1
|
|
|
<?php namespace EvolutionCMS\Legacy; |
2
|
|
|
|
3
|
|
|
use EvolutionCMS\Interfaces\ManagerApiInterface; |
4
|
|
|
/* |
5
|
|
|
* MODX Manager API Class |
6
|
|
|
* Written by Raymond Irving 2005 |
7
|
|
|
* |
8
|
|
|
*/ |
9
|
|
|
|
10
|
|
|
//global $_PAGE; // page view state object. Usage $_PAGE['vs']['propertyname'] = $value; |
11
|
|
|
|
12
|
|
|
// Content manager wrapper class |
13
|
|
|
class ManagerApi implements ManagerApiInterface |
14
|
|
|
{ |
15
|
|
|
/** |
16
|
|
|
* @var string |
17
|
|
|
*/ |
18
|
|
|
public $action; // action directive |
19
|
|
|
|
20
|
|
|
/** |
21
|
|
|
* ManagerAPI constructor. |
22
|
|
|
*/ |
23
|
|
|
public function __construct() |
24
|
|
|
{ |
25
|
|
|
global $action; |
|
|
|
|
26
|
|
|
$this->action = $action; // set action directive |
27
|
|
|
} |
28
|
|
|
|
29
|
|
|
/** |
30
|
|
|
* @param int $id |
31
|
|
|
*/ |
32
|
|
|
public function initPageViewState($id = 0) |
|
|
|
|
33
|
|
|
{ |
34
|
|
|
global $_PAGE; |
|
|
|
|
35
|
|
|
$vsid = isset($_SESSION["mgrPageViewSID"]) ? $_SESSION["mgrPageViewSID"] : ''; |
36
|
|
|
if ($vsid != $this->action) { |
37
|
|
|
$_SESSION["mgrPageViewSDATA"] = array(); // new view state |
38
|
|
|
$_SESSION["mgrPageViewSID"] = $id > 0 ? $id : $this->action; // set id |
39
|
|
|
} |
40
|
|
|
$_PAGE['vs'] = &$_SESSION["mgrPageViewSDATA"]; // restore viewstate |
41
|
|
|
} |
42
|
|
|
|
43
|
|
|
/** |
44
|
|
|
* save page view state - not really necessary, |
45
|
|
|
* |
46
|
|
|
* @param int $id |
47
|
|
|
*/ |
48
|
|
|
public function savePageViewState($id = 0) |
|
|
|
|
49
|
|
|
{ |
50
|
|
|
global $_PAGE; |
|
|
|
|
51
|
|
|
$_SESSION["mgrPageViewSDATA"] = $_PAGE['vs']; |
52
|
|
|
$_SESSION["mgrPageViewSID"] = $id > 0 ? $id : $this->action; |
53
|
|
|
} |
54
|
|
|
|
55
|
|
|
/** |
56
|
|
|
* check for saved form |
57
|
|
|
* |
58
|
|
|
* @return bool |
59
|
|
|
*/ |
60
|
|
|
public function hasFormValues() |
|
|
|
|
61
|
|
|
{ |
62
|
|
|
if (isset($_SESSION["mgrFormValueId"])) { |
63
|
|
|
if ($this->action == $_SESSION["mgrFormValueId"]) { |
64
|
|
|
return true; |
65
|
|
|
} else { |
66
|
|
|
$this->clearSavedFormValues(); |
67
|
|
|
} |
68
|
|
|
} |
69
|
|
|
|
70
|
|
|
return false; |
71
|
|
|
} |
72
|
|
|
|
73
|
|
|
/** |
74
|
|
|
* saved form post from $_POST |
75
|
|
|
* |
76
|
|
|
* @param int $id |
77
|
|
|
*/ |
78
|
|
|
public function saveFormValues($id = 0) |
|
|
|
|
79
|
|
|
{ |
80
|
|
|
$_SESSION["mgrFormValues"] = $_POST; |
81
|
|
|
$_SESSION["mgrFormValueId"] = $id > 0 ? $id : $this->action; |
82
|
|
|
} |
83
|
|
|
|
84
|
|
|
/** |
85
|
|
|
* load saved form values into $_POST |
86
|
|
|
* |
87
|
|
|
* @return bool |
88
|
|
|
*/ |
89
|
|
|
public function loadFormValues() |
|
|
|
|
90
|
|
|
{ |
91
|
|
|
|
92
|
|
|
if (!$this->hasFormValues()) { |
93
|
|
|
return false; |
94
|
|
|
} |
95
|
|
|
|
96
|
|
|
$p = $_SESSION["mgrFormValues"]; |
|
|
|
|
97
|
|
|
$this->clearSavedFormValues(); |
98
|
|
|
foreach ($p as $k => $v) { |
99
|
|
|
$_POST[$k] = $v; |
100
|
|
|
} |
101
|
|
|
|
102
|
|
|
return true; |
103
|
|
|
} |
104
|
|
|
|
105
|
|
|
/** |
106
|
|
|
* clear form post |
107
|
|
|
* |
108
|
|
|
* @return void |
109
|
|
|
*/ |
110
|
|
|
public function clearSavedFormValues() |
|
|
|
|
111
|
|
|
{ |
112
|
|
|
unset($_SESSION["mgrFormValues"]); |
113
|
|
|
unset($_SESSION["mgrFormValueId"]); |
114
|
|
|
} |
115
|
|
|
|
116
|
|
|
/** |
117
|
|
|
* @param string $db_value |
118
|
|
|
* @return string |
119
|
|
|
*/ |
120
|
|
|
public function getHashType($db_value = '') |
|
|
|
|
121
|
|
|
{ // md5 | v1 | phpass |
122
|
|
|
$c = substr($db_value, 0, 1); |
|
|
|
|
123
|
|
|
if ($c === '$') { |
124
|
|
|
return 'phpass'; |
125
|
|
|
} elseif (strlen($db_value) === 32) { |
126
|
|
|
return 'md5'; |
127
|
|
|
} elseif ($c !== '$' && strpos($db_value, '>') !== false) { |
128
|
|
|
return 'v1'; |
129
|
|
|
} else { |
130
|
|
|
return 'unknown'; |
131
|
|
|
} |
132
|
|
|
} |
133
|
|
|
|
134
|
|
|
/** |
135
|
|
|
* @param string $password |
136
|
|
|
* @param string $seed |
137
|
|
|
* @return string |
138
|
|
|
*/ |
139
|
|
|
public function genV1Hash($password, $seed = '1') |
140
|
|
|
{ // $seed is user_id basically |
141
|
|
|
$modx = evolutionCMS(); |
142
|
|
|
|
143
|
|
View Code Duplication |
if (isset($modx->config['pwd_hash_algo']) && !empty($modx->config['pwd_hash_algo'])) { |
144
|
|
|
$algorithm = $modx->config['pwd_hash_algo']; |
145
|
|
|
} else { |
146
|
|
|
$algorithm = 'UNCRYPT'; |
147
|
|
|
} |
148
|
|
|
|
149
|
|
|
$salt = md5($password . $seed); |
150
|
|
|
|
151
|
|
|
switch ($algorithm) { |
152
|
|
|
case 'BLOWFISH_Y': |
153
|
|
|
$salt = '$2y$07$' . substr($salt, 0, 22); |
154
|
|
|
break; |
155
|
|
|
case 'BLOWFISH_A': |
156
|
|
|
$salt = '$2a$07$' . substr($salt, 0, 22); |
157
|
|
|
break; |
158
|
|
|
case 'SHA512': |
159
|
|
|
$salt = '$6$' . substr($salt, 0, 16); |
160
|
|
|
break; |
161
|
|
|
case 'SHA256': |
162
|
|
|
$salt = '$5$' . substr($salt, 0, 16); |
163
|
|
|
break; |
164
|
|
|
case 'MD5': |
165
|
|
|
$salt = '$1$' . substr($salt, 0, 8); |
166
|
|
|
break; |
167
|
|
|
} |
168
|
|
|
|
169
|
|
|
if ($algorithm !== 'UNCRYPT') { |
170
|
|
|
$password = sha1($password) . crypt($password, $salt); |
171
|
|
|
} else { |
172
|
|
|
$password = sha1($salt . $password); |
173
|
|
|
} |
174
|
|
|
|
175
|
|
|
$result = strtolower($algorithm) . '>' . md5($salt . $password) . substr(md5($salt), 0, 8); |
176
|
|
|
|
177
|
|
|
return $result; |
178
|
|
|
} |
179
|
|
|
|
180
|
|
|
/** |
181
|
|
|
* @param string $uid |
182
|
|
|
* @return string |
183
|
|
|
*/ |
184
|
|
|
public function getV1UserHashAlgorithm($uid) |
185
|
|
|
{ |
186
|
|
|
$modx = evolutionCMS(); |
187
|
|
|
$tbl_manager_users = $modx->getFullTableName('manager_users'); |
188
|
|
|
$uid = $modx->getDatabase()->escape($uid); |
189
|
|
|
$rs = $modx->getDatabase()->select('password', $tbl_manager_users, "id='{$uid}'"); |
|
|
|
|
190
|
|
|
$password = $modx->getDatabase()->getValue($rs); |
|
|
|
|
191
|
|
|
|
192
|
|
View Code Duplication |
if (strpos($password, '>') === false) { |
193
|
|
|
$algo = 'NOSALT'; |
194
|
|
|
} else { |
195
|
|
|
$algo = substr($password, 0, strpos($password, '>')); |
196
|
|
|
} |
197
|
|
|
|
198
|
|
|
return strtoupper($algo); |
199
|
|
|
} |
200
|
|
|
|
201
|
|
|
/** |
202
|
|
|
* @param string $algorithm |
203
|
|
|
* @return bool |
204
|
|
|
*/ |
205
|
|
|
public function checkHashAlgorithm($algorithm = '') |
206
|
|
|
{ |
207
|
|
|
$result = false; |
208
|
|
|
if (!empty($algorithm)) { |
209
|
|
|
switch ($algorithm) { |
210
|
|
|
case 'BLOWFISH_Y': |
211
|
|
|
if (defined('CRYPT_BLOWFISH') && CRYPT_BLOWFISH == 1) { |
212
|
|
|
if (version_compare('5.3.7', PHP_VERSION) <= 0) { |
213
|
|
|
$result = true; |
214
|
|
|
} |
215
|
|
|
} |
216
|
|
|
break; |
217
|
|
|
case 'BLOWFISH_A': |
218
|
|
|
if (defined('CRYPT_BLOWFISH') && CRYPT_BLOWFISH == 1) { |
219
|
|
|
$result = true; |
220
|
|
|
} |
221
|
|
|
break; |
222
|
|
|
case 'SHA512': |
223
|
|
|
if (defined('CRYPT_SHA512') && CRYPT_SHA512 == 1) { |
224
|
|
|
$result = true; |
225
|
|
|
} |
226
|
|
|
break; |
227
|
|
|
case 'SHA256': |
228
|
|
|
if (defined('CRYPT_SHA256') && CRYPT_SHA256 == 1) { |
229
|
|
|
$result = true; |
230
|
|
|
} |
231
|
|
|
break; |
232
|
|
|
case 'MD5': |
233
|
|
|
if (defined('CRYPT_MD5') && CRYPT_MD5 == 1 && PHP_VERSION != '5.3.7') { |
234
|
|
|
$result = true; |
235
|
|
|
} |
236
|
|
|
break; |
237
|
|
|
case 'UNCRYPT': |
238
|
|
|
$result = true; |
239
|
|
|
break; |
240
|
|
|
} |
241
|
|
|
} |
242
|
|
|
|
243
|
|
|
return $result; |
244
|
|
|
} |
245
|
|
|
|
246
|
|
|
/** |
247
|
|
|
* @param string $check_files |
248
|
|
|
* @return string |
249
|
|
|
*/ |
250
|
|
|
public function getSystemChecksum($check_files) |
|
|
|
|
251
|
|
|
{ |
252
|
|
|
$_ = array(); |
|
|
|
|
253
|
|
|
$check_files = trim($check_files); |
254
|
|
|
$check_files = explode("\n", $check_files); |
255
|
|
View Code Duplication |
foreach ($check_files as $file) { |
256
|
|
|
$file = trim($file); |
257
|
|
|
$file = MODX_BASE_PATH . $file; |
258
|
|
|
if (!is_file($file)) { |
259
|
|
|
continue; |
260
|
|
|
} |
261
|
|
|
$_[$file] = md5_file($file); |
262
|
|
|
} |
263
|
|
|
|
264
|
|
|
return serialize($_); |
265
|
|
|
} |
266
|
|
|
|
267
|
|
|
/** |
268
|
|
|
* @param string $check_files |
269
|
|
|
* @param string $checksum |
270
|
|
|
* @return array |
271
|
|
|
*/ |
272
|
|
|
public function getModifiedSystemFilesList($check_files, $checksum) |
|
|
|
|
273
|
|
|
{ |
274
|
|
|
$_ = array(); |
|
|
|
|
275
|
|
|
$check_files = trim($check_files); |
276
|
|
|
$check_files = explode("\n", $check_files); |
277
|
|
|
$checksum = unserialize($checksum); |
278
|
|
View Code Duplication |
foreach ($check_files as $file) { |
279
|
|
|
$file = trim($file); |
280
|
|
|
$filePath = MODX_BASE_PATH . $file; |
281
|
|
|
if (!is_file($filePath)) { |
282
|
|
|
continue; |
283
|
|
|
} |
284
|
|
|
if (md5_file($filePath) != $checksum[$filePath]) { |
285
|
|
|
$_[] = $file; |
286
|
|
|
} |
287
|
|
|
} |
288
|
|
|
|
289
|
|
|
return $_; |
290
|
|
|
} |
291
|
|
|
|
292
|
|
|
/** |
293
|
|
|
* @param string $checksum |
294
|
|
|
*/ |
295
|
|
|
public function setSystemChecksum($checksum) |
296
|
|
|
{ |
297
|
|
|
$modx = evolutionCMS(); |
298
|
|
|
$tbl_system_settings = $modx->getFullTableName('system_settings'); |
299
|
|
|
$sql = "REPLACE INTO {$tbl_system_settings} (setting_name, setting_value) VALUES ('sys_files_checksum','" . $modx->getDatabase()->escape($checksum) . "')"; |
300
|
|
|
$modx->getDatabase()->query($sql); |
301
|
|
|
} |
302
|
|
|
|
303
|
|
|
/** |
304
|
|
|
* @return array|string |
305
|
|
|
*/ |
306
|
|
|
public function checkSystemChecksum() |
307
|
|
|
{ |
308
|
|
|
$modx = evolutionCMS(); |
309
|
|
|
|
310
|
|
|
if (!isset($modx->config['check_files_onlogin']) || empty($modx->config['check_files_onlogin'])) { |
311
|
|
|
return '0'; |
312
|
|
|
} |
313
|
|
|
|
314
|
|
|
$current = $this->getSystemChecksum($modx->config['check_files_onlogin']); |
315
|
|
|
if (empty($current)) { |
316
|
|
|
return '0'; |
317
|
|
|
} |
318
|
|
|
|
319
|
|
|
if (!isset($modx->config['sys_files_checksum']) || empty($modx->config['sys_files_checksum'])) { |
320
|
|
|
$this->setSystemChecksum($current); |
321
|
|
|
|
322
|
|
|
return '0'; |
323
|
|
|
} |
324
|
|
|
if ($current === $modx->config['sys_files_checksum']) { |
325
|
|
|
$result = '0'; |
326
|
|
|
} else { |
327
|
|
|
$result = $this->getModifiedSystemFilesList($modx->config['check_files_onlogin'], |
328
|
|
|
$modx->config['sys_files_checksum']); |
329
|
|
|
} |
330
|
|
|
|
331
|
|
|
return $result; |
332
|
|
|
} |
333
|
|
|
|
334
|
|
|
/** |
335
|
|
|
* @param bool|string $key |
336
|
|
|
* @return null|string|array |
337
|
|
|
*/ |
338
|
|
|
public function getLastUserSetting($key = false) |
|
|
|
|
339
|
|
|
{ |
340
|
|
|
$modx = evolutionCMS(); |
341
|
|
|
|
342
|
|
|
$rs = $modx->getDatabase()->select('*', $modx->getFullTableName('user_settings'), |
|
|
|
|
343
|
|
|
"user = '{$_SESSION['mgrInternalKey']}'"); |
344
|
|
|
|
345
|
|
|
$usersettings = array(); |
346
|
|
|
while ($row = $modx->getDatabase()->getRow($rs)) { |
|
|
|
|
347
|
|
|
if (substr($row['setting_name'], 0, 6) == '_LAST_') { |
348
|
|
|
$name = substr($row['setting_name'], 6); |
349
|
|
|
$usersettings[$name] = $row['setting_value']; |
350
|
|
|
} |
351
|
|
|
} |
352
|
|
|
|
353
|
|
|
if ($key === false) { |
354
|
|
|
return $usersettings; |
355
|
|
|
} else { |
356
|
|
|
return isset($usersettings[$key]) ? $usersettings[$key] : null; |
357
|
|
|
} |
358
|
|
|
} |
359
|
|
|
|
360
|
|
|
/** |
361
|
|
|
* @param array $settings |
362
|
|
|
* @param string $val |
363
|
|
|
*/ |
364
|
|
|
public function saveLastUserSetting($settings, $val = '') |
|
|
|
|
365
|
|
|
{ |
366
|
|
|
$modx = evolutionCMS(); |
367
|
|
|
|
368
|
|
|
if (!empty($settings)) { |
369
|
|
|
if (!is_array($settings)) { |
370
|
|
|
$settings = array($settings => $val); |
371
|
|
|
} |
372
|
|
|
|
373
|
|
|
foreach ($settings as $key => $val) { |
374
|
|
|
$f = array(); |
375
|
|
|
$f['user'] = $_SESSION['mgrInternalKey']; |
376
|
|
|
$f['setting_name'] = '_LAST_' . $key; |
377
|
|
|
$f['setting_value'] = $val; |
378
|
|
|
$f = $modx->getDatabase()->escape($f); |
379
|
|
|
$f = "(`" . implode("`, `", array_keys($f)) . "`) VALUES('" . implode("', '", array_values($f)) . "')"; |
380
|
|
|
$f .= " ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)"; |
381
|
|
|
$modx->getDatabase()->insert($f, $modx->getFullTableName('user_settings')); |
382
|
|
|
} |
383
|
|
|
} |
384
|
|
|
} |
385
|
|
|
|
386
|
|
|
/** |
387
|
|
|
* @param $path |
388
|
|
|
* @return string |
389
|
|
|
*/ |
390
|
|
|
public function loadDatePicker($path) |
391
|
|
|
{ |
392
|
|
|
$modx = evolutionCMS(); |
393
|
|
|
include_once($path); |
394
|
|
|
$dp = new \DATEPICKER(); |
|
|
|
|
395
|
|
|
|
396
|
|
|
return $modx->mergeSettingsContent($dp->getDP()); |
397
|
|
|
} |
398
|
|
|
} |
399
|
|
|
|
Instead of relying on
global
state, we recommend one of these alternatives:1. Pass all data via parameters
2. Create a class that maintains your state