Classes/class-paneluser.php

   1 <?php
   2 /** Relating to Panel Access: Can add, delete and edit users. Big boss. */
   3 define('PERMISSION_MANAGE_USERS', 'manage_users');
   4 /** Relating to Users tab: Can ban users connected to IRC */
   5 define('PERMISSION_BAN_USERS', 'ban_users');
   6 /** Change properties of a user, i.e. vhost, modes and more */
   7 define('PERMISSION_EDIT_USER', 'edit_user');
   8 /** Change properties of a channel, i.e. topic, modes and more */
   9 define('PERMISSION_EDIT_CHANNEL', 'edit_channel');
  10 /** Change properties of a user on a channel i.e give/remove voice or ops and more */
  11 define('PERMISSION_EDIT_CHANNEL_USER', 'edit_channel_user');
  12 /** Can add manual bans, including G-Lines, Z-Lines and more */
  13 define('PERMISSION_SERVER_BAN_ADD', 'tkl_add');
  14 /** Can remove set bans, including G-Lines, Z-Lines and more */
  15 define('PERMISSION_SERVER_BAN_DEL', 'tkl_del');
  16 /** Can add Name Bans (Q-Lines) */
  17 define('PERMISSION_NAME_BAN_ADD', 'nb_add');
  18 /** Can delete Name Bans (Q-Lines) */
  19 define('PERMISSION_NAME_BAN_DEL', 'nb_del');
  20 /** Can add ban exceptions (E-Lines) */
  21 define('PERMISSION_BAN_EXCEPTION_ADD', 'be_add');
  22 /** Can delete ban exceptions (E-Lines) */
  23 define('PERMISSION_BAN_EXCEPTION_DEL', 'be_del');
  24 /** Can add spamfilter entries */
  25 define('PERMISSION_SPAMFILTER_ADD', 'sf_add');
  26 /** Can delete spamfilter entries */
  27 define('PERMISSION_SPAMFILTER_DEL', 'sf_del');
  28 /** Can rehash servers */
  29 define('PERMISSION_REHASH', 'rhs');
  30 /**
  31  * PanelUser
  32  * This is the User class for the SQL_Auth plugin
  33  */
  34 class PanelUser
  35 {
  36         public $id = NULL;
  37         public $username = NULL;
  38         private $passhash = NULL;
  39         public $first_name = NULL;
  40         public $last_name = NULL;
  41         public $created = NULL;
  42         public $user_meta = [];
  43         public $bio = NULL;
  44         public $email = NULL;
  45
  46         /**
  47          * Find a user in the database by name or ID
  48          * @param string $name
  49          * @param mixed $id
  50          */
  51         function __construct(string $name = NULL, int $id = NULL)
  52         {
  53                 $user["name"] = $name;
  54                 $user["id"] = $id;
  55                 $user["object"] = NULL;
  56                 Hook::run(HOOKTYPE_USER_LOOKUP, $user);
  57                 if ($user['object'] === null)
  58                         return; /* no auth module loaded? */
  59                 foreach ($user['object'] as $key => $value)
  60                         $this->$key = $value;
  61         }
  62
  63         /**
  64          * Verify a user's password
  65          * @param string $input
  66          * @return bool
  67          */
  68         function password_verify(string $password, bool &$hash_needs_updating = false) : bool
  69         {
  70                 GLOBAL $config;
  71                 $hash_needs_updating = false;
  72
  73                 if (str_starts_with($this->passhash, "peppered:"))
  74                 {
  75                         /* Argon2 with pepper */
  76                         $password = hash_hmac("sha256", $password, $config['secrets']['pepper']);
  77                         if (password_verify($password, substr($this->passhash,9)))
  78                                 return true;
  79                 } else {
  80                         /* Old standard argon2 */
  81                         if (password_verify($password, $this->passhash))
  82                         {
  83                                 $hash_needs_updating = true;
  84                                 return true;
  85                         }
  86                 }
  87                 return false;
  88         }
  89
  90         /**
  91          * Generate hash of user's password
  92          * @param string $password
  93          * @return string
  94          */
  95         public static function password_hash(string $password) : string
  96         {
  97                 GLOBAL $config;
  98                 $input = hash_hmac("sha256", $password, $config['secrets']['pepper']);
  99                 return "peppered:".password_hash($input, PASSWORD_ARGON2ID);
 100         }
 101
 102         /**
 103          * Add user meta data
 104          * @param string $key
 105          * @param string $value
 106          */
 107         function add_meta(string $key, string $value)
 108         {
 109
 110                 if (!$key || !$value)
 111                         return false;
 112
 113                 $meta = [
 114                         "id" => $this->id,
 115                         "key" => $key,
 116                         "value" => $value
 117                 ];
 118
 119                 $array['meta'] = $meta;
 120                 $array['user'] = $this;
 121                 Hook::run(HOOKTYPE_USERMETA_ADD, $array);
 122
 123         }
 124
 125         /**
 126          * Delete user meta data by key
 127          * @param string $key
 128          */
 129         function delete_meta(string $key)
 130         {
 131                 if (!$key )
 132                         return false;
 133
 134                 $meta = [
 135                         "id" => $this->id,
 136                         "key" => $key,
 137                 ];
 138                 $array['meta'] = $meta;
 139                 $array['user'] = $this;
 140                 Hook::run(HOOKTYPE_USERMETA_DEL, $array);
 141
 142         }
 143
 144         /** PERMISSIONS */
 145
 146         function add_permission($permission)
 147         {
 148                 $meta = (isset($this->user_meta['permissions'])) ? unserialize($this->user_meta['permissions']) : [];
 149                 if (!in_array($permission,$meta))
 150                         $meta[] = $permission;
 151                 $this->add_meta("permissions", serialize($meta)); // updet de dettabess
 152                 $this->user_meta['permissions'] = serialize($meta); // put it back in our object in case it still needs to be used
 153         }
 154         function delete_permission($permission)
 155         {
 156                 $meta = (isset($this->user_meta['permissions'])) ? unserialize($this->user_meta['permissions']) : [];
 157                 foreach($meta as $key => $value)
 158                 {
 159                         if (!strcmp($permission, $value))
 160                                 unset($meta[$key]);
 161                 }
 162                 $this->add_meta("permissions", serialize($meta));
 163                 $this->user_meta['permissions'] = serialize($meta);
 164         }
 165
 166         /** Updates core user info.
 167          * CAUTION: Updating a non-existent column will crash
 168          * your shit
 169          */
 170         function update_core_info($array)
 171         {
 172                 $arr = ['info' => $array, 'user' => $this];
 173                 Hook::run(HOOKTYPE_EDIT_USER, $arr);
 174         }
 175 }
 176
 177
 178 /**
 179  * This class looks up and returns any user meta.
 180  * This is used by PanelUser, so you won't need to
 181  * call it separately from PanelUser.
 182  */
 183 class PanelUser_Meta
 184 {
 185         public $list = [];
 186         function __construct($id)
 187         {
 188                 $array = [];
 189                 $arr["id"] = $id;
 190                 $arr['meta'] = &$array;
 191                 Hook::run(HOOKTYPE_USERMETA_GET, $arr);
 192                 $this->list = $arr['meta'];
 193
 194         }
 195 }
 196
 197 /**
 198  * Array of user
 199  *
 200  * Required:
 201  * user_name
 202  * user_pass
 203  *
 204  * Optional:
 205  * user_fname
 206  * user_lname
 207  *
 208  * @param array $user
 209  * @throws Exception
 210  * @return bool
 211  */
 212 function create_new_user(array &$user) : bool
 213 {
 214         if (!isset($user['user_name']) || !isset($user['user_pass']))
 215                 throw new Exception("Attempted to add user without specifying user_name or user_pass");
 216
 217         $user['user_name'] = htmlspecialchars($user['user_name']);
 218         $user['user_pass'] = PanelUser::password_hash($user['user_pass']);
 219         $user['fname'] = (isset($user['fname'])) ? htmlspecialchars($user['fname']) : NULL;
 220         $last['lname'] = (isset($user['lname'])) ? htmlspecialchars($user['lname']) : NULL;
 221         $user['user_bio'] = (isset($user['user_bio'])) ? htmlspecialchars($user['user_bio']) : NULL;
 222         $user['email'] = (isset($user['user_email'])) ? htmlspecialchars($user['user_email']) : NULL;
 223
 224         if (($u = new PanelUser($user['user_name']))->id)
 225         {
 226                 $user['err'] = "User already exists";
 227                 return false;
 228         }
 229         // internal use
 230         $user['success'] = false;
 231         $user['errmsg'] = [];
 232
 233         Hook::run(HOOKTYPE_USER_CREATE, $user);
 234         if (!$user['success'])
 235                 return false;
 236
 237         return true;
 238 }
 239
 240 /**
 241  * Gets the user object for the current session
 242  * @return PanelUser|bool
 243  */
 244 function unreal_get_current_user() : PanelUser|bool
 245 {
 246         if (isset($_SESSION) && isset($_SESSION['id']))
 247         {
 248                 $user = new PanelUser(NULL, $_SESSION['id']);
 249                 if ($user->id)
 250                         return $user;
 251         }
 252         return false;
 253 }
 254
 255 /**
 256  * Checks if a user can do something
 257  * @param string $permission
 258  * @return bool
 259  */
 260 function current_user_can($permission) : bool
 261 {
 262         $user = unreal_get_current_user();
 263         if (!$user)
 264                 return false;
 265         return user_can($user, $permission);
 266 }
 267
 268 /**
 269  * Checks if a user can do something
 270  * @param string $permission
 271  * @return bool
 272  */
 273 function user_can(PanelUser $user, $permission) : bool
 274 {
 275         global $config;
 276         if (!$user)
 277                 return false;
 278
 279         if (isset($user->user_meta['role']))
 280         {
 281                 if ($user->user_meta['role'] == "Super-Admin")
 282                         return true;
 283
 284                 else if ($user->user_meta['role'] == "Read-Only")
 285                         return false;
 286
 287                 else if (in_array($permission, $config['user_roles'][$user->user_meta['role']]))
 288                         return true;
 289
 290                 return false;
 291         }
 292
 293         /* compatibility fallback */
 294         if (isset($user->user_meta['permissions']))
 295         {
 296                 $perms = unserialize($user->user_meta['permissions']);
 297                 if (in_array($permission, $perms))
 298                         return true;
 299         }
 300         return false;
 301 }
 302
 303 /**
 304  * Delete a user and related meta
 305  * @param int $id The ID of the user in the SQL database.
 306  * @param array $info This will fill with a response.
 307  * @return int
 308  *
 309  * Return values:
 310  *  1   The user was successfully deleted.
 311  *  0   The user was not found
 312  *  -1  The admin does not have permission to delete users [TODO]
 313  */
 314 function delete_user(int $id, &$info = []) : int
 315 {
 316         $user = new PanelUser(NULL, $id);
 317         if (!$user->id) {
 318                 $info[] = "Could not find user";
 319                 return 0;
 320         }
 321         $arr = ["user" => $user, "info" => &$info, "boolint" => 0];
 322         Hook::run(HOOKTYPE_USER_DELETE, $arr);
 323         return $arr["boolint"];
 324 }
 325
 326 function get_panel_user_permission_list()
 327 {
 328         $list = [
 329                 "Can add/delete/edit Admin Panel users" => PERMISSION_MANAGE_USERS,
 330                 "Can ban/kill IRC users" => PERMISSION_BAN_USERS,
 331                 "Can change properties of a user, i.e. vhost, modes and more" => PERMISSION_EDIT_USER,
 332                 "Can change properties of a channel, i.e. topic, modes and more" => PERMISSION_EDIT_CHANNEL,
 333                 "Can change properties of a user on a channel i.e give/remove voice or ops and more" => PERMISSION_EDIT_CHANNEL_USER,
 334                 "Can add manual bans, including G-Lines, Z-Lines and more" => PERMISSION_SERVER_BAN_ADD,
 335                 "Can remove set bans, including G-Lines, Z-Lines and more" => PERMISSION_SERVER_BAN_DEL,
 336                 "Can forbid usernames and channels" => PERMISSION_NAME_BAN_ADD,
 337                 "Can unforbid usernames and channels" => PERMISSION_NAME_BAN_DEL,
 338                 "Can add server ban exceptions" => PERMISSION_BAN_EXCEPTION_ADD,
 339                 "Can remove server ban exceptions" => PERMISSION_BAN_EXCEPTION_DEL,
 340                 "Can add Spamfilter entries" => PERMISSION_SPAMFILTER_ADD,
 341                 "Can remove Spamfilter entries" => PERMISSION_SPAMFILTER_DEL
 342         ];
 343         Hook::run(HOOKTYPE_USER_PERMISSION_LIST, $list); // so plugin writers can add their own permissions
 344         return $list;
 345 }
 346
 347 function generate_panel_user_permission_table($user)
 348 {
 349
 350         $list = get_panel_user_permission_list();
 351         foreach($list as $desc => $slug)
 352         {
 353                 $attributes = "";
 354                 $attributes .= (current_user_can(PERMISSION_MANAGE_USERS)) ? "" : "disabled ";
 355                 ?>
 356                 <div class="input-group">
 357                         <div class="input-group-prepend">
 358                                 <div class="input-group-text">
 359                                         <input <?php
 360                                                 $attributes .= (user_can($user, $slug)) ? "checked" : "";
 361                                                 echo $attributes;
 362                                         ?> name="permissions[]" value="<?php echo $slug; ?>" type="checkbox">
 363                                 </div>
 364                         </div>
 365                         <input type="text" readonly  class="form-control" value="<?php echo "$desc ($slug)"; ?>">
 366                 </div>
 367
 368                 <?php
 369         }
 370 }
 371
 372 function get_panel_user_roles_list()
 373 {
 374         /* Defaults */
 375         $list = [
 376         "Super-Admin" => get_panel_user_permission_list(), // SuperAdmin can do everything
 377         "Read-Only" => [], // Read Only can do nothing
 378         ];
 379
 380         Hook::run(HOOKTYPE_USER_ROLE_LIST, $list);
 381         return $list;
 382 }
 383
 384 function generate_role_list($list)
 385 {
 386         $list2 = get_panel_user_permission_list();
 387         ?>
 388                 <h5>Roles List:</h5>
 389                 <div id="permlist">
 390                 <div class="container-xxl" style="max-width: 1430px;">
 391                 <div class="accordion" id="roles_accord">
 392
 393 <?php foreach($list as $role => $slug) {?>
 394         <div class="card">
 395                 <div class="card-header" id="<?php echo to_slug($role); ?>_heading">
 396                         <div class="btn-header-link btn-block text-left collapsed" type="button" data-toggle="collapse" data-target="#collapse_<?php echo to_slug($role); ?>" aria-expanded="true" aria-controls="collapse_<?php echo to_slug($role); ?>">
 397                                 <?php echo $role ?>
 398
 399                         </div>
 400                 </div>
 401
 402                 <div id="collapse_<?php echo to_slug($role); ?>" class="collapse" aria-labelledby="<?php echo to_slug($role); ?>_heading" data-parent="#roles_accord">
 403                         <div id="results_rpc" class="card-body">
 404                                 <form method="post">
 405                                 <?php if ($role !== "Super-Admin" && $role !== "Read-Only") { ?>
 406                                         <div class="container row mb-2">
 407                                                 <button id="update_role" name="update_role" value="<?php echo $role ?>" class="btn btn-primary ml-1 mr-2" >Update</button>
 408                                                 <button id="delete_role" name="del_role_name" value="<?php echo $role ?>" class="btn btn-danger"><i class="fa fa-trash fa-1" aria-hidden="true"></i></button>
 409                                         </div>
 410
 411                                 <?php } ?>
 412                                 <div id="<?php echo $role; ?>_input_area"><?php
 413                                         foreach($list2 as $desc => $slug)
 414                                         {
 415                                         $attributes = "";
 416                                         $attributes .= ($role == "Super-Admin" || $role == "Read-Only") ? "disabled " : "";
 417
 418                                                 ?>
 419                                                 <div class="input-group">
 420                                                         <div class="input-group-prepend">
 421                                                                 <div class="input-group-text">
 422                                                                         <input <?php
 423                                                                                 $attributes .= (in_array($slug, $list[$role])) ? "checked" : "";
 424                                                                                 echo $attributes;
 425                                                                         ?> name="permissions[]" value="<?php echo $slug; ?>" type="checkbox">
 426                                                                 </div>
 427                                                         </div>
 428                                                         <input type="text" readonly class="form-control" value="<?php echo "$desc ($slug)"; ?>">
 429                                                 </div>
 430
 431                                                 <?php
 432                                         }
 433                                 ?>      </div>
 434                                 </form>
 435                         </div>
 436                 </div>
 437         </div>
 438 <?php }?>
 439
 440                 </div></div><br>
 441
 442 </div><?php
 443
 444 }