diff --git a/CHANGELOG b/CHANGELOG
index a2b565a7..e53e5b72 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,25 @@
+Database changes for session authentication:
+
+
+/* Make the first user the admin user - with default password of: password */
+INSERT INTO `lime_users` (`users_name`, `password`, `full_name`, `parent_id`, `lang`, `superadmin`)
+SELECT username, '0x35653838343839386461323830343731353164306535366638646336323932373733363033643064366161626264643632613131656637323164313534326438', firstName, 1, 'auto', 1
+FROM operators
+WHERE operator_id = 1;
+
+/* Make all other users operators - with default password of: password */
+INSERT INTO `lime_users` (`users_name`, `password`, `full_name`, `parent_id`, `lang`, `superadmin`)
+SELECT username, '0x35653838343839386461323830343731353164306535366638646336323932373733363033643064366161626264643632613131656637323164313534326438', firstName, 1, 'auto', 0
+FROM operators
+WHERE operator_id != 1;
+
+/* Make all clients - with default password of: password */
+INSERT INTO `lime_users` (`users_name`, `password`, `full_name`, `parent_id`, `lang`, `superadmin`)
+SELECT username, '0x35653838343839386461323830343731353164306535366638646336323932373733363033643064366161626264643632613131656637323164313534326438', firstName, 1, 'auto', 0
+FROM clients
+WHERE 1;
+
+/* Remove redundant table */
DROP TABLE `sessions2`;
queXS 1.13.0 - Changes since 1.12.1
diff --git a/admin/clients.php b/admin/clients.php
index 8b23f23f..a10c6c98 100644
--- a/admin/clients.php
+++ b/admin/clients.php
@@ -61,6 +61,7 @@ if (isset($_POST['client']))
{
$client = $db->qstr($_POST['client'],get_magic_quotes_gpc());
$firstname = $db->qstr($_POST['firstname'],get_magic_quotes_gpc());
+ $email = $db->qstr($_POST['email'],get_magic_quotes_gpc());
$lastname = $db->qstr($_POST['lastname'],get_magic_quotes_gpc());
$time_zone_name = $db->qstr($_POST['Time_zone_name'],get_magic_quotes_gpc());
@@ -72,17 +73,15 @@ if (isset($_POST['client']))
if ($db->Execute($sql))
{
- if (HTPASSWD_PATH !== false && HTGROUP_PATH !== false)
- {
- //Get password and add it to the configured htpassword
- include_once("../functions/functions.htpasswd.php");
- $htp = New Htpasswd(HTPASSWD_PATH);
- $htg = New Htgroup(HTGROUP_PATH);
-
- $htp->addUser($_POST['client'],$_POST['password']);
- $htg->addUserToGroup($_POST['client'],HTGROUP_CLIENT);
- }
+ include_once("../include/limesurvey/admin/classes/core/sha256.php");
+ //Insert into lime_users
+ $sql = "INSERT INTO " . LIME_PREFIX . "users (`users_name`,`password`,`full_name`,`parent_id`,`superadmin`,`email`,`lang`)
+ VALUES ($client, '" . SHA256::hashing($_POST['password']) . "',$firstname,1,0,$email,'auto')";
+
+ $db->Execute($sql);
+
+
$a = T_("Added: $client");
}
else
@@ -154,16 +153,14 @@ function generate() {
-
-
+
+
+
+
";
display_chooser($rs,"Time_zone_name","Time_zone_name",false,false,false,false,array("value",get_setting("DEFAULT_TIME_ZONE")),true,"pull-left"); ?>
diff --git a/admin/operatorlist.php b/admin/operatorlist.php
index 0a3d7b62..972becac 100644
--- a/admin/operatorlist.php
+++ b/admin/operatorlist.php
@@ -60,25 +60,43 @@ if (isset($_POST['submit']))
if (isset($_POST['chat_enable'])) $chat_enable = 1;
if (isset($_POST['enabled'])) $enabled = 1;
- if (HTPASSWD_PATH !== false && $_POST['existing_username'] != $_POST['username'] && empty($_POST['password']))
- {
- $msg = "
" . T_("If changing usernames, you must specify a new password") . " ";
- }
- else
- {
- $sql = "UPDATE operator
- SET username = " . $db->qstr($_POST['username']) . ",
- lastName = " . $db->qstr($_POST['lastName']) . ",
- firstName = " . $db->qstr($_POST['firstName']) . ",
- chat_user = " . $db->qstr($_POST['chat_user']) . ",
- chat_password = " . $db->qstr($_POST['chat_password']) . ",
- Time_zone_name = " . $db->qstr($_POST['timezone']) . ",
- voip = $voip, enabled = $enabled, chat_enable = $chat_enable
- WHERE operator_id = $operator_id";
+ //get username
+ $sql = "SELECT username
+ FROM operator
+ WHERE operator_id = $operator_id";
- $rs = $db->Execute($sql);
+ $uname = $db->GetOne($sql);
- if (!empty($rs))
+ $sql = "UPDATE " . LIME_PREFIX . "users
+ SET users_name = " . $db->qstr($_POST['username']) . ",
+ email = " . $db->qstr($_POST['email']) . ",
+ full_name = " . $db->qstr($_POST['firstName']);
+
+ if (!empty($_POST['password']))
+ {
+ include_once("../include/limesurvey/admin/classes/core/sha256.php");
+ $sql .= ", password = '" . SHA256::hashing($_POST['password']) . "' ";
+ }
+
+ $sql .= " WHERE users_name = '$uname'";
+
+ $rs = $db->Execute($sql);
+
+ if (!empty($rs))
+ {
+ $sql = "UPDATE operator
+ SET username = " . $db->qstr($_POST['username']) . ",
+ lastName = " . $db->qstr($_POST['lastName']) . ",
+ firstName = " . $db->qstr($_POST['firstName']) . ",
+ chat_user = " . $db->qstr($_POST['chat_user']) . ",
+ chat_password = " . $db->qstr($_POST['chat_password']) . ",
+ Time_zone_name = " . $db->qstr($_POST['timezone']) . ",
+ voip = $voip, enabled = $enabled, chat_enable = $chat_enable
+ WHERE operator_id = $operator_id";
+
+ $rs = $db->Execute($sql);
+
+ if (!empty($rs))
{
//only update extension if we aren't on a case
$sql = "SELECT case_id
@@ -94,38 +112,28 @@ if (isset($_POST['submit']))
WHERE current_operator_id= $operator_id";
$db->Execute($sql);
-
+
if (!empty($_POST['extension_id']))
{
$sql = "UPDATE extension
SET current_operator_id = $operator_id
WHERE extension_id = " . intval($_POST['extension_id']);
-
+
$db->Execute($sql);
}
}
-
- if (HTPASSWD_PATH !== false && !empty($_POST['password']))
- {
- //update password in htaccess
- include_once(dirname(__FILE__).'/../functions/functions.htpasswd.php');
- $htp = New Htpasswd(HTPASSWD_PATH);
- $htp->deleteUser($_POST["existing_username"]);
- $htp->deleteUser($_POST["username"]);
- $htp->addUser($_POST["username"],$_POST["password"]);
- $htg = New Htgroup(HTGROUP_PATH);
- $htg->deleteUserFromGroup($_POST["existing_username"],HTGROUP_INTERVIEWER);
- $htg->addUserToGroup($_POST["username"],HTGROUP_INTERVIEWER);
- }
-
- $msg = "
" . T_("Successfully updated user") . ": " . $_POST['username'] . " ";
- }
- else
- {
- $msg = "
" . T_("Failed to update user") . ": " . $_POST['username'] . " " . T_("Please make sure the username is unique") . " ";
- }
- }
- $_GET['edit'] = $operator_id;
+ $msg = "
" . T_("Successfully updated user") . ": " . $_POST['username'] . " ";
+ }
+ else
+ {
+ $msg = "
" . T_("Failed to update user") . ": " . $_POST['username'] . " " . T_("Please make sure the username is unique") . " ";
+ }
+ }
+ else
+ {
+ $msg = "
" . T_("Failed to update user") . ": " . $_POST['username'] . " " . T_("Please make sure the username is unique") . " ";
+ }
+ $_GET['edit'] = $operator_id;
}
@@ -135,9 +143,10 @@ if (isset($_GET['edit']))
$operator_id = intval($_GET['edit']);
- $sql = "SELECT *
- FROM operator
- WHERE operator_id = $operator_id";
+ $sql = "SELECT o.*,l.superadmin,l.email
+ FROM operator as o, " . LIME_PREFIX ."users as l
+ WHERE o.operator_id = $operator_id
+ AND l.users_name = o.username";
$rs = $db->GetRow($sql);
@@ -205,7 +214,6 @@ function generate() {
-
-
+