   505     $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);

   506     

   507     // Fetch our decryption key

   508     

   509     $aes_key = $this->fetch_public_key($aes_key);

   510     if(!$aes_key)

   511       return 'Couldn\'t look up public key "'.$aes_key.'" for decryption';

   512     

   513     // Convert the key to a binary string

   514     $bin_key = hexdecode($aes_key);

   515     

   516     if(strlen($bin_key) != AES_BITS / 8)

   517       return 'The decryption key is the wrong length';

   518     

   519     // Decrypt our password

   520     $password = $aes->decrypt($aes_data, $bin_key, ENC_HEX);

   521     

   522     // Initialize our success switch

   523     $success = false;

   524     

   525     // Select the user data from the table, and decrypt that so we can verify the password

   526     $this->sql('SELECT password,old_encryption,user_id,user_level,theme,style,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$this->prepare_text(strtolower($username)).'\';');

   527     if($db->numrows() < 1)

   528       return 'The username and/or password is incorrect.';

   529     $row = $db->fetchrow();

   530     

   531     // Check to see if we're logging in using a temporary password

   532     

   533     if((intval($row['temp_password_time']) + 3600*24) > time() )

   534     {

   535       $temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX );

   536       if( $temp_pass == $password )

   537       {

   538         $url = makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']);

   539         redirect($url, 'Login sucessful', 'Please wait while you are transferred to the Password Reset form.');

   540         exit;

   541       }

   542     }

   543     

   544     if($row['old_encryption'] == 1)

   545     {

   546       // The user's password is stored using the obsolete and insecure MD5 algorithm, so we'll update the field with the new password

   547       if(md5($password) == $row['password'])

   548       {

   549         $pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX);

   550         $this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';');

   551         $success = true;

   552       }

   553     }

   554     else

   555     {

   556       // Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match; if so then do challenge authentication

   557       $real_pass = $aes->decrypt(hexdecode($row['password']), $this->private_key, ENC_BINARY);

   558       if($password == $real_pass)

   559       {

   560         // Yay! We passed AES authentication, now do an MD5 challenge check to make sure we weren't spoofed

   561         $chal = substr($challenge, 0, 32);

   562         $salt = substr($challenge, 32, 32);

   563         $correct_challenge = md5( $real_pass . $salt );

   564         if($chal == $correct_challenge)

   565           $success = true;

   566       }

   567     }

   568     if($success)

   569     {

   570       if($level > $row['user_level'])

   571         return 'You are not authorized for this level of access.';

   572       

   573       $sess = $this->register_session(intval($row['user_id']), $username, $password, $level);

   574       if($sess)

   575       {

   576         $this->username = $username;

   577         $this->user_id = intval($row['user_id']);

   578         $this->theme = $row['theme'];

   579         $this->style = $row['style'];

   580         

   581         if($level > USER_LEVEL_MEMBER)

   582           $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');

   583         else

   584           $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');

   585         

   586         $code = $plugins->setHook('login_success');

   587         foreach ( $code as $cmd )

   588         {

   589           eval($cmd);

   590         }

   591         return 'success';

   592       }

   593       else

   594         return 'Your login credentials were correct, but an internal error occurred while registering the session key in the database.';

   595     }

   596     else

   597     {

   598       if($level > USER_LEVEL_MEMBER)

   599         $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');

   600       else

   601         $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');

   602         

   603       return 'The username and/or password is incorrect.';

   604     }

   605   }

   606   

   607   /**

   608    * Attempts to login without using crypto stuff, mainly for use when the other side doesn't like Javascript

   609    * This method of authentication is inherently insecure, there's really nothing we can do about it except hope and pray that everyone moves to Firefox

   610    * Technically it still uses crypto, but it only decrypts the password already stored, which is (obviously) required for authentication

   611    * @param string $username The username

   612    * @param string $password The password -OR- the MD5 hash of the password if $already_md5ed is true

   613    * @param bool $already_md5ed This should be set to true if $password is an MD5 hash, and should be false if it's plaintext. Defaults to false.

   614    * @param int $level The privilege level we're authenticating for, defaults to 0

   615    */

   616   

   617   function login_without_crypto($username, $password, $already_md5ed = false, $level = USER_LEVEL_MEMBER)

   618   {

   619     global $db, $session, $paths, $template, $plugins; // Common objects

   620     

   621     $pass_hashed = ( $already_md5ed ) ? $password : md5($password);

   622     

   623     // Perhaps we're upgrading Enano?

   624     if($this->compat)

   625     {

   626       return $this->login_compat($username, $pass_hashed, $level);

   627     }

   628     

   629     // Instanciate the Rijndael encryption object

   630     $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);

   631     

   632     // Initialize our success switch

   633     $success = false;

   634     

   635     // Retrieve the real password from the database

   636     $this->sql('SELECT password,old_encryption,user_id,user_level,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$this->prepare_text(strtolower($username)).'\';');

   637     if($db->numrows() < 1)

   638       return 'The username and/or password is incorrect.';

   639     $row = $db->fetchrow();

   640     

   641     // Check to see if we're logging in using a temporary password

   642     

   643     if((intval($row['temp_password_time']) + 3600*24) > time() )

   644     {

   645       $temp_pass = $aes->decrypt( $row['temp_password'], $this->private_key, ENC_HEX );

   646       if( md5($temp_pass) == $pass_hashed )

   647       {

   648         header('Location: ' . makeUrlComplete('Special', 'PasswordReset/stage2/' . $row['user_id'] . '/' . $row['temp_password']) );

   649         exit;

   650       }

   651     }

   652     

   653     if($row['old_encryption'] == 1)

   654     {

   655       // The user's password is stored using the obsolete and insecure MD5 algorithm - we'll update the field with the new password

   656       if($pass_hashed == $row['password'] && !$already_md5ed)

   657       {

   658         $pass_stashed = $aes->encrypt($password, $this->private_key, ENC_HEX);

   659         $this->sql('UPDATE '.table_prefix.'users SET password=\''.$pass_stashed.'\',old_encryption=0 WHERE user_id='.$row['user_id'].';');

   660         $success = true;

   661       }

   662       elseif($pass_hashed == $row['password'] && $already_md5ed)

   663       {

   664         // We don't have the real password so don't bother with encrypting it, just call it success and get out of here

   665         $success = true;

   666       }

   667     }

   668     else

   669     {

   670       // Our password field is up-to-date with the >=1.0RC1 encryption standards, so decrypt the password in the table and see if we have a match

   671       $real_pass = $aes->decrypt($row['password'], $this->private_key);

   672       if($pass_hashed == md5($real_pass))

   673       {

   674         $success = true;

   675       }

   676     }

   677     if($success)

   678     {

   679       if((int)$level > (int)$row['user_level'])

   680         return 'You are not authorized for this level of access.';

   681       $sess = $this->register_session(intval($row['user_id']), $username, $real_pass, $level);

   682       if($sess)

   683       {

   684         if($level > USER_LEVEL_MEMBER)

   685           $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');

   686         else

   687           $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_good\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');

   688         

   689         $code = $plugins->setHook('login_success');

   690         foreach ( $code as $cmd )

   691         {

   692           eval($cmd);

   693         }

   694         return 'success';

   695       }

   696       else

   697         return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.';

   698     }

   699     else

   700     {

   701       if($level > USER_LEVEL_MEMBER)

   702         $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');

   703       else

   704         $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary) VALUES(\'security\', \'auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\')');

   705         

   706       return 'The username and/or password is incorrect.';

   707     }

   708   }

   709   

   710   /**

   711    * Attempts to log in using the old table structure and algorithm.

   712    * @param string $username

   713    * @param string $password This should be an MD5 hash

   714    * @return string 'success' if successful, or error message on failure

   715    */

   716   

   717   function login_compat($username, $password, $level = 0)

   718   {

   719     global $db, $session, $paths, $template, $plugins; // Common objects

   720     $pass_hashed =& $password;

   721     $this->sql('SELECT password,user_id,user_level FROM '.table_prefix.'users WHERE username=\''.$this->prepare_text($username).'\';');

   722     if($db->numrows() < 1)

   723       return 'The username and/or password is incorrect.';

   724     $row = $db->fetchrow();

   725     if($row['password'] == $password)

   726     {

   727       if((int)$level > (int)$row['user_level'])

   728         return 'You are not authorized for this level of access.';

   729       $sess = $this->register_session_compat(intval($row['user_id']), $username, $password, $level);

   730       if($sess)

   731         return 'success';

   732       else

   733         return 'Your login credentials were correct, but an internal error occured while registering the session key in the database.';

   734     }

   735     else

   736     {

   737       return 'The username and/or password is incorrect.';

   738     }

   739   }

   740   

   741   /**

   742    * Registers a session key in the database. This function *ASSUMES* that the username and password have already been validated!

   743    * Basically the session key is a base64-encoded cookie (encrypted with the site's private key) that says "u=[username];p=[sha1 of password]"

   744    * @param int $user_id

   745    * @param string $username

   746    * @param string $password

   747    * @param int $level The level of access to grant, defaults to USER_LEVEL_MEMBER

   748    * @return bool

   749    */

   750    

   751   function register_session($user_id, $username, $password, $level = USER_LEVEL_MEMBER)

   752   {

   753     $salt = md5(microtime() . mt_rand());

   754     $passha1 = sha1($password);

   755     $session_key = "u=$username;p=$passha1;s=$salt";

   756     $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);

   757     $session_key = $aes->encrypt($session_key, $this->private_key, ENC_HEX);

   758     if($level > USER_LEVEL_MEMBER)

   759     {

   760       $hexkey = strrev($session_key);

   761       $this->sid_super = $hexkey;

   762       $_GET['auth'] = $hexkey;

   763     }

   764     else

   765     {

   766       setcookie( 'sid', $session_key, time()+315360000, scriptPath.'/' );

   767       $_COOKIE['sid'] = $session_key;

   768     }

   769     $keyhash = md5($session_key);

   770     $ip = ip2hex($_SERVER['REMOTE_ADDR']);

   771     if(!$ip)

   772       die('$session->register_session: Remote-Addr was spoofed');

   773     $time = time();

   774     if(!is_int($user_id))

   775       die('Somehow an SQL injection attempt crawled into our session registrar! (1)');

   776     if(!is_int($level))

   777       die('Somehow an SQL injection attempt crawled into our session registrar! (2)');

   778     

   779     $query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$keyhash.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');');

   780     return true;

   781   }

   782   

   783   /**

   784    * Identical to register_session in nature, but uses the old login/table structure. DO NOT use this.

   785    * @see sessionManager::register_session()

   786    * @access private

   787    */

   788   

   789   function register_session_compat($user_id, $username, $password, $level = 0)

   790   {

   791     $salt = md5(microtime() . mt_rand());

   792     $thekey = md5($password . $salt);

   793     if($level > 0)

   794     {

   795       $this->sid_super = $thekey;

   796     }

   797     else

   798     {

   799       setcookie( 'sid', $thekey, time()+315360000, scriptPath.'/' );

   800       $_COOKIE['sid'] = $thekey;

   801     }

   802     $ip = ip2hex($_SERVER['REMOTE_ADDR']);

   803     if(!$ip)

   804       die('$session->register_session: Remote-Addr was spoofed');

   805     $time = time();

   806     if(!is_int($user_id))

   807       die('Somehow an SQL injection attempt crawled into our session registrar! (1)');

   808     if(!is_int($level))

   809       die('Somehow an SQL injection attempt crawled into our session registrar! (2)');

   810     $query = $this->sql('INSERT INTO '.table_prefix.'session_keys(session_key, salt, user_id, auth_level, source_ip, time) VALUES(\''.$thekey.'\', \''.$salt.'\', '.$user_id.', '.$level.', \''.$ip.'\', '.$time.');');

   811     return true;

   812   }

   813   

   814   /**

   815    * Creates/restores a guest session

   816    * @todo implement real session management for guests

   817    */

   818    

   819   function register_guest_session()

   820   {

   821     global $db, $session, $paths, $template, $plugins; // Common objects

   822     $this->username = $_SERVER['REMOTE_ADDR'];

   823     $this->user_level = USER_LEVEL_GUEST;

   824     if($this->compat || defined('IN_ENANO_INSTALL'))

   825     {

   826       $this->theme = 'oxygen';

   827       $this->style = 'bleu';

   828     }

   829     else

   830     {

   831       $this->theme = ( isset($_GET['theme']) && isset($template->named_theme_list[$_GET['theme']])) ? $_GET['theme'] : $template->default_theme;

   832       $this->style = ( isset($_GET['style']) && file_exists(ENANO_ROOT.'/themes/'.$this->theme . '/css/'.$_GET['style'].'.css' )) ? $_GET['style'] : substr($template->named_theme_list[$this->theme]['default_style'], 0, strlen($template->named_theme_list[$this->theme]['default_style'])-4);

   833     }

   834     $this->user_id = 1;

   835   }

   836   

   837   /**

   838    * Validates a session key, and returns the userdata associated with the key or false

   839    * @param string $key The session key to validate

   840    * @return array Keys are 'user_id', 'username', 'email', 'real_name', 'user_level', 'theme', 'style', 'signature', 'reg_time', 'account_active', 'activation_key', and 'auth_level' or bool false if validation failed. The key 'auth_level' is the maximum authorization level that this key provides.

   841    */

   842    

   843   function validate_session($key)

   844   {

   845     global $db, $session, $paths, $template, $plugins; // Common objects

   846     $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE, true);

   847     $decrypted_key = $aes->decrypt($key, $this->private_key, ENC_HEX);

   848     

   849     if ( !$decrypted_key )

   850     {

   851       die_semicritical('AES encryption error', '<p>Something went wrong during the AES decryption process.</p><pre>'.print_r($decrypted_key, true).'</pre>');

   852     }

   853     

   854     $n = preg_match('/^u='.$this->valid_username.';p=([A-Fa-f0-9]+?);s=([A-Fa-f0-9]+?)$/', $decrypted_key, $keydata);

   855     if($n < 1)

   856     {

   857       // echo '(debug) $session->validate_session: Key does not match regex<br />Decrypted key: '.$decrypted_key;

   858       return false;

   859     }

   860     $keyhash = md5($key);

   861     $salt = $db->escape($keydata[3]);

   862     $query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms,x.* FROM '.table_prefix.'session_keys AS k

   863                            LEFT JOIN '.table_prefix.'users AS u

   864                              ON ( u.user_id=k.user_id )

   865                            LEFT JOIN '.table_prefix.'users_extra AS x

   866                              ON ( u.user_id=x.user_id OR x.user_id IS NULL )

   867                            LEFT JOIN '.table_prefix.'privmsgs AS p

   868                              ON ( p.message_to=u.username AND p.message_read=0 )

   869                            WHERE k.session_key=\''.$keyhash.'\'

   870                              AND k.salt=\''.$salt.'\'

   871                            GROUP BY u.user_id;');

   872     if($db->numrows() < 1)

   873     {

   874       // echo '(debug) $session->validate_session: Key was not found in database<br />';

   875       return false;

   876     }

   877     $row = $db->fetchrow();

   878     $row['user_id'] =& $row['uid'];

   879     $ip = ip2hex($_SERVER['REMOTE_ADDR']);

   880     if($row['auth_level'] > $row['user_level'])

   881     {

   882       // Failed authorization check

   883       // echo '(debug) $session->validate_session: access to this auth level denied<br />';

   884       return false;

   885     }

   886     if($ip != $row['source_ip'])

   887     {

   888       // Failed IP address check

   889       // echo '(debug) $session->validate_session: IP address mismatch<br />';

   890       return false;

   891     }

   892     

   893     // Do the password validation

   894     $real_pass = $aes->decrypt($row['password'], $this->private_key, ENC_HEX);

   895     

   896     //die('<pre>'.print_r($keydata, true).'</pre>');

   897     if(sha1($real_pass) != $keydata[2])

   898     {

   899       // Failed password check

   900       // echo '(debug) $session->validate_session: encrypted password is wrong<br />Real password: '.$real_pass.'<br />Real hash: '.sha1($real_pass).'<br />User hash: '.$keydata[2];

   901       return false;

   902     }

   903     

   904     $time_now = time();

   905     $time_key = $row['time'] + 900;

   906     if($time_now > $time_key && $row['auth_level'] > USER_LEVEL_MEMBER)

   907     {

   908       // Session timed out

   909       // echo '(debug) $session->validate_session: super session timed out<br />';

   910       $this->sw_timed_out = true;

   911       return false;

   912     }

   913     

   914     // If this is an elevated-access session key, update the time

   915     if( $row['auth_level'] > USER_LEVEL_MEMBER )

   916     {

   917       $this->sql('UPDATE '.table_prefix.'session_keys SET time='.time().' WHERE session_key=\''.$keyhash.'\';');

   918     }

   919     

   920     $row['password'] = md5($real_pass);

   921     return $row;

   922   }

   923   

   924   /**

   925    * Validates a session key, and returns the userdata associated with the key or false. Optimized for compatibility with the old MD5-based auth system.

   926    * @param string $key The session key to validate

   927    * @return array Keys are 'user_id', 'username', 'email', 'real_name', 'user_level', 'theme', 'style', 'signature', 'reg_time', 'account_active', 'activation_key', and 'auth_level' or bool false if validation failed. The key 'auth_level' is the maximum authorization level that this key provides.

   928    */

   929    

   930   function compat_validate_session($key)

   931   {

   932     global $db, $session, $paths, $template, $plugins; // Common objects

   933     $key = $db->escape($key);

   934     

   935     $query = $this->sql('SELECT u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,k.source_ip,k.salt,k.time,k.auth_level FROM '.table_prefix.'session_keys AS k

   936                            LEFT JOIN '.table_prefix.'users AS u

   937                              ON u.user_id=k.user_id

   938                            WHERE k.session_key=\''.$key.'\';');

   939     if($db->numrows() < 1)

   940     {

   941       // echo '(debug) $session->validate_session: Key '.$key.' was not found in database<br />';

   942       return false;

   943     }

   944     $row = $db->fetchrow();

   945     $ip = ip2hex($_SERVER['REMOTE_ADDR']);

   946     if($row['auth_level'] > $row['user_level'])

   947     {

   948       // Failed authorization check

   949       // echo '(debug) $session->validate_session: user not authorized for this access level';

   950       return false;

   951     }

   952     if($ip != $row['source_ip'])

   953     {

   954       // Failed IP address check

   955       // echo '(debug) $session->validate_session: IP address mismatch; IP in table: '.$row['source_ip'].'; reported IP: '.$ip.'';

   956       return false;

   957     }

   958     

   959     // Do the password validation

   960     $real_key = md5($row['password'] . $row['salt']);

   961     

   962     //die('<pre>'.print_r($keydata, true).'</pre>');

   963     if($real_key != $key)

   964     {

   965       // Failed password check

   966       // echo '(debug) $session->validate_session: supplied password is wrong<br />Real key: '.$real_key.'<br />User key: '.$key;

   967       return false;

   968     }

   969     

   970     $time_now = time();

   971     $time_key = $row['time'] + 900;

   972     if($time_now > $time_key && $row['auth_level'] >= 1)

   973     {

   974       $this->sw_timed_out = true;

   975       // Session timed out

   976       // echo '(debug) $session->validate_session: super session timed out<br />';

   977       return false;

   978     }

   979     

   980     return $row;

   981   }

   982    

   983   /**

   984    * Demotes us to one less than the specified auth level. AKA destroys elevated authentication and/or logs out the user, depending on $level

   985    * @param int $level How low we should go - USER_LEVEL_MEMBER means demote to USER_LEVEL_GUEST, and anything more powerful than USER_LEVEL_MEMBER means demote to USER_LEVEL_MEMBER

   986    * @return string 'success' if successful, or error on failure

   987    */

   988    

   989   function logout($level = USER_LEVEL_MEMBER)

   990   {

   991     global $db, $session, $paths, $template, $plugins; // Common objects

   992     $ou = $this->username;

   993     $oid = $this->user_id;

   994     if($level > USER_LEVEL_CHPREF)

   995     {

   996       $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);

   997       if(!$this->user_logged_in || $this->auth_level < USER_LEVEL_MOD) return 'success';

   998       // Destroy elevated privileges

   999       $keyhash = md5(strrev($this->sid_super));

  1000       $this->sql('DELETE FROM '.table_prefix.'session_keys WHERE session_key=\''.$keyhash.'\' AND user_id=\'' . $this->user_id . '\';');

  1001       $this->sid_super = false;

  1002       $this->auth_level = USER_LEVEL_MEMBER;

  1003     }

  1004     else

  1005     {

  1006       if($this->user_logged_in)

  1007       {

  1008         // Completely destroy our session

  1009         if($this->auth_level > USER_LEVEL_CHPREF)

  1010         {

  1011           $this->logout(USER_LEVEL_ADMIN);

  1012         }

  1013         $this->sql('DELETE FROM '.table_prefix.'session_keys WHERE session_key=\''.md5($this->sid).'\';');

  1014         setcookie( 'sid', '', time()-(3600*24), scriptPath.'/' );

  1015       }

  1016     }

  1017     $code = $plugins->setHook('logout_success'); // , Array('level'=>$level,'old_username'=>$ou,'old_user_id'=>$oid));

  1018     foreach ( $code as $cmd )

  1019     {

  1020       eval($cmd);

  1021     }

  1022     return 'success';

  1023   }

  1024   

  1025   # Miscellaneous stuff

  1026   

  1027   /**

  1028    * Appends the high-privilege session key to the URL if we are authorized to do high-privilege stuff

  1029    * @param string $url The URL to add session data to

  1030    * @return string

  1031    */

  1032   

  1033   function append_sid($url)

  1034   {

  1035     $sep = ( strstr($url, '?') ) ? '&' : '?';

  1036     if ( $this->sid_super )

  1037     {

  1038       $url = $url . $sep . 'auth=' . urlencode($this->sid_super);

  1039       // echo($this->sid_super.'<br/>');

  1040     }

  1041     return $url;

  1042   }

  1043   

  1044   /**

  1045    * Grabs the user's password MD5

  1046    * @return string, or bool false if access denied

  1047    */

  1048    

  1049   function grab_password_hash()

  1050   {

  1051     if(!$this->password_hash) return false;

  1052     return $this->password_hash;

  1053   }

  1054   

  1055   /**

  1056    * Destroys the user's password MD5 in memory

  1057    */

  1058   

  1059   function disallow_password_grab()

  1060   {

  1061     $this->password_hash = false;

  1062     return false;

  1063   }

  1064   

  1065   /**

  1066    * Generates an AES key and stashes it in the database

  1067    * @return string Hex-encoded AES key

  1068    */

  1069    

  1070   function rijndael_genkey()

  1071   {

  1072     $aes = new AESCrypt(AES_BITS, AES_BLOCKSIZE);

  1073     $key = $aes->gen_readymade_key();

  1074     $keys = getConfig('login_key_cache');

  1075     if(is_string($keys))

  1076       $keys .= $key;

  1077     else

  1078       $keys = $key;

  1079     setConfig('login_key_cache', $keys);

  1080     return $key;

  1081   }

  1082   

  1083   /**

  1084    * Generate a totally random 128-bit value for MD5 challenges

  1085    * @return string

  1086    */

  1087    

  1088   function dss_rand()

  1089   {

  1090     $aes = new AESCrypt();

  1091     $random = $aes->randkey(128);

  1092     unset($aes);

  1093     return md5(microtime() . $random);

  1094   }

  1095   

  1096   /**

  1097    * Fetch a cached login public key using the MD5sum as an identifier. Each key can only be fetched once before it is destroyed.

  1098    * @param string $md5 The MD5 sum of the key

  1099    * @return string, or bool false on failure

  1100    */

  1101    

  1102   function fetch_public_key($md5)

  1103   {

  1104     $keys = getConfig('login_key_cache');

  1105     $keys = enano_str_split($keys, AES_BITS / 4);

  1106     

  1107     foreach($keys as $i => $k)

  1108     {

  1109       if(md5($k) == $md5)

  1110       {

  1111         unset($keys[$i]);

  1112         if(count($keys) > 0)

  1113         {

  1114           if ( strlen(getConfig('login_key_cache') ) > 64000 )

  1115           {

  1116             // This should only need to be done once every month or so for an average-size site

  1117             setConfig('login_key_cache', '');

  1118           }

  1119           else

  1120           {

  1121             $keys = implode('', array_values($keys));

  1122             setConfig('login_key_cache', $keys);

  1123           }

  1124         }

  1125         else

  1126         {

  1127           setConfig('login_key_cache', '');

  1128         }

  1129         return $k;

  1130       }

  1131     }

  1132     // Couldn't find the key...

  1133     return false;

  1134   }

  1135