Zeile 45 | Zeile 45 |
---|
if(!isset($cp_language)) {
|
if(!isset($cp_language)) {
|
if(!file_exists(MYBB_ROOT."inc/languages/".$mybb->settings['cplanguage']."/admin/home_dashboard.lang.php")) { $mybb->settings['cplanguage'] = "english"; }
| |
$lang->set_language($mybb->settings['cplanguage'], "admin"); }
| $lang->set_language($mybb->settings['cplanguage'], "admin"); }
|
Zeile 112 | Zeile 108 |
---|
{ $user = get_user_by_username($mybb->input['username'], array('fields' => '*'));
|
{ $user = get_user_by_username($mybb->input['username'], array('fields' => '*'));
|
if(!$user['uid'])
| if(!$user)
|
{ $error = $lang->error_invalid_username; }
| { $error = $lang->error_invalid_username; }
|
Zeile 120 | Zeile 116 |
---|
else if($mybb->input['uid']) { $user = get_user($mybb->input['uid']);
|
else if($mybb->input['uid']) { $user = get_user($mybb->input['uid']);
|
if(!$user['uid'])
| if(!$user)
|
{ $error = $lang->error_invalid_uid; }
| { $error = $lang->error_invalid_uid; }
|
Zeile 194 | Zeile 190 |
---|
$plugins->run_hooks("admin_login_incorrect_pin");
if($login_user['uid'] > 0)
|
$plugins->run_hooks("admin_login_incorrect_pin");
if($login_user['uid'] > 0)
|
{ $db->update_query("adminoptions", array("loginattempts" => "loginattempts+1"), "uid='".(int)$login_user['uid']."'", '', true); }
$loginattempts = login_attempt_check_acp($login_user['uid'], true);
// Have we attempted too many times? if($loginattempts['loginattempts'] > 0) { // Have we set an expiry yet? if($loginattempts['loginlockoutexpiry'] == 0) { $db->update_query("adminoptions", array("loginlockoutexpiry" => TIME_NOW+((int)$mybb->settings['loginattemptstimeout']*60)), "uid='".(int)$login_user['uid']."'"); }
| { $db->update_query("adminoptions", array("loginattempts" => "loginattempts+1"), "uid='".(int)$login_user['uid']."'", '', true); }
$loginattempts = login_attempt_check_acp($login_user['uid'], true);
// Have we attempted too many times? if($loginattempts !== false && $loginattempts['loginattempts'] > 0) { // Have we set an expiry yet? if($loginattempts['loginlockoutexpiry'] == 0) { $db->update_query("adminoptions", array("loginlockoutexpiry" => TIME_NOW+((int)$mybb->settings['loginattemptstimeout']*60)), "uid='".(int)$login_user['uid']."'"); }
|
// Did we hit lockout for the first time? Send the unlock email to the administrator if($loginattempts['loginattempts'] == $mybb->settings['maxloginattempts'])
| // Did we hit lockout for the first time? Send the unlock email to the administrator if($loginattempts['loginattempts'] == $mybb->settings['maxloginattempts'])
|
Zeile 251 | Zeile 247 |
---|
$mybb->user = get_user($loginhandler->login_data['uid']); }
|
$mybb->user = get_user($loginhandler->login_data['uid']); }
|
if($mybb->user['uid'])
| if(!empty($mybb->user['uid']))
|
{ if(login_attempt_check_acp($mybb->user['uid']) == true) {
| { if(login_attempt_check_acp($mybb->user['uid']) == true) {
|
Zeile 287 | Zeile 283 |
---|
"lastactive" => TIME_NOW, "data" => my_serialize(array()), "useragent" => $db->escape_string($useragent),
|
"lastactive" => TIME_NOW, "data" => my_serialize(array()), "useragent" => $db->escape_string($useragent),
|
| "authenticated" => 0,
|
); $db->insert_query("adminsessions", $admin_session); $admin_session['data'] = array();
| ); $db->insert_query("adminsessions", $admin_session); $admin_session['data'] = array();
|
Zeile 299 | Zeile 296 |
---|
$db->update_query("adminoptions", array("loginattempts" => 0, "loginlockoutexpiry" => 0), "uid='{$mybb->user['uid']}'"); }
|
$db->update_query("adminoptions", array("loginattempts" => 0, "loginlockoutexpiry" => 0), "uid='{$mybb->user['uid']}'"); }
|
my_setcookie("adminsid", $sid, '', true);
| my_setcookie("adminsid", $sid, '', true, "strict");
|
my_setcookie('acploginattempts', 0); $post_verify = false;
| my_setcookie('acploginattempts', 0); $post_verify = false;
|
Zeile 332 | Zeile 329 |
---|
{ $params = explode("=", $param);
|
{ $params = explode("=", $param);
|
$query_string .= '&'.htmlspecialchars_uni($params[0])."=".htmlspecialchars_uni($params[1]);
| $query_string .= '&'.htmlspecialchars_uni($params[0]);
if(isset($params[1])) { $query_string .= "=".htmlspecialchars_uni($params[1]); }
|
} }
|
} }
|
|
|
admin_redirect("index.php".$query_string);
|
admin_redirect("index.php".$query_string);
|
}
| }
|
} else {
| } else {
|
Zeile 345 | Zeile 347 |
---|
$plugins->run_hooks("admin_login_fail");
|
$plugins->run_hooks("admin_login_fail");
|
if($login_user['uid'] > 0)
| $loginattempts = false; if(!empty($login_user['uid']) && $login_user['uid'] > 0)
|
{ $db->update_query("adminoptions", array("loginattempts" => "loginattempts+1"), "uid='".(int)$login_user['uid']."'", '', true);
|
{ $db->update_query("adminoptions", array("loginattempts" => "loginattempts+1"), "uid='".(int)$login_user['uid']."'", '', true);
|
| $loginattempts = login_attempt_check_acp($login_user['uid'], true);
|
}
|
}
|
$loginattempts = login_attempt_check_acp($login_user['uid'], true);
| |
// Have we attempted too many times?
|
// Have we attempted too many times?
|
if($loginattempts['loginattempts'] > 0)
| if($loginattempts !== false && $loginattempts['loginattempts'] > 0)
|
{ // Have we set an expiry yet? if($loginattempts['loginlockoutexpiry'] == 0)
| { // Have we set an expiry yet? if($loginattempts['loginlockoutexpiry'] == 0)
|
Zeile 407 | Zeile 409 |
---|
$admin_session = $db->fetch_array($query);
// No matching admin session found - show message on login screen
|
$admin_session = $db->fetch_array($query);
// No matching admin session found - show message on login screen
|
if(!$admin_session['sid'])
| if(empty($admin_session) || !$admin_session['sid'])
|
{ $login_message = $lang->error_invalid_admin_session; }
| { $login_message = $lang->error_invalid_admin_session; }
|
Zeile 446 | Zeile 448 |
---|
++$matches; } if($matches == ADMIN_IP_SEGMENTS)
|
++$matches; } if($matches == ADMIN_IP_SEGMENTS)
|
{ $valid_ip = true; break; } }
// IP doesn't match properly - show message on logon screen if(!$valid_ip) { $login_message = $lang->error_invalid_ip; unset($mybb->user); } }
| { $valid_ip = true; break; } }
// IP doesn't match properly - show message on logon screen if(!$valid_ip) { $login_message = $lang->error_invalid_ip; unset($mybb->user); } }
|
else if(ADMIN_IPV6_SEGMENTS > 0 && strpos($ip_address, ':') !== false) { // Expand IPv6 addresses
| else if(ADMIN_IPV6_SEGMENTS > 0 && strpos($ip_address, ':') !== false) { // Expand IPv6 addresses
|
Zeile 500 | Zeile 502 |
---|
{ $plugins->run_hooks("admin_logout");
|
{ $plugins->run_hooks("admin_logout");
|
if(verify_post_check($mybb->input['my_post_key']))
| if(verify_post_check($mybb->get_input('my_post_key')))
|
{ $db->delete_query("adminsessions", "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); my_unsetcookie('adminsid');
| { $db->delete_query("adminsessions", "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); my_unsetcookie('adminsid');
|
Zeile 509 | Zeile 511 |
---|
}
if(!isset($mybb->user['usergroup']))
|
}
if(!isset($mybb->user['usergroup']))
|
{
| {
|
$mybbgroups = 1;
|
$mybbgroups = 1;
|
}
| }
|
else
|
else
|
{
| {
|
$mybbgroups = $mybb->user['usergroup'].",".$mybb->user['additionalgroups'];
|
$mybbgroups = $mybb->user['usergroup'].",".$mybb->user['additionalgroups'];
|
}
| }
|
$mybb->usergroup = usergroup_permissions($mybbgroups);
|
$mybb->usergroup = usergroup_permissions($mybbgroups);
|
$is_super_admin = is_super_admin($mybb->user['uid']);
| $is_super_admin = false; if(isset($mybb->user['uid'])) { $is_super_admin = is_super_admin($mybb->user['uid']); }
|
|
|
if($mybb->usergroup['cancp'] != 1 && !$is_super_admin || !$mybb->user['uid'])
| if(empty($mybb->usergroup['cancp']) && !$is_super_admin || !$mybb->user['uid'])
|
{ $uid = 0; if(isset($mybb->user['uid']))
| { $uid = 0; if(isset($mybb->user['uid']))
|
Zeile 530 | Zeile 536 |
---|
$db->delete_query("adminsessions", "uid = '{$uid}'"); unset($mybb->user); my_unsetcookie('adminsid');
|
$db->delete_query("adminsessions", "uid = '{$uid}'"); unset($mybb->user); my_unsetcookie('adminsid');
|
}
| if($mybb->get_input('do') == 'login') { $login_message = $lang->error_mybb_not_admin_account; } }
|
if(!empty($mybb->user['uid'])) { $query = $db->simple_select("adminoptions", "*", "uid='".$mybb->user['uid']."'"); $admin_options = $db->fetch_array($query);
|
if(!empty($mybb->user['uid'])) { $query = $db->simple_select("adminoptions", "*", "uid='".$mybb->user['uid']."'"); $admin_options = $db->fetch_array($query);
|
| // Only update language / theme once fully authenticated if(empty($admin_options['authsecret']) || $admin_session['authenticated'] == 1) { if(!empty($admin_options['cplanguage'])) { $cp_language = $admin_options['cplanguage']; $lang->set_language($cp_language, "admin"); $lang->load("global"); // Reload global language vars $lang->load("messages", true); }
if(!empty($admin_options['cpstyle']) && file_exists(MYBB_ADMIN_DIR."/styles/{$admin_options['cpstyle']}/main.css")) { $cp_style = $admin_options['cpstyle']; } }
|
// Update the session information in the DB if($admin_session['sid'])
|
// Update the session information in the DB if($admin_session['sid'])
|
{
| {
|
$db->update_query("adminsessions", array('lastactive' => TIME_NOW, 'ip' => $db->escape_binary(my_inet_pton(get_ip()))), "sid='".$db->escape_string($admin_session['sid'])."'");
|
$db->update_query("adminsessions", array('lastactive' => TIME_NOW, 'ip' => $db->escape_binary(my_inet_pton(get_ip()))), "sid='".$db->escape_string($admin_session['sid'])."'");
|
}
| }
|
// Fetch administrator permissions $mybb->admin['permissions'] = get_admin_permissions($mybb->user['uid']); }
|
// Fetch administrator permissions $mybb->admin['permissions'] = get_admin_permissions($mybb->user['uid']); }
|
| // Include the layout generation class overrides for this style if(file_exists(MYBB_ADMIN_DIR."/styles/{$cp_style}/style.php")) { require_once MYBB_ADMIN_DIR."/styles/{$cp_style}/style.php"; }
// Check if any of the layout generation classes we can override exist in the style file $classes = array( "Page" => "DefaultPage", "SidebarItem" => "DefaultSidebarItem", "PopupMenu" => "DefaultPopupMenu", "Table" => "DefaultTable", "Form" => "DefaultForm", "FormContainer" => "DefaultFormContainer" ); foreach($classes as $style_name => $default_name) { // Style does not have this layout generation class, create it if(!class_exists($style_name)) { eval("class {$style_name} extends {$default_name} { }"); } }
$page = new Page; $page->style = $cp_style;
|
// Do not have a valid Admin user, throw back to login page. if(!isset($mybb->user['uid']) || $logged_out == true) { if($logged_out == true) {
|
// Do not have a valid Admin user, throw back to login page. if(!isset($mybb->user['uid']) || $logged_out == true) { if($logged_out == true) {
|
$default_page->show_login($lang->success_logged_out);
| $page->show_login($lang->success_logged_out);
|
} elseif($fail_check == 1) {
|
} elseif($fail_check == 1) {
|
$default_page->show_login($login_lang_string, "error");
| $page->show_login($login_lang_string, "error");
|
} else
|
} else
|
{
| {
|
// If we have this error while retreiving it from an AJAX request, then send back a nice error if(isset($mybb->input['ajax']) && $mybb->input['ajax'] == 1) { echo json_encode(array("errors" => array("login"))); exit; }
|
// If we have this error while retreiving it from an AJAX request, then send back a nice error if(isset($mybb->input['ajax']) && $mybb->input['ajax'] == 1) { echo json_encode(array("errors" => array("login"))); exit; }
|
$default_page->show_login($login_message, "error");
| $page->show_login($login_message, "error");
|
} }
| } }
|
Zeile 603 | Zeile 657 |
---|
$admin_session['authenticated'] = 1; $db->update_query("adminoptions", array("loginattempts" => 0, "loginlockoutexpiry" => 0), "uid='{$mybb->user['uid']}'"); my_setcookie('acploginattempts', 0);
|
$admin_session['authenticated'] = 1; $db->update_query("adminoptions", array("loginattempts" => 0, "loginlockoutexpiry" => 0), "uid='{$mybb->user['uid']}'"); my_setcookie('acploginattempts', 0);
|
// post would result in an authorization code mismatch error $mybb->request_method = "get";
| admin_redirect("index.php");
|
} else {
| } else {
|
Zeile 618 | Zeile 671 |
---|
$loginattempts = login_attempt_check_acp($mybb->user['uid'], true);
// Have we attempted too many times?
|
$loginattempts = login_attempt_check_acp($mybb->user['uid'], true);
// Have we attempted too many times?
|
if($loginattempts['loginattempts'] > 0)
| if($loginattempts !== false && $loginattempts['loginattempts'] > 0)
|
{ // Have we set an expiry yet? if($loginattempts['loginlockoutexpiry'] == 0)
| { // Have we set an expiry yet? if($loginattempts['loginlockoutexpiry'] == 0)
|
Zeile 650 | Zeile 703 |
---|
) );
|
) );
|
$default_page->show_lockedout();
| $page->show_lockedout();
|
}
|
}
|
|
|
// Still here? Show a custom login page
|
// Still here? Show a custom login page
|
$default_page->show_login($lang->my2fa_failed, "error"); } }
| $page->show_login($lang->my2fa_failed, "error"); } }
|
// Show our 2FA page if(!empty($admin_options['authsecret']) && $admin_session['authenticated'] != 1) {
|
// Show our 2FA page if(!empty($admin_options['authsecret']) && $admin_session['authenticated'] != 1) {
|
$default_page->show_2fa(); }
// Now the user is fully authenticated setup their personal options if(!empty($admin_options['cplanguage']) && file_exists(MYBB_ROOT."inc/languages/".$admin_options['cplanguage']."/admin/home_dashboard.lang.php")) { $cp_language = $admin_options['cplanguage']; $lang->set_language($cp_language, "admin"); $lang->load("global"); // Reload global language vars $lang->load("messages", true); } if(!empty($admin_options['cpstyle']) && file_exists(MYBB_ADMIN_DIR."/styles/{$admin_options['cpstyle']}/main.css")) { $cp_style = $admin_options['cpstyle']; }
// Include the layout generation class overrides for this style if(file_exists(MYBB_ADMIN_DIR."/styles/{$cp_style}/style.php")) { require_once MYBB_ADMIN_DIR."/styles/{$cp_style}/style.php"; }
// Check if any of the layout generation classes we can override exist in the style file $classes = array( "Page" => "DefaultPage", "SidebarItem" => "DefaultSidebarItem", "PopupMenu" => "DefaultPopupMenu", "Table" => "DefaultTable", "Form" => "DefaultForm", "FormContainer" => "DefaultFormContainer" ); foreach($classes as $style_name => $default_name) { // Style does not have this layout generation class, create it if(!class_exists($style_name)) { eval("class {$style_name} extends {$default_name} { }"); }
| $page->show_2fa();
|
}
|
}
|
$page = new Page; $page->style = $cp_style;
| |
$page->add_breadcrumb_item($lang->home, "index.php");
| $page->add_breadcrumb_item($lang->home, "index.php");
|
Zeile 806 | Zeile 819 |
---|
if($post_verify == true) { // If the post key does not match we switch the action to GET and set a message to show the user
|
if($post_verify == true) { // If the post key does not match we switch the action to GET and set a message to show the user
|
if(!isset($mybb->input['my_post_key']) || $mybb->post_code !== $mybb->input['my_post_key'])
| if(!verify_post_check($mybb->get_input('my_post_key'), true))
|
{ $mybb->request_method = "get"; $page->show_post_verify_error = true;
| { $mybb->request_method = "get"; $page->show_post_verify_error = true;
|