dolibarr  18.0.0-alpha
functions_dolibarr.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2007-2015 Laurent Destailleur <eldy@users.sourceforge.net>
3  * Copyright (C) 2007-2015 Regis Houssin <regis.houssin@inodbox.com>
4  * Copyright (C) 2010-2011 Juanjo Menent <jmenent@2byte.es>
5  * Copyright (C) 2022 Harry Winner Kamdem <harry@sense.africa>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program. If not, see <https://www.gnu.org/licenses/>.
19  */
20 
38 function check_user_password_dolibarr($usertotest, $passwordtotest, $entitytotest = 1)
39 {
40  global $db, $conf, $langs;
41 
42  // Force master entity in transversal mode
43  $entity = $entitytotest;
44  if (isModEnabled('multicompany') && !empty($conf->global->MULTICOMPANY_TRANSVERSE_MODE)) {
45  $entity = 1;
46  }
47 
48  $login = '';
49 
50  if (!empty($usertotest)) {
51  require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
52  dol_syslog("functions_dolibarr::check_user_password_dolibarr usertotest=".$usertotest." passwordtotest=".preg_replace('/./', '*', $passwordtotest)." entitytotest=".$entitytotest);
53 
54  // If test username/password asked, we define $test=false if ko and $login var to login if ok, set also $_SESSION["dol_loginmesg"] if ko
55  $table = MAIN_DB_PREFIX."user";
56  $usernamecol1 = 'login';
57  $usernamecol2 = 'email';
58  $entitycol = 'entity';
59 
60  $sql = "SELECT rowid, login, entity, pass, pass_crypted, datestartvalidity, dateendvalidity, flagdelsessionsbefore";
61  $sql .= " FROM ".$table;
62  $sql .= " WHERE (".$usernamecol1." = '".$db->escape($usertotest)."'";
63  if (preg_match('/@/', $usertotest)) {
64  $sql .= " OR ".$usernamecol2." = '".$db->escape($usertotest)."'";
65  }
66  $sql .= ") AND ".$entitycol." IN (0,".($entity ? ((int) $entity) : 1).")";
67  $sql .= " AND statut = 1";
68  // Note: Test on validity is done later
69  // Order is required to firstly found the user into entity, then the superadmin.
70  // For the case (TODO: we must avoid that) a user has renamed its login with same value than a user in entity 0.
71  $sql .= " ORDER BY entity DESC";
72 
73  $resql = $db->query($sql);
74  if ($resql) {
75  $obj = $db->fetch_object($resql);
76  if ($obj) {
77  $passclear = $obj->pass;
78  $passcrypted = $obj->pass_crypted;
79  $passtyped = $passwordtotest;
80 
81  $passok = false;
82 
83  // Check crypted password
84  $cryptType = '';
85  if (!empty($conf->global->DATABASE_PWD_ENCRYPTED)) {
86  $cryptType = $conf->global->DATABASE_PWD_ENCRYPTED;
87  }
88 
89  // By default, we use default setup for encryption rule
90  if (!in_array($cryptType, array('auto'))) {
91  $cryptType = 'auto';
92  }
93  // Check crypted password according to crypt algorithm
94  if ($cryptType == 'auto') {
95  if ($passcrypted && dol_verifyHash($passtyped, $passcrypted, '0')) {
96  $passok = true;
97  dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok - hash ".$cryptType." of pass is ok");
98  }
99  }
100 
101  // For compatibility with very old versions
102  if (!$passok) {
103  if ((!$passcrypted || $passtyped)
104  && ($passclear && ($passtyped == $passclear))) {
105  $passok = true;
106  dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok - found old pass in database", LOG_WARNING);
107  }
108  }
109 
110  // Password ok ?
111  if ($passok) {
112  $login = $obj->login;
113  } else {
114  dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO bad password for '".$usertotest."', cryptType=".$cryptType, LOG_NOTICE);
115  sleep(1); // Anti brut force protection. Must be same delay when login is not valid
116 
117  // Load translation files required by the page
118  $langs->loadLangs(array('main', 'errors'));
119 
120  $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorBadLoginPassword");
121  }
122 
123  // We must check entity
124  if ($passok && isModEnabled('multicompany')) { // We must check entity
125  global $mc;
126 
127  if (!isset($mc)) {
128  !isModEnabled('multicompany'); // Global not available, disable $conf->multicompany->enabled for safety
129  } else {
130  $ret = $mc->checkRight($obj->rowid, $entitytotest);
131  if ($ret < 0) {
132  dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO entity '".$entitytotest."' not allowed for user '".$obj->rowid."'", LOG_NOTICE);
133 
134  $login = ''; // force authentication failure
135  if ($mc->db->lasterror()) {
136  $_SESSION["dol_loginmesg"] = $mc->db->lasterror();
137  }
138  }
139  }
140  }
141  } else {
142  dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO user not found for '".$usertotest."'", LOG_NOTICE);
143  sleep(1); // Anti brut force protection. Must be same delay when password is not valid
144 
145  // Load translation files required by the page
146  $langs->loadLangs(array('main', 'errors'));
147 
148  $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorBadLoginPassword");
149  }
150  } else {
151  dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO db error for '".$usertotest."' error=".$db->lasterror(), LOG_ERR);
152  sleep(1);
153  $_SESSION["dol_loginmesg"] = $db->lasterror();
154  }
155  }
156 
157  return $login;
158 }
$sql
if(isModEnabled('facture') &&!empty($user->rights->facture->lire)) if((isModEnabled('fournisseur') &&empty($conf->global->MAIN_USE_NEW_SUPPLIERMOD) && $user->hasRight("fournisseur", "facture", "lire"))||(isModEnabled('supplier_invoice') && $user->hasRight("supplier_invoice", "lire"))) if(isModEnabled('don') &&!empty($user->rights->don->lire)) if(isModEnabled('tax') &&!empty($user->rights->tax->charges->lire)) if(isModEnabled('facture') &&isModEnabled('commande') && $user->hasRight("commande", "lire") &&empty($conf->global->WORKFLOW_DISABLE_CREATE_INVOICE_FROM_ORDER)) $sql
Social contributions to pay.
Definition: index.php:745
dol_verifyHash
dol_verifyHash($chain, $hash, $type='0')
Compute a hash and compare it to the given one For backward compatibility reasons,...
Definition: security.lib.php:266
dol_syslog
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
Definition: functions.lib.php:1669
isModEnabled
isModEnabled($module)
Is Dolibarr module enabled.
Definition: functions.lib.php:166
check_user_password_dolibarr
check_user_password_dolibarr($usertotest, $passwordtotest, $entitytotest=1)
Check validity of user/password/entity If test is ko, reason must be filled into $_SESSION["dol_login...
Definition: functions_dolibarr.php:38