cgi-files/Modules/Auth/PostgreSQL.pm

   1 #################################################################################
   2 # Xestia Scanner Server Database Module - PostgreSQL Database Module            #
   3 # Database module for mainipulating data in a PostgreSQL database.              #
   4 #                                                                               #
   5 # Copyright (C) 2010-2011 Steve Brokenshire <sbrokenshire@xestia.co.uk>         #
   6 #                                                                               #
   7 # This module is licensed under the same license as Xestia Scanner Server which #
   8 # is the GPL version 3.                                                         #
   9 #                                                                               #
  10 # This program is free software: you can redistribute it and/or modify          #
  11 # it under the terms of the GNU General Public License as published by          #
  12 # the Free Software Foundation, version 3 of the License.                       #
  13 #                                                                               #
  14 # This program is distributed in the hope that it will be useful,               #
  15 # but WITHOUT ANY WARRANTY; without even the implied warranty of                #
  16 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the                 #
  17 # GNU General Public License for more details.                                  #
  18 #                                                                               #
  19 # You should have received a copy of the GNU General Public License             #
  20 # along with this program.  If not, see <http://www.gnu.org/licenses/>.         #
  21 #################################################################################
  22
  23 # Define the package (perl module) name.
  24
  25 package Modules::Auth::PostgreSQL;
  26
  27 # Enable strict and use warnings.
  28
  29 use strict;
  30 use warnings;
  31 use Encode;
  32 use Digest;
  33 use utf8;
  34
  35 # Load the following Perl modules.
  36
  37 use DBI qw(:sql_types);
  38
  39 # Set the following values.
  40
  41 our $VERSION    = "0.1.0";
  42 my ($options, %options);
  43 my $database_handle;
  44 my $statement_handle;
  45 my $error;
  46 my $errorext;
  47 my $database_filename;
  48 my $second_database_filename;
  49
  50 #################################################################################
  51 # Generic Subroutines.                                                          #
  52 #################################################################################
  53
  54 sub new{
  55 #################################################################################
  56 # new: Create an instance of the PostgreSQL module.                             #
  57 #                                                                               #
  58 # Usage:                                                                        #
  59 #                                                                               #
  60 # $dbmodule = PostgreSQL->new();                                                #
  61 #################################################################################
  62
  63         # Get the perl module name.
  64
  65         my $class = shift;
  66         my $self = {};
  67
  68         return bless($self, $class);
  69
  70 }
  71
  72 sub capabilities{
  73 #################################################################################
  74 # capabilities: Get the capabilities for this module as a hash.                 #
  75 #                                                                               #
  76 # Usage:                                                                        #
  77 #                                                                               #
  78 # $dbmodule->capabilities();                                                    #
  79 #################################################################################
  80
  81         my $class = shift;
  82
  83         my %capabilities = (
  84                 "multiuser"     => 1,
  85         );
  86
  87         return %capabilities;
  88
  89 }
  90
  91 sub loadsettings{
  92 #################################################################################
  93 # loadsettings: Loads settings into the PostgreSQL authentication module        #
  94 #                                                                               #
  95 # Usage:                                                                        #
  96 #                                                                               #
  97 # $dbmodule->loadsettings(options);                                             #
  98 #                                                                               #
  99 # options       Specifies the following options (in any order).                 #
 100 #                                                                               #
 101 # DateTime      Specifies the date and time format to use.                      #
 102 # Server        Specifies the server to use.                                    #
 103 # Database      Specifies the database to use.                                  #
 104 # Username      Specifies the username to use.                                  #
 105 # Password      Specifies the password to use.                                  #
 106 # Port          Specifies the server port to use.                               #
 107 # Protocol      Specifies the protocol to use.                                  #
 108 # TablePrefix   Specifies the table prefix to use.                              #
 109 #################################################################################
 110
 111         # Get the data passed to the subroutine.
 112
 113         my $class = shift;
 114         my ($passedoptions)     = @_;
 115
 116         # Add the directory setting to the list of options (as it's the only
 117         # one needed for this database module).
 118
 119         %options = (
 120                 "Directory"     => $passedoptions->{"Directory"},
 121                 "DateTime"      => $passedoptions->{"DateTime"},
 122                 "Server"        => $passedoptions->{"Server"},
 123                 "Database"      => $passedoptions->{"Database"},
 124                 "Username"      => $passedoptions->{"Username"},
 125                 "Password"      => $passedoptions->{"Password"},
 126                 "Port"          => $passedoptions->{"Port"},
 127                 "Protocol"      => $passedoptions->{"Protocol"},
 128                 "TablePrefix"   => $passedoptions->{"TablePrefix"}
 129         );
 130
 131 }
 132
 133 sub convert{
 134 #################################################################################
 135 # convert: Converts data into SQL formatted data.                               #
 136 #                                                                               #
 137 # Usage:                                                                        #
 138 #                                                                               #
 139 # $dbmodule->convert(data);                                                     #
 140 #                                                                               #
 141 # data          Specifies the data to convert.                                  #
 142 #################################################################################
 143
 144         # Get the data passed to the subroutine.
 145
 146         my $class       = shift;
 147         my $data        = shift;
 148
 149         if (!$data){
 150                 $data = "";
 151         }
 152
 153         $data =~ s/\'/''/g;
 154         $data =~ s/\b//g;
 155
 156         return $data;
 157
 158 }
 159
 160 sub dateconvert{
 161 #################################################################################
 162 # dateconvert: Converts a SQL date into a proper date.                          #
 163 #                                                                               #
 164 # Usage:                                                                        #
 165 #                                                                               #
 166 # $dbmodule->dateconvert(date);                                                 #
 167 #                                                                               #
 168 # date          Specifies the date to convert.                                  #
 169 #################################################################################
 170
 171         # Get the date passed to the subroutine.
 172
 173         my $class       = shift;
 174         my $data        = shift;
 175
 176         # Convert the date given into the proper date.
 177
 178         # Create the following varialbes to be used later.
 179
 180         my $date;
 181         my $time;
 182         my $day;
 183         my $day_full;
 184         my $month;
 185         my $month_check;
 186         my $month_full;
 187         my $year;
 188         my $year_short;
 189         my $hour;
 190         my $hour_full;
 191         my $minute;
 192         my $minute_full;
 193         my $second;
 194         my $second_full;
 195         my $seek = 0;
 196         my $timelength;
 197         my $datelength;
 198         my $daylength;
 199         my $secondlength;
 200         my $startchar = 0;
 201         my $char;
 202         my $length;
 203         my $count = 0;
 204
 205         # Split the date and time.
 206
 207         $length = length($data);
 208
 209         if ($length > 0){
 210
 211                 do {
 212
 213                         # Get the character and check if it is a space.
 214
 215                         $char = substr($data, $seek, 1);
 216
 217                         if ($char eq ' '){
 218
 219                                 # The character is a space, so get the date and time.
 220
 221                                 $date           = substr($data, 0, $seek);
 222                                 $timelength     = $length - $seek - 1;
 223                                 $time           = substr($data, $seek + 1, $timelength);
 224
 225                         }
 226
 227                         $seek++;
 228
 229                 } until ($seek eq $length);
 230
 231                 # Get the year, month and date.
 232
 233                 $length = length($date);
 234                 $seek = 0;
 235
 236                 do {
 237
 238                         # Get the character and check if it is a dash.
 239
 240                         $char = substr($date, $seek, 1);
 241
 242                         if ($char eq '-'){
 243
 244                                 # The character is a dash, so get the year, month or day.
 245
 246                                 $datelength = $seek - $startchar;
 247
 248                                 if ($count eq 0){
 249
 250                                         # Get the year from the date.
 251
 252                                         $year           = substr($date, 0, $datelength) + 1900;
 253                                         $startchar      = $seek;
 254                                         $count = 1;
 255
 256                                         # Get the last two characters to get the short year
 257                                         # version.
 258
 259                                         $year_short     = substr($year, 2, 2);
 260
 261                                 } elsif ($count eq 1){
 262
 263                                         # Get the month and day from the date.
 264
 265                                         $month  = substr($date, $startchar + 1, $datelength - 1) + 1;
 266
 267                                         # Check if the month is less then 10, if it is
 268                                         # add a zero to the value.
 269
 270                                         if ($month < 10){
 271
 272                                                 $month_full = '0' . $month;
 273
 274                                         } else {
 275
 276                                                 $month_full = $month;
 277
 278                                         }
 279
 280                                         $startchar      = $seek;
 281                                         $count = 2;
 282
 283                                         $daylength      = $length - $seek + 1;
 284                                         $day            = substr($date, $startchar + 1, $daylength);
 285
 286                                         $day =~ s/^0//;
 287
 288                                         # Check if the day is less than 10, if it is
 289                                         # add a zero to the value.
 290
 291                                         if ($day < 10){
 292
 293                                                 $day_full       = '0' . $day;
 294
 295                                         } else {
 296
 297                                                 $day_full       = $day;
 298
 299                                         }
 300
 301                                 }
 302
 303                         }
 304
 305                         $seek++;
 306
 307                 } until ($seek eq $length);
 308
 309                 # Get the length of the time value and reset certain
 310                 # values to 0.
 311
 312                 $length = length($time);
 313                 $seek = 0;
 314                 $count = 0;
 315                 $startchar = 0;
 316
 317                 do {
 318
 319                         # Get the character and check if it is a colon.
 320
 321                         $char = substr($time, $seek, 1);
 322
 323                         if ($char eq ':'){
 324
 325                                 # The character is a colon, so get the hour, minute and day.
 326
 327                                 $timelength = $seek - $startchar;
 328
 329                                 if ($count eq 0){
 330
 331                                         # Get the hour from the time.
 332
 333                                         $hour = substr($time, 0, $timelength);
 334                                         $hour =~ s/^0//;
 335                                         $count = 1;
 336                                         $startchar = $seek;
 337
 338                                         # If the hour is less than ten then add a
 339                                         # zero.
 340
 341                                         if ($hour < 10){
 342
 343                                                 $hour_full = '0' . $hour;
 344
 345                                         } else {
 346
 347                                                 $hour_full = $hour;
 348
 349                                         }
 350
 351                                 } elsif ($count eq 1){
 352
 353                                         # Get the minute and second from the time.
 354
 355                                         $minute = substr($time, $startchar + 1, $timelength - 1);
 356                                         $minute =~ s/^0//;
 357                                         $count = 2;
 358
 359                                         # If the minute is less than ten then add a
 360                                         # zero.
 361
 362                                         if ($minute < 10){
 363
 364                                                 $minute_full = '0' . $minute;
 365
 366                                         } else {
 367
 368                                                 $minute_full = $minute;
 369
 370                                         }
 371
 372                                         $startchar = $seek;
 373
 374                                         $secondlength = $length - $seek + 1;
 375                                         $second = substr($time, $startchar + 1, $secondlength);
 376                                         $second =~ s/^0//;
 377
 378                                         # If the second is less than ten then add a
 379                                         # zero.
 380
 381                                         if ($second < 10){
 382
 383                                                 $second_full = '0' . $second;
 384
 385                                         } else {
 386
 387                                                 $second_full = $second;
 388
 389                                         }
 390
 391                                 }
 392
 393                         }
 394
 395                         $seek++;
 396
 397                 } until ($seek eq $length);
 398
 399                 # Get the setting for displaying the date and time.
 400
 401                 $data = $options{"DateTime"};
 402
 403                 # Process the setting for displaying the date and time
 404                 # using regular expressions
 405
 406                 $data =~ s/DD/$day_full/g;
 407                 $data =~ s/D/$day/g;
 408                 $data =~ s/MM/$month_full/g;
 409                 $data =~ s/M/$month/g;
 410                 $data =~ s/YY/$year/g;
 411                 $data =~ s/Y/$year_short/g;
 412
 413                 $data =~ s/hh/$hour_full/g;
 414                 $data =~ s/h/$hour/g;
 415                 $data =~ s/mm/$minute_full/g;
 416                 $data =~ s/m/$minute/g;
 417                 $data =~ s/ss/$second_full/g;
 418                 $data =~ s/s/$second/g;
 419
 420         }
 421
 422         return $data;
 423
 424 }
 425
 426 sub geterror{
 427 #################################################################################
 428 # geterror: Gets the error message (or extended error message).                 #
 429 #                                                                               #
 430 # Usage:                                                                        #
 431 #                                                                               #
 432 # $dbmodule->geterror(extended);                                                #
 433 #                                                                               #
 434 # Extended      Specifies if the extended error should be retrieved.            #
 435 #################################################################################
 436
 437         # Get the data passed to the subroutine.
 438
 439         my $class       = shift;
 440         my $extended    = shift;
 441
 442         if (!$extended){
 443                 $extended = 0;
 444         }
 445
 446         if (!$errorext){
 447                 $errorext = "";
 448         }
 449
 450         if (!$error){
 451                 $error = "";
 452         }
 453
 454         # Check to see if extended information should be returned.
 455
 456         if ($extended eq 1){
 457
 458                 # Extended information should be returned.
 459
 460                 return $errorext;
 461
 462         } else {
 463
 464                 # Basic information should be returned.
 465
 466                 return $error;
 467
 468         }
 469
 470 }
 471
 472 #################################################################################
 473 # General subroutines.                                                          #
 474 #################################################################################
 475
 476 sub connect{
 477 #################################################################################
 478 # connect: Connect to the server.                                               #
 479 #                                                                               #
 480 # Usage:                                                                        #
 481 #                                                                               #
 482 # $dbmodule->connect();                                                         #
 483 #################################################################################
 484
 485         $error = "";
 486         $errorext = "";
 487
 488         # Connect to the server.
 489
 490         $database_handle = DBI->connect("DBI:Pg:dbname=" . $options{"Database"} . ";host=" . $options{"Server"} . ";port=" . $options{"Port"}, $options{"Username"}, $options{"Password"}) or ( $error = "AuthConnectionError", $errorext = DBI->errstr, return );
 491         $database_handle->do("SET CLIENT_ENCODING TO 'UTF8'");
 492         #$database_handle->do('SET NAMES utf8');
 493
 494 }
 495
 496 sub disconnect{
 497 #################################################################################
 498 # connect: Disconnect from the server.                                          #
 499 #                                                                               #
 500 # Usage:                                                                        #
 501 #                                                                               #
 502 # $dbmodule->disconnect();                                                      #
 503 #################################################################################
 504
 505         # Disconnect from the server.
 506
 507         if ($statement_handle){
 508
 509                 $statement_handle->finish();
 510
 511         }
 512
 513         if ($database_handle){
 514
 515                 $database_handle->disconnect();
 516
 517         }
 518
 519 }
 520
 521 sub getuserlist{
 522 #################################################################################
 523 # getuserlist: Get the user list.                                               #
 524 #                                                                               #
 525 # Usage:                                                                        #
 526 #                                                                               #
 527 # $dbmodule->getuserlist(options);                                              #
 528 #                                                                               #
 529 # options       Specifies the following options in any order.                   #
 530 #                                                                               #
 531 # Reduced               Gets a reduced version of the user list.                #
 532 # ShowDeactivated       Show users that are deactivated from the list.          #
 533 #################################################################################
 534
 535         $error = "";
 536         $errorext = "";
 537
 538         # Get the values passed to the subroutine.
 539
 540         my $class = shift;
 541         my ($passedoptions) = @_;
 542         my $sqlquery = "";
 543         my @user_data;
 544         my %user_list;
 545         my $user_seek = 1;
 546
 547         tie(%user_list, 'Tie::IxHash');
 548
 549         my $reduced_list        = $passedoptions->{"Reduced"};
 550         my $deactivated_show    = $passedoptions->{"ShowDeactivated"};
 551         $deactivated_show = 0 if !$passedoptions->{"ShowDeactivated"};
 552
 553         # Check if a reduced version of the user list should be retreived.
 554
 555         if ($reduced_list eq 1){
 556
 557                 # Get the list of users with reduced information.
 558
 559                 $sqlquery = 'SELECT username, name, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_users';
 560
 561         } else {
 562
 563                 # Get the list of users.
 564
 565                 $sqlquery = 'SELECT * FROM ' . $class->convert($options{"TablePrefix"}) . '_users';
 566
 567         }
 568
 569         # Check if the deactivated users should be hidden.
 570
 571         if ($deactivated_show eq 0){
 572
 573                 # The deactivated users should be hidden from the list.
 574
 575                 $sqlquery = $sqlquery . ' WHERE enabled=TRUE';
 576
 577         }
 578
 579         $sqlquery = $sqlquery . ' ORDER BY username';
 580
 581         # Run the query.
 582
 583         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 584         $statement_handle->execute();
 585
 586         # Process the user list.
 587
 588         while (@user_data = $statement_handle->fetchrow_array()){
 589
 590                 $user_list{$user_seek}{username}        = decode_utf8($user_data[0]);
 591                 $user_list{$user_seek}{name}            = decode_utf8($user_data[1]);
 592
 593                 if ($user_data[2] eq 0){
 594
 595                         $user_list{$user_seek}{deactivated}     = 1;
 596
 597                 } else {
 598
 599                         $user_list{$user_seek}{deactivated}     = 0;
 600
 601                 }
 602
 603                 $user_seek++;
 604
 605         }
 606
 607         return %user_list;
 608
 609 }
 610
 611 sub getpermissions{
 612 #################################################################################
 613 # getpermissions: Get the permissions for scanner or module.                    #
 614 #                                                                               #
 615 # Usage:                                                                        #
 616 #                                                                               #
 617 # $dbmodule->getpermissions(options);                                           #
 618 #                                                                               #
 619 # options       Specifies the following options in any order.                   #
 620 #                                                                               #
 621 # Username              Specifies the username to get permissions for.          #
 622 # PermissionType        Specifies the permission type.                          #
 623 # PermissionName        Get a specific permission name.                         #
 624 #                                                                               #
 625 # If no permission name is specified then a list of permissions will be         #
 626 # returned as hash otherwise the value will be returned as a normal string.     #
 627 #################################################################################
 628
 629         $error = "";
 630         $errorext = "";
 631
 632         # Get the value passed to the subroutine.
 633
 634         my $class = shift;
 635         my ($passedoptions) = @_;
 636
 637         my $username            = $passedoptions->{'Username'};
 638         my $permissiontype      = $passedoptions->{'PermissionType'};
 639         my $permissionname      = $passedoptions->{'PermissionName'};
 640         my $sqlquery = "";
 641         my $user_exists = 0;
 642
 643         my $permissionresult = 0;
 644         my @userdata;
 645         my @permissiondata;
 646         my $uid = 0;
 647
 648         if (!$username){
 649
 650                 # The username is blank so return an error.
 651
 652                 $error = "UsernameBlank";
 653                 return;
 654
 655         }
 656
 657         if (!$permissiontype){
 658
 659                 # The permissions type is blank so return an error.
 660
 661                 $error = "PermissionTypeBlank";
 662                 return;
 663
 664         }
 665
 666         #if (!$permissionname){
 667
 668                 # The permissions name is blank so return a list of
 669                 # permissions for that type.
 670
 671         #       my %user_permissions;
 672
 673         #       return %user_permissions;
 674
 675         #}
 676
 677         # Get the user ID number.
 678
 679         $sqlquery = 'SELECT uid, username FROM ' . $class->convert($options{"TablePrefix"}) . '_users WHERE username=\'' . $class->convert(decode_utf8($username)) . '\'';
 680
 681         # Run the query.
 682
 683         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 684         $statement_handle->execute();
 685
 686         while(@userdata = $statement_handle->fetchrow_array()){
 687
 688                 $uid = $userdata[0];
 689
 690         }
 691
 692         if ($permissiontype eq "OutputModule"){
 693
 694                 if (!$permissionname){
 695
 696                         my %useroutputinfo;
 697
 698                         # No permission name was specified so get the list of
 699                         # scanner permissions.
 700
 701                         $sqlquery = 'SELECT uid, moduletype, modulename, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_modules WHERE uid=\'' . $class->convert($uid) . '\' AND moduletype=\'Output\'';
 702
 703                         # Run the query.
 704
 705                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 706                         $statement_handle->execute();
 707
 708                         # Process the list of permissions.
 709
 710                         while(@permissiondata = $statement_handle->fetchrow_array()){
 711
 712                                 $useroutputinfo{$permissiondata[2]}             = $permissiondata[3];
 713
 714                         }
 715
 716                         return %useroutputinfo;
 717
 718                 }
 719
 720                 $sqlquery = 'SELECT uid, moduletype, modulename, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_modules WHERE uid=\'' . $class->convert($uid) . '\' AND moduletype=\'Output\' AND modulename=\'' . $class->convert($permissionname) . '\'';
 721
 722                 # Run the query.
 723
 724                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 725                 $statement_handle->execute();
 726
 727                 # Check to see the value of the permission.
 728
 729                 while(@permissiondata = $statement_handle->fetchrow_array()){
 730
 731                         if ($permissiondata[3] eq 1){
 732
 733                                 $permissionresult = 1;
 734
 735                         } else {
 736
 737                                 $permissionresult = 0;
 738
 739                         }
 740
 741                 }
 742
 743         } elsif ($permissiontype eq "ExportModule"){
 744
 745                 if (!$permissionname){
 746
 747                         my %userexportinfo;
 748
 749                         # No permission name was specified so get the list of
 750                         # scanner permissions.
 751
 752                         $sqlquery = 'SELECT uid, moduletype, modulename, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_modules WHERE uid=\'' . $class->convert($uid) . '\' AND moduletype=\'Export\'';
 753
 754                         # Run the query.
 755
 756                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 757                         $statement_handle->execute();
 758
 759                         # Process the list of permissions.
 760
 761                         while(@permissiondata = $statement_handle->fetchrow_array()){
 762
 763                                 $userexportinfo{$permissiondata[2]}             = $permissiondata[3];
 764
 765                         }
 766
 767                         return %userexportinfo;
 768
 769                 }
 770
 771                 $sqlquery = 'SELECT uid, moduletype, modulename, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_modules WHERE uid=\'' . $class->convert($uid) . '\' AND moduletype=\'Export\' AND modulename=\'' . $class->convert($permissionname) . '\'';
 772
 773                 # Run the query.
 774
 775                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 776                 $statement_handle->execute();
 777
 778                 # Check to see the value of the permission.
 779
 780                 while(@permissiondata = $statement_handle->fetchrow_array()){
 781
 782                         if ($permissiondata[3] eq 1){
 783
 784                                 $permissionresult = 1;
 785
 786                         } else {
 787
 788                                 $permissionresult = 0;
 789
 790                         }
 791
 792                 }
 793
 794         } elsif ($permissiontype eq "Scanner"){
 795
 796                 # The permission type is a Scanner permission.
 797
 798                 if (!$permissionname){
 799
 800                         my %userscannerinfo;
 801
 802                         # No permission name was specified so get the list of
 803                         # scanner permissions.
 804
 805                         $sqlquery = 'SELECT uid, scannerid, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_scanners WHERE uid=\'' . $class->convert($uid) . '\'';
 806
 807                         # Run the query.
 808
 809                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 810                         $statement_handle->execute();
 811
 812                         # Process the list of permissions.
 813
 814                         while(@permissiondata = $statement_handle->fetchrow_array()){
 815
 816                                 $userscannerinfo{$permissiondata[1]}            = $permissiondata[2];
 817
 818                         }
 819
 820                         return %userscannerinfo;
 821
 822                 }
 823
 824                 # The permission type is a Scanner permission.
 825
 826                 $sqlquery = 'SELECT uid, scannerid, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_scanners WHERE uid=\'' . $class->convert($uid) . '\' AND scannerid=\'' . $class->convert($permissionname) . '\'';
 827
 828                 # Run the query.
 829
 830                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 831                 $statement_handle->execute();
 832
 833                 # Check to see the value of the permission.
 834
 835                 while(@permissiondata = $statement_handle->fetchrow_array()){
 836
 837                         if ($permissiondata[2] eq 1){
 838
 839                                 $permissionresult = 1;
 840
 841                         } else {
 842
 843                                 $permissionresult = 0;
 844
 845                         }
 846
 847                 }
 848
 849         } elsif ($permissiontype eq "Admin"){
 850
 851                 # Check to see if the user has administrative permissions.
 852
 853                 $sqlquery = 'SELECT uid, admin FROM ' . $class->convert($options{"TablePrefix"}) . '_users WHERE uid=\'' . $class->convert($uid) . '\' AND admin=TRUE AND enabled=TRUE';
 854
 855                 # Run the query.
 856
 857                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 858                 $statement_handle->execute();
 859
 860                 # Check to see the value of the admin permission.
 861
 862                 while(@permissiondata = $statement_handle->fetchrow_array()){
 863
 864                         if ($permissiondata[1] eq 1){
 865
 866                                 $permissionresult = 1;
 867
 868                         } else {
 869
 870                                 $permissionresult = 0;
 871
 872                         }
 873
 874                 }
 875
 876         } elsif ($permissiontype eq "UserInfo"){
 877
 878                 my %userinfo;
 879
 880                 # Get the details of the user.
 881
 882                 $sqlquery = 'SELECT uid, username, name, admin, enabled FROM ' . $class->convert($options{"TablePrefix"}) . '_users WHERE uid=\'' . $class->convert($uid) . '\'';
 883
 884                 # Run the query.
 885
 886                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 887                 $statement_handle->execute();
 888
 889                 while(@permissiondata = $statement_handle->fetchrow_array()){
 890
 891                         $userinfo{UID}          = $permissiondata[0];
 892                         $userinfo{Username}     = decode_utf8($permissiondata[1]);
 893                         $userinfo{Name}         = decode_utf8($permissiondata[2]);
 894                         $userinfo{Admin}        = $permissiondata[3];
 895                         $userinfo{Enabled}      = $permissiondata[4];
 896
 897                 }
 898
 899                 return %userinfo;
 900
 901         }
 902
 903         return $permissionresult;
 904
 905 }
 906
 907 sub adduser{
 908 #################################################################################
 909 # adduser: Add a user to the user list with specific permissions.               #
 910 #                                                                               #
 911 # Usage:                                                                        #
 912 #                                                                               #
 913 # $dbmodule->adduser(username, userinfo);                                       #
 914 #                                                                               #
 915 # username              Specifies the username.                                 #
 916 # userinfo              Specifies the user information hash.                    #
 917 #################################################################################
 918
 919         $error = "";
 920         $errorext = "";
 921
 922         my $class       = shift;
 923
 924         my $username    = shift;
 925         my %userinfo    = @_;
 926
 927         if (!$username){
 928
 929                 # The username is blank so return an error.
 930
 931                 $error = "UsernameBlank";
 932                 return;
 933
 934         }
 935
 936         # Check if the username exists.
 937
 938         my $sqlquery = "";
 939         my @user_data;
 940         my $user_exists = 0;
 941         $sqlquery = "SELECT * FROM " . $class->convert($options{"TablePrefix"}) . "_users WHERE username='" . $class->convert($username) . "'";
 942
 943         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
 944         $statement_handle->execute();
 945
 946         while (@user_data = $statement_handle->fetchrow_array()){
 947
 948                 $user_exists = 1;
 949
 950         }
 951
 952         if ($user_exists eq 1){
 953
 954                 $error = "UserExists";
 955                 return;
 956
 957         }
 958
 959         $sqlquery = "";
 960
 961         my $adminpriv   = "FALSE";
 962         my $enabledpriv = "FALSE";
 963
 964         if (!$userinfo{"Enabled"}){
 965
 966                 $userinfo{"Enabled"} = "off";
 967
 968         }
 969
 970         if (!$userinfo{"Admin"}){
 971
 972                 $userinfo{"Admin"} = "off";
 973
 974         }
 975
 976         $adminpriv = "TRUE" if $userinfo{Admin} eq "on";
 977         $enabledpriv = "TRUE" if $userinfo{Enabled} eq "on";
 978
 979         # Generate a random salt for the password and combine it
 980         # with the password.
 981
 982         my $digest = Digest->new("SHA-512");
 983
 984         my $salt = uc(sprintf("%x",int(rand(50000000))));
 985
 986         $digest->add(decode_utf8($userinfo{Password}));
 987         $digest->add($salt);
 988
 989         $sqlquery = "INSERT INTO " . $class->convert($options{"TablePrefix"}) . "_users (username, password, salt, version, name, admin, enabled) VALUES(";
 990         $sqlquery = $sqlquery . "'" . $class->convert(decode_utf8($userinfo{Username})) . "',";
 991         $sqlquery = $sqlquery . "'" . $digest->hexdigest . "',";
 992         $sqlquery = $sqlquery . "'" . $salt . "',";
 993         $sqlquery = $sqlquery . "1,";
 994         $sqlquery = $sqlquery . "'" . $class->convert(decode_utf8($userinfo{Name})) . "',";
 995         $sqlquery = $sqlquery . $adminpriv . ",";
 996         $sqlquery = $sqlquery . $enabledpriv;
 997         $sqlquery = $sqlquery . ")";
 998
 999         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1000         $statement_handle->execute();
1001
1002         return;
1003
1004 }
1005
1006 sub edituser{
1007 #################################################################################
1008 # edituser: Edit a user on the user list.                                       #
1009 #                                                                               #
1010 # Usage:                                                                        #
1011 #                                                                               #
1012 # $dbmodule->edituser(username, type, data);                                    #
1013 #                                                                               #
1014 # Usage:                                                                        #
1015 #                                                                               #
1016 # username              Specifies the username to edit.                         #
1017 # type                  Specifies the type of data to edit.                     #
1018 # data                  Specifies the data to use (as a hash).                  #
1019 #################################################################################
1020
1021         $error = "";
1022         $errorext = "";
1023
1024         my $class = shift;
1025
1026         my $username            = shift;
1027         my $type                = shift;
1028         my (%data)              = @_;
1029
1030         #(%permissions)         = @_;
1031         #my %permissions_final;
1032         #my $user_exists = 0;
1033
1034         #if (!$username){
1035
1036         # The username is blank so return an error.
1037
1038         #       $error = "UsernameBlank";
1039         #       return;
1040
1041         #}
1042
1043         #$username = $data{OriginalUsername};
1044
1045         if (!$username){
1046
1047                 # The username is blank so return an error.
1048
1049                 $error = "UsernameBlank";
1050                 return;
1051
1052         }
1053
1054         if (!$type){
1055
1056                 # The type is blank so return an error.
1057
1058                 $error = "TypeBlank";
1059                 return;
1060
1061         }
1062
1063         # Check if the username exists.
1064
1065         my $sqlquery = "";
1066         my @user_data;
1067         my $user_exists = 0;
1068
1069         $sqlquery = "SELECT * FROM " . $class->convert($options{"TablePrefix"}) . "_users WHERE username='" . decode_utf8($username) . "'";
1070
1071         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1072         $statement_handle->execute();
1073
1074         while (@user_data = $statement_handle->fetchrow_array()){
1075
1076                 $user_exists = 1;
1077
1078         }
1079
1080         if ($user_exists ne 1){
1081
1082                 $error = "UserDoesNotExist";
1083                 return;
1084
1085         }
1086
1087         # Check what type of data is being updated.
1088
1089         # Get the user ID (UID) number.
1090
1091         my $uid = 0;
1092         $sqlquery = 'SELECT uid, username FROM ' . $class->convert($options{"TablePrefix"}) . '_users WHERE username=\'' . $class->convert(decode_utf8($username)) . '\'';
1093         @user_data = [];
1094
1095         # Run the query.
1096
1097         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1098         $statement_handle->execute();
1099
1100         while(@user_data = $statement_handle->fetchrow_array()){
1101
1102                 $uid = $user_data[0];
1103
1104         }
1105
1106         if ($type eq "User"){
1107
1108                 # Update the user information.
1109
1110                 $sqlquery = "UPDATE " . $class->convert($options{"TablePrefix"}) . "_users SET";
1111
1112                 if (!$data{"Enabled"}){
1113
1114                         $data{"Enabled"} = "off";
1115
1116                 }
1117
1118                 if (!$data{"Admin"}){
1119
1120                         $data{"Admin"} = "off";
1121
1122                 }
1123
1124                 # Check if the account is enabled or not.
1125
1126                 if ($data{Enabled} eq "on"){
1127
1128                         $sqlquery = $sqlquery . " enabled = TRUE";
1129
1130                 } else {
1131
1132                         $sqlquery = $sqlquery . " enabled = FALSE";
1133
1134                 }
1135
1136                 # Check if the account has administrative status or not.
1137
1138                 if ($data{Admin} eq "on"){
1139
1140                         $sqlquery = $sqlquery . ", admin = TRUE";
1141
1142                 } else {
1143
1144                         $sqlquery = $sqlquery . ", admin = FALSE";
1145
1146                 }
1147
1148                 # Add the name to query.
1149
1150                 $sqlquery = $sqlquery . ", name = '" . $class->convert(decode_utf8($data{Name})) . "'";
1151
1152                 # Check if the user with the new username already exists.
1153
1154                 $user_exists = 0;
1155
1156                 if (decode_utf8($username) ne decode_utf8($data{NewUsername})){
1157
1158                         my $sqlqueryusername = "";
1159                         @user_data = [];
1160                         $sqlqueryusername = "SELECT * FROM " . $class->convert($options{"TablePrefix"}) . "_users WHERE username='" . $class->convert(decode_utf8($data{NewUsername})) . "'";
1161
1162                         $statement_handle = $database_handle->prepare($sqlqueryusername) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1163                         $statement_handle->execute();
1164
1165                         while (@user_data = $statement_handle->fetchrow_array()){
1166
1167                                 $user_exists = 1;
1168
1169                         }
1170
1171                         if ($user_exists eq 1){
1172
1173                                 $error = "NewUsernameAlreadyExists";
1174                                 return;
1175
1176                         }
1177
1178                         $sqlquery = $sqlquery . ", username = \'" . $class->convert(decode_utf8($data{NewUsername})) . "\'";
1179
1180                 }
1181
1182                 # Check if the password needs to be changed.
1183
1184                 if ($data{Password} ne ""){
1185
1186                         if ($data{Password} eq $data{ConfirmPassword}){
1187
1188                                 # Generate a random salt for the password and combine it
1189                                 # with the password.
1190
1191                                 my $digest = Digest->new("SHA-512");
1192
1193                                 my $salt = uc(sprintf("%x\n",int(rand(50000000))));
1194
1195                                 $digest->add(decode_utf8($data{Password}));
1196                                 $digest->add($salt);
1197
1198                                 $sqlquery = $sqlquery . ", password = \'" . $class->convert($digest->hexdigest) . "\'";
1199                                 $sqlquery = $sqlquery . ", salt = \'" . $class->convert($salt) . "\'";
1200                                 $sqlquery = $sqlquery . ", version = 1";
1201
1202                         }
1203
1204                 }
1205
1206                 # Add the user id on the end.
1207
1208                 $sqlquery = $sqlquery . " WHERE uid = '" . $class->convert($uid) . "'";
1209
1210                 # Run the query.
1211
1212                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1213                 $statement_handle->execute();
1214
1215         } elsif ($type eq "Scanner"){
1216
1217                 # Drop all scanner information for this user.
1218
1219                 $sqlquery = "DELETE FROM " . $class->convert($options{"TablePrefix"}) . "_scanners WHERE uid =\'" . $class->convert($uid)  . "\'";
1220
1221                 # Run the query.
1222
1223                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1224                 $statement_handle->execute();
1225
1226                 return if (!%data);
1227
1228                 # Insert the new scanner information for this user.
1229
1230                 $sqlquery = "";
1231
1232                 $sqlquery = "INSERT INTO xestiascan_scanners (uid, scannerid, enabled) VALUES";
1233
1234                 # Process the hash passed to the subroutine.
1235
1236                 my $firstline = 1;
1237                 my $datakeyname;
1238
1239                 foreach $datakeyname (keys %data){
1240
1241                         if ($firstline eq 1){
1242
1243                                 $sqlquery = $sqlquery . "(" . $class->convert($uid) . ",\'" . $class->convert($datakeyname) . "\',";
1244                                 $firstline = 0;
1245
1246                         } else {
1247
1248                                 $sqlquery = $sqlquery . ",(" . $class->convert($uid) . ",\'" . $class->convert($datakeyname) . "\',";
1249
1250                         }
1251
1252                         if ($data{$datakeyname} eq "on"){
1253
1254                                 $sqlquery = $sqlquery . "TRUE)";
1255
1256                         } else {
1257
1258                                 $sqlquery = $sqlquery . "FALSE)";
1259
1260                         }
1261
1262                 }
1263
1264                 # Run the query.
1265
1266                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1267                 $statement_handle->execute();
1268
1269         } elsif ($type eq "OutputModule"){
1270
1271                 # Drop all output module information for this user.
1272
1273                 $sqlquery = "DELETE FROM " . $class->convert($options{"TablePrefix"}) . "_modules WHERE uid ='" . $class->convert($uid)  . "' AND moduletype ='Output'";
1274
1275                 # Run the query.
1276
1277                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1278                 $statement_handle->execute();
1279
1280                 return if (!%data);
1281
1282                 # Insert the new output module information for this user.
1283
1284                 $sqlquery = "";
1285
1286                 $sqlquery = "INSERT INTO xestiascan_modules (uid, moduletype, modulename, enabled) VALUES";
1287
1288                 # Process the hash passed to the subroutine.
1289
1290                 my $firstline = 1;
1291                 my $datakeyname;
1292
1293                 foreach $datakeyname (keys %data){
1294
1295                         if ($firstline eq 1){
1296
1297                                 $sqlquery = $sqlquery . "(" . $class->convert($uid) . ",'Output','" . $class->convert($datakeyname) . "',";
1298                                 $firstline = 0;
1299
1300                         } else {
1301
1302                                 $sqlquery = $sqlquery . ",(" . $class->convert($uid) . ",'Output','" . $class->convert($datakeyname) . "',";
1303
1304                         }
1305
1306                         if ($data{$datakeyname} eq "on"){
1307
1308                                 $sqlquery = $sqlquery . "TRUE)";
1309
1310                         } else {
1311
1312                                 $sqlquery = $sqlquery . "FALSE)";
1313
1314                         }
1315
1316                 }
1317
1318                 # Run the query.
1319
1320                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1321                 $statement_handle->execute();
1322
1323         } elsif ($type eq "ExportModule"){
1324
1325                 # Drop all export module information for this user.
1326
1327                 $sqlquery = "DELETE FROM " . $class->convert($options{"TablePrefix"}) . "_modules WHERE uid ='" . $class->convert($uid)  . "' AND moduletype ='Export'";
1328
1329                 # Run the query.
1330
1331                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1332                 $statement_handle->execute();
1333
1334                 return if (!%data);
1335
1336                 # Insert the new export module information for this user.
1337
1338                 $sqlquery = "";
1339
1340                 $sqlquery = "INSERT INTO xestiascan_modules (uid, moduletype, modulename, enabled) VALUES";
1341
1342                 # Process the hash passed to the subroutine.
1343
1344                 my $firstline = 1;
1345                 my $datakeyname;
1346
1347                 foreach $datakeyname (keys %data){
1348
1349                         if ($firstline eq 1){
1350
1351                                 $sqlquery = $sqlquery . "(" . $class->convert($uid) . ",\'Export',\'" . $class->convert($datakeyname) . "\',";
1352                                 $firstline = 0;
1353
1354                         } else {
1355
1356                                 $sqlquery = $sqlquery . ",(" . $class->convert($uid) . ",\'Export\',\'" . $class->convert($datakeyname) . "\',";
1357
1358                         }
1359
1360                         if ($data{$datakeyname} eq "on"){
1361
1362                                 $sqlquery = $sqlquery . "TRUE)";
1363
1364                         } else {
1365
1366                                 $sqlquery = $sqlquery . "FALSE)";
1367
1368                         }
1369
1370                 }
1371
1372                 # Run the query.
1373
1374                 $statement_handle = $database_handle->prepare($sqlquery) or die; #( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1375                 $statement_handle->execute();
1376
1377         }
1378
1379 }
1380
1381 sub deleteuser{
1382 #################################################################################
1383 # deleteuser: Delete a user from the user list.                                 #
1384 #                                                                               #
1385 # Usage:                                                                        #
1386 #                                                                               #
1387 # $dbmodule->deleteuser(username);                                              #
1388 #                                                                               #
1389 # username      Specifies the username to delete from the user list.            #
1390 #################################################################################
1391
1392         $error = "";
1393         $errorext = "";
1394
1395         my $class = shift;
1396
1397         my $username = shift;
1398
1399         if (!$username){
1400
1401                 # User name is blank so return an error.
1402
1403                 $error = "UsernameBlank";
1404                 return;
1405
1406         }
1407
1408         # Check if the user exists before deleting.
1409
1410         my $user_exists = 0;
1411         my @user_data;
1412
1413         my $sqlquery = "SELECT * FROM " . $class->convert($options{"TablePrefix"}) . "_users WHERE username=\'" . $class->convert(decode_utf8($username)) . "\' LIMIT 1";
1414
1415         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1416         $statement_handle->execute();
1417
1418         while (@user_data = $statement_handle->fetchrow_array()){
1419
1420                 $user_exists = 1;
1421
1422         }
1423
1424         if ($user_exists eq 0){
1425
1426                 $error = "UserDoesNotExist";
1427                 return;
1428
1429         }
1430
1431         # Get the user ID (UID) number.
1432
1433         my $uid = 0;
1434         $sqlquery = 'SELECT uid, username FROM ' . $class->convert($options{"TablePrefix"}) . '_users WHERE username=\'' . $class->convert(decode_utf8($username)) . '\'';
1435         @user_data = [];
1436
1437         # Run the query.
1438
1439         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1440         $statement_handle->execute();
1441
1442         while(@user_data = $statement_handle->fetchrow_array()){
1443
1444                 $uid = $user_data[0];
1445
1446         }
1447
1448         # Delete the module permissions from the modules table.
1449
1450         $sqlquery = "DELETE FROM " . $class->convert($options{"TablePrefix"}) . "_scanners where uid=\'" . $class->convert($uid) . "\'";
1451
1452         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1453         $statement_handle->execute();
1454
1455         # Delete the scanner permissions from the scanners table.
1456
1457         $sqlquery = "DELETE FROM " . $class->convert($options{"TablePrefix"}) . "_modules where uid=\'" . $class->convert($uid) . "\'";
1458
1459         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1460         $statement_handle->execute();
1461
1462         # Delete the user from the users table.
1463
1464         $sqlquery = "DELETE FROM " . $class->convert($options{"TablePrefix"}) . "_users where username=\'" . $class->convert(decode_utf8($username)) . "\'";
1465
1466         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1467         $statement_handle->execute();
1468
1469 }
1470
1471 sub userauth{
1472 #################################################################################
1473 # authuser: Authenticate a user.                                                #
1474 #                                                                               #
1475 # Usage:                                                                        #
1476 #                                                                               #
1477 # $dbmodule->authuser(type, user, password, keeploggedin);                      #
1478 #                                                                               #
1479 # type          Specifies the type of authentication.                           #
1480 # user          Specifies the name of the user.                                 #
1481 # password      Specifies the password or authentication token.                 #
1482 # keeploggedin  Specifies if the user should stay logged in for one year.       #
1483 #################################################################################
1484
1485         $error = "";
1486         $errorext = "";
1487
1488         my $class = shift;
1489
1490         my $type = shift;
1491         my $username = shift;
1492         my $password = shift;
1493         my $keeploggedin = shift;
1494
1495         my $user_exists = 0;
1496         my @user_data;
1497
1498         # Check to see if the user exists before authenticating.
1499
1500         #my $sqlquery = "";
1501         my $sqlquery = "SELECT * FROM " . $class->convert($options{"TablePrefix"}) . "_users WHERE username=\'" . $class->convert(decode_utf8($username)) . "\' LIMIT 1";
1502
1503         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1504         $statement_handle->execute();
1505
1506         while (@user_data = $statement_handle->fetchrow_array()){
1507
1508                 $user_exists = 1;
1509
1510         }
1511
1512         if ($user_exists eq 0){
1513
1514                 $error = "UserDoesNotExist";
1515                 return 0;
1516
1517         }
1518
1519         # Authenticate the user.
1520
1521         my @auth_data;
1522         my $valid_login = 0;
1523
1524         if ($type eq "seed"){
1525
1526                 $sqlquery = "SELECT * FROM " . $class->convert($options{"TablePrefix"}) . "_sessions WHERE username=\'" . $class->convert(decode_utf8($username)) . "\' AND seed=\'" . $class->convert($password) . "\' AND expires > now() LIMIT 1";
1527
1528                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1529                 $statement_handle->execute();
1530
1531                 while (@auth_data = $statement_handle->fetchrow_array()){
1532
1533                         $valid_login = 1;
1534
1535                 }
1536
1537                 return $valid_login;
1538
1539         } elsif ($type eq "password") {
1540
1541                 $sqlquery = "SELECT username, salt, enabled FROM " . $class->convert($options{"TablePrefix"}) . "_users WHERE username=\'" . $class->convert(decode_utf8($username)) . "\' LIMIT 1";
1542
1543                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1544                 $statement_handle->execute();
1545
1546                 my $digest = Digest->new("SHA-512");
1547                 my $salt = "";
1548                 my $hash = "";
1549
1550                 while (@auth_data = $statement_handle->fetchrow_array()){
1551
1552                         $valid_login = 1;
1553
1554                         # Check if the user account has been disabled.
1555
1556                         if ($auth_data[2] eq 0){
1557
1558                                 # Account has been disabled so login is invalid.
1559
1560                                 $valid_login = 0;
1561
1562                         } else {
1563
1564                                 # Generate the passsword hash using the password and salt given.
1565
1566                                 $salt = $auth_data[1];
1567                                 $digest->add(decode_utf8($password));
1568                                 $digest->add($salt);
1569
1570                         }
1571
1572                 }
1573
1574                 return if $valid_login eq 0;
1575
1576                 $sqlquery = "SELECT username, password, enabled FROM " . $class->convert($options{"TablePrefix"}) . "_users WHERE username=\'" . $class->convert(decode_utf8($username)) . "\' AND password =\'" . $class->convert($digest->hexdigest) . "\' LIMIT 1";
1577
1578                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1579                 $statement_handle->execute();
1580
1581                 $valid_login = 0;
1582
1583                 while (@auth_data = $statement_handle->fetchrow_array()){
1584
1585                         $valid_login = 1;
1586
1587                         # Check if the user account has been disabled.
1588
1589                         if ($auth_data[2] eq 0){
1590
1591                                 # Account has been disabled so login is invalid.
1592
1593                                 $valid_login = 0;
1594
1595                         }
1596
1597                 }
1598
1599                 if ($valid_login eq 1){
1600
1601                         my $auth_seed_unique = "yes";
1602                         my $new_auth_seed;
1603                         my @auth_seed_data;
1604
1605                         # Check if the auth seed already exists and generate
1606                         # a new random number if it does exist.
1607
1608                         do {
1609
1610                                 $auth_seed_unique = "yes";
1611                                 $new_auth_seed = int(rand(192000000));
1612
1613                                 $sqlquery = "SELECT * FROM  " . $class->convert($options{"TablePrefix"}) . "_sessions WHERE seed=\'" . $class->convert($new_auth_seed) . "\' LIMIT 1";
1614
1615                                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1616                                 $statement_handle->execute();
1617
1618                                 while (@auth_seed_data = $statement_handle->fetchrow_array()){
1619
1620                                         $auth_seed_unique = "no";
1621
1622                                 }
1623
1624                         } until ($auth_seed_unique eq "yes");
1625
1626                         # Insert this into the sessions database.
1627
1628                         if ($keeploggedin eq 1){
1629
1630                                 $sqlquery = "INSERT INTO " . $class->convert($options{"TablePrefix"}) . "_sessions (username, seed, expires) VALUES( '" . $class->convert(decode_utf8($username)) . "', '" . $class->convert($new_auth_seed) . "', 'now'::timestamp + '1 year'::interval);";
1631
1632                         } else {
1633
1634                                 $sqlquery = "INSERT INTO " . $class->convert($options{"TablePrefix"}) . "_sessions (username, seed, expires) VALUES( '" . $class->convert(decode_utf8($username)) . "', '" . $class->convert($new_auth_seed) . "', 'now'::timestamp + '3 hours'::interval);";
1635
1636                         }
1637
1638                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1639                         $statement_handle->execute();
1640
1641                         return ($valid_login, $new_auth_seed);
1642
1643                 }
1644
1645                 # Return the result.
1646
1647                 return $valid_login;
1648
1649         }
1650
1651 }
1652
1653 sub flushusers{
1654 #################################################################################
1655 # flushusers: Flush all users from the sessions table.                          #
1656 #                                                                               #
1657 # Usage:                                                                        #
1658 #                                                                               #
1659 # $dbmodule->flushusers();                                                      #
1660 #################################################################################
1661
1662         $error = "";
1663         $errorext = "";
1664
1665         # Flush all users from the sessions table. (This includes the user who
1666         # called the action to flush the table).
1667
1668         my $class = shift;
1669
1670         my $sqlquery = "DELETE FROM " . $class->convert($options{"TablePrefix"})  . "_sessions";
1671
1672         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1673         $statement_handle->execute();
1674
1675 }
1676
1677 sub populatetables{
1678 #################################################################################
1679 # populatetables: Populate the database with tables.                            #
1680 #                                                                               #
1681 # Usage:                                                                        #
1682 #                                                                               #
1683 # type          Specifies the type of table to populate.                        #
1684 # forcerecreate Force recreates the table (delete and create).                  #
1685 #################################################################################
1686
1687         $error = "";
1688         $errorext = "";
1689
1690         my $class = shift;
1691
1692         my $type = shift;
1693         my $forcerecreate = shift;
1694
1695         my $sqlquery = "";
1696
1697         if ($type eq "modules"){
1698
1699                 if ($forcerecreate eq 1){
1700
1701                         $sqlquery = "DROP TABLE " . $class->convert($options{"TablePrefix"})  . "_modules";
1702
1703                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1704                         $statement_handle->execute();
1705
1706                         if ($DBI::err){
1707
1708                                 $error = "DatabaseError";
1709                                 $errorext = $DBI::errstr;
1710                                 return;
1711
1712                         }
1713
1714                 }
1715
1716                 $sqlquery = "CREATE TABLE " . $class->convert($options{"TablePrefix"})  . "_modules (
1717                 uid bigint NOT NULL,
1718                 moduletype varchar(12) NOT NULL,
1719                 modulename varchar(256) NOT NULL,
1720                 enabled boolean NOT NULL
1721                 )";
1722
1723                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1724                 $statement_handle->execute();
1725
1726                 if ($DBI::err){
1727
1728                         $error = "DatabaseError";
1729                         $errorext = $DBI::errstr;
1730                         return;
1731
1732                 }
1733
1734         } elsif ($type eq "scanners"){
1735
1736                 if ($forcerecreate eq 1){
1737
1738                         $sqlquery = "DROP TABLE " . $class->convert($options{"TablePrefix"})  . "_scanners";
1739
1740                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1741                         $statement_handle->execute();
1742
1743                         if ($DBI::err){
1744
1745                                 $error = "DatabaseError";
1746                                 $errorext = $DBI::errstr;
1747                                 return;
1748
1749                         }
1750
1751                 }
1752
1753                 $sqlquery = "CREATE TABLE " . $class->convert($options{"TablePrefix"})  . "_scanners (
1754                 uid bigint NOT NULL,
1755                 scannerid varchar(256) NOT NULL,
1756                 enabled boolean NOT NULL
1757                 )";
1758
1759                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1760                 $statement_handle->execute();
1761
1762                 if ($DBI::err){
1763
1764                         $error = "DatabaseError";
1765                         $errorext = $DBI::errstr;
1766                         return;
1767
1768                 }
1769
1770         } elsif ($type eq "sessions"){
1771
1772                 if ($forcerecreate eq 1){
1773
1774                         $sqlquery = "DROP TABLE " . $class->convert($options{"TablePrefix"})  . "_sessions";
1775
1776                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1777                         $statement_handle->execute();
1778
1779                         if ($DBI::err){
1780
1781                                 $error = "DatabaseError";
1782                                 $errorext = $DBI::errstr;
1783                                 return;
1784
1785                         }
1786
1787                 }
1788
1789                 $sqlquery = "CREATE TABLE " . $class->convert($options{"TablePrefix"})  . "_sessions (
1790                 seed varchar(32) UNIQUE PRIMARY KEY NOT NULL,
1791                 username text NOT NULL,
1792                 expires timestamp NOT NULL
1793                 )";
1794
1795                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1796                 $statement_handle->execute();
1797
1798                 if ($DBI::err){
1799
1800                         $error = "DatabaseError";
1801                         $errorext = $DBI::errstr;
1802                         return;
1803
1804                 }
1805
1806         } elsif ($type eq "users"){
1807
1808                 if ($forcerecreate eq 1){
1809
1810                         $sqlquery = "DROP TABLE " . $class->convert($options{"TablePrefix"})  . "_users";
1811
1812                         $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1813                         $statement_handle->execute();
1814
1815                         if ($DBI::err){
1816
1817                                 $error = "DatabaseError";
1818                                 $errorext = $DBI::errstr;
1819                                 return;
1820
1821                         }
1822
1823                 }
1824
1825                 $sqlquery = "CREATE TABLE " . $class->convert($options{"TablePrefix"})  . "_users (
1826                 uid SERIAL PRIMARY KEY,
1827                 username varchar(64) UNIQUE NOT NULL,
1828                 password text NOT NULL,
1829                 salt varchar(512) NOT NULL,
1830                 version integer NOT NULL,
1831                 name varchar(128) NOT NULL,
1832                 admin boolean NOT NULL,
1833                 enabled boolean NOT NULL
1834                 )";
1835
1836                 $statement_handle = $database_handle->prepare($sqlquery) or ( $error = "DatabaseError", $errorext = $database_handle->errstr, return );
1837                 $statement_handle->execute();
1838
1839                 if ($DBI::err){
1840
1841                         $error = "DatabaseError";
1842                         $errorext = $DBI::errstr;
1843                         return;
1844
1845                 }
1846
1847         }
1848
1849 }
1850
1851 1;