Initial commit

production/classes/session/cc_admin_session.php

@@ -0,0 +1,136 @@
+<?php 
+/*
++--------------------------------------------------------------------------
+|   CubeCart 4
+|   ========================================
+|	CubeCart is a registered trade mark of Devellion Limited
+|   Copyright Devellion Limited 2006. All rights reserved.
+|   Devellion Limited,
+|   5 Bridge Street,
+|   Bishops Stortford,
+|   HERTFORDSHIRE.
+|   CM23 2JU
+|   UNITED KINGDOM
+|   http://www.devellion.com
+|	UK Private Limited Company No. 5323904
+|   ========================================
+|   Web: http://www.cubecart.com
+|   Email: info (at) cubecart (dot) com
+|	License Type: CubeCart is NOT Open Source Software and Limitations Apply 
+|   Licence Info: http://www.cubecart.com/site/faq/license.php
++--------------------------------------------------------------------------
+|	cc_admin_session.php
+|   ========================================
+|	Admin Authentication and Permissions
++--------------------------------------------------------------------------
+*/
+
+class admin_session {
+	
+	var $config;
+	var $db;
+	var $glob;
+	var $ini;
+	
+	function admin_session() {
+		$this->__construct();
+	}
+	
+	function __construct() {
+		global $config, $db, $glob, $ini;
+		
+		$this->config	= $config;
+		$this->db		= &$db;
+		$this->glob		= $glob;
+		$this->ini		= $ini;
+	}
+	
+	function get_session_data() {
+		if (!isset($GLOBALS[CC_ADMIN_SESSION_NAME])) {
+			## If no session redirect to login screen
+			httpredir($GLOBALS['rootRel'].$this->glob['adminFile']."?_g=login&goto=".urlencode(currentPage()));
+		} else {
+			## Get session information as array
+			$query = sprintf("SELECT * FROM ".$this->glob['dbprefix']."CubeCart_admin_users WHERE sessId = %s", $this->db->mySQLSafe($GLOBALS[CC_ADMIN_SESSION_NAME]));
+			$ccAdminData = $this->db->select($query);
+			
+			## Security checks
+			//$client_ip = (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];
+			$client_ip = get_ip_address();
+			
+			if ($ccAdminData[0]['sessIp'] !== $client_ip || $ccAdminData[0]['browser'] !== $_SERVER['HTTP_USER_AGENT']) {
+				$this->logout();
+			}
+			
+			## Find permissions for those who are not super users
+			if (!$ccAdminData[0]['isSuper']) {
+				$query = sprintf("SELECT %1\$sCubeCart_admin_sections.sectId, name, `read`, `write`, `edit`, `delete` FROM %1\$sCubeCart_admin_sections LEFT JOIN %1\$sCubeCart_admin_permissions ON %1\$sCubeCart_admin_sections.sectId = %1\$sCubeCart_admin_permissions.sectId WHERE adminId = %2\$s", $this->glob['dbprefix'], $this->db->mySQLSafe($ccAdminData[0]['adminId']));
+				$permissionArray = $this->db->select($query);
+				
+				#print_r($permissionArray);
+				#die;
+				
+				if (is_array($permissionArray)) {
+					for ($i=0; $i<count($permissionArray); $i++) {
+						foreach ($permissionArray[$i] as $key => $value) {
+							$masterKey = $permissionArray[$i]['name'];
+							$ccAdminData[0][$masterKey][$key] = $value;
+						}
+					}
+				}
+			}
+			return $ccAdminData[0];
+		}
+	}
+	
+	function makeSessId() {
+		session_start();
+		session_regenerate_id(true);
+		return session_id();
+	}
+	
+	function logout() {
+		## reset session data
+		$record['sessId'] = "''";
+		$record['sessIp'] = "''";
+		$record['browser'] = "''";
+		
+		$this->db->update($this->glob['dbprefix']."CubeCart_admin_users", $record,"sessId = ".$this->db->MySQLSafe($GLOBALS[CC_ADMIN_SESSION_NAME]));
+		
+		$this->set_cc_admin_cookie(CC_ADMIN_SESSION_NAME, '');
+		httpredir($GLOBALS['rootRel'].$this->glob['adminFile']."?_g=login");
+	}
+	
+	function login($username, $password) {
+		$query = sprintf("SELECT adminId FROM %sCubeCart_admin_users WHERE username = %s AND password = %s AND failLevel < %s AND blockTime < %s", $this->glob['dbprefix'], $this->db->mySQLSafe($username), $this->db->mySQLSafe(md5($password)), $this->ini['bfattempts'], time());
+		$result = $this->db->select($query);
+		return $result;
+	}
+	
+	function createSession($admin_id) {
+		$sessionId = $this->makeSessId();
+		$this->set_cc_admin_cookie(CC_ADMIN_SESSION_NAME, $sessionId);
+		
+		## set session global var because cookie won't show until next page load
+		$GLOBALS[CC_ADMIN_SESSION_NAME] = $sessionId;
+		
+		$record['sessId'] = "'".$sessionId."'";
+		## log browser & ip for security purposes no session hijacking here :)
+		$record['sessIp'] = $this->db->MySQLSafe(get_ip_address());
+		$record['browser'] = $this->db->MySQLSafe($_SERVER['HTTP_USER_AGENT']);
+		$this->db->update($this->glob['dbprefix']."CubeCart_admin_users", $record, "adminId = ".$admin_id);
+	}
+	
+	function get_cookie_domain($domain) {
+		$cookie_domain = str_replace(array('http://', 'https://', 'www.'), '', strtolower($domain));
+		$cookie_domain = explode("/",$cookie_domain);
+		$cookie_domain = explode(":", $cookie_domain[0]);
+		return '.'.$cookie_domain[0];
+	}
+	
+	function set_cc_admin_cookie($name, $value) {
+		$expires = 0; ## remember session until browser is closed
+		@setcookie($name, $value, $expires, $GLOBALS['rootRel']);
+	}
+}
+?>