lib/WikiUser/AdoDb.php

   1 <?php
   2
   3 /*
   4  * Copyright (C) 2004 ReiniUrban
   5  *
   6  * This file is part of PhpWiki.
   7  *
   8  * PhpWiki is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * PhpWiki is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with PhpWiki; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22
  23 include_once 'lib/WikiUser/Db.php';
  24
  25 class _AdoDbPassUser
  26     extends _DbPassUser
  27     /**
  28      * ADODB methods
  29      * Simple sprintf, no prepare.
  30      *
  31      * Warning: Since we use FETCH_MODE_ASSOC (string hash) and not the also faster
  32      * FETCH_MODE_ROW (numeric), we have to use the correct aliases in auth_* sql statements!
  33      *
  34      * TODO: Change FETCH_MODE in adodb WikiDB sublasses.
  35      *
  36      * @tables: user
  37      */
  38 {
  39     public $_authmethod = 'AdoDb';
  40
  41     function _AdoDbPassUser($UserName = '', $prefs = false)
  42     {
  43         if (!$this->_prefs and isa($this, "_AdoDbPassUser")) {
  44             if ($prefs) $this->_prefs = $prefs;
  45             if (!isset($this->_prefs->_method))
  46                 _PassUser::_PassUser($UserName);
  47         }
  48         if (!$this->isValidName($UserName)) {
  49             trigger_error(_("Invalid username."), E_USER_WARNING);
  50             return false;
  51         }
  52         $this->_userid = $UserName;
  53         $this->getAuthDbh();
  54         $this->_auth_crypt_method = $GLOBALS['request']->_dbi->getAuthParam('auth_crypt_method');
  55         // Don't prepare the configured auth statements anymore
  56         return $this;
  57     }
  58
  59     function getPreferences()
  60     {
  61         // override the generic slow method here for efficiency
  62         _AnonUser::getPreferences();
  63         $this->getAuthDbh();
  64         if (isset($this->_prefs->_select)) {
  65             $dbh = & $this->_auth_dbi;
  66             $rs = $dbh->Execute(sprintf($this->_prefs->_select, $dbh->qstr($this->_userid)));
  67             if ($rs->EOF) {
  68                 $rs->Close();
  69             } else {
  70                 $prefs_blob = @$rs->fields['prefs'];
  71                 $rs->Close();
  72                 if ($restored_from_db = $this->_prefs->retrieve($prefs_blob)) {
  73                     $this->_prefs->updatePrefs($restored_from_db);
  74                     return $this->_prefs;
  75                 }
  76             }
  77         }
  78         if (!empty($this->_HomePagehandle)) {
  79             if ($restored_from_page = $this->_prefs->retrieve
  80             ($this->_HomePagehandle->get('pref'))
  81             ) {
  82                 $this->_prefs->updatePrefs($restored_from_page);
  83                 return $this->_prefs;
  84             }
  85         }
  86         return $this->_prefs;
  87     }
  88
  89     function setPreferences($prefs, $id_only = false)
  90     {
  91         // if the prefs are changed
  92         if (_AnonUser::setPreferences($prefs, 1)) {
  93             global $request;
  94             $packed = $this->_prefs->store();
  95             //$user = $request->_user;
  96             //unset($user->_auth_dbi);
  97             if (!$id_only and isset($this->_prefs->_update)) {
  98                 $this->getAuthDbh();
  99                 $dbh = &$this->_auth_dbi;
 100                 // check if the user already exists (not needed with mysql REPLACE)
 101                 $rs = $dbh->Execute(sprintf($this->_prefs->_select, $dbh->qstr($this->_userid)));
 102                 if ($rs->EOF) {
 103                     $rs->Close();
 104                     $prefs_blob = false;
 105                 } else {
 106                     $prefs_blob = @$rs->fields['prefs'];
 107                     $rs->Close();
 108                 }
 109                 if ($prefs_blob) {
 110                     $db_result = $dbh->Execute(sprintf($this->_prefs->_update,
 111                         $dbh->qstr($packed),
 112                         $dbh->qstr($this->_userid)));
 113                 } else {
 114                     // Otherwise, insert a record for them and set it to the defaults.
 115                     $dbi = $request->getDbh();
 116                     $this->_prefs->_insert = $this->prepare($dbi->getAuthParam('pref_insert'),
 117                         array("pref_blob", "userid"));
 118                     $db_result = $dbh->Execute(sprintf($this->_prefs->_insert,
 119                         $dbh->qstr($packed),
 120                         $dbh->qstr($this->_userid)));
 121                 }
 122                 $db_result->Close();
 123                 // delete pageprefs:
 124                 if ($this->_HomePagehandle and $this->_HomePagehandle->get('pref'))
 125                     $this->_HomePagehandle->set('pref', '');
 126             } else {
 127                 //store prefs in homepage, not in cookie
 128                 if ($this->_HomePagehandle and !$id_only)
 129                     $this->_HomePagehandle->set('pref', $packed);
 130             }
 131             return count($this->_prefs->unpack($packed));
 132         }
 133         return 0;
 134     }
 135
 136     function userExists()
 137     {
 138         $this->getAuthDbh();
 139         $dbh = &$this->_auth_dbi;
 140         if (!$dbh) { // needed?
 141             return $this->_tryNextUser();
 142         }
 143         if (!$this->isValidName()) {
 144             return $this->_tryNextUser();
 145         }
 146         $dbi =& $GLOBALS['request']->_dbi;
 147         // Prepare the configured auth statements
 148         if ($dbi->getAuthParam('auth_check') and empty($this->_authselect)) {
 149             $this->_authselect = $this->prepare($dbi->getAuthParam('auth_check'),
 150                 array("password", "userid"));
 151         }
 152         //NOTE: for auth_crypt_method='crypt' no special auth_user_exists is needed
 153         if (!$dbi->getAuthParam('auth_user_exists')
 154             and $this->_auth_crypt_method == 'crypt'
 155                 and $this->_authselect
 156         ) {
 157             $rs = $dbh->Execute(sprintf($this->_authselect, $dbh->qstr($this->_userid)));
 158             if (!$rs->EOF) {
 159                 $rs->Close();
 160                 return true;
 161             } else {
 162                 $rs->Close();
 163             }
 164         } else {
 165             if (!$dbi->getAuthParam('auth_user_exists'))
 166                 trigger_error(fmt("%s is missing", 'DBAUTH_AUTH_USER_EXISTS'),
 167                     E_USER_WARNING);
 168             $this->_authcheck = $this->prepare($dbi->getAuthParam('auth_user_exists'),
 169                 'userid');
 170             $rs = $dbh->Execute(sprintf($this->_authcheck, $dbh->qstr($this->_userid)));
 171             if (!$rs->EOF) {
 172                 $rs->Close();
 173                 return true;
 174             } else {
 175                 $rs->Close();
 176             }
 177         }
 178         // User does not exist yet.
 179         // Maybe the user is allowed to create himself. Generally not wanted in
 180         // external databases, but maybe wanted for the wiki database, for performance
 181         // reasons
 182         if (empty($this->_authcreate) and $dbi->getAuthParam('auth_create')) {
 183             $this->_authcreate = $this->prepare($dbi->getAuthParam('auth_create'),
 184                 array("password", "userid"));
 185         }
 186         if (!empty($this->_authcreate) and
 187             isset($GLOBALS['HTTP_POST_VARS']['auth']) and
 188                 isset($GLOBALS['HTTP_POST_VARS']['auth']['passwd'])
 189         ) {
 190             $passwd = $GLOBALS['HTTP_POST_VARS']['auth']['passwd'];
 191             $dbh->Execute(sprintf($this->_authcreate,
 192                 $dbh->qstr($passwd),
 193                 $dbh->qstr($this->_userid)));
 194             return true;
 195         }
 196
 197         return $this->_tryNextUser();
 198     }
 199
 200     function checkPass($submitted_password)
 201     {
 202         //global $DBAuthParams;
 203         $this->getAuthDbh();
 204         if (!$this->_auth_dbi) { // needed?
 205             return $this->_tryNextPass($submitted_password);
 206         }
 207         if (!$this->isValidName()) {
 208             trigger_error(_("Invalid username."), E_USER_WARNING);
 209             return $this->_tryNextPass($submitted_password);
 210         }
 211         if (!$this->_checkPassLength($submitted_password)) {
 212             return WIKIAUTH_FORBIDDEN;
 213         }
 214         $dbh =& $this->_auth_dbi;
 215         $dbi =& $GLOBALS['request']->_dbi;
 216         if (empty($this->_authselect) and $dbi->getAuthParam('auth_check')) {
 217             $this->_authselect = $this->prepare($dbi->getAuthParam('auth_check'),
 218                 array("password", "userid"));
 219         }
 220         if (!isset($this->_authselect))
 221             $this->userExists();
 222         if (!isset($this->_authselect))
 223             trigger_error(fmt("Either %s is missing or DATABASE_TYPE != “%s”",
 224                     'DBAUTH_AUTH_CHECK', 'ADODB'),
 225                 E_USER_WARNING);
 226         //NOTE: for auth_crypt_method='crypt'  defined('ENCRYPTED_PASSWD',true) must be set
 227         if ($this->_auth_crypt_method == 'crypt') {
 228             $rs = $dbh->Execute(sprintf($this->_authselect,
 229                 $dbh->qstr($this->_userid)));
 230             if (!$rs->EOF) {
 231                 $stored_password = $rs->fields['password'];
 232                 $rs->Close();
 233                 $result = $this->_checkPass($submitted_password, $stored_password);
 234             } else {
 235                 $rs->Close();
 236                 $result = false;
 237             }
 238         } else {
 239             $rs = $dbh->Execute(sprintf($this->_authselect,
 240                 $dbh->qstr($submitted_password),
 241                 $dbh->qstr($this->_userid)));
 242             if (isset($rs->fields['ok']))
 243                 $okay = $rs->fields['ok'];
 244             elseif (isset($rs->fields[0]))
 245                 $okay = $rs->fields[0]; else {
 246                 if (is_array($rs->fields))
 247                     $okay = reset($rs->fields);
 248                 else
 249                     $okay = false;
 250             }
 251             $rs->Close();
 252             $result = !empty($okay);
 253         }
 254
 255         if ($result) {
 256             $this->_level = WIKIAUTH_USER;
 257             return $this->_level;
 258         } elseif (USER_AUTH_POLICY === 'strict') {
 259             $this->_level = WIKIAUTH_FORBIDDEN;
 260             return $this->_level;
 261         } else {
 262             return $this->_tryNextPass($submitted_password);
 263         }
 264     }
 265
 266     function mayChangePass()
 267     {
 268         return $GLOBALS['request']->_dbi->getAuthParam('auth_update');
 269     }
 270
 271     function storePass($submitted_password)
 272     {
 273         $this->getAuthDbh();
 274         $dbh = &$this->_auth_dbi;
 275         $dbi =& $GLOBALS['request']->_dbi;
 276         if ($dbi->getAuthParam('auth_update') and empty($this->_authupdate)) {
 277             $this->_authupdate = $this->prepare($dbi->getAuthParam('auth_update'),
 278                 array("password", "userid"));
 279         }
 280         if (!isset($this->_authupdate)) {
 281             trigger_error(fmt("Either %s is missing or DATABASE_TYPE != “%s”",
 282                     'DBAUTH_AUTH_UPDATE', 'ADODB'),
 283                 E_USER_WARNING);
 284             return false;
 285         }
 286
 287         if ($this->_auth_crypt_method == 'crypt') {
 288             if (function_exists('crypt'))
 289                 $submitted_password = crypt($submitted_password);
 290         }
 291         $rs = $dbh->Execute(sprintf($this->_authupdate,
 292             $dbh->qstr($submitted_password),
 293             $dbh->qstr($this->_userid)
 294         ));
 295         $rs->Close();
 296         return $rs;
 297     }
 298 }
 299
 300 // Local Variables:
 301 // mode: php
 302 // tab-width: 8
 303 // c-basic-offset: 4
 304 // c-hanging-comment-ender-p: nil
 305 // indent-tabs-mode: nil
 306 // End: