Happy New Year

[squirrelmail.git] / plugins / change_password / backend / mysql.php

diff --git a/plugins/change_password/backend/mysql.php b/plugins/change_password/backend/mysql.php
index bb40be02144d22fcbe40d020c5217dd5356548e5..1df21030bea4cf66e1c0fa53a52abdf7d1bd826b 100644 (file)
--- a/plugins/change_password/backend/mysql.php
+++ b/plugins/change_password/backend/mysql.php
@@ -1,6 +1,14 @@
 <?php
 <?php

-/* MySQL change password backend
- * Author: Thijs Kinkhorst <kink@squirrelmail.org>
+
+/**
+ * MySQL change password backend
+ *
+ * @author Thijs Kinkhorst <kink at squirrelmail.org>
+ * @copyright 2003-2018 The SquirrelMail Project Team
+ * @license http://opensource.org/licenses/gpl-license.php GNU Public License
+ * @version $Id$
+ * @package plugins
+ * @subpackage change_password

  */
 
 /**
  */
 
 /**


@@ -8,9 +16,10 @@
  */
 
 global $mysql_server, $mysql_database, $mysql_table, $mysql_userid_field,
  */
 
 global $mysql_server, $mysql_database, $mysql_table, $mysql_userid_field,

-       $mysql_password_field, $mysql_manager_id, $mysql_manager_pw;
+       $mysql_password_field, $mysql_manager_id, $mysql_manager_pw,
+       $mysql_saslcrypt, $mysql_unixcrypt, $cpw_mysql;

 
 

-// The MySQL Server
+// Initialize defaults

 $mysql_server = 'localhost';
 $mysql_database = 'email';
 $mysql_table = 'users';
 $mysql_server = 'localhost';
 $mysql_database = 'email';
 $mysql_table = 'users';


@@ -23,12 +32,23 @@ $mysql_password_field ='password';
 $mysql_manager_id = 'email_admin';
 $mysql_manager_pw = 'xxxxxxx';
 
 $mysql_manager_id = 'email_admin';
 $mysql_manager_pw = 'xxxxxxx';
 

+// saslcrypt checked first - if it is 1, UNIX crypt is not used.
+$mysql_saslcrypt = 0; // use MySQL password() function
+$mysql_unixcrypt = 0; // use UNIX crypt() function

 
 

-// NO NEED TO CHANGE ANYTHING BELOW THIS LINE
+// get overrides from config.
+if ( isset($cpw_mysql) && is_array($cpw_mysql) && !empty($cpw_mysql) )
+{
+  foreach ( $cpw_mysql as $key => $value )
+  {
+    if ( isset(${'mysql_'.$key}) )
+      ${'mysql_'.$key} = $value;
+  }
+}

 
 global $squirrelmail_plugin_hooks;
 
 global $squirrelmail_plugin_hooks;

-$squirrelmail_plugin_hooks['change_password_dochange']['mysql'] = 
-       'cpw_mysql_dochange';
+$squirrelmail_plugin_hooks['change_password_dochange']['mysql'] =
+        'cpw_mysql_dochange';

 
 /**
  * This is the function that is specific to your backend. It takes
 
 /**
  * This is the function that is specific to your backend. It takes


@@ -40,7 +60,7 @@ $squirrelmail_plugin_hooks['change_password_dochange']['mysql'] =
  * CPW_CURRENT_NOMATCH -> "Your current password is not correct."
  * CPW_INVALID_PW -> "Your new password contains invalid characters."
  *
  * CPW_CURRENT_NOMATCH -> "Your current password is not correct."
  * CPW_INVALID_PW -> "Your new password contains invalid characters."
  *

- * @param array data The username/currentpw/newpw data. 
+ * @param array data The username/currentpw/newpw data.

  * @return array Array of error messages.
  */
 function cpw_mysql_dochange($data)
  * @return array Array of error messages.
  */
 function cpw_mysql_dochange($data)


@@ -54,26 +74,38 @@ function cpw_mysql_dochange($data)
     $msgs = array();
 
     global $mysql_server, $mysql_database, $mysql_table, $mysql_userid_field,
     $msgs = array();
 
     global $mysql_server, $mysql_database, $mysql_table, $mysql_userid_field,

-           $mysql_password_field, $mysql_manager_id, $mysql_manager_pw;
+           $mysql_password_field, $mysql_manager_id, $mysql_manager_pw,
+           $mysql_saslcrypt, $mysql_unixcrypt;

 
 

+    // TODO: allow to choose between mysql_connect() and mysql_pconnect() functions.

     $ds = mysql_pconnect($mysql_server, $mysql_manager_id, $mysql_manager_pw);
     if (! $ds) {
         array_push($msgs, _("Cannot connect to Database Server, please try later!"));
     $ds = mysql_pconnect($mysql_server, $mysql_manager_id, $mysql_manager_pw);
     if (! $ds) {
         array_push($msgs, _("Cannot connect to Database Server, please try later!"));

-       return $msgs;
+        return $msgs;

     }
     if (!mysql_select_db($mysql_database, $ds)) {
         array_push($msgs, _("Database not found on server"));
     }
     if (!mysql_select_db($mysql_database, $ds)) {
         array_push($msgs, _("Database not found on server"));

-       return $msgs;
+        return $msgs;

     }
 
     $query_string = 'SELECT ' . $mysql_userid_field . ',' . $mysql_password_field
                   . ' FROM '  . $mysql_table
     }
 
     $query_string = 'SELECT ' . $mysql_userid_field . ',' . $mysql_password_field
                   . ' FROM '  . $mysql_table

-                  . ' WHERE ' . $mysql_userid_field . '="' . mysql_escape_string($username) .'"'
-                 . ' AND ' . $mysql_password_field . '="' . mysql_escape_string($curpw) . '"';
+                  . ' WHERE ' . $mysql_userid_field . '="' . mysql_real_escape_string($username, $ds) .'"'
+                  . ' AND ' . $mysql_password_field;
+
+    if ($mysql_saslcrypt) {
+        $query_string  .= '=password("'.mysql_real_escape_string($curpw, $ds).'")';
+    } elseif ($mysql_unixcrypt) {
+        // FIXME: why password field name is used for salting
+        $query_string  .= '=encrypt("'.mysql_real_escape_string($curpw, $ds).'", '.$mysql_password_field . ')';
+    } else {
+        $query_string  .= '="' . mysql_real_escape_string($curpw, $ds) . '"';
+    }
+

     $select_result = mysql_query($query_string, $ds);
     if (!$select_result) {
         array_push($msgs, _("SQL call failed, try again later."));
     $select_result = mysql_query($query_string, $ds);
     if (!$select_result) {
         array_push($msgs, _("SQL call failed, try again later."));

-       return $msgs;
+        return $msgs;

     }
 
     if (mysql_num_rows($select_result) == 0) {
     }
 
     if (mysql_num_rows($select_result) == 0) {


@@ -86,9 +118,18 @@ function cpw_mysql_dochange($data)
         return $msgs;
     }
 
         return $msgs;
     }
 

-    $update_string = 'UPDATE '. $mysql_table . ' SET ' . $mysql_password_field
-                   . ' = "' . mysql_escape_string($cp_newpass) . '"'
-                  . ' WHERE ' . $mysql_userid_field . ' = "' . mysql_escape_string($username) . '"';
+    $update_string = 'UPDATE '. $mysql_table . ' SET ' . $mysql_password_field;
+
+    if ($mysql_saslcrypt) {
+        $update_string  .= '=password("'.mysql_real_escape_string($newpw, $ds).'")';
+    } elseif ($mysql_unixcrypt) {
+        // FIXME: use random salt when you create new password
+        $update_string  .= '=encrypt("'.mysql_real_escape_string($newpw, $ds).'", '.$mysql_password_field . ')';
+    } else {
+        $update_string  .= '="' . mysql_real_escape_string($newpw, $ds) . '"';
+    }
+    $update_string .= ' WHERE ' . $mysql_userid_field . ' = "' . mysql_real_escape_string($username, $ds) . '"';
+

     if (!mysql_query($update_string, $ds)) {
         array_push($msgs, _("Password change was not successful!"));
     }
     if (!mysql_query($update_string, $ds)) {
         array_push($msgs, _("Password change was not successful!"));
     }