plugins/sql_auth/sql_auth.php

   1 <?php
   2
   3 require_once "SQL/sql.php";
   4 require_once "SQL/settings.php";
   5
   6 class sql_auth
   7 {
   8         public $name = "SQLAuth";
   9         public $author = "Valware";
  10         public $version = "1.0";
  11         public $description = "Provides a User Auth and Management Panel with an SQL backend";
  12         public $email = "v.a.pond@outlook.com";
  13
  14         function __construct()
  15         {
  16                 self::create_tables();
  17                 Hook::func(HOOKTYPE_PRE_HEADER, 'sql_auth::session_start');
  18                 Hook::func(HOOKTYPE_FOOTER, 'sql_auth::add_footer_info');
  19                 Hook::func(HOOKTYPE_USER_LOOKUP, 'sql_auth::get_user');
  20                 Hook::func(HOOKTYPE_USERMETA_ADD, 'sql_auth::add_usermeta');
  21                 Hook::func(HOOKTYPE_USERMETA_DEL, 'sql_auth::del_usermeta');
  22                 Hook::func(HOOKTYPE_USERMETA_GET, 'sql_auth::get_usermeta');
  23                 Hook::func(HOOKTYPE_USER_CREATE, 'sql_auth::user_create');
  24                 Hook::func(HOOKTYPE_GET_USER_LIST, 'sql_auth::get_user_list');
  25                 Hook::func(HOOKTYPE_USER_DELETE, 'sql_auth::user_delete');
  26                 Hook::func(HOOKTYPE_EDIT_USER, 'sql_auth::edit_core');
  27
  28                 if (defined('SQL_DEFAULT_USER')) // we've got a default account
  29                 {
  30                         $lkup = new PanelUser(SQL_DEFAULT_USER['username']);
  31
  32                         if (!$lkup->id) // doesn't exist, add it with full privileges
  33                         {
  34                                 $user = [];
  35                                 $user['user_name'] = SQL_DEFAULT_USER['username'];
  36                                 $user['user_pass'] = SQL_DEFAULT_USER['password'];
  37                                 $user['err'] = "";
  38                                 create_new_user($user);
  39                         }
  40                         $lkup = new PanelUser(SQL_DEFAULT_USER['username']);
  41                         if (!user_can($lkup, PERMISSION_MANAGE_USERS))
  42                                 $lkup->add_permission(PERMISSION_MANAGE_USERS);
  43                 }
  44         }
  45
  46
  47         public static function add_footer_info($empty)
  48         {
  49                 if (!($user = unreal_get_current_user()))
  50                         return;
  51
  52                 else {
  53                         echo "<code>Admin Panel v" . WEBPANEL_VERSION . "</code>";
  54                 }
  55         }
  56
  57         /* pre-Header hook */
  58         public static function session_start($n)
  59         {
  60                 if (!isset($_SESSION))
  61                 {
  62                         session_set_cookie_params(3600);
  63                         session_start();
  64                 }
  65                 if (!isset($_SESSION['id']) || empty($_SESSION))
  66                 {
  67                         $current_page = $_SERVER['REQUEST_URI'];
  68                         $tok = split($_SERVER['SCRIPT_FILENAME'], "/");
  69                         if ($check = security_check() && $tok[count($tok) - 1] !== "error.php") {
  70                                 header("Location: " . BASE_URL . "plugins/sql_auth/error.php");
  71                                 die();
  72                         }
  73                         header("Location: ".BASE_URL."login/?redirect=".urlencode($current_page));
  74                         die();
  75                 }
  76                 else
  77                 {
  78                         if (!unreal_get_current_user()) // user no longer exists
  79                         {
  80                                 session_destroy();
  81                                 header("Location: ".BASE_URL."login");
  82                                 die();
  83                         }
  84                         // you'll be automatically logged out after one hour of inactivity
  85                 }
  86         }
  87
  88         /**
  89          * Create the tables we'll be using in the SQLdb
  90          * @return void
  91          */
  92         public static function create_tables()
  93         {
  94                 $conn = sqlnew();
  95                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "users (
  96                         user_id int AUTO_INCREMENT NOT NULL,
  97                         user_name VARCHAR(255) NOT NULL,
  98                         user_pass VARCHAR(255) NOT NULL,
  99                         user_email VARCHAR(255),
 100                         user_fname VARCHAR(255),
 101                         user_lname VARCHAR(255),
 102                         user_bio VARCHAR(255),
 103                         created VARCHAR(255),
 104                         PRIMARY KEY (user_id)
 105                 )");
 106
 107                 /**
 108                  * Patch for beta users
 109                  * This adds the email column to existing tables without it
 110                 */
 111                 $columns = $conn->query("SHOW COLUMNS FROM " . SQL_PREFIX . "users");
 112                 $column_names = array();
 113                 $c = $columns->fetchAll();
 114
 115                 foreach($c as $column) {
 116                         $column_names[] = $column['Field'];
 117                 }
 118                 $column_exists = in_array("user_email", $column_names);
 119                 if (!$column_exists) {
 120                         $conn->query("ALTER TABLE " . SQL_PREFIX . "users ADD COLUMN user_email varchar(255)");
 121                 }
 122
 123                 /**
 124                  * Another patch for beta users
 125                  * This changes the size of the meta_value so we can store more
 126                  */
 127
 128                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "user_meta (
 129                         meta_id int AUTO_INCREMENT NOT NULL,
 130                         user_id int NOT NULL,
 131                         meta_key VARCHAR(255) NOT NULL,
 132                         meta_value VARCHAR(255),
 133                         PRIMARY KEY (meta_id)
 134                 )");
 135                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "auth_settings (
 136                         id int AUTO_INCREMENT NOT NULL,
 137                         setting_key VARCHAR(255) NOT NULL,
 138                         setting_value VARCHAR(255),
 139                         PRIMARY KEY (id)
 140                 )");
 141                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "fail2ban (
 142                         id int AUTO_INCREMENT NOT NULL,
 143                         ip VARCHAR(255) NOT NULL,
 144                         count VARCHAR(255),
 145                         PRIMARY KEY (id)
 146                 )");
 147                 $c = [];
 148                 if (($columns = $conn->query("SHOW COLUMNS FROM ".SQL_PREFIX."user_meta")));
 149                         $c = $columns->fetchAll();
 150                 if (!empty($c))
 151                         $conn->query("ALTER TABLE `".SQL_PREFIX."user_meta` CHANGE `meta_value` `meta_value` VARCHAR(5000) CHARACTER SET utf8mb3 COLLATE utf8mb3_bin NULL DEFAULT NULL");
 152
 153
 154                 new AuthSettings();
 155         }
 156
 157         /* We convert $u with a full user as an object ;D*/
 158         public static function get_user(&$u)
 159         {
 160                 $id = $u['id'];
 161                 $name = $u['name'];
 162                 $conn = sqlnew();
 163
 164                 if ($id)
 165                 {
 166                         $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "users WHERE user_id = :id LIMIT 1");
 167                         $prep->execute(["id" => strtolower($id)]);
 168                 }
 169                 elseif ($name)
 170                 {
 171                         $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "users WHERE LOWER(user_name) = :name LIMIT 1");
 172                         $prep->execute(["name" => strtolower($name)]);
 173                 }
 174                 $data = NULL;
 175                 $obj = (object) [];
 176                 if ($prep)
 177                         $data = $prep->fetchAll();
 178                 if (isset($data[0]) && $data = $data[0])
 179                 {
 180                         $obj->id = $data['user_id'];
 181                         $obj->username = $data['user_name'];
 182                         $obj->passhash = $data['user_pass'];
 183                         $obj->first_name = $data['user_fname'] ?? NULL;
 184                         $obj->last_name = $data['user_lname'] ?? NULL;
 185                         $obj->created = $data['created'];
 186                         $obj->bio = $data['user_bio'];
 187                         $obj->email = $data['user_email'];
 188                         $obj->user_meta = (new PanelUser_Meta($obj->id))->list;
 189                 }
 190                 $u['object'] = $obj;
 191         }
 192
 193         public static function get_usermeta(&$u)
 194         {
 195                 $list = &$u['meta'];
 196                 $id = $u['id'];
 197                 $conn = sqlnew();
 198                 if (isset($id))
 199                 {
 200                         $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id");
 201                         $prep->execute(["id" => $id]);
 202                 }
 203                 foreach ($prep->fetchAll() as $row)
 204                 {
 205                         $list[$row['meta_key']] = $row['meta_value'];
 206                 }
 207         }
 208
 209         public static function add_usermeta(&$meta)
 210         {
 211                 $meta = $meta['meta'];
 212                 $conn = sqlnew();
 213                 /* check if it exists first, update it if it does */
 214                 $query = "SELECT * FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id AND meta_key = :key";
 215                 $stmt = $conn->prepare($query);
 216                 $stmt->execute(["id" => $meta['id'], "key" => $meta['key']]);
 217                 if ($stmt->rowCount()) // it exists, update instead of insert
 218                 {
 219                         $query = "UPDATE " . SQL_PREFIX . "user_meta SET meta_value = :value WHERE user_id = :id AND meta_key = :key";
 220                         $stmt = $conn->prepare($query);
 221                         $stmt->execute($meta);
 222                         if ($stmt->rowCount())
 223                                 return true;
 224                         return false;
 225                 }
 226
 227                 else
 228                 {
 229                         $query = "INSERT INTO " . SQL_PREFIX . "user_meta (user_id, meta_key, meta_value) VALUES (:id, :key, :value)";
 230                         $stmt = $conn->prepare($query);
 231                         $stmt->execute($meta);
 232                         if ($stmt->rowCount())
 233                                 return true;
 234                         return false;
 235                 }
 236         }
 237         public static function del_usermeta(&$u)
 238         {
 239                 $conn = sqlnew();
 240                 $query = "DELETE FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id AND meta_key = :key";
 241                 $stmt = $conn->prepare($query);
 242                 $stmt->execute($u['meta']);
 243                 if ($stmt->rowCount())
 244                         return true;
 245                 return false;
 246         }
 247         public static function user_create(&$u)
 248         {
 249                 $username = $u['user_name'];
 250                 $first_name = $u['fname'] ?? NULL;
 251                 $last_name = $u['lname'] ?? NULL;
 252                 $password = $u['user_pass'] ?? NULL;
 253                 $user_bio = $u['user_bio'] ?? NULL;
 254                 $user_email = $u['user_email'] ?? NULL;
 255                 $conn = sqlnew();
 256                 $prep = $conn->prepare("INSERT INTO " . SQL_PREFIX . "users (user_name, user_pass, user_fname, user_lname, user_bio, user_email, created) VALUES (:name, :pass, :fname, :lname, :user_bio, :user_email, :created)");
 257                 $prep->execute(["name" => $username, "pass" => $password, "fname" => $first_name, "lname" => $last_name, "user_bio" => $user_bio, "user_email" => $user_email, "created" => date("Y-m-d H:i:s")]);
 258                 if ($prep->rowCount())
 259                         $u['success'] = true;
 260                 else
 261                         $u['errmsg'][] = "Could not add user";
 262         }
 263
 264         public static function get_user_list(&$list)
 265         {
 266                 $conn = sqlnew();
 267                 $result = $conn->query("SELECT user_id FROM " . SQL_PREFIX . "users");
 268                 if (!$result) // impossible
 269                 {
 270                         die("Something went wrong.");
 271                 }
 272                 $userlist = [];
 273                 while($row =  $result->fetch())
 274                 {
 275                         $userlist[] = new PanelUser(NULL, $row['user_id']);
 276                 }
 277                 if (!empty($userlist))
 278                         $list = $userlist;
 279
 280         }
 281         public static function user_delete(&$u)
 282         {
 283                 $user = $u['user'];
 284                 $query = "DELETE FROM " . SQL_PREFIX . "users WHERE user_id = :id";
 285                 $conn = sqlnew();
 286                 $stmt = $conn->prepare($query);
 287                 $stmt->execute(["id" => $user->id]);
 288                 $deleted = $stmt->rowCount();
 289                 if ($deleted)
 290                 {
 291                         $u['info'][] = "Successfully deleted user \"$user->username\"";
 292                         $u['boolint'] =  1;
 293                 } else {
 294                         $u['info'][] = "Unknown error";
 295                         $u['boolint'] = 0;
 296                 }
 297         }
 298
 299         public static function edit_core($arr)
 300         {
 301                 $conn = sqlnew();
 302                 $user = $arr['user'];
 303                 $info = $arr['info'];
 304                 foreach($info as $key => $val)
 305                 {
 306                         if (!$val)
 307                                 continue;
 308                         if (!strcmp($key,"update_fname"))
 309                                 $value = "user_fname";
 310
 311                         elseif (!strcmp($key,"update_lname"))
 312                                 $value = "user_lname";
 313
 314                         elseif (!strcmp($key,"update_bio"))
 315                                 $value = "user_bio";
 316
 317                         elseif (!strcmp($key,"update_pass") || !strcmp($key,"update_pass_conf"))
 318                                 $value = "user_pass";
 319
 320                         elseif(!strcmp($key,"update_email"))
 321                                 $value = "user_email";
 322                         else
 323                                 die("Malfunction");
 324                         $query = "UPDATE " . SQL_PREFIX . "users SET $value=:value WHERE user_id = :id";
 325                         $stmt = $conn->prepare($query);
 326                         $stmt->execute(["value" => $val, "id" => $user->id]);
 327                 }
 328         }
 329 }
 330
 331
 332 function security_check()
 333 {
 334         $ip = $_SERVER['REMOTE_ADDR'];
 335         if (dnsbl_check($ip))
 336                 return true;
 337
 338         else if (fail2ban_check($ip))
 339         {
 340
 341         }
 342 }
 343
 344 function dnsbl_check($ip)
 345 {
 346
 347         if (!defined('DNSBL'))
 348                 return;
 349         $dnsbl_lookup = DNSBL;
 350
 351         // clear variable just in case
 352         $listed = NULL;
 353
 354         // if the IP was not given because you're an idiot, stop processing
 355         if (!$ip) { return; }
 356
 357         // get the first two segments of the IPv4
 358         $because = split($ip, ".");   // why you
 359         $you = $because[1];               // gotta play
 360         $want = $because[2];             // that song
 361         $to = $you.".".$want.".";       // so loud?
 362
 363         // exempt local connections because sometimes they get a false positive
 364         if ($to == "192.168." || $to == "127.0.") { return NULL; }
 365
 366         // you spin my IP right round, right round, to check the records baby, right round-round-round
 367         $reverse_ip = glue(array_reverse(split($ip, ".")), ".");
 368
 369         // checkem
 370         foreach ($dnsbl_lookup as $host) {
 371
 372                 //if it was listed
 373                 if (checkdnsrr($reverse_ip . "." . $host . ".", "A")) {
 374
 375                         //take note
 376                         $listed = $host;
 377                 }
 378         }
 379
 380         // if it was safe, return NOTHING
 381         if (!$listed) {
 382                 return NULL;
 383         }
 384
 385         // else, you guessed it, return where it was listed
 386         else {
 387                 return $listed;
 388         }
 389 }
 390
 391 function fail2ban_check($ip)
 392 {
 393
 394 }