Skip to content

Commit 480b97a

Browse files
mladenbmladenb
committed
Refactor process_login_request 8: Extract method validate_and_fetch_user().
1 parent c25dbd5 commit 480b97a

File tree

1 file changed

+78
-62
lines changed

1 file changed

+78
-62
lines changed

‎interface/web/login/index.php‎

Lines changed: 78 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -95,68 +95,7 @@ function process_login_request(app $app, &$error, $conf, $module)
9595
return;
9696
}
9797

98-
if ($loginAs) {
99-
$sql = "SELECT * FROM sys_user WHERE USERNAME = ? and PASSWORT = ?";
100-
$user = $app->db->queryOneRecord($sql, (string)$username, (string)$password);
101-
} else {
102-
if (stristr($username, '@')) {
103-
//* mailuser login
104-
$sql = "SELECT * FROM mail_user WHERE login = ? or email = ?";
105-
$mailuser = $app->db->queryOneRecord($sql, (string)$username, $app->functions->idn_encode($username));
106-
$user = false;
107-
if ($mailuser) {
108-
$saved_password = stripslashes($mailuser['password']);
109-
//* Check if mailuser password is correct
110-
if (crypt(stripslashes($password), $saved_password) == $saved_password) {
111-
//* Get the sys_user language of the client of the mailuser
112-
$sys_user_lang = $app->db->queryOneRecord("SELECT language FROM sys_user WHERE default_group = ?", $mailuser['sys_groupid']);
113-
114-
//* we build a fake user here which has access to the mailuser module only and userid 0
115-
$user = array();
116-
$user['userid'] = 0;
117-
$user['active'] = 1;
118-
$user['startmodule'] = 'mailuser';
119-
$user['modules'] = 'mailuser';
120-
$user['typ'] = 'user';
121-
$user['email'] = $mailuser['email'];
122-
$user['username'] = $username;
123-
if (is_array($sys_user_lang) && $sys_user_lang['language'] != '') {
124-
$user['language'] = $sys_user_lang['language'];
125-
} else {
126-
$user['language'] = $conf['language'];
127-
}
128-
$user['theme'] = $conf['theme'];
129-
$user['app_theme'] = $conf['theme'];
130-
$user['mailuser_id'] = $mailuser['mailuser_id'];
131-
$user['default_group'] = $mailuser['sys_groupid'];
132-
}
133-
}
134-
} else {
135-
//* normal cp user login
136-
$sql = "SELECT * FROM sys_user WHERE USERNAME = ?";
137-
$user = $app->db->queryOneRecord($sql, (string)$username);
138-
if ($user) {
139-
$saved_password = stripslashes($user['passwort']);
140-
if (substr($saved_password, 0, 1) == '$') {
141-
//* The password is encrypted with crypt
142-
if (crypt(stripslashes($password), $saved_password) != $saved_password) {
143-
$user = false;
144-
}
145-
} else {
146-
//* The password is md5 encrypted
147-
if (md5($password) != $saved_password) {
148-
$user = false;
149-
} else {
150-
// update password with secure algo
151-
$sql = 'UPDATE `sys_user` SET `passwort` = ? WHERE `username` = ?';
152-
$app->db->query($sql, $app->auth->crypt_password($password), (string)$username);
153-
}
154-
}
155-
} else {
156-
$user = false;
157-
}
158-
}
159-
}
98+
$user = validate_and_fetch_user($app, $username, $password, $loginAs, $conf);
16099

161100
if ($user) {
162101
if ($user['active'] == 1) {
@@ -250,6 +189,83 @@ function process_login_request(app $app, &$error, $conf, $module)
250189
}
251190
}
252191

192+
/**
193+
* Validates user credentials and fetches the user if validation succeeded
194+
* @param app $app
195+
* @param $username
196+
* @param $password
197+
* @param $loginAs
198+
* @param $conf
199+
* @return array | bool
200+
*/
201+
function validate_and_fetch_user(app $app, $username, $password, $loginAs, $conf)
202+
{
203+
if ($loginAs) {
204+
$sql = "SELECT * FROM sys_user WHERE USERNAME = ? and PASSWORT = ?";
205+
$user = $app->db->queryOneRecord($sql, (string)$username, (string)$password);
206+
} else {
207+
if (stristr($username, '@')) {
208+
//* mailuser login
209+
$sql = "SELECT * FROM mail_user WHERE login = ? or email = ?";
210+
$mailuser = $app->db->queryOneRecord($sql, (string)$username, $app->functions->idn_encode($username));
211+
$user = false;
212+
if ($mailuser) {
213+
$saved_password = stripslashes($mailuser['password']);
214+
//* Check if mailuser password is correct
215+
if (crypt(stripslashes($password), $saved_password) == $saved_password) {
216+
//* Get the sys_user language of the client of the mailuser
217+
$sys_user_lang = $app->db->queryOneRecord("SELECT language FROM sys_user WHERE default_group = ?", $mailuser['sys_groupid']);
218+
219+
//* we build a fake user here which has access to the mailuser module only and userid 0
220+
$user = array();
221+
$user['userid'] = 0;
222+
$user['active'] = 1;
223+
$user['startmodule'] = 'mailuser';
224+
$user['modules'] = 'mailuser';
225+
$user['typ'] = 'user';
226+
$user['email'] = $mailuser['email'];
227+
$user['username'] = $username;
228+
if (is_array($sys_user_lang) && $sys_user_lang['language'] != '') {
229+
$user['language'] = $sys_user_lang['language'];
230+
} else {
231+
$user['language'] = $conf['language'];
232+
}
233+
$user['theme'] = $conf['theme'];
234+
$user['app_theme'] = $conf['theme'];
235+
$user['mailuser_id'] = $mailuser['mailuser_id'];
236+
$user['default_group'] = $mailuser['sys_groupid'];
237+
}
238+
}
239+
} else {
240+
//* normal cp user login
241+
$sql = "SELECT * FROM sys_user WHERE USERNAME = ?";
242+
$user = $app->db->queryOneRecord($sql, (string)$username);
243+
if ($user) {
244+
$saved_password = stripslashes($user['passwort']);
245+
if (substr($saved_password, 0, 1) == '$') {
246+
//* The password is encrypted with crypt
247+
if (crypt(stripslashes($password), $saved_password) != $saved_password) {
248+
$user = false;
249+
}
250+
} else {
251+
//* The password is md5 encrypted
252+
if (md5($password) != $saved_password) {
253+
$user = false;
254+
} else {
255+
// update password with secure algo
256+
$sql = 'UPDATE `sys_user` SET `passwort` = ? WHERE `username` = ?';
257+
$app->db->query($sql, $app->auth->crypt_password($password), (string)$username);
258+
}
259+
}
260+
} else {
261+
$user = false;
262+
}
263+
}
264+
}
265+
266+
return $user;
267+
}
268+
253269
/**
254270
* Checks if there is a "login as" instead of a "normal" login
255271
* @param app $app

0 commit comments

Comments
 (0)