WB 2.08.x

17 Jun -2015 Build 2125 Manuela v.d.Decken(DarkViper)

! /framework/class.Login.php

! /account/ ~login_form.php  ~login.php

! /admin/login/index.php

  fixed some possible intruder vectors and complete 2.8.4 adaption

    require($sStartFile);

$username_fieldname = 'username';

$password_fieldname = 'password';

if(isset($oReg->SmartLogin) && $oReg->SmartLogin == 'true') {

    $sTmp = '_'.substr(md5(microtime()), -8);

    $username_fieldname .= $sTmp;

    $password_fieldname .= $sTmp;

}

$WarnUrl = str_replace($oReg->AppPath, $oReg->AppUrl, $admin->correct_theme_source('warning.html'));

        'MAX_ATTEMPS'           => 3,

        'REMEMBER_ME_OPTION'    => $oReg->SmartLogin,

        'MIN_USERNAME_LEN'      => 2,

        'MIN_PASSWORD_LEN'      => 3,

        'MAX_USERNAME_LEN'      => 100,

        'MAX_PASSWORD_LEN'      => 100,

        'LOGIN_URL'             => $oReg->AcpUrl."login/index.php",

        'DEFAULT_URL'           => $oReg->AcpUrl."start/index.php",

        'FORGOTTEN_DETAILS_APP' => $oReg->AcpUrl."login/forgot/index.php",

        'USERS_TABLE'           => $oDb->TablePrefix."users",

        'GROUPS_TABLE'          => $oDb->TablePrefix."groups",

 * @copyright       WebsiteBaker Org. e.V.

 * @link			http://websitebaker.org/

if(!defined('SYSTEM_RUN')) {

    throw new Exception('illegal file access [account/login_form.php]');

// Generate username field name

$username_fieldname = 'username';

$password_fieldname = 'password';

if(isset($oReg->SmartLogin) && $oReg->SmartLogin == 'true') {

    $sTmp = '_'.substr(md5(microtime()), -8);

    $username_fieldname .= $sTmp;

    $password_fieldname .= $sTmp;

}

if( is_readable($oReg->AppPath.'account/frontend.css')) {

    $sIncludeHeadLinkCss .= '<link href="'.$oReg->AppUrl.'account/frontend.css"';

    $sIncludeHeadLinkCss .= ' rel="stylesheet" type="text/css" media="screen" />'."\n";

    $oTpl = new Template(__DIR__.'/htt');

    $oTpl->set_file('page', 'login.htt');

    $oTpl->debug = false;

    $oTpl->set_block('page', 'main_block', 'main');

    $oTpl->set_block('main_block', 'message_block', 'message');

    $oTpl->set_block('message', '');

// language vars

    $oTpl->set_var($oReg->Trans->getLangArray());

    $oTpl->set_var(array(

        'FTAN'                  => $wb->getFTAN(),

        'ACTION_URL'            => $oReg->AppUrl.'account/login.php',

        'FORGOT_URL'            => $oReg->AppUrl.'account/forgot.php',

        'REDIRECT_URL'          => $thisApp->redirect_url,

        'WB_URL'                => $oReg->AppUrl,

        'THEME_URL'             => $oReg->ThemeUrl,

        'TEMPLATE_URL'          => $oReg->TemplateDir,

        'HTTP_REFERER'          => $thisApp->redirect_url,

        'CSS_BLOCK'             => $sIncludeHeadLinkCss,

        'MESSAGE_VALUE'         => '',

        'ERROR_VALUE'           => '',

        'THISAPP_MESSAGE_VALUE' => $thisApp->message,

        'USER_FIELDNAME'        => $username_fieldname,

        'PASSWORD_FIELDNAME'    => $password_fieldname,

        )

    );

    $oTpl->set_block('main_block', 'show_smart_login_block', 'show_smart_login');

// $oTpl->parse('show_smart_login', '');

    if($username_fieldname != 'username') {

        $oTpl->parse('show_smart_login', 'show_smart_login_block', true);

    } else {

        $oTpl->set_block('show_smart_login', '');

    }

    //$oTpl->parse('message', 'message_block', true);

    $oTpl->parse('main', 'main_block', false);

    $output = $oTpl->finish($oTpl->parse('output', 'page'));

    unset($oTpl);

    print $output;

// Include the configuration file

$sStartFile = dirname(__DIR__).'/framework/initialize.php';

if (!defined('SYSTEM_RUN')) { require($sStartFile); }

require_once($oReg->AppPath.'framework/functions.php');

if(!$oReg->FrontendLogin) {

    header('Location: '.$oReg->AppUrl);

    exit;

$page_id =

    isset($oReg->ReferrerId)

    ? $oReg->ReferrerId

    : isset($_SESSION['PAGE_ID']) ? $_SESSION['PAGE_ID'] : 0;

$level = ($page_id > 0 ) ? level_count($page_id) : $page_id;

$root_parent = ($page_id > 0 ) ? root_parent($page_id) : $page_id;

define('PAGE_TITLE', $oTrans->TEXT_PLEASE_LOGIN);

define('MENU_TITLE', $oTrans->TEXT_PLEASE_LOGIN);

define('PAGE_CONTENT', $oReg->AppPath.'account/login_form.php');

$sRedirect  = strip_tags(isset(${$requestMethod}['redirect']) ? ${$requestMethod}['redirect'] : '');

$_SESSION['HTTP_REFERER'] = str_replace($oReg->AppUrl,'/',$sRedirect);

$sLoginUrl  = $oReg->AppUrl.'account/login.php';

$sLoginUrl .= (!empty($sRedirect) ? '?redirect=' .$_SESSION['HTTP_REFERER'] : '');

$sWarningUrl  = str_replace($oReg->AppPath, $oReg->AppUrl, $wb->correct_theme_source('warning.html'));

$sThemePath = realpath($oReg->AppPath . ltrim($wb->correct_theme_source('loginBox.htt'), '/'));

    array(

        'MAX_ATTEMPS'           => 3,

        'WARNING_URL'           => $sWarningUrl,

        'USERNAME_FIELDNAME'    => 'username',

        'PASSWORD_FIELDNAME'    => 'password',

        'REMEMBER_ME_OPTION'    => $oReg->SmartLogin,

        'MIN_USERNAME_LEN'      => 2,

        'MIN_PASSWORD_LEN'      => 3,

        'MAX_USERNAME_LEN'      => 100,

        'MAX_PASSWORD_LEN'      => 100,

        'LOGIN_URL'             => $sLoginUrl,

        'DEFAULT_URL'           => $oReg->AppUrl.'index.php',

        'TEMPLATE_DIR'          => $sThemePath,

        'TEMPLATE_FILE'         => 'login.htt',

        'FRONTEND'              => true,

        'FORGOTTEN_DETAILS_APP' => $oReg->AppUrl.'/account/forgot.php',

        'USERS_TABLE'           => $oDb->TablePrefix.'users',

        'GROUPS_TABLE'          => $oDb->TablePrefix.'groups',

        'REDIRECT_URL'          => $sRedirect

    )

);

require($oReg->AppPath.'index.php');

    const PASS_CHARS = '\w!#$%&*+\-.:=?@\|';

    const USER_CHARS = 'a-z0-9&\-.=@_';

    protected $oReg    = null;

    protected $oDb     = null;

    protected $oTrans  = null;

    protected $message = '';

    public function __construct($config_array)

    {

        $this->oReg   = WbAdaptor::getInstance();

        $this->oDb    = $this->oReg->Db;

        $this->oTrans = $this->oReg->Trans;

        parent::__construct();

    // Get configuration values

        while(list($key, $value) = each($config_array)) {

            $this->{(strtolower($key))} = $value;

        }

    // calculate redirect URL

        if(!isset($this->redirect_url)) { $this->redirect_url = ''; }

        $aServerUrl = $this->mb_parse_url($this->oReg->AppUrl);

        $sServerUrl = $_SERVER['SERVER_NAME'];

        $sServerScheme =

            isset($_SERVER['REQUEST_SCHEME'])

            ? $_SERVER['REQUEST_SCHEME']

            : isset($aServerUrl['scheme']) ? $aServerUrl['scheme'] : ' http';

        $sServerPath = $_SERVER['SCRIPT_NAME'];

        // If the url is blank, set it to the default url

        $this->url = $this->get_post('url');

        if (preg_match('/%0d|%0a|\s/i', $this->url)) {

            throw new Exception('Warning: possible intruder detected on login');

        }

        $this->url =

            isset($aRedirecthUrl['host']) &&($sServerUrl == $aUrl['host'])

            ? $this->url

            : $this->oReg->AcpUrl.'start/index.php';

        if ($this->redirect_url!='') {

            $this->redirect_url =

                isset($aRedirecthUrl['host']) &&($sServerUrl==$aRedirecthUrl['host'])

                ? $this->redirect_url

                : $sServerScheme.'://'.$sServerUrl;

            $this->url = $this->redirect_url;

        }

        if(strlen($this->url) < 2) {

            $this->default_url =

                isset($aDefaultUrl['host']) &&($sServerUrl==$aDefaultUrl['host'])

                ? $this->default_url

                : $sServerScheme.'://'.$sServerUrl;

            $this->url = $this->default_url;

        }

    // get username & password and validate it

        $username_fieldname = (string)$this->get_post('username_fieldname');

        $username_fieldname = (preg_match('/^_?[a-z][\w]+$/i', $username_fieldname) ? $username_fieldname : 'username');

        $sUsername = strtolower(trim((string)$this->get_post($username_fieldname)));

        $this->username = (preg_match(

            '/^['.self::USER_CHARS.']{'.$this->min_username_len.','.$this->max_username_len.'}$/is',

            $sUsername

        ) ? $sUsername : '');

        $password_fieldname = (string)$this->get_post('password_fieldname');

        $password_fieldname = (preg_match('/^_?[a-z][\w]+$/i', $password_fieldname) ? $password_fieldname : 'password');

        if ($this->username) {

/** @TODO implement crypting */

            $this->password = md5(trim((string)$this->get_post($password_fieldname)));

            // Figure out if the "remember me" option has been checked

            $this->remember = (@$_POST['remember'] == 'true' ? true : false);

        // try to authenticate

            $bSuccess = false;

            if (!($bSuccess = $this->is_authenticated())) {

                if ($this->is_remembered()) {

                    $sql = 'SELECT * FROM `'.$this->oDb->TablePrefix.'users` '

                         . 'WHERE `user_id`='.$this->get_safe_remember_key();

                    if (($oUsers = $this->oDb->doQuery($sql))) {

                        if (($aUser = $oUsers->fetchArray())) {

                            $this->username = $aUser['username'];

                            $this->password = $aUser['password'];

                            // Check if the user exists (authenticate them)

                            $bSuccess = $this->authenticate();

                        }

                    }

                } else {

                    // Check if the user exists (authenticate them)

                    $bSuccess = $this->authenticate();

                }

            }

            if ($bSuccess) {

                // Authentication successful

                $this->send_header($this->url);

            } else {

                $this->message = $this->oTrans->MESSAGE_LOGIN_AUTHENTICATION_FAILED;

                $this->increase_attemps();

            }

        } else {

            $this->display_login();

        }

    }

    // Authenticate the user (check if they exist in the database)

    function authenticate()

    {

        // Get user information

        $loginname = ( preg_match('/^['.self::USER_CHARS.']+$/s',$this->username) ? $this->username : '0');

        $aSettings = array();

        $aSettings['SYSTEM_PERMISSIONS']   = array();

        $aSettings['MODULE_PERMISSIONS']   = array();

        $aSettings['TEMPLATE_PERMISSIONS'] = array();

        $bRetval = false;

        $sql = 'SELECT * FROM `'.$this->oDb->TablePrefix.'users` '

             . 'WHERE `username`=\''.$this->oDb->escapeString($loginname).'\'';

        if (($oUser = $this->oDb->doQuery($sql))) {

            if (($aUser = $oUser->fetchArray())) {

                if (

                    $aUser['password'] == $this->password &&

                    $aUser['active'] == 1

                ) {

                // valide authentcation !!

                    $user_id                   = $aUser['user_id'];

                    $this->user_id             = $user_id;

                    $aSettings['USER_ID']      = $user_id;

                    $aSettings['GROUP_ID']     = $aUser['group_id'];

                    $aSettings['GROUPS_ID']    = $aUser['groups_id'];

                    $aSettings['USERNAME']     = $aUser['username'];

                    $aSettings['DISPLAY_NAME'] = $aUser['display_name'];

                    $aSettings['EMAIL']        = $aUser['email'];

                    $aSettings['HOME_FOLDER']  = $aUser['home_folder'];

                    // Run remember function if needed

                    if($this->remember == true) {

                        $this->remember($this->user_id);

                    }

                    // Set language

                    if($aUser['language'] != '') {

                        $aSettings['LANGUAGE'] = $aUser['language'];

                    }

                    // Set timezone

                    if($aUser['timezone'] != '-72000') {

                        $aSettings['TIMEZONE'] = $aUser['timezone'];

                    } else {

                        // Set a session var so apps can tell user is using default tz

                        $aSettings['USE_DEFAULT_TIMEZONE'] = true;

                    }

                    // Set date format

                    if($aUser['date_format'] != '') {

                        $aSettings['DATE_FORMAT'] = $aUser['date_format'];

                    } else {

                        // Set a session var so apps can tell user is using default date format

                        $aSettings['USE_DEFAULT_DATE_FORMAT'] = true;

                    }

                    // Set time format

                    if($aUser['time_format'] != '') {

                        $aSettings['TIME_FORMAT'] = $aUser['time_format'];

                    } else {

                        // Set a session var so apps can tell user is using default time format

                        $aSettings['USE_DEFAULT_TIME_FORMAT'] = true;

                    }

                    // Get group information

                    $aSettings['GROUP_NAME'] = array();

                    $bOnlyAdminGroup = $this->ami_group_member('1') && (sizeof($aGroupsIds) == 1);

                    $sql = 'SELECT * FROM `'.$this->oDb->TablePrefix.'groups` '

                         . 'WHERE `group_id` IN (\''.$aUser['groups_id'].',0\') '

                         . 'ORDER BY `group_id`';

                    if (($oGroups = $this->oDb->doQuery($sql))) {

                        while (($aGroup = $oGroups->fetchArray())) {

                            $aSettings['GROUP_NAME'][$aGroup['group_id']] = $aGroup['name'];

                        // collect system_permissions (additively)

                            $aSettings['SYSTEM_PERMISSIONS'] = array_merge(

                                $aSettings['SYSTEM_PERMISSIONS'],

                                explode(',', $aGroup['system_permissions'])

                            );

                        // collect module_permission (subtractive)

                            if (!sizeof($aSettings['MODULE_PERMISSIONS'])) {

                                $aSettings['MODULE_PERMISSIONS'] = explode(',', $aGroup['module_permissions']);

                                $aSettings['MODULE_PERMISSIONS'] = array_intersect(

                                    $aSettings['MODULE_PERMISSIONS'],

                                    preg_split('/\s*[,;\|\+]/', $aGroup['module_permissions'], -1, PREG_SPLIT_NO_EMPTY)

                                );

                        // collect template_permission (subtractive)

                            if (!sizeof($aSettings['TEMPLATE_PERMISSIONS'])) {

                                $aSettings['TEMPLATE_PERMISSIONS'] = explode(',', $aGroup['template_permissions']);

                            } else {

                                $aSettings['TEMPLATE_PERMISSIONS'] = array_intersect(

                                    $aSettings['TEMPLATE_PERMISSIONS'],

                                    preg_split('/\s*[,;\|\+]/', $aGroup['template_permissions'], -1, PREG_SPLIT_NO_EMPTY)

                                );

                            }

                        }

                    }

                    // Update the users table with current ip and timestamp

                    $sRemoteAddress = @$_SERVER['REMOTE_ADDR'] ?: 'unknown';

                    $sql = 'UPDATE `'.$this->oDb->TablePrefix.'users` '

                         . 'SET `login_when`='.time().', '

                         .     '`login_ip`=\''.$sRemoteAddress.'\' '

                         . 'WHERE `user_id`=\''.$user_id.'\'';

                    $this->oDb->doQuery($sql);

                    $bRetval = true;

                }

            }

        }

        // merge settings into $_SESSION and overwrite older one values

        $_SESSION = array_merge($_SESSION, $aSettings);

        // Return if the user exists or not

        return $bRetval;

    }

    // Increase the count for login attemps

    function increase_attemps()

    {

        $_SESSION['ATTEMPS'] = (isset($_SESSION['ATTEMPS']) ? $_SESSION['ATTEMPS']++ : 0);

        $this->display_login();

    }

    // Function to set a "remembering" cookie for the user - removed

    function remember($user_id)

    {

        return true;

    }

    // Function to check if a user has been remembered - removed

    function is_remembered()

    {

        return false;

    }

    // Display the login screen

    function display_login()

    {

        // If attemps more than allowed, warn the user

        if($this->get_session('ATTEMPS') > $this->max_attemps) {

            $this->warn();

        }

        // Show the login form

        if($this->frontend != true) {

            $template = new Template(dirname($this->correct_theme_source($this->template_file)));

            $template->set_file('page', $this->template_file);

            $template->set_block('page', 'mainBlock', 'main');

            $template->set_var('DISPLAY_REMEMBER_ME', ($this->remember_me_option ? '' : 'display: none;'));

            $template->set_var($this->oTrans->getLangArray());

            $template->set_var(

                array(

                    'TITLE_LOGOUT'           => $this->oTrans->MENU_LOGIN,

                    'TITLE_VIEW'             => $this->oTrans->TEXT_WEBSITE,

                    'SECTION_NAME'           => $this->oTrans->MENU_LOGIN,

                    'SECTION_LOGIN'          => $this->oTrans->MENU_LOGIN,

                    'ACTION_URL'             => $this->login_url,

                    'URL'                    => $this->default_url,

                    'ATTEMPS'                => $this->get_session('ATTEMPS'),

                    'USERNAME'               => $this->username,

                    'USERNAME_FIELDNAME'     => $this->username_fieldname,

                    'PASSWORD_FIELDNAME'     => $this->password_fieldname,

                    'MESSAGE'                => $this->message,

                    'WEBSITE_TITLE'          => $this->oReg->WebsiteTitle,

                    'INTERFACE_DIR_URL'      => $this->oReg->AcpUrl.'interface',

                    'MAX_USERNAME_LEN'       => $this->max_username_len,

                    'MAX_PASSWORD_LEN'       => $this->max_password_len,

                    'ADMIN_URL'              => $this->oReg->AcpUrl,

                    'WB_URL'                 => $this->oReg->AppUrl,

                    'URL_VIEW'               => $this->oReg->AppUrl,

                    'THEME_URL'              => $this->oReg->ThemeUrl,

                    'VERSION'                => $this->oReg->Version,

                    'SP'                     => (isset($this->oReg->Sp) ? $this->oReg->Sp : ''),

                    'REVISION'               => $this->oReg->Revision,

                    'LANGUAGE'               => strtolower($this->oReg->Language),

                    'FORGOTTEN_DETAILS_APP'  => $this->forgotten_details_app,

                    'PAGES_DIRECTORY'        => $this->oReg->PagesDir,

                    'LOGIN_DISPLAY_HIDDEN'   => !$this->is_authenticated() ? 'hidden' : '',

                    'LOGIN_DISPLAY_NONE'     => !$this->is_authenticated() ? 'none' : '',

                    'LOGIN_LINK'             => $_SERVER['SCRIPT_NAME'],

                    'LOGIN_ICON'             => 'login',

                    'START_ICON'             => 'blank',

                    'URL_HELP'               => 'http://wiki.websitebaker.org/',

                )

            );

            $template->set_var('CHARSET', (isset($this->oReg->DefaultCharset) ? $this->oReg->DefaultCharset : 'utf-8'));

            $template->parse('main', 'mainBlock', false);

            $template->pparse('output', 'page');

        }

    }

    // sanities the REMEMBER_KEY cookie to avoid SQL injection

    function get_safe_remember_key()

    {

        $iMatches = 0;

        if (isset($_COOKIE['REMEMBER_KEY'])) {

            $sRetval = preg_replace(

                '/^([0-9]{11})_([0-9a-f]{11})$/i',

                '\1\2',

                $_COOKIE['REMEMBER_KEY'], -1, $iMatches

            );

        }

        return ($iMatches ? $sRetval : '');

    }

    // Warn user that they have had to many login attemps

    function warn()

    {

        $this->send_header($this->warning_url);

        exit;

    }