Rather large update, please see commit notes

[irc/unrealircd/unrealircd-webpanel.git] / plugins / sql_auth / sql_auth.php

diff --git a/plugins/sql_auth/sql_auth.php b/plugins/sql_auth/sql_auth.php
index 62d59bd6062039113a2d9da35de36747fbb1a9c3..fdfeb566177842bc191ced91037807faf4cd6a26 100644 (file)
--- a/plugins/sql_auth/sql_auth.php
+++ b/plugins/sql_auth/sql_auth.php
@@ -2,6 +2,7 @@
 
 require_once "SQL/sql.php";
 require_once "SQL/user.php";
+require_once "SQL/settings.php";
 
 class sql_auth
 {
@@ -16,6 +17,7 @@ class sql_auth
                Hook::func(HOOKTYPE_NAVBAR, 'sql_auth::add_navbar');
                Hook::func(HOOKTYPE_PRE_HEADER, 'sql_auth::session_start');
                Hook::func(HOOKTYPE_OVERVIEW_CARD, 'sql_auth::add_overview_card');
+               Hook::func(HOOKTYPE_FOOTER, 'sql_auth::add_footer_info');
 
                if (defined('SQL_DEFAULT_USER')) // we've got a default account
                {
@@ -30,8 +32,11 @@ class sql_auth
 
        public static function add_navbar(&$pages)
        {
-               session_start();
-               
+               if (!unreal_get_current_user()->id)
+               {
+                       $pages = NULL;
+                       return;
+               }
                $pages["Panel Access"] = "plugins/sql_auth/";
                if (isset($_SESSION['id']))
                {
@@ -39,14 +44,48 @@ class sql_auth
                }
        }
 
+       public static function add_footer_info($empty)
+       {
+               if (!($user = unreal_get_current_user()))
+                       return;
+
+               else {
+                       echo "<code>Admin Panel v" . WEBPANEL_VERSION . "</code>";
+               }
+       }
+
        public static function session_start($n)
        {
-               if (!isset($_SESSION['id']))
+               do_log($_SESSION);
+               if (!isset($_SESSION['id']) || empty($_SESSION))
                {
+                       $tok = split($_SERVER['SCRIPT_FILENAME'], "/");
+                       if ($check = security_check() && $tok[count($tok) - 1] !== "error.php") {
+                               header("Location: " . BASE_URL . "plugins/sql_auth/error.php");
+                               die();
+                       }
+                       session_destroy();
                        header("Location: ".BASE_URL."plugins/sql_auth/login.php");
+                       die();
+               }
+               else
+               {
+                       if (!unreal_get_current_user()->id) // user no longer exists
+                       {
+                               session_destroy();
+                               header("Location: ".BASE_URL."plugins/sql_auth/login.php");
+                               die();
+                       }
+                       // you'll be automatically logged out after one hour of inactivity
+                       session_set_cookie_params(3600);
+                       session_start();
                }
        }
 
+       /**
+        * Create the tables we'll be using in the SQLdb
+        * @return void
+        */
        public static function create_tables()
        {
                $conn = sqlnew();
@@ -68,9 +107,27 @@ class sql_auth
                        meta_value VARCHAR(255),
                        PRIMARY KEY (meta_id)
                )");
+               $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "auth_settings (
+                       id int AUTO_INCREMENT NOT NULL,
+                       setting_key VARCHAR(255) NOT NULL,
+                       setting_value VARCHAR(255),
+                       PRIMARY KEY (id)
+               )");
+               $conn->query("CREATE TABLE IF NOT EXISTS " . SQL_PREFIX . "fail2ban (
+                       id int AUTO_INCREMENT NOT NULL,
+                       ip VARCHAR(255) NOT NULL,
+                       count VARCHAR(255),
+                       PRIMARY KEY (id)
+               )");
+               new AuthSettings();
        }
 
-       public static function add_overview_card(&$stats)
+       /**
+        * Summary of add_overview_card
+        * @param mixed $stats
+        * @return void
+        */
+       public static function add_overview_card(object &$stats) : void
        {
                $num_of_panel_admins = sqlnew()->query("SELECT COUNT(*) FROM " . SQL_PREFIX . "users")->fetchColumn();
                ?>
@@ -105,4 +162,66 @@ class sql_auth
                <?php
        }
 
+}
+
+
+function security_check()
+{
+       $ip = $_SERVER['REMOTE_ADDR'];
+       if (dnsbl_check($ip))
+               return true;
+
+       else if (fail2ban_check($ip))
+       {
+
+       }
+}
+
+function dnsbl_check($ip)
+{
+       $dnsbl_lookup = DNSBL;
+
+       // clear variable just in case
+       $listed = NULL;
+
+       // if the IP was not given because you're an idiot, stop processing
+       if (!$ip) { return; }
+       
+       // get the first two segments of the IPv4       
+       $because = split($ip, ".");   // why you
+       $you = $because[1];               // gotta play
+       $want = $because[2];             // that song
+       $to = $you.".".$want.".";       // so loud?
+       
+       // exempt local connections because sometimes they get a false positive
+       if ($to == "192.168." || $to == "127.0.") { return NULL; }
+       
+       // you spin my IP right round, right round, to check the records baby, right round-round-round
+       $reverse_ip = glue(array_reverse(split($ip, ".")), ".");
+       
+       // checkem
+       foreach ($dnsbl_lookup as $host) {
+               
+               //if it was listed
+               if (checkdnsrr($reverse_ip . "." . $host . ".", "A")) {
+                       
+                       //take note
+                       $listed = $host;
+               }
+       }
+
+       // if it was safe, return NOTHING
+       if (!$listed) {
+               return NULL;
+       }
+       
+       // else, you guessed it, return where it was listed
+       else {
+               return $listed;
+       }
+}
+
+function fail2ban_check($ip)
+{
+
 }
\ No newline at end of file