From 29ed335dfc3b57c6b5ee8ade2ea5cbdc8fa7d47c Mon Sep 17 00:00:00 2001 From: Jason Woofenden Date: Thu, 17 Nov 2011 18:05:49 -0500 Subject: [PATCH 1/1] add admin page to edit logins --- admin.html | 2 + admin_admins.html | 68 ++++++++++++++++++++++++++++++++ admin_admins.php | 114 +++++++++++++++++++++++++++++++++++++++++++++++++++++ admin_admins.sql | 8 ++++ admin_login.php | 22 +++++++---- code/config.php | 7 +--- 6 files changed, 207 insertions(+), 14 deletions(-) create mode 100644 admin_admins.html create mode 100644 admin_admins.php create mode 100644 admin_admins.sql diff --git a/admin.html b/admin.html index 03b31a3..c60e53f 100644 --- a/admin.html +++ b/admin.html @@ -15,6 +15,8 @@

Manage (downloadable) files

+

Manage administrators (passwords, etc.)

+

Log out

diff --git a/admin_admins.html b/admin_admins.html new file mode 100644 index 0000000..bf378e9 --- /dev/null +++ b/admin_admins.html @@ -0,0 +1,68 @@ + + + + + + <!--~$title show {~-->Accounts<!--~}~--> + + + + + + + +

Add a new accountEdit account "~username html~"

+ +
+ +
Name (optional)
+
+ +
Username (required)
+
This is used to log in, and is case sensitive, so you may want to stick with all lowercase
+
+ +
Password (case sensitive)
+
To disable this account, make this password blank.
+
Below you'll see only the encrypted version of the password. This is the only thing that's stored on the server, so if somebody has forgotten their password, the only thing that can be done about it is setting a new password using this field. If you do not edit this field, their password is unchanged.
+
+ +
Role
+
+ +
 
+
+ +
+ +
 
+
CancelCancel
+ + + +

Accounts Listing

+ + +

[Add a new account]

+ + + + + + + + + + +
NameUsernameRole 
~name html~(blank)~username html~(blank)~privs html~(blank)[delete this account]
+ + +

No accounts in database.

+ + +

[Add a new account]

+ + + + + diff --git a/admin_admins.php b/admin_admins.php new file mode 100644 index 0000000..acef408 --- /dev/null +++ b/admin_admins.php @@ -0,0 +1,114 @@ + session_generate_key() # [a-zA-Z0-9]{16} + ); + } + + tem_set('form', $data); +} diff --git a/admin_admins.sql b/admin_admins.sql new file mode 100644 index 0000000..0d52050 --- /dev/null +++ b/admin_admins.sql @@ -0,0 +1,8 @@ +drop table if exists admins; +create table admins ( + id int unique auto_increment, + name varchar(100) not null default "", + username varchar(50) not null default "", + password varchar(50) not null default "", + privs varchar(100) not null default "" +); diff --git a/admin_login.php b/admin_login.php index 92d3ab6..b0a89c4 100644 --- a/admin_login.php +++ b/admin_login.php @@ -7,7 +7,7 @@ function admin_login_get_fields() { $data['url'] = format_oneline($_REQUEST['url']); $data['username'] = format_oneline($_REQUEST['username']); - $data['password'] = format_oneline($_REQUEST['password']); + $data['password'] = sha1(format_oneline($_REQUEST['password'])); return $data; } @@ -18,14 +18,20 @@ function admin_login_main() { $data = admin_login_get_fields(); if(strlen($data['username'])) { - if($data['username'] == CMS_ADMIN_USER && - sha1($data['password']) == CMS_ADMIN_PASS) { + $row = db_get_assoc('admins', 'privs', 'where username=%" && password=%"', $data['username'], $data['password']); + if($row) { session_new(); - session_set('auth_username', $username); - session_set('auth_admin', 'yes'); - require_once('code/wfpl/http.php'); + session_set('auth_username', $data['username']); + switch($row['privs']) { + case 'admin': + session_set('auth_admin', 'yes'); + if(!$data['url']) { + $data['url'] = 'admin'; + } + break; + } if(!$data['url']) { - $data['url'] = './admin'; + $data['url'] = './'; } elseif(strpos(':', $data['url']) !== false) { $data['url'] = "./$data[url]"; } @@ -37,7 +43,7 @@ function admin_login_main() { } } - # Don't put (even failed) password back into the form + # make sure the hashed password doesn't make it back to the front end $data['password'] = ''; # display the form [again] diff --git a/code/config.php b/code/config.php index 39900ee..9ab25ea 100644 --- a/code/config.php +++ b/code/config.php @@ -3,12 +3,7 @@ define('WFPL_DB', 'fixme'); define('WFPL_DB_USER', 'fixme'); define('WFPL_DB_PASS', 'fixme'); -define('CMS_ADMIN_USER', 'fixme'); -define('CMS_ADMIN_PASS', '98fd71615b073b75810f4ed40d4538198c6450cc'); -# To change the cms admin password to "secret" run this command: -# echo '