plugins/sql_auth/sql_auth.php

   1 <?php
   2
   3 require_once "SQL/sql.php";
   4 require_once "SQL/settings.php";
   5
   6 class sql_auth
   7 {
   8         public $name = "SQLAuth";
   9         public $author = "Valware";
  10         public $version = "1.0";
  11         public $description = "Provides a User Auth and Management Panel with an SQL backend";
  12
  13         function __construct()
  14         {
  15                 self::create_tables();
  16                 Hook::func(HOOKTYPE_NAVBAR, 'sql_auth::add_navbar');
  17                 Hook::func(HOOKTYPE_PRE_HEADER, 'sql_auth::session_start');
  18                 Hook::func(HOOKTYPE_OVERVIEW_CARD, 'sql_auth::add_overview_card');
  19                 Hook::func(HOOKTYPE_FOOTER, 'sql_auth::add_footer_info');
  20                 Hook::func(HOOKTYPE_USER_LOOKUP, 'sql_auth::get_user');
  21                 Hook::func(HOOKTYPE_USERMETA_ADD, 'sql_auth::add_usermeta');
  22                 Hook::func(HOOKTYPE_USERMETA_DEL, 'sql_auth::del_usermeta');
  23                 Hook::func(HOOKTYPE_USERMETA_GET, 'sql_auth::get_usermeta');
  24
  25                 if (defined('SQL_DEFAULT_USER')) // we've got a default account
  26                 {
  27                         $lkup = new PanelUser(SQL_DEFAULT_USER['username']);
  28
  29                         if (!$lkup->id) // doesn't exist, add it with full privileges
  30                         {
  31                                 create_new_user(["user_name" => SQL_DEFAULT_USER['username'], "user_pass" => SQL_DEFAULT_USER['password']]);
  32                         }
  33                 }
  34         }
  35
  36         public static function add_navbar(&$pages)
  37         {
  38                 $user = unreal_get_current_user();
  39                 if (!$user)
  40                 {
  41                         $pages = NULL;
  42                         return;
  43                 }
  44                 $pages["Panel Access"] = "plugins/sql_auth/";
  45                 if (isset($_SESSION['id']))
  46                 {
  47                         $pages["Logout"] = "login/?logout=true";
  48                 }
  49         }
  50
  51         public static function add_footer_info($empty)
  52         {
  53                 if (!($user = unreal_get_current_user()))
  54                         return;
  55
  56                 else {
  57                         echo "<code>Admin Panel v" . WEBPANEL_VERSION . "</code>";
  58                 }
  59         }
  60
  61         /* pre-Header hook */
  62         public static function session_start($n)
  63         {
  64                 if (!isset($_SESSION))
  65                 {
  66                         session_set_cookie_params(3600);
  67                         session_start();
  68                 }
  69                 do_log($_SESSION);
  70                 if (!isset($_SESSION['id']) || empty($_SESSION))
  71                 {
  72                         $secure = ($_SERVER['HTTPS'] == 'on') ? "https://" : "http://";
  73                         $current_url = "$secure$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
  74                         $tok = split($_SERVER['SCRIPT_FILENAME'], "/");
  75                         if ($check = security_check() && $tok[count($tok) - 1] !== "error.php") {
  76                                 header("Location: " . BASE_URL . "plugins/sql_auth/error.php");
  77                                 die();
  78                         }
  79                         header("Location: ".BASE_URL."login/?redirect=".urlencode($current_url));
  80                         die();
  81                 }
  82                 else
  83                 {
  84                         if (!unreal_get_current_user()->id) // user no longer exists
  85                         {
  86                                 session_destroy();
  87                                 header("Location: ".BASE_URL."login");
  88                                 die();
  89                         }
  90                         // you'll be automatically logged out after one hour of inactivity
  91                 }
  92         }
  93
  94         /**
  95          * Create the tables we'll be using in the SQLdb
  96          * @return void
  97          */
  98         public static function create_tables()
  99         {
 100                 $conn = sqlnew();
 101                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "users (
 102                         user_id int AUTO_INCREMENT NOT NULL,
 103                         user_name VARCHAR(255) NOT NULL,
 104                         user_pass VARCHAR(255) NOT NULL,
 105
 106                         user_fname VARCHAR(255),
 107                         user_lname VARCHAR(255),
 108                         user_bio VARCHAR(255),
 109                         created VARCHAR(255),
 110                         PRIMARY KEY (user_id)
 111                 )");
 112                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "user_meta (
 113                         meta_id int AUTO_INCREMENT NOT NULL,
 114                         user_id int NOT NULL,
 115                         meta_key VARCHAR(255) NOT NULL,
 116                         meta_value VARCHAR(255),
 117                         PRIMARY KEY (meta_id)
 118                 )");
 119                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "auth_settings (
 120                         id int AUTO_INCREMENT NOT NULL,
 121                         setting_key VARCHAR(255) NOT NULL,
 122                         setting_value VARCHAR(255),
 123                         PRIMARY KEY (id)
 124                 )");
 125                 $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "fail2ban (
 126                         id int AUTO_INCREMENT NOT NULL,
 127                         ip VARCHAR(255) NOT NULL,
 128                         count VARCHAR(255),
 129                         PRIMARY KEY (id)
 130                 )");
 131                 new AuthSettings();
 132         }
 133
 134         /**
 135          * Summary of add_overview_card
 136          * @param mixed $stats
 137          * @return void
 138          */
 139         public static function add_overview_card(object &$stats) : void
 140         {
 141                 $num_of_panel_admins = sqlnew()->query("SELECT COUNT(*) FROM " . SQL_PREFIX . "users")->fetchColumn();
 142                 ?>
 143
 144                 <div class="container mt-5">
 145
 146                         <div class="row">
 147                                 <div class="col-sm-3">
 148                                         <div class="card text-center">
 149                                                 <div class="card-header bg-success text-white">
 150                                                         <div class="row">
 151                                                                 <div class="col">
 152                                                                         <i class="fa fa-lock-open fa-3x"></i>
 153                                                                 </div>
 154                                                                 <div class="col">
 155                                                                         <h3 class="display-4"><?php echo $num_of_panel_admins; ?></h3>
 156                                                                 </div>
 157                                                         </div>
 158                                                 </div>
 159                                                 <div class="card-body">
 160                                                         <div class="row">
 161                                                                 <div class="col">
 162                                                                         <h6>Panel Users</h6>
 163                                                                 </div>
 164                                                                 <div class="col"> <a class="btn btn-primary" href="<?php echo BASE_URL; ?>plugins/sql_auth/">View</a></div>
 165                                                         </div>
 166                                                 </div>
 167                                         </div>
 168                                 </div>
 169                         </div>
 170                 </div>
 171                 <?php
 172         }
 173
 174         /* We convert $u with a full user as an object ;D*/
 175         public static function get_user(&$u)
 176         {
 177                 $id = $u['id'];
 178                 $name = $u['name'];
 179                 $conn = sqlnew();
 180
 181                 if ($id)
 182                 {
 183                         $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "users WHERE user_id = :id LIMIT 1");
 184                         $prep->execute(["id" => strtolower($id)]);
 185                 }
 186                 elseif ($name)
 187                 {
 188                         $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "users WHERE LOWER(user_name) = :name LIMIT 1");
 189                         $prep->execute(["name" => strtolower($name)]);
 190                 }
 191                 $data = NULL;
 192                 $obj = (object) [];
 193                 if ($prep)
 194                         $data = $prep->fetchAll();
 195                 if (isset($data[0]) && $data = $data[0])
 196                 {
 197                         $obj->id = $data['user_id'];
 198                         $obj->username = $data['user_name'];
 199                         $obj->passhash = $data['user_pass'];
 200                         $obj->first_name = $data['user_fname'] ?? NULL;
 201                         $obj->last_name = $data['user_lname'] ?? NULL;
 202                         $obj->created = $data['created'];
 203                         $obj->bio = $data['user_bio'];
 204                         $obj->user_meta = (new PanelUser_Meta($obj->id))->list;
 205                 }
 206                 $u['object'] = $obj;
 207         }
 208
 209         public static function get_usermeta(&$u)
 210         {
 211                 //do_log($u);
 212                 $list = &$u['meta'];
 213                 $id = $u['id'];
 214                 $conn = sqlnew();
 215                 if (isset($id))
 216                 {
 217                         $prep = $conn->prepare("SELECT * FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id");
 218                         $prep->execute(["id" => $id]);
 219                 }
 220                 foreach ($prep->fetchAll() as $row)
 221                 {
 222                         $list[$row['meta_key']] = $row['meta_value'];
 223                 }
 224         }
 225
 226         public static function add_usermeta(&$meta)
 227         {
 228                 $meta = $meta['meta'];
 229                 $conn = sqlnew();
 230                 /* check if it exists first, update it if it does */
 231                 $query = "SELECT * FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id AND meta_key = :key";
 232                 $stmt = $conn->prepare($query);
 233                 $stmt->execute(["id" => $meta['id'], "key" => $meta['key']]);
 234                 if ($stmt->rowCount()) // it exists, update instead of insert
 235                 {
 236                         $query = "UPDATE " . SQL_PREFIX . "user_meta SET meta_value = :value WHERE user_id = :id AND meta_key = :key";
 237                         $stmt = $conn->prepare($query);
 238                         $stmt->execute($meta);
 239                         if ($stmt->rowCount())
 240                                 return true;
 241                         return false;
 242                 }
 243
 244                 else
 245                 {
 246                         $query = "INSERT INTO " . SQL_PREFIX . "user_meta (user_id, meta_key, meta_value) VALUES (:id, :key, :value)";
 247                         $stmt = $conn->prepare($query);
 248                         $stmt->execute($meta);
 249                         if ($stmt->rowCount())
 250                                 return true;
 251                         return false;
 252                 }
 253         }
 254         public static function del_usermeta(&$u)
 255         {
 256                 $conn = sqlnew();
 257                 $query = "DELETE FROM " . SQL_PREFIX . "user_meta WHERE user_id = :id AND meta_key = :key";
 258                 $stmt = $conn->prepare($query);
 259                 $stmt->execute($u['meta']);
 260                 if ($stmt->rowCount())
 261                         return true;
 262                 return false;
 263         }
 264 }
 265
 266
 267 function security_check()
 268 {
 269         $ip = $_SERVER['REMOTE_ADDR'];
 270         if (dnsbl_check($ip))
 271                 return true;
 272
 273         else if (fail2ban_check($ip))
 274         {
 275
 276         }
 277 }
 278
 279 function dnsbl_check($ip)
 280 {
 281         $dnsbl_lookup = DNSBL;
 282
 283         // clear variable just in case
 284         $listed = NULL;
 285
 286         // if the IP was not given because you're an idiot, stop processing
 287         if (!$ip) { return; }
 288
 289         // get the first two segments of the IPv4
 290         $because = split($ip, ".");   // why you
 291         $you = $because[1];               // gotta play
 292         $want = $because[2];             // that song
 293         $to = $you.".".$want.".";       // so loud?
 294
 295         // exempt local connections because sometimes they get a false positive
 296         if ($to == "192.168." || $to == "127.0.") { return NULL; }
 297
 298         // you spin my IP right round, right round, to check the records baby, right round-round-round
 299         $reverse_ip = glue(array_reverse(split($ip, ".")), ".");
 300
 301         // checkem
 302         foreach ($dnsbl_lookup as $host) {
 303
 304                 //if it was listed
 305                 if (checkdnsrr($reverse_ip . "." . $host . ".", "A")) {
 306
 307                         //take note
 308                         $listed = $host;
 309                 }
 310         }
 311
 312         // if it was safe, return NOTHING
 313         if (!$listed) {
 314                 return NULL;
 315         }
 316
 317         // else, you guessed it, return where it was listed
 318         else {
 319                 return $listed;
 320         }
 321 }
 322
 323 function fail2ban_check($ip)
 324 {
 325
 326 }