Skip to content

Commit c25dbd5

Browse files
mladenbmladenb
committed
Refactor process_login_request 7: Unwrap else.
1 parent 21e99c1 commit c25dbd5

File tree

1 file changed

+136
-136
lines changed

1 file changed

+136
-136
lines changed

‎interface/web/login/index.php‎

Lines changed: 136 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -93,160 +93,160 @@ function process_login_request(app $app, &$error, $conf, $module)
9393
if ($alreadyfailed['times'] > 5) {
9494
$error = $app->lng('error_user_too_many_logins');
9595
return;
96+
}
97+
98+
if ($loginAs) {
99+
$sql = "SELECT * FROM sys_user WHERE USERNAME = ? and PASSWORT = ?";
100+
$user = $app->db->queryOneRecord($sql, (string)$username, (string)$password);
96101
} else {
97-
if ($loginAs) {
98-
$sql = "SELECT * FROM sys_user WHERE USERNAME = ? and PASSWORT = ?";
99-
$user = $app->db->queryOneRecord($sql, (string)$username, (string)$password);
100-
} else {
101-
if (stristr($username, '@')) {
102-
//* mailuser login
103-
$sql = "SELECT * FROM mail_user WHERE login = ? or email = ?";
104-
$mailuser = $app->db->queryOneRecord($sql, (string)$username, $app->functions->idn_encode($username));
105-
$user = false;
106-
if ($mailuser) {
107-
$saved_password = stripslashes($mailuser['password']);
108-
//* Check if mailuser password is correct
109-
if (crypt(stripslashes($password), $saved_password) == $saved_password) {
110-
//* Get the sys_user language of the client of the mailuser
111-
$sys_user_lang = $app->db->queryOneRecord("SELECT language FROM sys_user WHERE default_group = ?", $mailuser['sys_groupid']);
112-
113-
//* we build a fake user here which has access to the mailuser module only and userid 0
114-
$user = array();
115-
$user['userid'] = 0;
116-
$user['active'] = 1;
117-
$user['startmodule'] = 'mailuser';
118-
$user['modules'] = 'mailuser';
119-
$user['typ'] = 'user';
120-
$user['email'] = $mailuser['email'];
121-
$user['username'] = $username;
122-
if (is_array($sys_user_lang) && $sys_user_lang['language'] != '') {
123-
$user['language'] = $sys_user_lang['language'];
124-
} else {
125-
$user['language'] = $conf['language'];
126-
}
127-
$user['theme'] = $conf['theme'];
128-
$user['app_theme'] = $conf['theme'];
129-
$user['mailuser_id'] = $mailuser['mailuser_id'];
130-
$user['default_group'] = $mailuser['sys_groupid'];
102+
if (stristr($username, '@')) {
103+
//* mailuser login
104+
$sql = "SELECT * FROM mail_user WHERE login = ? or email = ?";
105+
$mailuser = $app->db->queryOneRecord($sql, (string)$username, $app->functions->idn_encode($username));
106+
$user = false;
107+
if ($mailuser) {
108+
$saved_password = stripslashes($mailuser['password']);
109+
//* Check if mailuser password is correct
110+
if (crypt(stripslashes($password), $saved_password) == $saved_password) {
111+
//* Get the sys_user language of the client of the mailuser
112+
$sys_user_lang = $app->db->queryOneRecord("SELECT language FROM sys_user WHERE default_group = ?", $mailuser['sys_groupid']);
113+
114+
//* we build a fake user here which has access to the mailuser module only and userid 0
115+
$user = array();
116+
$user['userid'] = 0;
117+
$user['active'] = 1;
118+
$user['startmodule'] = 'mailuser';
119+
$user['modules'] = 'mailuser';
120+
$user['typ'] = 'user';
121+
$user['email'] = $mailuser['email'];
122+
$user['username'] = $username;
123+
if (is_array($sys_user_lang) && $sys_user_lang['language'] != '') {
124+
$user['language'] = $sys_user_lang['language'];
125+
} else {
126+
$user['language'] = $conf['language'];
131127
}
128+
$user['theme'] = $conf['theme'];
129+
$user['app_theme'] = $conf['theme'];
130+
$user['mailuser_id'] = $mailuser['mailuser_id'];
131+
$user['default_group'] = $mailuser['sys_groupid'];
132132
}
133-
} else {
134-
//* normal cp user login
135-
$sql = "SELECT * FROM sys_user WHERE USERNAME = ?";
136-
$user = $app->db->queryOneRecord($sql, (string)$username);
137-
if ($user) {
138-
$saved_password = stripslashes($user['passwort']);
139-
if (substr($saved_password, 0, 1) == '$') {
140-
//* The password is encrypted with crypt
141-
if (crypt(stripslashes($password), $saved_password) != $saved_password) {
142-
$user = false;
143-
}
144-
} else {
145-
//* The password is md5 encrypted
146-
if (md5($password) != $saved_password) {
147-
$user = false;
148-
} else {
149-
// update password with secure algo
150-
$sql = 'UPDATE `sys_user` SET `passwort` = ? WHERE `username` = ?';
151-
$app->db->query($sql, $app->auth->crypt_password($password), (string)$username);
152-
}
133+
}
134+
} else {
135+
//* normal cp user login
136+
$sql = "SELECT * FROM sys_user WHERE USERNAME = ?";
137+
$user = $app->db->queryOneRecord($sql, (string)$username);
138+
if ($user) {
139+
$saved_password = stripslashes($user['passwort']);
140+
if (substr($saved_password, 0, 1) == '$') {
141+
//* The password is encrypted with crypt
142+
if (crypt(stripslashes($password), $saved_password) != $saved_password) {
143+
$user = false;
153144
}
154145
} else {
155-
$user = false;
146+
//* The password is md5 encrypted
147+
if (md5($password) != $saved_password) {
148+
$user = false;
149+
} else {
150+
// update password with secure algo
151+
$sql = 'UPDATE `sys_user` SET `passwort` = ? WHERE `username` = ?';
152+
$app->db->query($sql, $app->auth->crypt_password($password), (string)$username);
153+
}
156154
}
155+
} else {
156+
$user = false;
157157
}
158158
}
159+
}
159160

160-
if ($user) {
161-
if ($user['active'] == 1) {
162-
// Maintenance mode - allow logins only when maintenance mode is off or if the user is admin
163-
if (!$app->is_under_maintenance() || $user['typ'] == 'admin') {
164-
165-
// User login right, so attempts can be deleted
166-
$sql = "DELETE FROM `attempts_login` WHERE `ip`=?";
167-
$app->db->query($sql, $ip);
168-
$user = $app->db->toLower($user);
169-
170-
if ($loginAs) $oldSession = $_SESSION['s'];
171-
172-
// Session regenerate causes login problems on some systems, see Issue #3827
173-
// Set session_regenerate_id to no in security settings, it you encounter
174-
// this problem.
175-
$app->uses('getconf');
176-
$security_config = $app->getconf->get_security_config('permissions');
177-
if (isset($security_config['session_regenerate_id']) && $security_config['session_regenerate_id'] == 'yes') {
178-
if (!$loginAs) session_regenerate_id(true);
179-
}
180-
$_SESSION = array();
181-
if ($loginAs) $_SESSION['s_old'] = $oldSession; // keep the way back!
182-
$_SESSION['s']['user'] = $user;
183-
$_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
184-
$_SESSION['s']['language'] = $app->functions->check_language($user['language']);
185-
$_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
186-
if ($loginAs) $_SESSION['s']['plugin_cache'] = $_SESSION['s_old']['plugin_cache'];
187-
188-
if (is_file(ISPC_WEB_PATH.'/'.$_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
189-
include_once $app->functions->check_include_path(ISPC_WEB_PATH.'/'.$_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
190-
$menu_dir = ISPC_WEB_PATH.'/'.$_SESSION['s']['user']['startmodule'].'/lib/menu.d';
191-
include_menu_dir_files($menu_dir);
192-
$_SESSION['s']['module'] = $module;
193-
}
194-
// check if the user theme is valid
195-
if ($_SESSION['s']['user']['theme'] != 'default') {
196-
$tmp_path = ISPC_THEMES_PATH."/".$_SESSION['s']['user']['theme'];
197-
if (!@is_dir($tmp_path) || !@file_exists($tmp_path."/ispconfig_version") || trim(file_get_contents($tmp_path."/ispconfig_version")) != ISPC_APP_VERSION) {
198-
// fall back to default theme if this one is not compatible with current ispc version
199-
$_SESSION['s']['user']['theme'] = 'default';
200-
$_SESSION['s']['theme'] = 'default';
201-
$_SESSION['show_error_msg'] = $app->lng('theme_not_compatible');
202-
}
161+
if ($user) {
162+
if ($user['active'] == 1) {
163+
// Maintenance mode - allow logins only when maintenance mode is off or if the user is admin
164+
if (!$app->is_under_maintenance() || $user['typ'] == 'admin') {
165+
166+
// User login right, so attempts can be deleted
167+
$sql = "DELETE FROM `attempts_login` WHERE `ip`=?";
168+
$app->db->query($sql, $ip);
169+
$user = $app->db->toLower($user);
170+
171+
if ($loginAs) $oldSession = $_SESSION['s'];
172+
173+
// Session regenerate causes login problems on some systems, see Issue #3827
174+
// Set session_regenerate_id to no in security settings, it you encounter
175+
// this problem.
176+
$app->uses('getconf');
177+
$security_config = $app->getconf->get_security_config('permissions');
178+
if (isset($security_config['session_regenerate_id']) && $security_config['session_regenerate_id'] == 'yes') {
179+
if (!$loginAs) session_regenerate_id(true);
180+
}
181+
$_SESSION = array();
182+
if ($loginAs) $_SESSION['s_old'] = $oldSession; // keep the way back!
183+
$_SESSION['s']['user'] = $user;
184+
$_SESSION['s']['user']['theme'] = isset($user['app_theme']) ? $user['app_theme'] : 'default';
185+
$_SESSION['s']['language'] = $app->functions->check_language($user['language']);
186+
$_SESSION["s"]['theme'] = $_SESSION['s']['user']['theme'];
187+
if ($loginAs) $_SESSION['s']['plugin_cache'] = $_SESSION['s_old']['plugin_cache'];
188+
189+
if (is_file(ISPC_WEB_PATH.'/'.$_SESSION['s']['user']['startmodule'].'/lib/module.conf.php')) {
190+
include_once $app->functions->check_include_path(ISPC_WEB_PATH.'/'.$_SESSION['s']['user']['startmodule'].'/lib/module.conf.php');
191+
$menu_dir = ISPC_WEB_PATH.'/'.$_SESSION['s']['user']['startmodule'].'/lib/menu.d';
192+
include_menu_dir_files($menu_dir);
193+
$_SESSION['s']['module'] = $module;
194+
}
195+
// check if the user theme is valid
196+
if ($_SESSION['s']['user']['theme'] != 'default') {
197+
$tmp_path = ISPC_THEMES_PATH."/".$_SESSION['s']['user']['theme'];
198+
if (!@is_dir($tmp_path) || !@file_exists($tmp_path."/ispconfig_version") || trim(file_get_contents($tmp_path."/ispconfig_version")) != ISPC_APP_VERSION) {
199+
// fall back to default theme if this one is not compatible with current ispc version
200+
$_SESSION['s']['user']['theme'] = 'default';
201+
$_SESSION['s']['theme'] = 'default';
202+
$_SESSION['show_error_msg'] = $app->lng('theme_not_compatible');
203203
}
204+
}
204205

205-
$app->plugin->raiseEvent('login', $username);
206+
$app->plugin->raiseEvent('login', $username);
206207

207-
//* Save successful login message to var
208-
$authlog = 'Successful login for user \''.$username.'\' from '.$_SERVER['REMOTE_ADDR'].' at '.date('Y-m-d H:i:s').' with session ID '.session_id();
209-
$authlog_handle = fopen($conf['ispconfig_log_dir'].'/auth.log', 'a');
210-
fwrite($authlog_handle, $authlog."\n");
211-
fclose($authlog_handle);
208+
//* Save successful login message to var
209+
$authlog = 'Successful login for user \''.$username.'\' from '.$_SERVER['REMOTE_ADDR'].' at '.date('Y-m-d H:i:s').' with session ID '.session_id();
210+
$authlog_handle = fopen($conf['ispconfig_log_dir'].'/auth.log', 'a');
211+
fwrite($authlog_handle, $authlog."\n");
212+
fclose($authlog_handle);
212213

213-
/*
214-
* We need LOGIN_REDIRECT instead of HEADER_REDIRECT to load the
215-
* new theme, if the logged-in user has another
216-
*/
214+
/*
215+
* We need LOGIN_REDIRECT instead of HEADER_REDIRECT to load the
216+
* new theme, if the logged-in user has another
217+
*/
217218

218-
if ($loginAs) {
219-
echo 'LOGIN_REDIRECT:'.$_SESSION['s']['module']['startpage'];
220-
exit;
221-
} else {
222-
header('Location: ../index.php');
223-
die();
224-
}
219+
if ($loginAs) {
220+
echo 'LOGIN_REDIRECT:'.$_SESSION['s']['module']['startpage'];
221+
exit;
222+
} else {
223+
header('Location: ../index.php');
224+
die();
225225
}
226-
} else {
227-
$error = $app->lng('error_user_blocked');
228226
}
229227
} else {
230-
if (!$alreadyfailed['times']) {
231-
//* user login the first time wrong
232-
$sql = "INSERT INTO `attempts_login` (`ip`, `times`, `login_time`) VALUES (?, 1, NOW())";
233-
$app->db->query($sql, $ip);
234-
} elseif ($alreadyfailed['times'] >= 1) {
235-
//* update times wrong
236-
$sql = "UPDATE `attempts_login` SET `times`=`times`+1, `login_time`=NOW() WHERE `ip` = ? AND `login_time` < NOW() ORDER BY `login_time` DESC LIMIT 1";
237-
$app->db->query($sql, $ip);
238-
}
239-
//* Incorrect login - Username and password incorrect
240-
$error = $app->lng('error_user_password_incorrect');
241-
if ($app->db->errorMessage != '') $error .= '<br />'.$app->db->errorMessage != '';
242-
243-
$app->plugin->raiseEvent('login_failed', $username);
244-
//* Save failed login message to var
245-
$authlog = 'Failed login for user \''.$username.'\' from '.$_SERVER['REMOTE_ADDR'].' at '.date('Y-m-d H:i:s');
246-
$authlog_handle = fopen($conf['ispconfig_log_dir'].'/auth.log', 'a');
247-
fwrite($authlog_handle, $authlog."\n");
248-
fclose($authlog_handle);
228+
$error = $app->lng('error_user_blocked');
229+
}
230+
} else {
231+
if (!$alreadyfailed['times']) {
232+
//* user login the first time wrong
233+
$sql = "INSERT INTO `attempts_login` (`ip`, `times`, `login_time`) VALUES (?, 1, NOW())";
234+
$app->db->query($sql, $ip);
235+
} elseif ($alreadyfailed['times'] >= 1) {
236+
//* update times wrong
237+
$sql = "UPDATE `attempts_login` SET `times`=`times`+1, `login_time`=NOW() WHERE `ip` = ? AND `login_time` < NOW() ORDER BY `login_time` DESC LIMIT 1";
238+
$app->db->query($sql, $ip);
249239
}
240+
//* Incorrect login - Username and password incorrect
241+
$error = $app->lng('error_user_password_incorrect');
242+
if ($app->db->errorMessage != '') $error .= '<br />'.$app->db->errorMessage != '';
243+
244+
$app->plugin->raiseEvent('login_failed', $username);
245+
//* Save failed login message to var
246+
$authlog = 'Failed login for user \''.$username.'\' from '.$_SERVER['REMOTE_ADDR'].' at '.date('Y-m-d H:i:s');
247+
$authlog_handle = fopen($conf['ispconfig_log_dir'].'/auth.log', 'a');
248+
fwrite($authlog_handle, $authlog."\n");
249+
fclose($authlog_handle);
250250
}
251251
}
252252

0 commit comments

Comments
 (0)