\n";
GetSessionUserRights($_SESSION['loginID']);
//go to queXS
$loc = "";
if ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
$loc = "admin";
else
{
$utest = $connect->GetOne("SELECT username FROM client WHERE username = '" . $_SESSION['user'] . "'");
if (!empty($utest))
$loc = "client";
}
header('Location: ' . QUEXS_URL . $loc);
die();
}
else
{
$query = fGetLoginAttemptUpdateQry($bLoginAttempted,$sIp);
$result = $connect->Execute($query) or safe_die ($query." ".$connect->ErrorMsg());;
if ($result)
{
// wrong or unknown username
$loginsummary .= "
".$clang->gT("Incorrect username and/or password!")." ";
if ($intNthAttempt+1>=$maxLoginAttempt)
$loginsummary .= sprintf($clang->gT("You have exceeded you maximum login attempts. Please wait %d minutes before trying again"),($timeOutTime/60))." ";
$loginsummary .= " ".$clang->gT("Continue")." \n";
}
}
}
}
else{
$loginsummary .= "
".sprintf($clang->gT("You have exceeded you maximum login attempts. Please wait %d minutes before trying again"),($timeOutTime/60))." ";
$loginsummary .= " ".$clang->gT("Continue")." \n";
}
}
}
elseif($useWebserverAuth === true && !isset($_SERVER['PHP_AUTH_USER'])) // LimeSurvey expects webserver auth but it has not been achieved
{
$loginsummary .= " ".$clang->gT("LimeSurvey is setup to use the webserver authentication, but it seems you have not already been authenticated")." ";
$loginsummary .= "
".$clang->gT("Please contact your system administrator")." \n";
}
elseif($useWebserverAuth === true && isset($_SERVER['PHP_AUTH_USER'])) // normal login through webserver authentication
{
$action = 'login';
// we'll include database.php
// we need to unset surveyid
// that could be set if the user clicked on
// a link with all params before first auto-login
unset($surveyid);
$loginsummary = '';
// getting user name, optionnally mapped
if (isset($userArrayMap) && is_array($userArrayMap) &&
isset($userArrayMap[$_SERVER['PHP_AUTH_USER']]))
{
$mappeduser=$userArrayMap[$_SERVER['PHP_AUTH_USER']];
}
else
{
$mappeduser=$_SERVER['PHP_AUTH_USER'];
}
include("database.php");
$query = "SELECT uid, users_name, password, parent_id, email, lang, htmleditormode, questionselectormode, templateeditormode, dateformat FROM ".db_table_name('users')." WHERE users_name=".$connect->qstr($mappeduser);
$ADODB_FETCH_MODE = ADODB_FETCH_ASSOC; //Checked
$result = $connect->SelectLimit($query, 1) or safe_die ($query." ".$connect->ErrorMsg());
if ($result->RecordCount() < 1)
{
// In case the hook function is defined
// overrite the default auto-import profile
// by this function's result
if (function_exists("hook_get_autouserprofile"))
{
// If defined this function returns an array
// describing the defaukt profile for this user
$WebserverAuth_autouserprofile = hook_get_autouserprofile($mappeduser);
}
if (isset($WebserverAuth_autocreateUser) &&
$WebserverAuth_autocreateUser === true &&
isset($WebserverAuth_autouserprofile) &&
is_array ($WebserverAuth_autouserprofile) &&
count($WebserverAuth_autouserprofile) > 0 )
{ // user doesn't exist but auto-create user is set
$isAuthenticated=false;
$new_pass = createPassword();
$uquery = "INSERT INTO {$dbprefix}users "
."(users_name, password,full_name,parent_id,lang,email,create_survey,create_user,delete_user,superadmin,configurator,manage_template,manage_label) "
."VALUES ("
. $connect->qstr($mappeduser).", "
. "'".SHA256::hashing($new_pass)."', "
. "'".db_quote($WebserverAuth_autouserprofile['full_name'])."', "
. getInitialAdmin_uid()." , "
. "'".$WebserverAuth_autouserprofile['lang']."', "
. "'".db_quote($WebserverAuth_autouserprofile['email'])."', "
. intval($WebserverAuth_autouserprofile['create_survey']).","
. intval($WebserverAuth_autouserprofile['create_user']).","
. intval($WebserverAuth_autouserprofile['delete_user']).","
. intval($WebserverAuth_autouserprofile['superadmin']).","
. intval($WebserverAuth_autouserprofile['configurator']).","
. intval($WebserverAuth_autouserprofile['manage_template']).","
. intval($WebserverAuth_autouserprofile['manage_label'])
.")";
$uresult = $connect->Execute($uquery); //Checked
if ($uresult)
{
$isAuthenticated=true;
$newqid = $connect->Insert_ID("{$dbprefix}users","uid");
$arrayTemplates=explode(",",$WebserverAuth_autouserprofile['templatelist']);
foreach ($arrayTemplates as $tplname)
{
$template_query = "INSERT INTO {$dbprefix}templates_rights VALUES('$newqid','$tplname','1')";
$connect->Execute($template_query); //Checked
}
// read again user from newly created entry
$result = $connect->SelectLimit($query, 1) or safe_die ($query." ".$connect->ErrorMsg());//Checked
}
else
{
$loginsummary .= " ".$clang->gT("Auto-import of user failed!")." ";
$loginsummary .= "
".$clang->gT("Continue")." \n";
$isAuthenticated=false;
}
}
else
{
$query = fGetLoginAttemptUpdateQry($bLoginAttempted,$sIp);
$result = $connect->Execute($query) or safe_die ($query." ".$connect->ErrorMsg());;
if ($result)
{
// wrong or unknown username
$loginsummary .= "
".$clang->gT("Incorrect username and/or password!")." ";
if ($intNthAttempt+1>=$maxLoginAttempt)
$loginsummary .= sprintf($clang->gT("You have exceeded you maximum login attempts. Please wait %d minutes before trying again"),($timeOutTime/60))." ";
$loginsummary .= " ".$clang->gT("Continue")." \n";
}
$isAuthenticated=false;
}
}
else
{ // User already exists
$isAuthenticated=true;
}
if ($isAuthenticated ===true)
{ // user exists and was authenticated by webserver
$fields = $result->FetchRow();
$_SESSION['loginID'] = intval($fields['uid']);
$_SESSION['user'] = $fields['users_name'];
$_SESSION['adminlang'] = $fields['lang'];
$_SESSION['htmleditormode'] = $fields['htmleditormode'];
$_SESSION['questionselectormode'] = $fields['questionselectormode'];
$_SESSION['templateeditormode'] = $fields['templateeditormode'];
$_SESSION['dateformat'] = $fields['dateformat'];
$_SESSION['checksessionpost'] = sRandomChars(10);
$_SESSION['pw_notify']=false;
$clang = new limesurvey_lang($_SESSION['adminlang']);
$login = true;
$loginsummary .= " " .sprintf($clang->gT("Welcome %s!"),$_SESSION['user']) . " ";
$loginsummary .= $clang->gT("You logged in successfully.");
if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING'] &&
strpos($_SERVER['QUERY_STRING'], "action=logout") === FALSE)
{
$_SESSION['metaHeader']="";
$loginsummary .= "
\n" . " " . $clang->gT("The email address is not valid.")." \n";
}
if(empty($new_user))
{
if($valid_email) $addsummary .= " ".$clang->gT("Failed to add user")." \n" . " ";
$addsummary .= $clang->gT("A username was not supplied or the username is invalid.")." \n";
}
elseif($valid_email)
{
$new_pass = createPassword();
$uquery = "INSERT INTO {$dbprefix}users (users_name, password,full_name,parent_id,lang,email,create_survey,create_user,delete_user,superadmin,configurator,manage_template,manage_label)
VALUES ('".db_quote($new_user)."', '".SHA256::hashing($new_pass)."', '".db_quote($new_full_name)."', {$_SESSION['loginID']}, 'auto', '".db_quote($new_email)."',0,0,0,0,0,0,0)";
$uresult = $connect->Execute($uquery); //Checked
if($uresult)
{
$newqid = $connect->Insert_ID("{$dbprefix}users","uid");
// add default template to template rights for user
$template_query = "INSERT INTO {$dbprefix}templates_rights VALUES('$newqid','default','1')";
$connect->Execute($template_query); //Checked
// add new user to userlist
$squery = "SELECT uid, users_name, password, parent_id, email, create_survey, configurator, create_user, delete_user, superadmin, manage_template, manage_label FROM ".db_table_name('users')." WHERE uid='{$newqid}'"; //added by Dennis
$sresult = db_execute_assoc($squery);//Checked
$srow = $sresult->FetchRow();
$userlist = getuserlist();
array_push($userlist, array("user"=>$srow['users_name'], "uid"=>$srow['uid'], "email"=>$srow['email'],
"password"=>$srow["password"], "parent_id"=>$srow['parent_id'], // "level"=>$level,
"create_survey"=>$srow['create_survey'], "configurator"=>$srow['configurator'], "create_user"=>$srow['create_user'],
"delete_user"=>$srow['delete_user'], "superadmin"=>$srow['superadmin'], "manage_template"=>$srow['manage_template'],
"manage_label"=>$srow['manage_label']));
// send Mail
$body = sprintf($clang->gT("Hello %s,",'unescaped'), $new_full_name)."
\n";
$body .= sprintf($clang->gT("this is an automated email to notify that a user has been created for you on the site '%s'.",'unescaped'), $sitename)."
\n";
$body .= $clang->gT("You can use now the following credentials to log into the site:",'unescaped')." \n";
$body .= $clang->gT("Username",'unescaped') . ": " . $new_user . " \n";
if ($useWebserverAuth === false)
{ // authent is not delegated to web server
// send password (if authorized by config)
if ($display_user_password_in_email === true)
{
$body .= $clang->gT("Password",'unescaped') . ": " . $new_pass . " \n";
}
else
{
$body .= $clang->gT("Password",'unescaped') . ": " . $clang->gT("Please ask your LimeSurvey administrator for your password.") . " \n";
}
}
$body .= "".$clang->gT("Click here to log in.",'unescaped')."
\n";
$body .= sprintf($clang->gT('If you have any questions regarding this mail please do not hesitate to contact the site administrator at %s. Thank you!','unescaped'),$siteadminemail)." \n";
$subject = sprintf($clang->gT("User registration at '%s'","unescaped"),$sitename);
$to = $new_user." <$new_email>";
$from = $siteadminname." <$siteadminemail>";
$addsummary .="
";
if(SendEmailMessage(null, $body, $subject, $to, $from, $sitename, true, $siteadminbounce))
{
$addsummary .= " ".$clang->gT("Username").": $new_user ".$clang->gT("Email").": $new_email ";
$addsummary .= " ".$clang->gT("An email with a generated password was sent to the user.");
}
else
{
// has to be sent again or no other way
$tmp = str_replace("{NAME}", "".$new_user."", $clang->gT("Email to {NAME} ({EMAIL}) failed."));
$addsummary .= " ".str_replace("{EMAIL}", $new_email, $tmp) . " ";
}
$addsummary .= " \t\t\t
";
}
else{
$addsummary .= "
".$clang->gT("Failed to add user")."
\n" . " " . $clang->gT("The user name already exists.")." \n";
}
}
$addsummary .= "
\n";
// A user can't modify his own rights ;-)
if($postuserid != $_SESSION['loginID'])
{
$squery = "SELECT uid FROM {$dbprefix}users WHERE uid=$postuserid AND parent_id=".$_SESSION['loginID'];
$sresult = $connect->Execute($squery); // Checked
$sresultcount = $sresult->RecordCount();
if($_SESSION['USER_RIGHT_SUPERADMIN'] != 1 && $sresultcount > 0)
{ // Not Admin, just a user with childs
$rights = array();
// Forbids Allowing more privileges than I have
if(isset($_POST['create_survey']) && $_SESSION['USER_RIGHT_CREATE_SURVEY'])$rights['create_survey']=1; else $rights['create_survey']=0;
if(isset($_POST['configurator']) && $_SESSION['USER_RIGHT_CONFIGURATOR'])$rights['configurator']=1; else $rights['configurator']=0;
if(isset($_POST['create_user']) && $_SESSION['USER_RIGHT_CREATE_USER'])$rights['create_user']=1; else $rights['create_user']=0;
if(isset($_POST['delete_user']) && $_SESSION['USER_RIGHT_DELETE_USER'])$rights['delete_user']=1; else $rights['delete_user']=0;
$rights['superadmin']=0; // ONLY Initial Superadmin can give this right
if(isset($_POST['manage_template']) && $_SESSION['USER_RIGHT_MANAGE_TEMPLATE'])$rights['manage_template']=1; else $rights['manage_template']=0;
if(isset($_POST['manage_label']) && $_SESSION['USER_RIGHT_MANAGE_LABEL'])$rights['manage_label']=1; else $rights['manage_label']=0;
if ($postuserid<>1) setuserrights($postuserid, $rights);
$addsummary .= "
".$clang->gT("User permissions were updated successfully.")."
\n";
$addsummary .= " gT("Continue")."\"/>\n";
}
elseif ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1)
{
$rights = array();
if(isset($_POST['create_survey']))$rights['create_survey']=1; else $rights['create_survey']=0;
if(isset($_POST['configurator']))$rights['configurator']=1; else $rights['configurator']=0;
if(isset($_POST['create_user']))$rights['create_user']=1; else $rights['create_user']=0;
if(isset($_POST['delete_user']))$rights['delete_user']=1; else $rights['delete_user']=0;
// Only Initial Superadmin can give this right
if(isset($_POST['superadmin']))
{
// Am I original Superadmin ?
// Initial SuperAdmin has parent_id == 0
$adminquery = "SELECT uid FROM {$dbprefix}users WHERE parent_id=0";
$adminresult = db_select_limit_assoc($adminquery, 1);
$row=$adminresult->FetchRow();
if($row['uid'] == $_SESSION['loginID']) // it's the original superadmin !!!
{
$rights['superadmin']=1;
}
else
{
$rights['superadmin']=0;
}
}
else
{
$rights['superadmin']=0;
}
if(isset($_POST['manage_template']))$rights['manage_template']=1; else $rights['manage_template']=0;
if(isset($_POST['manage_label']))$rights['manage_label']=1; else $rights['manage_label']=0;
setuserrights($postuserid, $rights);
$addsummary .= "
".$clang->gT("User permissions were updated successfully.")."