| [ Index ] |
PHP Cross Reference of MyBB 1.8.41 |
[Summary view] [Print] [Text view]
1 <?php 2 /** 3 * MyBB 1.8 4 * Copyright 2014 MyBB Group, All Rights Reserved 5 * 6 * Website: http://www.mybb.com 7 * License: http://www.mybb.com/about/license 8 * 9 */ 10 11 define("IN_MYBB", 1); 12 define("IN_ADMINCP", 1); 13 14 // Here you can change how much of an Admin CP IP address must match in a previous session for the user is validated (e.g. 3 means a.b.c need to match) 15 define("ADMIN_IP_SEGMENTS", 0); 16 define("ADMIN_IPV6_SEGMENTS", 0); 17 18 require_once dirname(dirname(__FILE__))."/inc/init.php"; 19 20 $shutdown_queries = $shutdown_functions = array(); 21 22 send_page_headers(); 23 24 header('X-Frame-Options: SAMEORIGIN'); 25 header('Referrer-Policy: no-referrer'); 26 27 if(!isset($config['admin_dir']) || !file_exists(MYBB_ROOT.$config['admin_dir']."/inc/class_page.php")) 28 { 29 $config['admin_dir'] = basename(dirname(__FILE__)); 30 } 31 32 define('MYBB_ADMIN_DIR', MYBB_ROOT.$config['admin_dir'].'/'); 33 34 define('COPY_YEAR', my_date('Y', TIME_NOW)); 35 36 require_once MYBB_ADMIN_DIR."inc/class_page.php"; 37 require_once MYBB_ADMIN_DIR."inc/class_form.php"; 38 require_once MYBB_ADMIN_DIR."inc/class_table.php"; 39 require_once MYBB_ADMIN_DIR."inc/functions.php"; 40 require_once MYBB_ROOT."inc/functions_user.php"; 41 42 // Set cookie path to our admin dir temporarily, i.e. so that it affects the ACP only 43 $loc = get_current_location('', '', true); 44 $mybb->settings['cookiepath'] = substr($loc, 0, strrpos($loc, "/{$config['admin_dir']}/"))."/{$config['admin_dir']}/"; 45 46 if(!isset($cp_language)) 47 { 48 $lang->set_language($mybb->settings['cplanguage'], "admin"); 49 } 50 51 // Load global language phrases 52 $lang->load("global"); 53 $lang->load("messages", true); 54 55 if(function_exists('mb_internal_encoding') && !empty($lang->settings['charset'])) 56 { 57 @mb_internal_encoding($lang->settings['charset']); 58 } 59 60 header("Content-type: text/html; charset={$lang->settings['charset']}"); 61 62 $time = TIME_NOW; 63 $errors = null; 64 65 if(is_dir(MYBB_ROOT."install") && !file_exists(MYBB_ROOT."install/lock")) 66 { 67 $mybb->trigger_generic_error("install_directory"); 68 } 69 70 $ip_address = get_ip(); 71 unset($user); 72 73 // Load Admin CP style 74 if(!isset($cp_style)) 75 { 76 if(!empty($mybb->settings['cpstyle']) && file_exists(MYBB_ADMIN_DIR."/styles/".$mybb->settings['cpstyle']."/main.css")) 77 { 78 $cp_style = $mybb->settings['cpstyle']; 79 } 80 else 81 { 82 $cp_style = "default"; 83 } 84 } 85 86 $default_page = new DefaultPage; 87 88 $logged_out = false; 89 $fail_check = 0; 90 $post_verify = true; 91 92 foreach(array('action', 'do', 'module') as $input) 93 { 94 if(!isset($mybb->input[$input])) 95 { 96 $mybb->input[$input] = ''; 97 } 98 } 99 100 if($mybb->input['action'] == "unlock") 101 { 102 $user = array(); 103 $error = ''; 104 105 $plugins->run_hooks("admin_unlock_start"); 106 107 if($mybb->input['username']) 108 { 109 $user = get_user_by_username($mybb->input['username'], array('fields' => '*')); 110 111 if(!$user) 112 { 113 $error = $lang->error_invalid_username; 114 } 115 } 116 else if($mybb->input['uid']) 117 { 118 $user = get_user($mybb->input['uid']); 119 if(!$user) 120 { 121 $error = $lang->error_invalid_uid; 122 } 123 } 124 125 // Do we have the token? If so let's process it 126 if($mybb->input['token'] && $user['uid']) 127 { 128 $query = $db->simple_select("awaitingactivation", "COUNT(aid) AS num", "uid='".(int)$user['uid']."' AND code='".$db->escape_string($mybb->input['token'])."' AND type='l' AND dateline > '".(int)(TIME_NOW - 86400)."'"); 129 130 $plugins->run_hooks("admin_unlock_end"); 131 132 // If we're good to go 133 if($db->fetch_field($query, "num") > 0) 134 { 135 $db->delete_query("awaitingactivation", "uid='".(int)$user['uid']."' AND code='".$db->escape_string($mybb->input['token'])."' AND type='l'"); 136 $db->update_query("adminoptions", array('loginlockoutexpiry' => 0, 'loginattempts' => 0), "uid='".(int)$user['uid']."'"); 137 138 admin_redirect("index.php"); 139 } 140 else 141 { 142 $error = $lang->error_invalid_token; 143 } 144 } 145 146 $default_page->show_lockout_unlock($error, 'error'); 147 } 148 elseif($mybb->input['do'] == "login") 149 { 150 $plugins->run_hooks("admin_login"); 151 152 // We have an adminsid cookie? 153 if(isset($mybb->cookies['adminsid'])) 154 { 155 // Check admin session 156 $query = $db->simple_select("adminsessions", "sid", "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); 157 $admin_session = $db->fetch_field($query, 'sid'); 158 159 // Session found: redirect to index 160 if($admin_session) 161 { 162 admin_redirect("index.php"); 163 } 164 } 165 166 require_once MYBB_ROOT."inc/datahandlers/login.php"; 167 $loginhandler = new LoginDataHandler("get"); 168 169 // Determine login method 170 $login_lang_string = $lang->error_invalid_username_password; 171 switch($mybb->settings['username_method']) 172 { 173 case 0: // Username only 174 $login_lang_string = $lang->sprintf($login_lang_string, $lang->login_username); 175 break; 176 case 1: // Email only 177 $login_lang_string = $lang->sprintf($login_lang_string, $lang->login_email); 178 break; 179 case 2: // Username and email 180 default: 181 $login_lang_string = $lang->sprintf($login_lang_string, $lang->login_username_and_password); 182 break; 183 } 184 185 // Validate PIN first 186 if(!empty($config['secret_pin']) && (empty($mybb->input['pin']) || !my_hash_equals($config['secret_pin'], $mybb->input['pin']))) 187 { 188 $login_user = get_user_by_username( 189 $mybb->input['username'], 190 array( 191 'fields' => array('email', 'username'), 192 'username_method' => $mybb->settings['username_method'] 193 ) 194 ); 195 196 $plugins->run_hooks("admin_login_incorrect_pin"); 197 198 if($login_user['uid'] > 0) 199 { 200 $db->update_query("adminoptions", array("loginattempts" => "loginattempts+1"), "uid='".(int)$login_user['uid']."'", '', true); 201 } 202 203 $loginattempts = login_attempt_check_acp($login_user['uid'], true); 204 205 // Have we attempted too many times? 206 if($loginattempts !== false && $loginattempts['loginattempts'] > 0) 207 { 208 // Have we set an expiry yet? 209 if($loginattempts['loginlockoutexpiry'] == 0) 210 { 211 $db->update_query("adminoptions", array("loginlockoutexpiry" => TIME_NOW+((int)$mybb->settings['loginattemptstimeout']*60)), "uid='".(int)$login_user['uid']."'"); 212 } 213 214 // Did we hit lockout for the first time? Send the unlock email to the administrator 215 if($loginattempts['loginattempts'] == $mybb->settings['maxloginattempts']) 216 { 217 $db->delete_query("awaitingactivation", "uid='".(int)$login_user['uid']."' AND type='l'"); 218 $lockout_array = array( 219 "uid" => $login_user['uid'], 220 "dateline" => TIME_NOW, 221 "code" => random_str(30), 222 "type" => "l" 223 ); 224 $db->insert_query("awaitingactivation", $lockout_array); 225 226 $subject = $lang->sprintf($lang->locked_out_subject, $mybb->settings['bbname']); 227 $message = $lang->sprintf($lang->locked_out_message, htmlspecialchars_uni($mybb->input['username']), $mybb->settings['bbname'], $mybb->settings['maxloginattempts'], $mybb->settings['bburl'], $mybb->config['admin_dir'], $lockout_array['code'], $lockout_array['uid']); 228 my_mail($login_user['email'], $subject, $message); 229 } 230 231 log_admin_action(array( 232 'type' => 'admin_locked_out', 233 'uid' => (int)$login_user['uid'], 234 'username' => $login_user['username'], 235 ) 236 ); 237 238 $default_page->show_lockedout(); 239 } 240 else 241 { 242 $default_page->show_login($login_lang_string, "error"); 243 } 244 } 245 246 $loginhandler->set_data(array( 247 'username' => $mybb->input['username'], 248 'password' => $mybb->input['password'] 249 )); 250 251 if($loginhandler->validate_login() == true) 252 { 253 $mybb->user = get_user($loginhandler->login_data['uid']); 254 } 255 256 if(!empty($mybb->user['uid'])) 257 { 258 if(login_attempt_check_acp($mybb->user['uid']) == true) 259 { 260 log_admin_action(array( 261 'type' => 'admin_locked_out', 262 'uid' => (int)$mybb->user['uid'], 263 'username' => $mybb->user['username'], 264 ) 265 ); 266 267 $default_page->show_lockedout(); 268 } 269 270 $plugins->run_hooks("admin_login_success"); 271 272 $db->delete_query("adminsessions", "uid='{$mybb->user['uid']}'"); 273 274 $sid = md5(random_str(50)); 275 276 $useragent = $_SERVER['HTTP_USER_AGENT']; 277 if(my_strlen($useragent) > 200) 278 { 279 $useragent = my_substr($useragent, 0, 200); 280 } 281 282 // Create a new admin session for this user 283 $admin_session = array( 284 "sid" => $sid, 285 "uid" => $mybb->user['uid'], 286 "loginkey" => $mybb->user['loginkey'], 287 "ip" => $db->escape_binary(my_inet_pton(get_ip())), 288 "dateline" => TIME_NOW, 289 "lastactive" => TIME_NOW, 290 "data" => my_serialize(array()), 291 "useragent" => $db->escape_string($useragent), 292 "authenticated" => 0, 293 ); 294 $db->insert_query("adminsessions", $admin_session); 295 $admin_session['data'] = array(); 296 297 // Only reset the loginattempts when we're really logged in and the user doesn't need to enter a 2fa code 298 $query = $db->simple_select("adminoptions", "authsecret", "uid='{$mybb->user['uid']}'"); 299 $admin_options = $db->fetch_array($query); 300 if(empty($admin_options['authsecret'])) 301 { 302 $db->update_query("adminoptions", array("loginattempts" => 0, "loginlockoutexpiry" => 0), "uid='{$mybb->user['uid']}'"); 303 } 304 305 my_setcookie("adminsid", $sid, '', true, "strict"); 306 my_setcookie('acploginattempts', 0); 307 $post_verify = false; 308 309 $mybb->request_method = "get"; 310 311 if(!empty($mybb->input['module'])) 312 { 313 // $query_string should contain the module 314 $query_string = '?module='.htmlspecialchars_uni($mybb->input['module']); 315 316 // Now we look for any paramters passed in $_SERVER['QUERY_STRING'] 317 if($_SERVER['QUERY_STRING']) 318 { 319 $qstring = '?'.preg_replace('#adminsid=(.{32})#i', '', $_SERVER['QUERY_STRING']); 320 $qstring = str_replace('action=logout', '', $qstring); 321 $qstring = preg_replace('#&+#', '&', $qstring); 322 $qstring = str_replace('?&', '?', $qstring); 323 324 // So what do we do? We know that parameters are devided by ampersands 325 // That means we must get to work! 326 $parameters = explode('&', $qstring); 327 328 // Remove our first member if it's for the module 329 if(substr($parameters[0], 0, 8) == '?module=') 330 { 331 unset($parameters[0]); 332 } 333 334 foreach($parameters as $key => $param) 335 { 336 $params = explode("=", $param); 337 338 $query_string .= '&'.htmlspecialchars_uni($params[0]); 339 340 if(isset($params[1])) 341 { 342 $query_string .= "=".htmlspecialchars_uni($params[1]); 343 } 344 } 345 } 346 347 admin_redirect("index.php".$query_string); 348 } 349 } 350 else 351 { 352 $login_user = get_user_by_username( 353 $mybb->input['username'], 354 array( 355 'fields' => array('email', 'username'), 356 'username_method' => $mybb->settings['username_method'] 357 ) 358 ); 359 360 $plugins->run_hooks("admin_login_fail"); 361 362 $loginattempts = false; 363 if(!empty($login_user['uid']) && $login_user['uid'] > 0) 364 { 365 $db->update_query("adminoptions", array("loginattempts" => "loginattempts+1"), "uid='".(int)$login_user['uid']."'", '', true); 366 $loginattempts = login_attempt_check_acp($login_user['uid'], true); 367 } 368 369 // Have we attempted too many times? 370 if($loginattempts !== false && $loginattempts['loginattempts'] > 0) 371 { 372 // Have we set an expiry yet? 373 if($loginattempts['loginlockoutexpiry'] == 0) 374 { 375 $db->update_query("adminoptions", array("loginlockoutexpiry" => TIME_NOW+((int)$mybb->settings['loginattemptstimeout']*60)), "uid='".(int)$login_user['uid']."'"); 376 } 377 378 $plugins->run_hooks("admin_login_lockout"); 379 380 // Did we hit lockout for the first time? Send the unlock email to the administrator 381 if($loginattempts['loginattempts'] == $mybb->settings['maxloginattempts']) 382 { 383 $db->delete_query("awaitingactivation", "uid='".(int)$login_user['uid']."' AND type='l'"); 384 $lockout_array = array( 385 "uid" => $login_user['uid'], 386 "dateline" => TIME_NOW, 387 "code" => random_str(30), 388 "type" => "l" 389 ); 390 $db->insert_query("awaitingactivation", $lockout_array); 391 392 $subject = $lang->sprintf($lang->locked_out_subject, $mybb->settings['bbname']); 393 $message = $lang->sprintf($lang->locked_out_message, htmlspecialchars_uni($mybb->input['username']), $mybb->settings['bbname'], $mybb->settings['maxloginattempts'], $mybb->settings['bburl'], $mybb->config['admin_dir'], $lockout_array['code'], $lockout_array['uid']); 394 my_mail($login_user['email'], $subject, $message); 395 } 396 397 log_admin_action(array( 398 'type' => 'admin_locked_out', 399 'uid' => (int)$login_user['uid'], 400 'username' => $login_user['username'], 401 ) 402 ); 403 404 $default_page->show_lockedout(); 405 } 406 407 $fail_check = 1; 408 } 409 } 410 else 411 { 412 // No admin session - show message on the login screen 413 if(!isset($mybb->cookies['adminsid'])) 414 { 415 $login_message = ""; 416 } 417 // Otherwise, check admin session 418 else 419 { 420 $query = $db->simple_select("adminsessions", "*", "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); 421 $admin_session = $db->fetch_array($query); 422 423 // No matching admin session found - show message on login screen 424 if(empty($admin_session) || !$admin_session['sid']) 425 { 426 $login_message = $lang->error_invalid_admin_session; 427 } 428 else 429 { 430 $admin_session['data'] = my_unserialize($admin_session['data']); 431 432 // Fetch the user from the admin session 433 $mybb->user = get_user($admin_session['uid']); 434 435 // Login key has changed - force logout 436 if(!$mybb->user['uid'] || $mybb->user['loginkey'] !== $admin_session['loginkey']) 437 { 438 unset($mybb->user); 439 } 440 else 441 { 442 // Admin CP sessions 2 hours old are expired 443 if($admin_session['lastactive'] < TIME_NOW-7200) 444 { 445 $login_message = $lang->error_admin_session_expired; 446 $db->delete_query("adminsessions", "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); 447 unset($mybb->user); 448 } 449 // If IP matching is set - check IP address against the session IP 450 else if(ADMIN_IP_SEGMENTS > 0 && strpos($ip_address, ':') === false) 451 { 452 $exploded_ip = explode(".", $ip_address); 453 $exploded_admin_ip = explode(".", my_inet_ntop($admin_session['ip'])); 454 $matches = 0; 455 $valid_ip = false; 456 for($i = 0; $i < ADMIN_IP_SEGMENTS; ++$i) 457 { 458 if($exploded_ip[$i] == $exploded_admin_ip[$i]) 459 { 460 ++$matches; 461 } 462 if($matches == ADMIN_IP_SEGMENTS) 463 { 464 $valid_ip = true; 465 break; 466 } 467 } 468 469 // IP doesn't match properly - show message on logon screen 470 if(!$valid_ip) 471 { 472 $login_message = $lang->error_invalid_ip; 473 unset($mybb->user); 474 } 475 } 476 else if(ADMIN_IPV6_SEGMENTS > 0 && strpos($ip_address, ':') !== false) 477 { 478 // Expand IPv6 addresses 479 $hex = unpack("H*hex", my_inet_pton($ip_address)); 480 $expanded_ip = substr(preg_replace("/([A-f0-9]{4})/", "$1:", $hex['hex']), 0, -1); 481 $hex_admin = unpack("H*hex", $admin_session['ip']); 482 $expanded_admin_ip = substr(preg_replace("/([A-f0-9]{4})/", "$1:", $hex_admin['hex']), 0, -1); 483 484 $exploded_ip = explode(":", $expanded_ip); 485 $exploded_admin_ip = explode(":", $expanded_admin_ip); 486 $matches = 0; 487 $valid_ip = false; 488 for($i = 0; $i < ADMIN_IPV6_SEGMENTS; ++$i) 489 { 490 if($exploded_ip[$i] == $exploded_admin_ip[$i]) 491 { 492 ++$matches; 493 } 494 if($matches == ADMIN_IPV6_SEGMENTS) 495 { 496 $valid_ip = true; 497 break; 498 } 499 } 500 501 // IP doesn't match properly - show message on logon screen 502 if(!$valid_ip) 503 { 504 $login_message = $lang->error_invalid_ip; 505 unset($mybb->user); 506 } 507 } 508 } 509 } 510 } 511 } 512 513 if($mybb->input['action'] == "logout" && $mybb->user) 514 { 515 $plugins->run_hooks("admin_logout"); 516 517 if(verify_post_check($mybb->get_input('my_post_key'))) 518 { 519 $db->delete_query("adminsessions", "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); 520 my_unsetcookie('adminsid'); 521 $logged_out = true; 522 } 523 } 524 525 if(!isset($mybb->user['usergroup'])) 526 { 527 $mybbgroups = 1; 528 } 529 else 530 { 531 $mybbgroups = $mybb->user['usergroup'].",".$mybb->user['additionalgroups']; 532 } 533 $mybb->usergroup = usergroup_permissions($mybbgroups); 534 535 $is_super_admin = false; 536 if(isset($mybb->user['uid'])) 537 { 538 $is_super_admin = is_super_admin($mybb->user['uid']); 539 } 540 541 if(empty($mybb->usergroup['cancp']) && !$is_super_admin || empty($mybb->user['uid'])) 542 { 543 $uid = 0; 544 if(isset($mybb->user['uid'])) 545 { 546 $uid = (int)$mybb->user['uid']; 547 } 548 $db->delete_query("adminsessions", "uid = '{$uid}'"); 549 unset($mybb->user); 550 my_unsetcookie('adminsid'); 551 if($mybb->get_input('do') == 'login') 552 { 553 $login_message = $lang->error_mybb_not_admin_account; 554 } 555 } 556 557 if(!empty($mybb->user['uid'])) 558 { 559 $query = $db->simple_select("adminoptions", "*", "uid='".$mybb->user['uid']."'"); 560 $admin_options = $db->fetch_array($query); 561 562 // Only update language / theme once fully authenticated 563 if(empty($admin_options['authsecret']) || $admin_session['authenticated'] == 1) 564 { 565 if(!empty($admin_options['cplanguage'])) 566 { 567 $cp_language = $admin_options['cplanguage']; 568 $lang->set_language($cp_language, "admin"); 569 $lang->load("global"); // Reload global language vars 570 $lang->load("messages", true); 571 } 572 573 if(!empty($admin_options['cpstyle']) && file_exists(MYBB_ADMIN_DIR."/styles/{$admin_options['cpstyle']}/main.css")) 574 { 575 $cp_style = $admin_options['cpstyle']; 576 } 577 } 578 579 // Update the session information in the DB 580 if($admin_session['sid']) 581 { 582 $db->update_query("adminsessions", array('lastactive' => TIME_NOW, 'ip' => $db->escape_binary(my_inet_pton(get_ip()))), "sid='".$db->escape_string($admin_session['sid'])."'"); 583 } 584 585 // Fetch administrator permissions 586 $mybb->admin['permissions'] = get_admin_permissions($mybb->user['uid']); 587 } 588 589 // Include the layout generation class overrides for this style 590 if(file_exists(MYBB_ADMIN_DIR."/styles/{$cp_style}/style.php")) 591 { 592 require_once MYBB_ADMIN_DIR."/styles/{$cp_style}/style.php"; 593 } 594 595 // Check if any of the layout generation classes we can override exist in the style file 596 $classes = array( 597 "Page" => "DefaultPage", 598 "SidebarItem" => "DefaultSidebarItem", 599 "PopupMenu" => "DefaultPopupMenu", 600 "Table" => "DefaultTable", 601 "Form" => "DefaultForm", 602 "FormContainer" => "DefaultFormContainer" 603 ); 604 foreach($classes as $style_name => $default_name) 605 { 606 // Style does not have this layout generation class, create it 607 if(!class_exists($style_name)) 608 { 609 eval("class {$style_name} extends {$default_name} { }"); 610 } 611 } 612 613 $page = new Page; 614 $page->style = $cp_style; 615 616 // Do not have a valid Admin user, throw back to login page. 617 if(!isset($mybb->user['uid']) || $logged_out == true) 618 { 619 if($logged_out == true) 620 { 621 $page->show_login($lang->success_logged_out); 622 } 623 elseif($fail_check == 1) 624 { 625 $page->show_login($login_lang_string, "error"); 626 } 627 else 628 { 629 // If we have this error while retreiving it from an AJAX request, then send back a nice error 630 if(isset($mybb->input['ajax']) && $mybb->input['ajax'] == 1) 631 { 632 echo json_encode(array("errors" => array("login"))); 633 exit; 634 } 635 $page->show_login($login_message, "error"); 636 } 637 } 638 639 // Time to check for Two-Factor Authentication 640 // First: are we trying to verify a code? 641 if($mybb->input['do'] == "do_2fa" && $mybb->request_method == "post") 642 { 643 // Test whether it's a recovery code 644 $recovery = false; 645 $codes = my_unserialize($admin_options['recovery_codes']); 646 if(!empty($codes) && in_array($mybb->get_input('code'), $codes)) 647 { 648 $recovery = true; 649 $ncodes = array_diff($codes, array($mybb->input['code'])); // Removes our current code from the codes array 650 $db->update_query("adminoptions", array("recovery_codes" => $db->escape_string(my_serialize($ncodes))), "uid='{$mybb->user['uid']}'"); 651 652 if(count($ncodes) == 0) 653 { 654 flash_message($lang->my2fa_no_codes, "error"); 655 } 656 } 657 658 // Validate the code 659 require_once MYBB_ROOT."inc/3rdparty/2fa/GoogleAuthenticator.php"; 660 $auth = new PHPGangsta_GoogleAuthenticator; 661 662 $test = $auth->verifyCode($admin_options['authsecret'], $mybb->get_input('code')); 663 664 // Either the code was okay or it was a recovery code 665 if($test === true || $recovery === true) 666 { 667 // Correct code -> session authenticated 668 $db->update_query("adminsessions", array("authenticated" => 1), "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); 669 $admin_session['authenticated'] = 1; 670 $db->update_query("adminoptions", array("loginattempts" => 0, "loginlockoutexpiry" => 0), "uid='{$mybb->user['uid']}'"); 671 my_setcookie('acploginattempts', 0); 672 admin_redirect("index.php"); 673 } 674 else 675 { 676 // Wrong code -> close session (aka logout) 677 $db->delete_query("adminsessions", "sid='".$db->escape_string($mybb->cookies['adminsid'])."'"); 678 my_unsetcookie('adminsid'); 679 680 // Now test whether we need to lock this guy completly 681 $db->update_query("adminoptions", array("loginattempts" => "loginattempts+1"), "uid='{$mybb->user['uid']}'", '', true); 682 683 $loginattempts = login_attempt_check_acp($mybb->user['uid'], true); 684 685 // Have we attempted too many times? 686 if($loginattempts !== false && $loginattempts['loginattempts'] > 0) 687 { 688 // Have we set an expiry yet? 689 if($loginattempts['loginlockoutexpiry'] == 0) 690 { 691 $db->update_query("adminoptions", array("loginlockoutexpiry" => TIME_NOW+((int)$mybb->settings['loginattemptstimeout']*60)), "uid='{$mybb->user['uid']}'"); 692 } 693 694 // Did we hit lockout for the first time? Send the unlock email to the administrator 695 if($loginattempts['loginattempts'] == $mybb->settings['maxloginattempts']) 696 { 697 $db->delete_query("awaitingactivation", "uid='{$mybb->user['uid']}' AND type='l'"); 698 $lockout_array = array( 699 "uid" => $mybb->user['uid'], 700 "dateline" => TIME_NOW, 701 "code" => random_str(30), 702 "type" => "l" 703 ); 704 $db->insert_query("awaitingactivation", $lockout_array); 705 706 $subject = $lang->sprintf($lang->locked_out_subject, $mybb->settings['bbname']); 707 $message = $lang->sprintf($lang->locked_out_message, htmlspecialchars_uni($mybb->user['username']), $mybb->settings['bbname'], $mybb->settings['maxloginattempts'], $mybb->settings['bburl'], $mybb->config['admin_dir'], $lockout_array['code'], $lockout_array['uid']); 708 my_mail($mybb->user['email'], $subject, $message); 709 } 710 711 log_admin_action(array( 712 'type' => 'admin_locked_out', 713 'uid' => $mybb->user['uid'], 714 'username' => $mybb->user['username'], 715 ) 716 ); 717 718 $page->show_lockedout(); 719 } 720 721 // Still here? Show a custom login page 722 $page->show_login($lang->my2fa_failed, "error"); 723 } 724 } 725 726 // Show our 2FA page 727 if(!empty($admin_options['authsecret']) && $admin_session['authenticated'] != 1) 728 { 729 $page->show_2fa(); 730 } 731 732 $page->add_breadcrumb_item($lang->home, "index.php"); 733 734 // Begin dealing with the modules 735 $modules_dir = MYBB_ADMIN_DIR."modules"; 736 $dir = opendir($modules_dir); 737 while(($module = readdir($dir)) !== false) 738 { 739 if(is_dir($modules_dir."/".$module) && !in_array($module, array(".", "..")) && file_exists($modules_dir."/".$module."/module_meta.php")) 740 { 741 require_once $modules_dir."/".$module."/module_meta.php"; 742 743 // Need to always load it for admin permissions / quick access 744 $lang->load($module."_module_meta", false, true); 745 746 $has_permission = false; 747 if(function_exists($module."_admin_permissions")) 748 { 749 if(isset($mybb->admin['permissions'][$module]) || $is_super_admin == true) 750 { 751 $has_permission = true; 752 } 753 } 754 // This module doesn't support permissions 755 else 756 { 757 $has_permission = true; 758 } 759 760 // Do we have permissions to run this module (Note: home is accessible by all) 761 if($module == "home" || $has_permission == true) 762 { 763 $meta_function = $module."_meta"; 764 $initialized = $meta_function(); 765 if($initialized == true) 766 { 767 $modules[$module] = 1; 768 } 769 } 770 else 771 { 772 $modules[$module] = 0; 773 } 774 } 775 } 776 777 $modules = $plugins->run_hooks("admin_tabs", $modules); 778 779 closedir($dir); 780 781 if(strpos($mybb->input['module'], "/") !== false) 782 { 783 $current_module = explode("/", $mybb->input['module'], 2); 784 } 785 else 786 { 787 $current_module = explode("-", $mybb->input['module'], 2); 788 } 789 790 if(!isset($current_module[1])) 791 { 792 $current_module[1] = 'home'; 793 } 794 795 if($mybb->input['module'] && isset($modules[$current_module[0]])) 796 { 797 $run_module = $current_module[0]; 798 } 799 else 800 { 801 $run_module = "home"; 802 } 803 804 $action_handler = $run_module."_action_handler"; 805 $action_file = $action_handler($current_module[1]); 806 807 // Set our POST validation code here 808 $mybb->post_code = generate_post_check(); 809 810 if($run_module != "home") 811 { 812 check_admin_permissions(array('module' => $page->active_module, 'action' => $page->active_action)); 813 } 814 815 // Only POST actions with a valid post code can modify information. Here we check if the incoming request is a POST and if that key is valid. 816 $post_check_ignores = array( 817 "example/page" => array("action") 818 ); // An array of modules/actions to ignore POST checks for. 819 820 if($mybb->request_method == "post") 821 { 822 if(in_array($mybb->input['module'], $post_check_ignores)) 823 { 824 $k = array_search($mybb->input['module'], $post_check_ignores); 825 if(in_array($mybb->input['action'], $post_check_ignores[$k])) 826 { 827 $post_verify = false; 828 } 829 } 830 831 if($post_verify == true) 832 { 833 // If the post key does not match we switch the action to GET and set a message to show the user 834 if(!verify_post_check($mybb->get_input('my_post_key'), true)) 835 { 836 $mybb->request_method = "get"; 837 $page->show_post_verify_error = true; 838 } 839 } 840 } 841 842 $lang->load("{$run_module}_{$page->active_action}", false, true); 843 844 $plugins->run_hooks("admin_load"); 845 846 require $modules_dir."/".$run_module."/".$action_file; 847
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
| 2005 - 2021 © MyBB.de | Alle Rechte vorbehalten! | Sponsor: netcup | Cross-referenced by PHPXref |