dolibarr 21.0.0-alpha
functions_dolibarr.php
Go to the documentation of this file.
1<?php
2/* Copyright (C) 2007-2015 Laurent Destailleur <eldy@users.sourceforge.net>
3 * Copyright (C) 2007-2015 Regis Houssin <regis.houssin@inodbox.com>
4 * Copyright (C) 2010-2011 Juanjo Menent <jmenent@2byte.es>
5 * Copyright (C) 2022 Harry Winner Kamdem <harry@sense.africa>
6 * Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program. If not, see <https://www.gnu.org/licenses/>.
20 */
21
39function check_user_password_dolibarr($usertotest, $passwordtotest, $entitytotest = 1)
40{
41 global $db, $conf, $langs;
42
43 // Force master entity in transversal mode
44 $entity = $entitytotest;
45 if (isModEnabled('multicompany') && getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE')) {
46 $entity = 1;
47 }
48
49 $login = '';
50
51 if (!empty($usertotest)) {
52 require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
53 dol_syslog("functions_dolibarr::check_user_password_dolibarr usertotest=".$usertotest." passwordtotest=".preg_replace('/./', '*', $passwordtotest)." entitytotest=".$entitytotest);
54
55 // Verification number of USER_LOGIN_FAILED
56 $dateverificationauth = dol_time_plus_duree(dol_now(), -1, 'd');
57 $userremoteip = getUserRemoteIP();
58 $nbevents = 0;
59
60 $sql = "SELECT COUNT(e.rowid) as nbevent";
61 $sql .= " FROM ".MAIN_DB_PREFIX."events as e";
62 $sql .= " WHERE e.type = 'USER_LOGIN_FAILED'";
63 $sql .= " AND e.ip = '".$db->escape($userremoteip)."'";
64 $sql .= " AND e.dateevent > '".$db->idate($dateverificationauth)."'";
65 $resql = $db->query($sql);
66 if ($resql) {
67 $obj = $db->fetch_object($resql);
68 if ($obj) {
69 $nbevents = $obj->nbevent;
70 }
71 }
72
73 if ($nbevents <= getDolGlobalInt("MAIN_SECURITY_MAX_NUMBER_FAILED_AUTH", 100)) {
74 // If test username/password asked, we define $test=false if ko and $login var to login if ok, set also $_SESSION["dol_loginmesg"] if ko
75 $table = MAIN_DB_PREFIX."user";
76 $usernamecol1 = 'login';
77 $usernamecol2 = 'email';
78 $entitycol = 'entity';
79
80 $sql = "SELECT rowid, login, entity, pass, pass_crypted, datestartvalidity, dateendvalidity, flagdelsessionsbefore";
81 $sql .= " FROM ".$table;
82 $sql .= " WHERE (".$usernamecol1." = '".$db->escape($usertotest)."'";
83 if (preg_match('/@/', $usertotest)) {
84 $sql .= " OR ".$usernamecol2." = '".$db->escape($usertotest)."'";
85 }
86 $sql .= ") AND ".$entitycol." IN (0,".($entity ? ((int) $entity) : 1).")";
87 $sql .= " AND statut = 1";
88 // Order is required to firstly found the user into entity, then the superadmin.
89 // For the case (TODO: we must avoid that) a user has renamed its login with same value than a user in entity 0.
90 $sql .= " ORDER BY entity DESC";
91
92 // Note: Test on validity is done later natively with isNotIntoValidityDateRange() by core after calling checkLoginPassEntity() that call this method
93
94 $resql = $db->query($sql);
95 if ($resql) {
96 $obj = $db->fetch_object($resql);
97 if ($obj) {
98 $passclear = $obj->pass;
99 $passcrypted = $obj->pass_crypted;
100 $passtyped = $passwordtotest;
101
102 $passok = false;
103
104 // Check crypted password
105 $cryptType = '';
106 if (getDolGlobalString('DATABASE_PWD_ENCRYPTED')) {
107 $cryptType = getDolGlobalString('DATABASE_PWD_ENCRYPTED');
108 }
109
110 // By default, we use default setup for encryption rule
111 if (!in_array($cryptType, array('auto'))) {
112 $cryptType = 'auto';
113 }
114 // Check encrypted password according to encryption algorithm
115 if ($cryptType == 'auto') {
116 if ($passcrypted && dol_verifyHash($passtyped, $passcrypted, '0')) {
117 $passok = true;
118 dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication ok - hash ".$cryptType." of pass is ok");
119 }
120 }
121
122 // For compatibility with very old versions
123 if (!$passok) {
124 if ((!$passcrypted || $passtyped)
125 && ($passclear && ($passtyped == $passclear))) {
126 $passok = true;
127 dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication ok - found old pass in database", LOG_WARNING);
128 }
129 }
130
131 // Password ok ?
132 if ($passok) {
133 $login = $obj->login;
134 } else {
135 dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO bad password for '".$usertotest."', cryptType=".$cryptType, LOG_NOTICE);
136 sleep(1); // Anti brut force protection. Must be same delay when login is not valid
137
138 // Load translation files required by the page
139 $langs->loadLangs(array('main', 'errors'));
140
141 $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorBadLoginPassword");
142 }
143
144 // We must check entity
145 if ($passok && isModEnabled('multicompany')) { // We must check entity
146 global $mc;
147
148 if (!isset($mc)) {
149 unset($conf->multicompany->enabled); // Global not available, disable $conf->multicompany->enabled for safety
150 } else {
151 $ret = $mc->checkRight($obj->rowid, $entitytotest);
152 if ($ret < 0) {
153 dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO entity '".$entitytotest."' not allowed for user '".$obj->rowid."'", LOG_NOTICE);
154
155 $login = ''; // force authentication failure
156 if ($mc->db->lasterror()) {
157 $_SESSION["dol_loginmesg"] = $mc->db->lasterror();
158 }
159 }
160 }
161 }
162 } else {
163 dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO user not found for '".$usertotest."'", LOG_NOTICE);
164 sleep(1); // Anti brut force protection. Must be same delay when password is not valid
165
166 // Load translation files required by the page
167 $langs->loadLangs(array('main', 'errors'));
168
169 $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorBadLoginPassword");
170 }
171 } else {
172 dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO db error for '".$usertotest."' error=".$db->lasterror(), LOG_ERR);
173 sleep(1);
174 $_SESSION["dol_loginmesg"] = $db->lasterror();
175 }
176 } else {
177 dol_syslog("functions_dolibarr::check_user_password_dolibarr Authentication KO Too many attempts", LOG_NOTICE);
178 sleep(1); // Anti brut force protection. Must be same delay when password is not valid
179 // Load translation files required by the page
180 $langs->loadLangs(array('main', 'errors'));
181 $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorTooManyAttempts");
182 }
183 }
184 return $login;
185}
dol_time_plus_duree($time, $duration_value, $duration_unit, $ruleforendofmonth=0)
Add a delay to a date.
Definition date.lib.php:124
dol_now($mode='auto')
Return date for now.
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
getUserRemoteIP()
Return the IP of remote user.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
check_user_password_dolibarr($usertotest, $passwordtotest, $entitytotest=1)
Check validity of user/password/entity If test is ko, reason must be filled into $_SESSION["dol_login...
dol_verifyHash($chain, $hash, $type='0')
Compute a hash and compare it to the given one For backward compatibility reasons,...