Skip to content

Commit 39dd4ec

Browse files
author
Till Brehm
committed
- Added functions client_get_emailcontact and client_login_get to remote api.
- Add option to _get functions of the remote-api to return all records when primaryID = -1 - Fixed permission problem in _get functions of remote api. - Fixed typo in german dashboard language file.
1 parent add2800 commit 39dd4ec

File tree

4 files changed

+152
-3
lines changed

4 files changed

+152
-3
lines changed

‎interface/lib/classes/remote.d/client.inc.php‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,27 @@ public function client_get_id($session_id, $sys_userid)
113113
}
114114

115115
}
116+
117+
//* Get the contact details to send a email like email address, name, etc.
118+
public function client_get_emailcontact($session_id, $client_id) {
119+
global $app;
120+
121+
if(!$this->checkPerm($session_id, 'client_get_emailcontact')) {
122+
throw new SoapFault('permission_denied', 'You do not have the permissions to access this function.');
123+
return false;
124+
}
125+
126+
$client_id = $app->functions->intval($client_id);
127+
128+
$rec = $app->db->queryOneRecord("SELECT company_name,contact_name,gender,email,language FROM client WHERE client_id = ".$client_id);
129+
130+
if(is_array($rec)) {
131+
return $rec;
132+
} else {
133+
throw new SoapFault('no_client_found', 'There is no client with this client ID.');
134+
return false;
135+
}
136+
}
116137

117138
public function client_get_groupid($session_id, $client_id)
118139
{
@@ -489,6 +510,123 @@ public function client_templates_get_all($session_id) {
489510
$result = $app->db->queryAllRecords($sql);
490511
return $result;
491512
}
513+
514+
public function client_login_get($session_id,$username,$password,$remote_ip = '') {
515+
global $app;
516+
517+
//* Check permissions
518+
if(!$this->checkPerm($session_id, 'client_get')) {
519+
throw new SoapFault('permission_denied', 'You do not have the permissions to access this function.');
520+
return false;
521+
}
522+
523+
//* Check username and password
524+
if(!preg_match("/^[\w\.\-\_\@]{1,128}$/", $username)) {
525+
throw new SoapFault('user_regex_error', 'Username contains invalid characters.');
526+
return false;
527+
}
528+
if(!preg_match("/^.{1,64}$/i", $password)) {
529+
throw new SoapFault('password_length_error', 'Invalid password length or no password provided.');
530+
return false;
531+
}
532+
533+
//* Check failed logins
534+
$sql = "SELECT * FROM `attempts_login` WHERE `ip`= '".$app->db->quote($remote_ip)."' AND `login_time` > (NOW() - INTERVAL 1 MINUTE) LIMIT 1";
535+
$alreadyfailed = $app->db->queryOneRecord($sql);
536+
537+
//* too many failedlogins
538+
if($alreadyfailed['times'] > 5) {
539+
throw new SoapFault('error_user_too_many_logins', 'Too many failed logins.');
540+
return false;
541+
}
542+
543+
544+
//*Set variables
545+
$returnval == false;
546+
547+
if(strstr($username,'@')) {
548+
// Check against client table
549+
$sql = "SELECT * FROM client WHERE email = '".$app->db->quote($username)."'";
550+
$user = $app->db->queryOneRecord($sql);
551+
552+
if($user) {
553+
$saved_password = stripslashes($user['password']);
554+
555+
if(substr($saved_password, 0, 3) == '$1$') {
556+
//* The password is crypt-md5 encrypted
557+
$salt = '$1$'.substr($saved_password, 3, 8).'$';
558+
559+
if(crypt(stripslashes($password), $salt) != $saved_password) {
560+
$user = false;
561+
}
562+
} else {
563+
564+
//* The password is md5 encrypted
565+
if(md5($password) != $saved_password) {
566+
$user = false;
567+
}
568+
}
569+
}
570+
571+
if(is_array($user)) {
572+
$returnval = array( 'username' => $user['username'],
573+
'type' => 'user',
574+
'client_id' => $user['client_id'],
575+
'language' => $user['language'],
576+
'country' => $user['country']);
577+
}
578+
579+
} else {
580+
// Check against sys_user table
581+
$sql = "SELECT * FROM sys_user WHERE username = '".$app->db->quote($username)."'";
582+
$user = $app->db->queryOneRecord($sql);
583+
584+
if($user) {
585+
$saved_password = stripslashes($user['passwort']);
586+
587+
if(substr($saved_password, 0, 3) == '$1$') {
588+
//* The password is crypt-md5 encrypted
589+
$salt = '$1$'.substr($saved_password, 3, 8).'$';
590+
591+
if(crypt(stripslashes($password), $salt) != $saved_password) {
592+
$user = false;
593+
}
594+
} else {
595+
596+
//* The password is md5 encrypted
597+
if(md5($password) != $saved_password) {
598+
$user = false;
599+
}
600+
}
601+
}
602+
603+
if(is_array($user)) {
604+
$returnval = array( 'username' => $user['username'],
605+
'type' => $user['typ'],
606+
'client_id' => $user['client_id'],
607+
'language' => $user['language'],
608+
'country' => 'de');
609+
} else {
610+
throw new SoapFault('login_failed', 'Login failed.');
611+
}
612+
}
613+
614+
//* Log failed login attempts
615+
if($user === false) {
616+
$time = time();
617+
if(!$alreadyfailed['times'] ) {
618+
//* user login the first time wrong
619+
$sql = "INSERT INTO `attempts_login` (`ip`, `times`, `login_time`) VALUES ('".$app->db->quote($remote_ip)."', 1, NOW())";
620+
$app->db->query($sql);
621+
} elseif($alreadyfailed['times'] >= 1) {
622+
//* update times wrong
623+
$sql = "UPDATE `attempts_login` SET `times`=`times`+1, `login_time`=NOW() WHERE `login_time` >= '".$time."' LIMIT 1";
624+
$app->db->query($sql);
625+
}
626+
}
627+
628+
return $returnval;
629+
}
492630

493631
}
494632

‎interface/lib/classes/remoting_lib.inc.php‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,8 +233,19 @@ function getDeleteSQL($primary_id) {
233233
function getDataRecord($primary_id) {
234234
global $app;
235235
$escape = '`';
236+
$this->loadUserProfile();
236237
if(@is_numeric($primary_id)) {
237-
return parent::getDataRecord($primary_id);
238+
if($primary_id > 0) {
239+
// Return a single record
240+
return parent::getDataRecord($primary_id);
241+
} elseif($primary_id == -1) {
242+
// Return a array with all records
243+
$sql = "SELECT * FROM ".$escape.$this->formDef['db_table'].$escape;
244+
return $app->db->queryAllRecords($sql);
245+
} else {
246+
throw new SoapFault('invalid_id', 'The ID has to be > 0 or -1.');
247+
return array();
248+
}
238249
} elseif (@is_array($primary_id) || @is_object($primary_id)) {
239250
if(@is_object($primary_id)) $primary_id = get_object_vars($primary_id); // do not use cast (array)xxx because it returns private and protected properties!
240251
$sql_offset = 0;

‎interface/web/client/lib/remote.conf.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22

3-
$function_list['client_get_all,client_get,client_add,client_update,client_delete,client_get_sites_by_user,client_get_by_username,client_change_password,client_get_id,client_delete_everything'] = 'Client functions';
3+
$function_list['client_get_all,client_get,client_add,client_update,client_delete,client_get_sites_by_user,client_get_by_username,client_change_password,client_get_id,client_delete_everything,client_get_emailcontact'] = 'Client functions';
44
$function_list['domains_domain_get,domains_domain_add,domains_domain_delete,domains_get_all_by_user'] = 'Domaintool functions';
55
$function_list['quota_get_by_user,mailquota_get_by_user'] = 'Quota functions';
66

‎interface/web/dashboard/lib/lang/de.lng‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
<?php
2-
$wb['welcome_user_txt'] = 'Herzlich Willkommen %s';
2+
$wb['welcome_user_txt'] = 'Herzlich willkommen %s';
33
$wb['available_modules_txt'] = 'Verfügbare Module';
44
?>

0 commit comments

Comments
 (0)