Enano CMS (1.0.x): comparison includes/sessions.php

equal deleted inserted replaced

-:8be996c3740d
+:112debff64bd
 $username = str_replace('_', ' ', $username);
 $db_username_lower = $this->prepare_text(strtolower($username));
 $db_username       = $this->prepare_text($username);
 // Select the user data from the table, and decrypt that so we can verify the password
-$this->sql('SELECT password,old_encryption,user_id,user_level,theme,style,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$db_username_lower.'\' OR username=\'' . $db_username . '\';');
+$this->sql('SELECT password,old_encryption,user_id,user_level,theme,style,temp_password,temp_password_time FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=\''.$db_username_lower.'\' OR username=\'' . $db_username . '\';');
 if($db->numrows() < 1)
 {
 // This wasn't logged in <1.0.2, dunno how it slipped through
 if($level > USER_LEVEL_MEMBER)
 $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
 // Initialize our success switch
 $success = false;
 // Retrieve the real password from the database
-$this->sql('SELECT password,old_encryption,user_id,user_level,temp_password,temp_password_time FROM '.table_prefix.'users WHERE lcase(username)=\''.$this->prepare_text(strtolower($username)).'\';');
+$this->sql('SELECT password,old_encryption,user_id,user_level,temp_password,temp_password_time FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=\''.$this->prepare_text(strtolower($username)).'\';');
 if ( $db->numrows() < 1 )
 {
 // This wasn't logged in <1.0.2, dunno how it slipped through
 if($level > USER_LEVEL_MEMBER)
 $this->sql('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,date_string,author,edit_summary,page_text) VALUES(\'security\', \'admin_auth_bad\', '.time().', \''.date('d M Y h:i a').'\', \''.$db->escape($username).'\', \''.$db->escape($_SERVER['REMOTE_ADDR']).'\', ' . intval($level) . ')');
 . '    ON ( u.user_id=x.user_id OR x.user_id IS NULL )' . "\n"
 . '  LEFT JOIN '.table_prefix.'privmsgs AS p' . "\n"
 . '    ON ( p.message_to=u.username AND p.message_read=0 )' . "\n"
 . '  WHERE k.session_key=\''.$keyhash.'\'' . "\n"
 . '    AND k.salt=\''.$salt.'\'' . "\n"
-. '  GROUP BY u.user_id;');
+. '  GROUP BY u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,x.user_id, x.user_aim, x.user_yahoo, x.user_msn, x.user_xmpp, x.user_homepage, x.user_location, x.user_job, x.user_hobbies, x.email_public;');
 if ( !$query )
 {
 $query = $this->sql('SELECT u.user_id AS uid,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level,COUNT(p.message_id) AS num_pms FROM '.table_prefix.'session_keys AS k
 LEFT JOIN '.table_prefix.'users AS u
 ON ( u.user_id=k.user_id )
 LEFT JOIN '.table_prefix.'privmsgs AS p
 ON ( p.message_to=u.username AND p.message_read=0 )
 WHERE k.session_key=\''.$keyhash.'\'
 AND k.salt=\''.$salt.'\'
-GROUP BY u.user_id;');
+GROUP BY u.user_id,u.username,u.password,u.email,u.real_name,u.user_level,u.theme,u.style,u.signature,u.reg_time,u.account_active,u.activation_key,k.source_ip,k.time,k.auth_level;');
 }
 if($db->numrows() < 1)
 {
 // echo '(debug) $session->validate_session: Key was not found in database<br />';
 return false;
 $col_reason = ( $this->compat ) ? '"No reason entered (session manager is in compatibility mode)" AS reason' : 'reason';
 $banned = false;
 if ( $this->user_logged_in )
 {
 // check by IP, email, and username
-$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE \n"
+if ( ENANO_DBLAYER == 'MYSQL' )
-. "    ( ban_type = " . BAN_IP    . " AND is_regex = 0 ) OR \n"
+{
-. "    ( ban_type = " . BAN_IP    . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' REGEXP ban_value ) OR \n"
+$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE \n"
-. "    ( ban_type = " . BAN_USER  . " AND is_regex = 0 AND ban_value = '{$this->username}' ) OR \n"
+. "    ( ban_type = " . BAN_IP    . " AND is_regex = 0 ) OR \n"
-. "    ( ban_type = " . BAN_USER  . " AND is_regex = 1 AND '{$this->username}' REGEXP ban_value ) OR \n"
+. "    ( ban_type = " . BAN_IP    . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' REGEXP ban_value ) OR \n"
-. "    ( ban_type = " . BAN_EMAIL . " AND is_regex = 0 AND ban_value = '{$this->email}' ) OR \n"
+. "    ( ban_type = " . BAN_USER  . " AND is_regex = 0 AND ban_value = '{$this->username}' ) OR \n"
-. "    ( ban_type = " . BAN_EMAIL . " AND is_regex = 1 AND '{$this->email}' REGEXP ban_value ) \n"
+. "    ( ban_type = " . BAN_USER  . " AND is_regex = 1 AND '{$this->username}' REGEXP ban_value ) OR \n"
-. "  ORDER BY ban_type ASC;";
+. "    ( ban_type = " . BAN_EMAIL . " AND is_regex = 0 AND ban_value = '{$this->email}' ) OR \n"
+. "    ( ban_type = " . BAN_EMAIL . " AND is_regex = 1 AND '{$this->email}' REGEXP ban_value ) \n"
+. "  ORDER BY ban_type ASC;";
+}
+else if ( ENANO_DBLAYER == 'PGSQL' )
+{
+$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE \n"
+. "    ( ban_type = " . BAN_IP    . " AND is_regex = 0 ) OR \n"
+. "    ( ban_type = " . BAN_IP    . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' LIKE ban_value ) OR \n"
+. "    ( ban_type = " . BAN_USER  . " AND is_regex = 0 AND ban_value = '{$this->username}' ) OR \n"
+. "    ( ban_type = " . BAN_USER  . " AND is_regex = 1 AND '{$this->username}' LIKE ban_value ) OR \n"
+. "    ( ban_type = " . BAN_EMAIL . " AND is_regex = 0 AND ban_value = '{$this->email}' ) OR \n"
+. "    ( ban_type = " . BAN_EMAIL . " AND is_regex = 1 AND '{$this->email}' LIKE ban_value ) \n"
+. "  ORDER BY ban_type ASC;";
+}
 $q = $this->sql($sql);
 if ( $db->numrows() > 0 )
 {
 while ( list($reason, $ban_value, $ban_type, $is_regex) = $db->fetchrow_num() )
 {
 $db->free_result();
 }
 else
 {
 // check by IP only
-$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE
+if ( ENANO_DBLAYER == 'MYSQL' )
-( ban_type = " . BAN_IP    . " AND is_regex = 0 ) OR
+{
-( ban_type = " . BAN_IP    . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' REGEXP ban_value )
+$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE
-ORDER BY ban_type ASC;";
+( ban_type = " . BAN_IP    . " AND is_regex = 0 ) OR
+( ban_type = " . BAN_IP    . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' REGEXP ban_value )
+ORDER BY ban_type ASC;";
+}
+else if ( ENANO_DBLAYER == 'PGSQL' )
+{
+$sql = "SELECT $col_reason, ban_value, ban_type, is_regex FROM " . table_prefix . "banlist WHERE
+( ban_type = " . BAN_IP    . " AND is_regex = 0 ) OR
+( ban_type = " . BAN_IP    . " AND is_regex = 1 AND '{$_SERVER['REMOTE_ADDR']}' LIKE ban_value )
+ORDER BY ban_type ASC;";
+}
 $q = $this->sql($sql);
 if ( $db->numrows() > 0 )
 {
 while ( list($reason, $ban_value, $ban_type, $is_regex) = $db->fetchrow_num() )
 {
 $username = $this->prepare_text($username);
 $email = $this->prepare_text($email);
 $real_name = $this->prepare_text($real_name);
 $nameclause = ( $real_name != '' ) ? ' OR real_name=\''.$real_name.'\'' : '';
-$q = $this->sql('SELECT * FROM '.table_prefix.'users WHERE lcase(username)=\''.strtolower($username).'\' OR email=\''.$email.'\''.$nameclause.';');
+$q = $this->sql('SELECT * FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=\''.strtolower($username).'\' OR email=\''.$email.'\''.$nameclause.';');
 if($db->numrows() > 0)
 {
 $r = 'The ';
 $i=0;
 $row = $db->fetchrow();
 {
 $q = $this->sql('SELECT user_id,username,email FROM '.table_prefix.'users WHERE user_id='.$user.';'); // This is SAFE! This is only called if $user is an integer
 }
 elseif(is_string($user))
 {
-$q = $this->sql('SELECT user_id,username,email FROM '.table_prefix.'users WHERE lcase(username)=lcase(\''.$db->escape($user).'\');');
+$q = $this->sql('SELECT user_id,username,email FROM '.table_prefix.'users WHERE ' . ENANO_SQLFUNC_LOWERCASE . '(username)=' . ENANO_SQLFUNC_LOWERCASE . '(\''.$db->escape($user).'\');');
 }
 else
 {
 return false;
 }
 function make_captcha($len = 7)
 {
 $code = $this->generate_captcha_code($len);
 $hash = md5(microtime() . mt_rand());
-$this->sql('INSERT INTO '.table_prefix.'session_keys(session_key,salt,auth_level,source_ip,user_id) VALUES(\''.$hash.'\', \''.$s.'\', -1, \''.ip2hex($_SERVER['REMOTE_ADDR']).'\', -2);');
+$this->sql('INSERT INTO '.table_prefix.'session_keys(session_key,salt,auth_level,source_ip,user_id) VALUES(\''.$hash.'\', \'\', -1, \''.ip2hex($_SERVER['REMOTE_ADDR']).'\', -2);');
 return $hash;
 }
 /**
 * Generates the actual confirmation code text.
 {
 $pg_info .= ' ( page_id=\'' . $g_id . '\' AND namespace=\'__PageGroup\' ) OR';
 }
 // Build a query to grab ACL info
-$bs = 'SELECT rules FROM '.table_prefix.'acl WHERE ' . "\n"
+$bs = 'SELECT rules,target_type,target_id FROM '.table_prefix.'acl WHERE ' . "\n"
 . '  ( ';
 $q = Array();
 $q[] = '( target_type='.ACL_TYPE_USER.' AND target_id='.$session->user_id.' )';
 if(count($session->groups) > 0)
 {

changeset 259	112debff64bd
parent 256	f8356d9c3481
child 261	5f1cd51bf1be