Skip to content

Commit 7c49931

Browse files
GrorukGroruk
committed
Passwords are now required for everybody
1 parent 727fea0 commit 7c49931

File tree

2 files changed

+138
-190
lines changed

2 files changed

+138
-190
lines changed

‎web/includes/CUserManager.php

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -324,19 +324,13 @@ public function AddAdmin($name, $steam, $password, $email, $web_group, $web_flag
324324
throw new RuntimeException('Password must be at least ' . MIN_PASS_LENGTH . ' characters long.');
325325
}
326326
if (empty($password)) {
327-
// Silently generate a token for account if there is no password set
328-
// the token is required in Steam OAuth routines.
329-
// Due to ugly codebase and lack of migrations we store the token as password hash.
330-
// Also we use a prefix here to prevent any possible collisions with `encrypt_password` implementation.
331-
$password_hash = '$token$' . $this->random_string();
332-
} else {
333-
$password_hash = $this->hash($password);
327+
throw new RuntimeException('Password must not be empty!');
334328
}
335329
$this->dbh->query('INSERT INTO `:prefix_admins` (user, authid, password, gid, email, extraflags, immunity, srv_group, srv_flags, srv_password)
336330
VALUES (:user, :authid, :password, :gid, :email, :extraflags, :immunity, :srv_group, :srv_flags, :srv_password)');
337331
$this->dbh->bind(':user', $name);
338332
$this->dbh->bind(':authid', $steam);
339-
$this->dbh->bind(':password', $password_hash);
333+
$this->dbh->bind(':password', password_hash($password, PASSWORD_BCRYPT));
340334
$this->dbh->bind(':gid', $web_group);
341335
$this->dbh->bind(':email', $email);
342336
$this->dbh->bind(':extraflags', $web_flags);

‎web/includes/sb-callback.php

Lines changed: 136 additions & 182 deletions
Original file line numberDiff line numberDiff line change
@@ -860,11 +860,10 @@ function AddAdmin($mask, $srv_mask, $a_name, $a_steam, $a_email, $a_password, $a
860860
{
861861
$objResponse = new xajaxResponse();
862862
global $userbank, $username;
863-
if(!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_ADMINS))
864-
{
865-
$objResponse->redirect("index.php?p=login&m=no_access", 0);
866-
$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add an admin, but doesnt have access.");
867-
return $objResponse;
863+
if (!$userbank->HasAccess(ADMIN_OWNER|ADMIN_ADD_ADMINS)) {
864+
$objResponse->redirect("index.php?p=login&m=no_access", 0);
865+
$log = new CSystemLog("w", "Hacking Attempt", $username . " tried to add an admin, but doesnt have access.");
866+
return $objResponse;
868867
}
869868
$a_name = RemoveCode($a_name);
870869
$a_steam = RemoveCode($a_steam);
@@ -876,168 +875,124 @@ function AddAdmin($mask, $srv_mask, $a_name, $a_steam, $a_email, $a_password, $a
876875
$error=0;
877876

878877
//No name
879-
if(empty($a_name))
880-
{
881-
$error++;
882-
$objResponse->addAssign("name.msg", "innerHTML", "You must type a name for the admin.");
883-
$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
884-
}
885-
else{
886-
if(strstr($a_name, "'"))
887-
{
888-
$error++;
889-
$objResponse->addAssign("name.msg", "innerHTML", "An admin name can not contain a \" ' \".");
890-
$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
891-
}
892-
else
893-
{
894-
if(is_taken("admins", "user", $a_name))
895-
{
896-
$error++;
897-
$objResponse->addAssign("name.msg", "innerHTML", "An admin with this name already exists");
898-
$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
899-
}
900-
else
901-
{
902-
$objResponse->addAssign("name.msg", "innerHTML", "");
903-
$objResponse->addScript("$('name.msg').setStyle('display', 'none');");
904-
}
905-
}
878+
if (empty($a_name)) {
879+
$error++;
880+
$objResponse->addAssign("name.msg", "innerHTML", "You must type a name for the admin.");
881+
$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
882+
} else {
883+
if (strstr($a_name, "'")) {
884+
$error++;
885+
$objResponse->addAssign("name.msg", "innerHTML", "An admin name can not contain a \" ' \".");
886+
$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
887+
} else {
888+
if (is_taken("admins", "user", $a_name)) {
889+
$error++;
890+
$objResponse->addAssign("name.msg", "innerHTML", "An admin with this name already exists");
891+
$objResponse->addScript("$('name.msg').setStyle('display', 'block');");
892+
} else {
893+
$objResponse->addAssign("name.msg", "innerHTML", "");
894+
$objResponse->addScript("$('name.msg').setStyle('display', 'none');");
895+
}
896+
}
906897
}
907898
// If they didnt type a steamid
908-
if((empty($a_steam) || strlen($a_steam) < 10))
909-
{
910-
$error++;
911-
$objResponse->addAssign("steam.msg", "innerHTML", "You must type a Steam ID or Community ID for the admin.");
912-
$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
913-
}
914-
else
915-
{
916-
// Validate the steamid or fetch it from the community id
917-
if((!is_numeric($a_steam)
918-
&& !validate_steam($a_steam))
919-
|| (is_numeric($a_steam)
920-
&& (strlen($a_steam) < 15
921-
|| !validate_steam($a_steam = FriendIDToSteamID($a_steam)))))
922-
{
923-
$error++;
924-
$objResponse->addAssign("steam.msg", "innerHTML", "Please enter a valid Steam ID or Community ID.");
925-
$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
926-
}
927-
else
928-
{
929-
if(is_taken("admins", "authid", $a_steam))
930-
{
931-
$admins = $userbank->GetAllAdmins();
932-
foreach($admins as $admin)
933-
{
934-
if($admin['authid'] == $a_steam)
935-
{
936-
$name = $admin['user'];
937-
break;
938-
}
939-
}
940-
$error++;
941-
$objResponse->addAssign("steam.msg", "innerHTML", "Admin ".htmlspecialchars(addslashes($name))." already uses this Steam ID.");
942-
$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
943-
}
944-
else
945-
{
946-
$objResponse->addAssign("steam.msg", "innerHTML", "");
947-
$objResponse->addScript("$('steam.msg').setStyle('display', 'none');");
948-
}
949-
}
899+
if ((empty($a_steam) || strlen($a_steam) < 10)) {
900+
$error++;
901+
$objResponse->addAssign("steam.msg", "innerHTML", "You must type a Steam ID or Community ID for the admin.");
902+
$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
903+
} else {
904+
// Validate the steamid or fetch it from the community id
905+
if ((!is_numeric($a_steam)
906+
&& !validate_steam($a_steam))
907+
|| (is_numeric($a_steam)
908+
&& (strlen($a_steam) < 15
909+
|| !validate_steam($a_steam = FriendIDToSteamID($a_steam)))))
910+
{
911+
$error++;
912+
$objResponse->addAssign("steam.msg", "innerHTML", "Please enter a valid Steam ID or Community ID.");
913+
$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
914+
} else {
915+
if (is_taken("admins", "authid", $a_steam)) {
916+
$admins = $userbank->GetAllAdmins();
917+
foreach ($admins as $admin) {
918+
if ($admin['authid'] == $a_steam) {
919+
$name = $admin['user'];
920+
break;
921+
}
922+
}
923+
$error++;
924+
$objResponse->addAssign("steam.msg", "innerHTML", "Admin ".htmlspecialchars(addslashes($name))." already uses this Steam ID.");
925+
$objResponse->addScript("$('steam.msg').setStyle('display', 'block');");
926+
} else {
927+
$objResponse->addAssign("steam.msg", "innerHTML", "");
928+
$objResponse->addScript("$('steam.msg').setStyle('display', 'none');");
929+
}
930+
}
950931
}
951932

952933
// No email
953-
if(empty($a_email))
954-
{
955-
// An E-Mail address is only required for users with web permissions.
956-
if($mask != 0)
957-
{
958-
$error++;
959-
$objResponse->addAssign("email.msg", "innerHTML", "You must type an e-mail address.");
960-
$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
961-
}
962-
}
963-
else{
964-
// Is an other admin already registred with that email address?
965-
if(is_taken("admins", "email", $a_email))
966-
{
967-
$admins = $userbank->GetAllAdmins();
968-
foreach($admins as $admin)
969-
{
970-
if($admin['email'] == $a_email)
971-
{
972-
$name = $admin['user'];
973-
break;
974-
}
975-
}
976-
$error++;
977-
$objResponse->addAssign("email.msg", "innerHTML", "This email address is already being used by ".htmlspecialchars(addslashes($name)).".");
978-
$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
979-
}
980-
else
981-
{
982-
$objResponse->addAssign("email.msg", "innerHTML", "");
983-
$objResponse->addScript("$('email.msg').setStyle('display', 'none');");
984-
/* if(!validate_email($a_email))
985-
{
986-
$error++;
987-
$objResponse->addAssign("email.msg", "innerHTML", "Please enter a valid email address.");
988-
$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
989-
}
990-
else
991-
{
992-
$objResponse->addAssign("email.msg", "innerHTML", "");
993-
$objResponse->addScript("$('email.msg').setStyle('display', 'none');");
994-
995-
}*/
996-
}
934+
if (empty($a_email)) {
935+
// An E-Mail address is only required for users with web permissions.
936+
if ($mask != 0) {
937+
$error++;
938+
$objResponse->addAssign("email.msg", "innerHTML", "You must type an e-mail address.");
939+
$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
940+
}
941+
} else {
942+
// Is an other admin already registred with that email address?
943+
if (is_taken("admins", "email", $a_email)) {
944+
$admins = $userbank->GetAllAdmins();
945+
foreach ($admins as $admin) {
946+
if ($admin['email'] == $a_email) {
947+
$name = $admin['user'];
948+
break;
949+
}
950+
}
951+
$error++;
952+
$objResponse->addAssign("email.msg", "innerHTML", "This email address is already being used by ".htmlspecialchars(addslashes($name)).".");
953+
$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
954+
} else {
955+
$objResponse->addAssign("email.msg", "innerHTML", "");
956+
$objResponse->addScript("$('email.msg').setStyle('display', 'none');");
957+
/* if (!validate_email($a_email)) {
958+
$error++;
959+
$objResponse->addAssign("email.msg", "innerHTML", "Please enter a valid email address.");
960+
$objResponse->addScript("$('email.msg').setStyle('display', 'block');");
961+
} else {
962+
$objResponse->addAssign("email.msg", "innerHTML", "");
963+
$objResponse->addScript("$('email.msg').setStyle('display', 'none');");
964+
}*/
965+
}
997966
}
998967

999968
// no pass
1000-
if(empty($a_password))
1001-
{
1002-
// A password is only required for users with web permissions.
1003-
if($mask != 0)
1004-
{
1005-
$error++;
1006-
$objResponse->addAssign("password.msg", "innerHTML", "You must type a password.");
1007-
$objResponse->addScript("$('password.msg').setStyle('display', 'block');");
1008-
}
1009-
}
1010-
// Password too short?
1011-
else if(strlen($a_password) < MIN_PASS_LENGTH)
1012-
{
1013-
$error++;
1014-
$objResponse->addAssign("password.msg", "innerHTML", "Your password must be at-least " . MIN_PASS_LENGTH . " characters long.");
1015-
$objResponse->addScript("$('password.msg').setStyle('display', 'block');");
1016-
}
1017-
else
1018-
{
1019-
$objResponse->addAssign("password.msg", "innerHTML", "");
1020-
$objResponse->addScript("$('password.msg').setStyle('display', 'none');");
1021-
1022-
// No confirmation typed
1023-
if(empty($a_password2))
1024-
{
1025-
$error++;
1026-
$objResponse->addAssign("password2.msg", "innerHTML", "You must confirm the password");
1027-
$objResponse->addScript("$('password2.msg').setStyle('display', 'block');");
1028-
}
1029-
// Passwords match?
1030-
else if($a_password != $a_password2)
1031-
{
1032-
$error++;
1033-
$objResponse->addAssign("password2.msg", "innerHTML", "Your passwords don't match");
1034-
$objResponse->addScript("$('password2.msg').setStyle('display', 'block');");
1035-
}
1036-
else
1037-
{
1038-
$objResponse->addAssign("password2.msg", "innerHTML", "");
1039-
$objResponse->addScript("$('password2.msg').setStyle('display', 'none');");
1040-
}
969+
if (empty($a_password)) {
970+
$error++;
971+
$objResponse->addAssign("password.msg", "innerHTML", "You must type a password.");
972+
$objResponse->addScript("$('password.msg').setStyle('display', 'block');");
973+
} elseif (strlen($a_password) < MIN_PASS_LENGTH) {
974+
// Password too short?
975+
$error++;
976+
$objResponse->addAssign("password.msg", "innerHTML", "Your password must be at-least " . MIN_PASS_LENGTH . " characters long.");
977+
$objResponse->addScript("$('password.msg').setStyle('display', 'block');");
978+
} else {
979+
$objResponse->addAssign("password.msg", "innerHTML", "");
980+
$objResponse->addScript("$('password.msg').setStyle('display', 'none');");
981+
982+
// No confirmation typed
983+
if (empty($a_password2)) {
984+
$error++;
985+
$objResponse->addAssign("password2.msg", "innerHTML", "You must confirm the password");
986+
$objResponse->addScript("$('password2.msg').setStyle('display', 'block');");
987+
} elseif ($a_password != $a_password2) {
988+
// Passwords match?
989+
$error++;
990+
$objResponse->addAssign("password2.msg", "innerHTML", "Your passwords don't match");
991+
$objResponse->addScript("$('password2.msg').setStyle('display', 'block');");
992+
} else {
993+
$objResponse->addAssign("password2.msg", "innerHTML", "");
994+
$objResponse->addScript("$('password2.msg').setStyle('display', 'none');");
995+
}
1041996
}
1042997

1043998
// Choose to use a server password
@@ -1163,36 +1118,30 @@ function AddAdmin($mask, $srv_mask, $a_name, $a_steam, $a_email, $a_password, $a
11631118
$immunity = 0;
11641119

11651120
// Extract immunity from server mask string
1166-
if(strstr($srv_mask, "#"))
1167-
{
1168-
$immunity = "0";
1169-
$immunity = substr($srv_mask, strpos($srv_mask, "#")+1);
1170-
$srv_mask = substr($srv_mask, 0, strlen($srv_mask) - strlen($immunity)-1);
1121+
if (strstr($srv_mask, "#")) {
1122+
$immunity = "0";
1123+
$immunity = substr($srv_mask, strpos($srv_mask, "#")+1);
1124+
$srv_mask = substr($srv_mask, 0, strlen($srv_mask) - strlen($immunity)-1);
11711125
}
11721126

11731127
// Avoid negative immunity
11741128
$immunity = ($immunity>0) ? $immunity : 0;
11751129

11761130
// Handle Webpermissions
11771131
// Chose to create a new webgroup
1178-
if($a_wg == 'n')
1179-
{
1180-
$add_webgroup = $GLOBALS['db']->Execute("INSERT INTO ".DB_PREFIX."_groups(type, name, flags)
1181-
VALUES (?,?,?)", array(1, $a_webname, $mask));
1182-
$web_group = (int)$GLOBALS['db']->Insert_ID();
1183-
1184-
// We added those permissons to the group, so don't add them as custom permissions again
1185-
$mask = 0;
1186-
}
1187-
// Chose an existing group
1188-
else if($a_wg != 'c' && $a_wg > 0)
1189-
{
1190-
$web_group = (int)$a_wg;
1191-
}
1192-
// Custom permissions -> no group
1193-
else
1194-
{
1195-
$web_group = -1;
1132+
if ($a_wg == 'n') {
1133+
$add_webgroup = $GLOBALS['db']->Execute("INSERT INTO ".DB_PREFIX."_groups(type, name, flags)
1134+
VALUES (?,?,?)", array(1, $a_webname, $mask));
1135+
$web_group = (int)$GLOBALS['db']->Insert_ID();
1136+
1137+
// We added those permissons to the group, so don't add them as custom permissions again
1138+
$mask = 0;
1139+
} elseif ($a_wg != 'c' && $a_wg > 0) {
1140+
// Chose an existing group
1141+
$web_group = (int)$a_wg;
1142+
} else {
1143+
// Custom permissions -> no group
1144+
$web_group = -1;
11961145
}
11971146

11981147
// Handle Serverpermissions
@@ -1221,6 +1170,11 @@ function AddAdmin($mask, $srv_mask, $a_name, $a_steam, $a_email, $a_password, $a
12211170
$server_admin_group_int = -1;
12221171
}
12231172

1173+
//make sure steamid starts with STEAM_0
1174+
$steam = explode(':', $a_steam);
1175+
$steam[0] = "STEAM_0";
1176+
$a_steam = implode(':', $steam);
1177+
12241178
// Add the admin
12251179
$aid = $userbank->AddAdmin($a_name, $a_steam, $a_password, $a_email, $web_group, $mask, $server_admin_group, $srv_mask, $immunity, $a_serverpass);
12261180

0 commit comments

Comments
 (0)