Skip to content

Commit 5c49702

Browse files
author
vogelor
committed
It is now possible to "login as" as admin from the user-list
It is now possible to redirect to a different url as result of the loadContent AJAX function
1 parent 9f6339a commit 5c49702

File tree

7 files changed

+153
-9
lines changed

7 files changed

+153
-9
lines changed

interface/web/admin/login_as.php

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
<?php
2+
/*
3+
Copyright (c) 2008, Till Brehm, projektfarm Gmbh and Oliver Vogel www.muv.com
4+
All rights reserved.
5+
6+
Redistribution and use in source and binary forms, with or without modification,
7+
are permitted provided that the following conditions are met:
8+
9+
* Redistributions of source code must retain the above copyright notice,
10+
this list of conditions and the following disclaimer.
11+
* Redistributions in binary form must reproduce the above copyright notice,
12+
this list of conditions and the following disclaimer in the documentation
13+
and/or other materials provided with the distribution.
14+
* Neither the name of ISPConfig nor the names of its contributors
15+
may be used to endorse or promote products derived from this software without
16+
specific prior written permission.
17+
18+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
19+
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20+
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21+
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
22+
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
23+
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
25+
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
26+
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
27+
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28+
*/
29+
30+
31+
require_once('../../lib/config.inc.php');
32+
require_once('../../lib/app.inc.php');
33+
34+
/* Check permissions for module */
35+
$app->auth->check_module_permissions('admin');
36+
37+
/* for security reasons ONLY the admin can login as other user */
38+
if ($_SESSION["s"]["user"]["typ"] != 'admin') {
39+
die ("You don't have the right to login as other user!");
40+
}
41+
42+
/* get the id of the user (must be int!) */
43+
if (!isset($_GET['id'])){
44+
die ("No user selected!");
45+
}
46+
$userId = intval($_GET['id']);
47+
48+
/*
49+
* Get the data to login as user x
50+
*/
51+
$dbData = $app->db->queryOneRecord(
52+
"SELECT username, passwort FROM sys_user WHERE userid = " . $userId);
53+
54+
/*
55+
* Now generate the login-Form
56+
*/
57+
echo '
58+
<br /> <br /> <br /> <br />
59+
Do you want to login as user ' . $dbData['username'] . '?<br />
60+
If you do so, you can "go back" by clicking at logout.<br />
61+
<div style="visibility:hidden">
62+
<input type="text" name="username" value="' . $dbData['username'] . '" />
63+
<input type="password" name="passwort" value="' . $dbData['passwort'] .'" />
64+
</div>
65+
<input type="hidden" name="s_mod" value="login" />
66+
<input type="hidden" name="s_pg" value="index" />
67+
<div class="wf_actions buttons">
68+
<button class="positive iconstxt icoPositive" type="button" value="Yes, login as Client" onClick="submitLoginForm(' . "'pageForm'" . ');"><span>Yes, login as Client</span></button>
69+
<button class="negative iconstxt icoNegative" type="button" value="No, back to list" onClick="loadContent('. "'admin/users_list.php'" . ');"><span>No, back to list</span></button>
70+
</div>
71+
';
72+
?>

interface/web/admin/templates/users_list.htm

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ <h2><tmpl_var name="list_head_txt"></h2>
4040
<td class="tbl_col_ort"><a href="#" onClick="loadContent('admin/users_edit.php?id={tmpl_var name='id'}');">{tmpl_var name="ort"}</a></td>
4141
<td class="tbl_col_buttons">
4242
<div class="buttons icons16">
43+
<a class="icons16 icoLoginAs" href="#" onclick="loadContent('/admin/login_as.php?id={tmpl_var name='id'}');"><span>{tmpl_var name='login_as_txt'}</span></a>
4344
<a class="icons16 icoDelete" href="javascript: del_record('admin/users_del.php?id={tmpl_var name='id'}&phpsessid={tmpl_var name='phpsessid'}','{tmpl_var name='delete_confirmation'}');"><span>{tmpl_var name='delete_txt'}</span></a>
4445
</div>
4546
</td>

interface/web/js/scrigo.js.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,9 +159,12 @@ function submitUploadForm(formname,target) {
159159
function loadContent(pagename) {
160160
var pageContentCallback2 = {
161161
success: function(o) {
162-
if(o.responseText.indexOf('HEADER_REDIRECT:') > -1) {
162+
if(o.responseText.indexOf('HEADER_REDIRECT:') > -1) {
163163
var parts = o.responseText.split(':');
164164
loadContent(parts[1]);
165+
} else if (o.responseText.indexOf('URL_REDIRECT:') > -1) {
166+
var newUrl= o.responseText.substr(o.responseText.indexOf('URL_REDIRECT:') + "URL_REDIRECT:".length);
167+
document.location.href = newUrl;
165168
} else {
166169
document.getElementById('pageContent').innerHTML = o.responseText;
167170
}

interface/web/login/index.php

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,11 @@ public function render() {
4141

4242
global $app, $conf;
4343

44-
if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
45-
die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
44+
/* Redirect to page, if login form was NOT send */
45+
if(count($_POST) == 0) {
46+
if(isset($_SESSION['s']['user']) && is_array($_SESSION['s']['user']) && is_array($_SESSION['s']['module'])) {
47+
die('HEADER_REDIRECT:'.$_SESSION['s']['module']['startpage']);
48+
}
4649
}
4750

4851
$app->uses('tpl');
@@ -60,22 +63,57 @@ public function render() {
6063
$passwort = $app->db->quote($_POST['passwort']);
6164

6265
if($username != '' and $passwort != '') {
66+
/*
67+
* Check, if there is a "login as" instead of a "normal" login
68+
*/
69+
if (isset($_SESSION['s']['user'])){
70+
/*
71+
* only the admin can "login as" so if the user is NOT a admin, we
72+
* open the startpage (after killing the old session), so the user
73+
* is logout and has to start again!
74+
*/
75+
if ($_SESSION['s']['user']['typ'] != 'admin') {
76+
/*
77+
* The actual user is NOT a admin, but maybe the admin
78+
* has logged in as "normal" user bevore...
79+
*/
80+
if (isset($_SESSION['s_old'])&& ($_SESSION['s_old']['user']['typ'] == 'admin')){
81+
/* The "old" user is admin, so everything is ok */
82+
}
83+
else {
84+
die("You don't have the right to 'login as'!");
85+
}
86+
}
87+
$loginAs = true;
88+
}
89+
else {
90+
/* normal login */
91+
$loginAs = false;
92+
}
93+
6394
//* Check if there already wrong logins
6495
$sql = "SELECT * FROM `attempts_login` WHERE `ip`= '{$ip}' AND `login_time` < NOW() + INTERVAL 15 MINUTE LIMIT 1";
6596
$alreadyfailed = $app->db->queryOneRecord($sql);
6697
//* login to much wrong
6798
if($alreadyfailed['times'] > 5) {
6899
$error = $app->lng(1004);
69100
} else {
70-
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
101+
if ($loginAs){
102+
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and PASSWORT = '". $passwort. "'";
103+
}
104+
else {
105+
$sql = "SELECT * FROM sys_user WHERE USERNAME = '$username' and ( PASSWORT = '".md5($passwort)."' or PASSWORT = password('$passwort') )";
106+
}
71107
$user = $app->db->queryOneRecord($sql);
72108
if($user) {
73109
if($user['active'] == 1) {
74110
// User login right, so attempts can be deleted
75111
$sql = "DELETE FROM `attempts_login` WHERE `ip`='{$ip}'";
76112
$app->db->query($sql);
77113
$user = $app->db->toLower($user);
114+
if ($loginAs) $oldSession = $_SESSION['s_old'];
78115
$_SESSION = array();
116+
if ($loginAs) $_SESSION['s_old'] = $oldSession; // keep the way back!
79117
$_SESSION['s']['user'] = $user;
80118
$_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
81119
$_SESSION['s']['language'] = $user['language'];

interface/web/login/logout.php

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,19 +30,48 @@
3030
require_once('../../lib/config.inc.php');
3131
require_once('../../lib/app.inc.php');
3232

33+
/*
34+
* Check if the logout is forced
35+
*/
36+
$forceLogout = false;
37+
if (isset($_GET['l']) && ($_GET['l']== 1)) $forceLogout = true;
38+
39+
/*
40+
* if the admin is logged in as client, then ask, if the admin want't to
41+
* "re-login" as admin again
42+
*/
43+
if ((isset($_SESSION['s_old']) && ($_SESSION['s_old']['user']['typ'] == 'admin')) &&
44+
(!$forceLogout)){
45+
echo '
46+
<br /> <br /> <br /> <br />
47+
Do you want to re-login as admin or log out?<br />
48+
<div style="visibility:hidden">
49+
<input type="text" name="username" value="' . $_SESSION['s_old']['user']['username'] . '" />
50+
<input type="password" name="passwort" value="' . $_SESSION['s_old']['user']['passwort'] .'" />
51+
</div>
52+
<input type="hidden" name="s_mod" value="login" />
53+
<input type="hidden" name="s_pg" value="index" />
54+
<div class="wf_actions buttons">
55+
<button class="positive iconstxt icoPositive" type="button" value="Yes, re-login as Admin" onClick="submitLoginForm(' . "'pageForm'" . ');"><span>Yes, re-login as Admin</span></button>
56+
<button class="negative iconstxt icoNegative" type="button" value="No, logout" onClick="loadContent('. "'login/logout.php?l=1'" . ');"><span>No, logout</span></button>
57+
</div>
58+
';
59+
exit;
60+
}
61+
3362
$_SESSION["s"]["user"] = null;
3463
$_SESSION["s"]["module"] = null;
64+
$_SESSION['s_old'] = null;
3565

3666
//header("Location: ../index.php?phpsessid=".$_SESSION["s"]["id"]);
3767

38-
3968
if($_SESSION["s"]["site"]["logout"] != '') {
40-
header("Location: ".$_SESSION["s"]["site"]["logout"]);
69+
echo('URL_REDIRECT:'.$_SESSION["s"]["site"]["logout"]);
4170
} else {
4271
if($conf["interface_logout_url"] != '') {
43-
header("Location: ".$conf["interface_logout_url"]);
72+
echo('URL_REDIRECT:'.$conf["interface_logout_url"]);
4473
} else {
45-
header("Location: ../index.php");
74+
echo('URL_REDIRECT:../index.php');
4675
}
4776
}
4877
exit;

interface/web/themes/default/css/screen/content_ispc.css

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,5 +288,6 @@
288288
.icons16.icoFilter { background-image: url(../../icons/x16/funnel.png); }
289289
.icons16.icoEdit { background-image: url("../../icons/x16/wrench.png"); }
290290
.icons16.icoDbAdmin { background-image: url("../../icons/x16/database.png"); }
291+
.icons16.icoLoginAs { background-image: url("../../icons/x16/user_go.png"); }
291292
}
292293

interface/web/themes/default/templates/main.tpl.htm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
<a class="skip" href="#navigation" title="skip link">Skip to the navigation</a><span class="hideme">.</span>
2323
<a class="skip" href="#content" title="skip link">Skip to the content</a><span class="hideme">.</span>
2424
<!-- end: skip link navigation -->
25-
<span><a href="login/logout.php">Logout</a> | <a href="#" onclick="capp('help')">Help</a><!-- | <a href="#">Imprint</a>--></span>
25+
<span><a href="#" onclick="loadContent('login/logout.php');">Logout</a> | <a href="#" onclick="capp('help')">Help</a><!-- | <a href="#">Imprint</a>--></span>
2626
</div>
2727
<h1 id="ir-HeaderLogo" class="swap"><span>ISPConfig 3</span></h1>
2828
<span>hosting control panel</span>

0 commit comments

Comments
 (0)