diff --git a/phpgwapi/inc/class.auth_ldap.inc.php b/phpgwapi/inc/class.auth_ldap.inc.php index 5398a13f47..743facacb3 100644 --- a/phpgwapi/inc/class.auth_ldap.inc.php +++ b/phpgwapi/inc/class.auth_ldap.inc.php @@ -26,6 +26,8 @@ class auth { + var $previous_login = -1; + function authenticate($username, $passwd) { global $phpgw_info, $phpgw; @@ -87,10 +89,13 @@ function update_lastlogin($account_id, $ip) { global $phpgw; - - $account_id = get_account_id($account_id); + + $db->query("select account_lastlogin from phpgw_accounts where account_id='$account_id'",__LINE__,__FILE__); + $db->next_record(); + $this->previous_login = $db->f('account_lastlogin'); + $now = time(); - + $phpgw->db->query("update phpgw_accounts set account_lastloginfrom='" . "$ip', account_lastlogin='" . $now . "' where account_id='$account_id'",__LINE__,__FILE__); diff --git a/phpgwapi/inc/class.auth_mail.inc.php b/phpgwapi/inc/class.auth_mail.inc.php index 4778f4b494..014cb7bd5f 100644 --- a/phpgwapi/inc/class.auth_mail.inc.php +++ b/phpgwapi/inc/class.auth_mail.inc.php @@ -25,6 +25,8 @@ class auth { + var $previous_login = -1; + function authenticate($username, $passwd) { global $phpgw_info, $phpgw; @@ -73,7 +75,9 @@ { global $phpgw; - $account_id = get_account_id($account_id); + $db->query("select account_lastlogin from phpgw_accounts where account_id='$account_id'",__LINE__,__FILE__); + $db->next_record(); + $this->previous_login = $db->f('account_lastlogin'); $phpgw->db->query("update phpgw_accounts set account_lastloginfrom='" . "$ip', account_lastlogin='" . time() diff --git a/phpgwapi/inc/class.auth_sql.inc.php b/phpgwapi/inc/class.auth_sql.inc.php index f09a2d8cac..443b648f2f 100644 --- a/phpgwapi/inc/class.auth_sql.inc.php +++ b/phpgwapi/inc/class.auth_sql.inc.php @@ -26,6 +26,8 @@ class auth { + var $previous_login = -1; + function authenticate($username, $passwd) { global $phpgw_info, $phpgw; @@ -35,9 +37,13 @@ . "account_pwd='" . md5($passwd) . "' AND account_status ='A'",__LINE__,__FILE__); $db->next_record(); - if ($db->f('account_lid')) { + if ($db->f('account_lid')) + { + $this->previous_login = $db->f('account_lastlogin'); return True; - } else { + } + else + { return False; } } @@ -65,8 +71,6 @@ { global $phpgw; - $account_id = get_account_id($account_id); - $phpgw->db->query("update phpgw_accounts set account_lastloginfrom='" . "$ip', account_lastlogin='" . time() . "' where account_id='$account_id'",__LINE__,__FILE__); diff --git a/phpgwapi/inc/class.auth_sqlssl.inc.php b/phpgwapi/inc/class.auth_sqlssl.inc.php index 7c5172c4fc..ebf55ee228 100644 --- a/phpgwapi/inc/class.auth_sqlssl.inc.php +++ b/phpgwapi/inc/class.auth_sqlssl.inc.php @@ -1,84 +1,103 @@ * - * Authentication based on SQL table and X.509 certificates * - * Copyright (C) 2000, 2001 Dan Kuykendall * - * -------------------------------------------------------------------------* - * This library is part of the phpGroupWare API * - * http://www.phpgroupware.org/api * - * ------------------------------------------------------------------------ * - * This library is free software; you can redistribute it and/or modify it * - * under the terms of the GNU Lesser General Public License as published by * - * the Free Software Foundation; either version 2.1 of the License, * - * or any later version. * - * This library is distributed in the hope that it will be useful, but * - * WITHOUT ANY WARRANTY; without even the implied warranty of * - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * - * See the GNU Lesser General Public License for more details. * - * You should have received a copy of the GNU Lesser General Public License * - * along with this library; if not, write to the Free Software Foundation, * - * Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * - \**************************************************************************/ + /**************************************************************************\ + * phpGroupWare API - Auth from SQL, with optional SSL authentication * + * This file written by Andreas 'Count' Kotes * + * Authentication based on SQL table and X.509 certificates * + * Copyright (C) 2000, 2001 Dan Kuykendall * + * -------------------------------------------------------------------------* + * This library is part of the phpGroupWare API * + * http://www.phpgroupware.org/api * + * ------------------------------------------------------------------------ * + * This library is free software; you can redistribute it and/or modify it * + * under the terms of the GNU Lesser General Public License as published by * + * the Free Software Foundation; either version 2.1 of the License, * + * or any later version. * + * This library is distributed in the hope that it will be useful, but * + * WITHOUT ANY WARRANTY; without even the implied warranty of * + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. * + * See the GNU Lesser General Public License for more details. * + * You should have received a copy of the GNU Lesser General Public License * + * along with this library; if not, write to the Free Software Foundation, * + * Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA * + \**************************************************************************/ - /* $Id$ */ + /* $Id$ */ - class auth - { + class auth + { + var $previous_login = -1; - function authenticate($username, $passwd) { - global $phpgw_info, $phpgw, $HTTP_SERVER_VARS; - - $db = $phpgw->db; - - $local_debug = False; - - if ($local_debug) { - echo "Debug SQL: uid - $username passwd - $passwd"; - } - - # Apache + mod_ssl provide the data in the environment - # Certificate (chain) verification occurs inside mod_ssl - # see http://www.modssl.org/docs/2.8/ssl_howto.html#ToC6 - if (!isset($HTTP_SERVER_VARS["SSL_CLIENT_S_DN"])) { - # if we're not doing SSL authentication, behave like auth_sql - $db->query("SELECT * FROM phpgw_accounts WHERE account_lid = '$username' AND " + function authenticate($username, $passwd) + { + global $phpgw_info, $phpgw, $HTTP_SERVER_VARS; + + $db = $phpgw->db; + + $local_debug = False; + + if ($local_debug) + { + echo "Debug SQL: uid - $username passwd - $passwd"; + } + + # Apache + mod_ssl provide the data in the environment + # Certificate (chain) verification occurs inside mod_ssl + # see http://www.modssl.org/docs/2.8/ssl_howto.html#ToC6 + if (!isset($HTTP_SERVER_VARS['SSL_CLIENT_S_DN'])) + { + # if we're not doing SSL authentication, behave like auth_sql + $db->query("SELECT * FROM phpgw_accounts WHERE account_lid = '$username' AND " . "account_pwd='" . md5($passwd) . "' AND account_status ='A'",__LINE__,__FILE__); - $db->next_record(); - } else { - # use username only for authentication, ignore X.509 subject in $passwd for now - $db->query("SELECT * FROM phpgw_accounts WHERE account_lid = '$username' AND account_status ='A'",__LINE__,__FILE__); - $db->next_record(); - } + $db->next_record(); + } + else + { + # use username only for authentication, ignore X.509 subject in $passwd for now + $db->query("SELECT * FROM phpgw_accounts WHERE account_lid = '$username' AND account_status ='A'",__LINE__,__FILE__); + $db->next_record(); + } - if ($db->f("account_lid")) { - return True; - } else { - return False; - } - } + if ($db->f('account_lid')) + { + return True; + } + else + { + return False; + } + } - function change_password($old_passwd, $new_passwd) { - global $phpgw_info, $phpgw; - $encrypted_passwd = md5($new_passwd); - $phpgw->db->query("update phpgw_accounts set account_pwd='" . md5($new_passwd) . "' " - . "where account_lid='" . $phpgw_info["user"]["userid"] . "'",__LINE__,__FILE__); - $phpgw->db->query("update phpgw_accounts set account_lastpwd_change='" . time() . "' where account_id='" - . $phpgw_info["user"]["account_id"] . "'",__LINE__,__FILE__); + function change_password($old_passwd, $new_passwd, $account_id = '') + { + global $phpgw_info, $phpgw; - return $encrypted_passwd; - } + if (! $account_id) + { + $account_id = $phpgw_info['user']['account_id']; + } - function update_lastlogin($account_id, $ip) - { - global $phpgw; - - $account_id = get_account_id($account_id); - - $phpgw->db->query("update phpgw_accounts set account_lastloginfrom='" - . "$ip', account_lastlogin='" . time() - . "' where account_id='$account_id'",__LINE__,__FILE__); - } + $encrypted_passwd = md5($new_passwd); - } + $phpgw->db->query("update phpgw_accounts set account_pwd='" . md5($new_passwd) . "'," + . "account_lastpwd_change='" . time() . "' where account_id='" . $account_id . "'",__LINE__,__FILE__); + + $phpgw->session->appsession('password','phpgwapi',$new_passwd); + + return $encrypted_passwd; + } + + function update_lastlogin($account_id, $ip) + { + global $phpgw; + + $db->query("select account_lastlogin from phpgw_accounts where account_id='$account_id'",__LINE__,__FILE__); + $db->next_record(); + $this->previous_login = $db->f('account_lastlogin'); + + $phpgw->db->query("update phpgw_accounts set account_lastloginfrom='" + . "$ip', account_lastlogin='" . time() + . "' where account_id='$account_id'",__LINE__,__FILE__); + } + + } ?> diff --git a/phpgwapi/inc/class.sessions.inc.php b/phpgwapi/inc/class.sessions.inc.php index d075ef9245..02ec227a8f 100644 --- a/phpgwapi/inc/class.sessions.inc.php +++ b/phpgwapi/inc/class.sessions.inc.php @@ -308,6 +308,7 @@ $phpgw->db->query("insert into phpgw_access_log values ('" . $this->sessionid . "','" . "$login','" . $user_ip . "','$now','') ",__LINE__,__FILE__); + $this->appsession('account_previous_login','phpgwapi',$phpgw->auth->previous_login); $phpgw->auth->update_lastlogin($this->account_id,$user_ip); return $this->sessionid;