]> jfr.im git - irc/unrealircd/unrealircd-webpanel.git/blame - plugins/sql_auth/sql_auth.php
Add footer to news
[irc/unrealircd/unrealircd-webpanel.git] / plugins / sql_auth / sql_auth.php
CommitLineData
ea27475b
VP
1<?php
2
3require_once "SQL/sql.php";
ce9cf366 4require_once "SQL/settings.php";
4d634d0a 5
ea27475b
VP
6class sql_auth
7{
b44a2e97 8 public $name = "SQLAuth";
ea27475b
VP
9 public $author = "Valware";
10 public $version = "1.0";
11 public $description = "Provides a User Auth and Management Panel with an SQL backend";
b65f0496 12 public $email = "v.a.pond@outlook.com";
ea27475b
VP
13
14 function __construct()
15 {
5015c85c 16 self::create_tables();
b44a2e97 17 Hook::func(HOOKTYPE_PRE_HEADER, 'sql_auth::session_start');
33f512fa 18 Hook::func(HOOKTYPE_FOOTER, 'sql_auth::add_footer_info');
6930484c
VP
19 Hook::func(HOOKTYPE_USER_LOOKUP, 'sql_auth::get_user');
20 Hook::func(HOOKTYPE_USERMETA_ADD, 'sql_auth::add_usermeta');
21 Hook::func(HOOKTYPE_USERMETA_DEL, 'sql_auth::del_usermeta');
22 Hook::func(HOOKTYPE_USERMETA_GET, 'sql_auth::get_usermeta');
180b8ec1
VP
23 Hook::func(HOOKTYPE_USER_CREATE, 'sql_auth::user_create');
24 Hook::func(HOOKTYPE_GET_USER_LIST, 'sql_auth::get_user_list');
25 Hook::func(HOOKTYPE_USER_DELETE, 'sql_auth::user_delete');
4d634d0a
VP
26
27 if (defined('SQL_DEFAULT_USER')) // we've got a default account
28 {
6930484c 29 $lkup = new PanelUser(SQL_DEFAULT_USER['username']);
4d634d0a
VP
30
31 if (!$lkup->id) // doesn't exist, add it with full privileges
32 {
180b8ec1
VP
33 $user = [];
34 $user['user_name'] = SQL_DEFAULT_USER['username'];
35 $user['user_pass'] = SQL_DEFAULT_USER['password'];
36 $user['err'] = "";
37 create_new_user($user);
4d634d0a
VP
38 }
39 }
ea27475b
VP
40 }
41
ea27475b 42
33f512fa
VP
43 public static function add_footer_info($empty)
44 {
45 if (!($user = unreal_get_current_user()))
46 return;
47
48 else {
49 echo "<code>Admin Panel v" . WEBPANEL_VERSION . "</code>";
50 }
51 }
52
3a8ffab8 53 /* pre-Header hook */
b44a2e97
VP
54 public static function session_start($n)
55 {
06369f59
VP
56 if (!isset($_SESSION))
57 {
58 session_set_cookie_params(3600);
59 session_start();
60 }
454379e3
VP
61 do_log($_SESSION);
62 if (!isset($_SESSION['id']) || empty($_SESSION))
b44a2e97 63 {
3a8ffab8
VP
64 $secure = ($_SERVER['HTTPS'] == 'on') ? "https://" : "http://";
65 $current_url = "$secure$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
ce9cf366
VP
66 $tok = split($_SERVER['SCRIPT_FILENAME'], "/");
67 if ($check = security_check() && $tok[count($tok) - 1] !== "error.php") {
68 header("Location: " . BASE_URL . "plugins/sql_auth/error.php");
69 die();
70 }
321b7b81 71 header("Location: ".BASE_URL."login/?redirect=".urlencode($current_url));
454379e3 72 die();
b44a2e97 73 }
08ce3aa7
VP
74 else
75 {
f5e3ecee 76 if (!unreal_get_current_user()->id) // user no longer exists
08ce3aa7
VP
77 {
78 session_destroy();
321b7b81 79 header("Location: ".BASE_URL."login");
f5e3ecee 80 die();
08ce3aa7 81 }
e3e93dde 82 // you'll be automatically logged out after one hour of inactivity
08ce3aa7 83 }
b44a2e97 84 }
ea27475b 85
ce9cf366
VP
86 /**
87 * Create the tables we'll be using in the SQLdb
88 * @return void
89 */
5015c85c
VP
90 public static function create_tables()
91 {
92 $conn = sqlnew();
93 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "users (
94 user_id int AUTO_INCREMENT NOT NULL,
95 user_name VARCHAR(255) NOT NULL,
96 user_pass VARCHAR(255) NOT NULL,
9a674833 97 user_email VARCHAR(255),
5015c85c
VP
98 user_fname VARCHAR(255),
99 user_lname VARCHAR(255),
100 user_bio VARCHAR(255),
101 created VARCHAR(255),
102 PRIMARY KEY (user_id)
103 )");
9a674833
VP
104
105 /**
106 * Patch for beta users
107 * This adds the email column to existing tables without it
108 */
109 $columns = $conn->query("SHOW COLUMNS FROM " . SQL_PREFIX . "users");
110 $column_names = array();
111 $c = $columns->fetchAll();
112 foreach($c as $column) {
113 $column_names[] = $column['Field'];
114 }
115 $column_exists = in_array("user_email", $column_names);
116 if (!$column_exists) {
117 $conn->query("ALTER TABLE " . SQL_PREFIX . "users ADD COLUMN user_email varchar(255)");
118 }
119
120
5015c85c
VP
121 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "user_meta (
122 meta_id int AUTO_INCREMENT NOT NULL,
123 user_id int NOT NULL,
124 meta_key VARCHAR(255) NOT NULL,
125 meta_value VARCHAR(255),
126 PRIMARY KEY (meta_id)
127 )");
ce9cf366
VP
128 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "auth_settings (
129 id int AUTO_INCREMENT NOT NULL,
130 setting_key VARCHAR(255) NOT NULL,
131 setting_value VARCHAR(255),
132 PRIMARY KEY (id)
133 )");
33f512fa
VP
134 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "fail2ban (
135 id int AUTO_INCREMENT NOT NULL,
136 ip VARCHAR(255) NOT NULL,
137 count VARCHAR(255),
138 PRIMARY KEY (id)
139 )");
9c643401 140 new AuthSettings();
5015c85c
VP
141 }
142
6930484c
VP
143 /* We convert $u with a full user as an object ;D*/
144 public static function get_user(&$u)
145 {
146 $id = $u['id'];
147 $name = $u['name'];
148 $conn = sqlnew();
149
150 if ($id)
151 {
152 $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "users WHERE user_id = :id LIMIT 1");
153 $prep->execute(["id" => strtolower($id)]);
154 }
155 elseif ($name)
156 {
157 $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "users WHERE LOWER(user_name) = :name LIMIT 1");
158 $prep->execute(["name" => strtolower($name)]);
159 }
160 $data = NULL;
161 $obj = (object) [];
162 if ($prep)
163 $data = $prep->fetchAll();
164 if (isset($data[0]) && $data = $data[0])
165 {
166 $obj->id = $data['user_id'];
167 $obj->username = $data['user_name'];
168 $obj->passhash = $data['user_pass'];
169 $obj->first_name = $data['user_fname'] ?? NULL;
170 $obj->last_name = $data['user_lname'] ?? NULL;
171 $obj->created = $data['created'];
172 $obj->bio = $data['user_bio'];
9a674833 173 $obj->email = $data['user_email'];
6930484c
VP
174 $obj->user_meta = (new PanelUser_Meta($obj->id))->list;
175 }
176 $u['object'] = $obj;
177 }
178
179 public static function get_usermeta(&$u)
180 {
181 //do_log($u);
182 $list = &$u['meta'];
183 $id = $u['id'];
184 $conn = sqlnew();
185 if (isset($id))
186 {
187 $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id");
188 $prep->execute(["id" => $id]);
189 }
190 foreach ($prep->fetchAll() as $row)
191 {
192 $list[$row['meta_key']] = $row['meta_value'];
193 }
194 }
195
196 public static function add_usermeta(&$meta)
197 {
da6fa2d1 198 $meta = $meta['meta'];
6930484c
VP
199 $conn = sqlnew();
200 /* check if it exists first, update it if it does */
201 $query = "SELECT * FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id AND meta_key = :key";
202 $stmt = $conn->prepare($query);
203 $stmt->execute(["id" => $meta['id'], "key" => $meta['key']]);
204 if ($stmt->rowCount()) // it exists, update instead of insert
205 {
206 $query = "UPDATE " . SQL_PREFIX . "user_meta SET meta_value = :value WHERE user_id = :id AND meta_key = :key";
207 $stmt = $conn->prepare($query);
208 $stmt->execute($meta);
209 if ($stmt->rowCount())
210 return true;
211 return false;
212 }
213
214 else
215 {
216 $query = "INSERT INTO " . SQL_PREFIX . "user_meta (user_id, meta_key, meta_value) VALUES (:id, :key, :value)";
217 $stmt = $conn->prepare($query);
218 $stmt->execute($meta);
219 if ($stmt->rowCount())
220 return true;
221 return false;
222 }
223 }
224 public static function del_usermeta(&$u)
225 {
226 $conn = sqlnew();
227 $query = "DELETE FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id AND meta_key = :key";
228 $stmt = $conn->prepare($query);
229 $stmt->execute($u['meta']);
230 if ($stmt->rowCount())
231 return true;
232 return false;
233 }
180b8ec1
VP
234 public static function user_create(&$u)
235 {
236 $username = $u['user_name'];
237 $first_name = $u['fname'];
238 $last_name = $u['lname'];
239 $password = $u['user_pass'];
240 $user_bio = $u['user_bio'];
9a674833 241 $user_email = $u['user_email'];
180b8ec1 242 $conn = sqlnew();
9a674833
VP
243 $prep = $conn->prepare("INSERT INTO " . SQL_PREFIX . "users (user_name, user_pass, user_fname, user_lname, user_bio, user_email, created) VALUES (:name, :pass, :fname, :lname, :user_bio, :user_email, :created)");
244 $prep->execute(["name" => $username, "pass" => $password, "fname" => $first_name, "lname" => $last_name, "user_bio" => $user_bio, "user_email" => $user_email, "created" => date("Y-m-d H:i:s")]);
180b8ec1
VP
245 if ($prep->rowCount())
246 $u['success'] = true;
247 else
248 $u['errmsg'][] = "Could not add user";
249 }
250
251 public static function get_user_list(&$list)
252 {
253 $conn = sqlnew();
254 $result = $conn->query("SELECT user_id FROM " . SQL_PREFIX . "users");
255 if (!$result) // impossible
256 {
257 die("Something went wrong.");
258 }
259 $userlist = [];
260 while($row = $result->fetch())
261 {
262 $userlist[] = new PanelUser(NULL, $row['user_id']);
263 }
264 if (!empty($userlist))
265 $list = $userlist;
266
267 }
268 public static function user_delete(&$u)
269 {
270 $user = $u['user'];
271 $query = "DELETE FROM " . SQL_PREFIX . "users WHERE user_id = :id";
272 $conn = sqlnew();
273 $stmt = $conn->prepare($query);
274 $stmt->execute(["id" => $user->id]);
275 $deleted = $stmt->rowCount();
276 if ($deleted)
277 {
278 $u['info'][] = "Successfully deleted user \"$user->username\"";
279 $u['boolint'] = 1;
280 } else {
281 $u['info'][] = "Unknown error";
282 $u['boolint'] = 0;
283 }
284 }
ce9cf366
VP
285}
286
287
288function security_check()
289{
290 $ip = $_SERVER['REMOTE_ADDR'];
291 if (dnsbl_check($ip))
292 return true;
293
294 else if (fail2ban_check($ip))
295 {
296
297 }
298}
299
300function dnsbl_check($ip)
301{
302 $dnsbl_lookup = DNSBL;
303
304 // clear variable just in case
305 $listed = NULL;
306
307 // if the IP was not given because you're an idiot, stop processing
308 if (!$ip) { return; }
309
310 // get the first two segments of the IPv4
311 $because = split($ip, "."); // why you
312 $you = $because[1]; // gotta play
313 $want = $because[2]; // that song
314 $to = $you.".".$want."."; // so loud?
315
316 // exempt local connections because sometimes they get a false positive
317 if ($to == "192.168." || $to == "127.0.") { return NULL; }
318
319 // you spin my IP right round, right round, to check the records baby, right round-round-round
320 $reverse_ip = glue(array_reverse(split($ip, ".")), ".");
321
322 // checkem
323 foreach ($dnsbl_lookup as $host) {
324
325 //if it was listed
326 if (checkdnsrr($reverse_ip . "." . $host . ".", "A")) {
327
328 //take note
329 $listed = $host;
330 }
331 }
332
333 // if it was safe, return NOTHING
334 if (!$listed) {
335 return NULL;
336 }
337
338 // else, you guessed it, return where it was listed
339 else {
340 return $listed;
341 }
342}
343
344function fail2ban_check($ip)
33f512fa
VP
345{
346
347}