sydney/IPB
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 5.0.0 beta 1

Browse Source
This commit is contained in:
Neo committed 2025-12-19 16:27:35 -08:00
1 parent 25ddeb65d6
commit 15c7beabc5
6736 files changed
+627902 -497943
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

applications/core/modules/setup/upgrade/login.php
+101 -46
View File
@@ -11,27 +11,56 @@
namespace IPS\core\modules\setup\upgrade;
/* To prevent PHP errors (extending class does not exist) revealing path */
if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
use IPS\Application;
use IPS\core\Setup\Upgrade;
use IPS\Data\Cache;
use IPS\Data\Store;
use IPS\Db;
use IPS\Dispatcher\Controller;
use IPS\Http\Url;
use IPS\IPS;
use IPS\Login as LoginClass;
use IPS\Member;
use IPS\Output;
use IPS\Request;
use IPS\Settings;
use IPS\Theme;
use OutOfRangeException;
use UnderflowException;
use function count;
use function defined;
use const IPS\BYPASS_UPGRADER_LOGIN;
if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
{
header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
header( ( $_SERVER['SERVER_PROTOCOL'] ?? 'HTTP/1.0' ) . ' 403 Forbidden' );
exit;
}
/**
* Upgrader: Login
*/
class _login extends \IPS\Dispatcher\Controller
class login extends Controller
{
/**
* Anything lower than this will cause the upgrader to disable
* non-1st party apps
*
* @var int
*/
protected static int $minimumv5 = 5000015;
/**
* Show login form and/or process login form
*
* @todo [Upgrade] Will also need to account for things in the input (e.g. password) that would be replaced, like & to &
* @return void
*/
public function manage()
public function manage() : void
{
/* Clear previous session data */
if( !isset( \IPS\Request::i()->sessionCheck ) AND \count( $_SESSION ) )
if( !isset( Request::i()->sessionCheck ) AND count( $_SESSION ) )
{
foreach( $_SESSION as $k => $v )
{
@@ -40,52 +69,78 @@ class _login extends \IPS\Dispatcher\Controller
}
/* Store a session variable and then check it on the next page load to make sure PHP sessions are working */
if( !isset( \IPS\Request::i()->sessionCheck ) )
if( !isset( Request::i()->sessionCheck ) )
{
$_SESSION['sessionCheck'] = TRUE;
\IPS\Output::i()->redirect( \IPS\Request::i()->url()->setQueryString( 'sessionCheck', 1 ), NULL, 307 ); // 307 instructs the browser to resubmit the form as a POST request maintaining all the values from before
Output::i()->redirect( Request::i()->url()->setQueryString( 'sessionCheck', 1 ), NULL, 307 ); // 307 instructs the browser to resubmit the form as a POST request maintaining all the values from before
}
else
{
if( !isset( $_SESSION['sessionCheck'] ) OR !$_SESSION['sessionCheck'] )
{
\IPS\Output::i()->error( 'session_check_fail', '5C289/1', 500, '' );
Output::i()->error( 'session_check_fail', '5C289/1', 500, '' );
}
}
/* Are we automatically logging in? */
if ( isset( \IPS\Request::i()->autologin ) and isset( \IPS\Request::i()->cookie['IPSSessionAdmin'] ) )
if ( isset( Request::i()->autologin ) and isset( Request::i()->cookie['IPSSessionAdmin'] ) )
{
try
{
$session = \IPS\Db::i()->select( '*', 'core_sys_cp_sessions', array( 'session_id=?', \IPS\Request::i()->cookie['IPSSessionAdmin'] ) )->first();
$member = $session['session_member_id'] ? \IPS\Member::load( $session['session_member_id'] ) : new \IPS\Member;
if ( $member->member_id and $this->_memberHasUpgradePermission( $member ) and ( !\IPS\Settings::i()->match_ipaddress or ( $session['session_ip_address'] === \IPS\Request::i()->ipAddress() ) ) )
$session = Db::i()->select( '*', 'core_sys_cp_sessions', array( 'session_id=?', Request::i()->cookie['IPSSessionAdmin'] ) )->first();
$member = $session['session_member_id'] ? Member::load( $session['session_member_id'] ) : new Member;
if ( $member->member_id and $this->_memberHasUpgradePermission( $member ) and ( !Settings::i()->match_ipaddress or ( $session['session_ip_address'] === Request::i()->ipAddress() ) ) )
{
$_SESSION['uniqueKey'] = \IPS\Login::generateRandomString();
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( "controller=systemcheck" )->setQueryString( 'key', $_SESSION['uniqueKey'] ) );
$_SESSION['uniqueKey'] = LoginClass::generateRandomString();
Output::i()->redirect( Url::internal( "controller=systemcheck" )->setQueryString( 'key', $_SESSION['uniqueKey'] ) );
}
}
catch( \UnderflowException $e ) {}
catch( UnderflowException $e ) {}
}
if ( \IPS\BYPASS_UPGRADER_LOGIN )
if ( BYPASS_UPGRADER_LOGIN )
{
$_SESSION['uniqueKey'] = \IPS\Login::generateRandomString();
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( "controller=systemcheck" )->setQueryString( 'key', $_SESSION['uniqueKey'] ) );
$_SESSION['uniqueKey'] = LoginClass::generateRandomString();
Output::i()->redirect( Url::internal( "controller=systemcheck" )->setQueryString( 'key', $_SESSION['uniqueKey'] ) );
}
/* Drop the data store before we continue */
/* Before going any further, make sure there is an actual upgrade to be done. This both provides a nicer experience (so
people don't log in ust to be told there's nothing to upgrade) and prevents having a permenantly available login
screen which doesn't use locking (which could be use to bruteforce an account) */
$canUpgrade = FALSE;
foreach( \IPS\Application::applications() as $app => $data )
$currentBaseVersion = Db::i()->select( 'app_long_version', 'core_applications', [ 'app_directory=?', 'core' ] )->first();
/* If we are upgrading from a version earlier than v5, disable and lock anything that isn't 1st party */
if( $currentBaseVersion < static::$minimumv5 )
{
$path = \IPS\Application::getRootPath( $app ) . '/applications/' . $app;
Db::i()->update( 'core_applications', [ 'app_enabled' => 0, 'app_requires_manual_intervention' => 1 ], Db::i()->in( 'app_directory', IPS::$ipsApps, true ) );
Cache::i()->clearAll();
Store::i()->clearAll();
}
foreach( Application::getStore() as $data )
{
$app = $data['app_directory'];
/* If we are upgrading from a version earlier than v5, only check 1st party apps */
if( $currentBaseVersion < static::$minimumv5 and !in_array( $app, IPS::$ipsApps ) )
{
continue;
}
/* Skip anything that is locked */
if( $data['app_requires_manual_intervention'] )
{
continue;
}
$path = Application::getRootPath( $app ) . '/applications/' . $app;
if ( $app != 'chat' and is_dir( $path . '/data' ) )
{
$currentVersion = \IPS\Application::load( $app )->long_version;
$availableVersion = \IPS\Application::getAvailableVersion( $app );
$currentVersion = Application::load( $app )->long_version;
$availableVersion = Application::getAvailableVersion( $app );
if ( empty( $errors ) AND $availableVersion > $currentVersion )
{
@@ -95,44 +150,44 @@ class _login extends \IPS\Dispatcher\Controller
}
/* We need to allow logins if the previous upgrade wasn't finished */
if( \IPS\Db::i()->checkForTable( 'upgrade_temp' ) )
if( Db::i()->checkForTable( 'upgrade_temp' ) )
{
$canUpgrade = TRUE;
}
if ( !$canUpgrade )
{
\IPS\Output::i()->output .= \IPS\Theme::i()->getTemplate( 'forms' )->noapps();
Output::i()->output .= Theme::i()->getTemplate( 'forms' )->noapps();
/* We do this just to be 100% certain the flag didn't get "stuck" and needs to be reset. */
\IPS\core\Setup\Upgrade::setUpgradingFlag( FALSE );
Upgrade::setUpgradingFlag( FALSE );
return;
}
/* Nope, show a form */
$error = NULL;
if ( isset( \IPS\Request::i()->auth ) and isset( \IPS\Request::i()->password ) )
if ( isset( Request::i()->auth ) and isset( Request::i()->password ) )
{
$table = 'core_members';
if ( \IPS\Db::i()->checkForTable( 'members' ) AND !\IPS\Db::i()->checkForTable( 'core_members' ) )
if ( Db::i()->checkForTable( 'members' ) AND !Db::i()->checkForTable( 'core_members' ) )
{
$table = 'members';
}
$memberRows = \IPS\Db::i()->select( '*', $table, array( 'email=? OR email=? OR name=? OR name=?', \IPS\Request::i()->auth, \IPS\Request::legacyEscape( \IPS\Request::i()->auth ), \IPS\Request::i()->auth, \IPS\Request::legacyEscape( \IPS\Request::i()->auth ) ) );
if ( \count( $memberRows ) )
$memberRows = Db::i()->select( '*', $table, array( 'email=? OR email=?', Request::i()->auth, Request::legacyEscape( Request::i()->auth ) ) );
if ( count( $memberRows ) )
{
foreach( $memberRows as $memberRow )
{
$member = \IPS\Member::constructFromData( $memberRow );
$member = Member::constructFromData( $memberRow );
if ( password_verify( \IPS\Request::i()->password, $member->members_pass_hash ) or $member->verifyLegacyPassword( \IPS\Request::i()->protect('password') ) )
if ( password_verify( Request::i()->password, $member->members_pass_hash ) or $member->verifyLegacyPassword( Request::i()->protect('password') ) )
{
if ( $this->_memberHasUpgradePermission( $member ) )
{
$_SESSION['uniqueKey'] = \IPS\Login::generateRandomString();
\IPS\IPS::resyncIPSCloud('Beginning upgrade');
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( "controller=systemcheck" )->setQueryString( 'key', $_SESSION['uniqueKey'] ) );
$_SESSION['uniqueKey'] = LoginClass::generateRandomString();
IPS::resyncIPSCloud('Beginning upgrade');
Output::i()->redirect( Url::internal( "controller=systemcheck" )->setQueryString( 'key', $_SESSION['uniqueKey'] ) );
}
else
{
@@ -153,26 +208,26 @@ class _login extends \IPS\Dispatcher\Controller
if ( $error )
{
$error = \IPS\Member::loggedIn()->language()->addToStack( $error, FALSE, array( 'pluralize' => array( 3 ) ) );
$error = Member::loggedIn()->language()->addToStack( $error, FALSE, array( 'pluralize' => array( 3 ) ) );
}
\IPS\Output::i()->title = \IPS\Member::loggedIn()->language()->addToStack('login');
\IPS\Output::i()->output .= \IPS\Theme::i()->getTemplate( 'forms' )->login( $error );
Output::i()->title = Member::loggedIn()->language()->addToStack('login');
Output::i()->output .= Theme::i()->getTemplate( 'forms' )->login( $error );
}
/**
* Can member log into upgrader?
*
* @param \IPS\Member $member The member
* @param Member $member The member
* @return bool
*/
protected function _memberHasUpgradePermission( \IPS\Member $member )
protected function _memberHasUpgradePermission( Member $member ) : bool
{
/* 4.x */
if ( \IPS\Db::i()->checkForTable( 'core_admin_permission_rows' ) )
if ( Db::i()->checkForTable( 'core_admin_permission_rows' ) )
{
/* This permission was added in 4.1.6, so if we have it, use it */
if ( \IPS\Application::load('core')->long_version > 101021 )
if ( Application::load('core')->long_version > 101021 )
{
return $member->hasAcpRestriction( 'core', 'overview', 'upgrade_manage' );
}
@@ -188,11 +243,11 @@ class _login extends \IPS\Dispatcher\Controller
/* Does our primary group have permission? */
try
{
$admin = (bool) \IPS\Db::i()->select( 'g_access_cp', 'groups', array( 'g_id=?', $member->member_group_id ) )->first();
$admin = (bool) Db::i()->select( 'g_access_cp', 'groups', array( 'g_id=?', $member->member_group_id ) )->first();
}
catch( \UnderflowException $e )
catch( UnderflowException $e )
{
throw new \OutOfRangeException( 'upgrade_group_not_exist' );
throw new OutOfRangeException( 'upgrade_group_not_exist' );
}
if( $admin )
@@ -208,7 +263,7 @@ class _login extends \IPS\Dispatcher\Controller
{
try
{
$admin = (bool) \IPS\Db::i()->select( 'g_access_cp', 'groups', array( 'g_id=?', $group ) )->first();
$admin = (bool) Db::i()->select( 'g_access_cp', 'groups', array( 'g_id=?', $group ) )->first();
if( $admin )
{
@@ -216,7 +271,7 @@ class _login extends \IPS\Dispatcher\Controller
}
}
/* It is possible the user has an old group that no longer exists defined as a secondary group */
catch( \UnderflowException $e ){}
catch( UnderflowException $e ){}
}
}