]> git.defcon.no Git - hermes/blob - api/lib/user_functions.php
Merge branch 'auth-refactor'
[hermes] / api / lib / user_functions.php
1 <?php
2 require_once('config.php');
3 require_once('lib/common_functions.php');
4 require_once('lib/db_functions.php');
5
6 $config = get_config();
7
8 // Default length 24 characters to provide a long password
9 // that still is short enough that Cisco SPA phones can use it
10 function generate_password( $length = 24 )
11 {
12 $string = "";
13 while ( strlen( $string ) < $length )
14 {
15 $string .= crypt(substr(md5(rand().rand()), 0, $length));
16 $string = preg_replace( '/\W/', '', $string);
17 }
18 return substr( $string, 0, $length );
19
20 }
21
22
23 function is_kamailio_subscriber ( $user, $domain )
24 {
25 global $config;
26 $query = sprintf("SELECT username FROM %s WHERE username = '%s' AND domain = '%s'",
27 $config['kamailio_subscriber_table'],
28 sql_clean( $user ),
29 sql_clean( $domain )
30 );
31 return sql_dbtest_numrows( $config['kamailio_db'], $query, 1);
32 }
33
34 function is_provision_user ( $user, $domain )
35 {
36 global $config;
37 $query = sprintf("SELECT username FROM %s WHERE username = '%s' AND domain = '%s'",
38 $config['provision_users_table'],
39 sql_clean( $user ),
40 sql_clean( $domain )
41 );
42 return sql_dbtest_numrows( $config['provision_db'], $query, 1);
43 }
44
45 function add_kamailio_subscriber( $username, $domain, $password, $email )
46 {
47
48 global $config;
49
50 $ha1 = md5( $username . ":" . $domain . ":" . $password );
51 $ha1b = md5( $username . "@" . $domain . ":" . $domain . ":" . $password );
52
53 $query = sprintf( "INSERT INTO %s (username, domain, password, email_address, ha1, ha1b) VALUES ('%s','%s','%s', '%s', '%s', '%s')",
54 $config['kamailio_subscriber_table'],
55 sql_clean($username),
56 sql_clean($domain),
57 sql_clean($password),
58 sql_clean($email),
59 $ha1,
60 $ha1b
61 );
62 if ( ! sql_dbexec( $config['kamailio_db'], $query ) ) return false;
63 return true;
64 }
65
66 function delete_kamailio_subscriber( $username, $domain )
67 {
68 global $config;
69
70
71 $query = sprintf("SELECT id FROM %s WHERE username = '%s' AND domain = '%s'",
72 $config['kamailio_subscriber_table'],
73 sql_clean($username),
74 sql_clean($domain)
75 );
76 $row = sql_dbquery_single( $config['kamailio_db'], $query );
77 if (!$row) return false;
78 $user_rowid = $row['id'];
79 if ( !$user_rowid ) return false;
80
81 $query = sprintf( "DELETE FROM %s WHERE id = %d AND username = '%s' AND domain = '%s'",
82 $config['kamailio_subscriber_table'],
83 $user_rowid,
84 sql_clean($username),
85 sql_clean($domain)
86 );
87 if ( sql_dbexec_rows( $config['kamailio_db'], $query) != 1 ) return false;
88 return true;
89 }
90
91
92 function update_kamailio_pw ( $username, $domain, $password )
93 {
94 global $config;
95
96 if ( ! ($username && $domain && $password))
97 return false;
98
99 $query = sprintf("UPDATE %s SET password = '%s' WHERE username = '%s' AND domain = '%s'",
100 $config['kamailio_subscriber_table'],
101 sql_clean($password),
102 sql_clean($username),
103 sql_clean($domain)
104
105 );
106 if ( sql_dbexec_rows( $config['kamailio_db'], $query) != 1 ) return false;
107 return true;
108 }
109
110 function update_kamailio_email ( $username, $domain, $email )
111 {
112 global $config;
113
114 if ( ! ($username && $domain && $email))
115 return false;
116
117 $query = sprintf("UPDATE %s SET email_address = '%s' WHERE username = '%s' AND domain = '%s'",
118 $config['kamailio_subscriber_table'],
119 sql_clean($email),
120 sql_clean($username),
121 sql_clean($domain)
122
123 );
124 if ( sql_dbexec_rows( $config['kamailio_db'], $query) != 1 ) return false;
125 return true;
126 }
127
128
129 function add_provision_user( $username, $password, $domain, $authid, $registrar, $r_port, $proxy, $p_port, $displayname, $dialplan, $linetext )
130 { global $config;
131
132 if ( is_provision_user( $username, $password ) ) return false;
133 $query = sprintf ("INSERT INTO %s ( username, password, displayname, domain, registrar, r_port, proxy, p_port, dialplan, authid, linetext )
134 VALUES ('%s', '%s', '%s', '%s', '%s', %d, '%s', %d, '%s', '%s', '%s')",
135 $config['provision_users_table'],
136 sql_clean($username),
137 sql_clean($password),
138 sql_clean($displayname),
139 sql_clean($domain),
140 sql_clean($registrar),
141 $r_port,
142 sql_clean($proxy),
143 $p_port,
144 sql_clean($dialplan),
145 sql_clean($authid),
146 sql_clean($linetext)
147 );
148 if ( ! sql_dbexec( $config['provision_db'], $query ) ) return false;
149 return true;
150 }
151 function get_provision_userid ( $username, $domain )
152 {
153 global $config;
154
155 $query = sprintf("SELECT id FROM %s WHERE username = '%s' AND domain = '%s'",
156 $config['provision_users_table'],
157 sql_clean($username),
158 sql_clean($domain)
159 );
160
161 $row = sql_dbquery_single( $config['provision_db'], $query );
162 if (!$row) return false;
163 $user_rowid = $row['id'];
164 return $user_rowid;
165 }
166
167 function delete_provision_user( $username, $domain )
168 {
169 global $config;
170
171 $user_rowid = get_provision_userid( $username, $domain );
172 if ( !$user_rowid ) return false;
173
174 $query = sprintf( "DELETE FROM %s WHERE id = %d AND username = '%s' AND domain = '%s'",
175 $config['provision_users_table'],
176 $user_rowid,
177 sql_clean($username),
178 sql_clean($domain)
179 );
180 if ( sql_dbexec_rows( $config['provision_db'], $query) != 1 ) return false;
181 return true;
182 }
183
184 function update_provision_data ( $param, $username, $domain, $data )
185 {
186 global $config;
187
188 if (! (
189 $param == "displayname" ||
190 $param == "dialplan" ||
191 $param == "linetext" ||
192 $param == "registrar" ||
193 $param == "r_port" ||
194 $param == "proxy" ||
195 $param == "p_port"
196 ) ) return -1;
197
198
199 if ( ! ($username && $domain))
200 return -1;
201
202 if ( ! is_provision_user( $username, $domain ) )
203 return -2;
204
205 $query = sprintf("UPDATE %s SET %s = '%s' WHERE username = '%s' AND domain = '%s'",
206 $config['provision_users_table'],
207 sql_clean($param),
208 sql_clean($data),
209 sql_clean($username),
210 sql_clean($domain)
211
212 );
213 $res = sql_dbexec_rows( $config['provision_db'], $query);
214
215 if ( $res < 0 ) return -2;
216 if ( $res > 1 ) return -2;
217 return $res;
218 }
219
220 function update_provision_pw ( $username, $domain, $password )
221 {
222 global $config;
223
224 if ( ! ($username && $domain && $password))
225 return false;
226
227 $query = sprintf("UPDATE %s SET password = '%s' WHERE username = '%s' AND domain = '%s'",
228 $config['provision_users_table'],
229 sql_clean($password),
230 sql_clean($username),
231 sql_clean($domain)
232
233 );
234 if ( sql_dbexec_rows( $config['provision_db'], $query) != 1 ) return false;
235 return true;
236 }
237
238 function list_users ( $search = null )
239 {
240 global $config;
241 $query = sprintf("SELECT CONCAT(username, '@', domain), displayname FROM %s ORDER BY username,domain", $config['provision_users_table'] );
242
243 if ( array_key_exists ( 'search', $_GET ) )
244 {
245 $search = $_GET['search']; // TODO: Add some sanitation and input validation!
246 $query = sprintf("SELECT CONCAT(username, '@', domain) FROM %s WHERE CONCAT(username, '@', domain) LIKE '%%%s%%' ORDER BY username,domain", $config['provision_users_table'], sql_clean( $search ) );
247 }
248
249 $result = sql_dbquery( $config['provision_db'], $query );
250 if ( !$result ) return null;
251 $list = array();
252 while ( $row = @mysql_fetch_row( $result ) )
253 {
254 array_push( $list, array( "user" => $row[0], "displayname" => $row[1] ) );
255 }
256 return $list;
257 print json_encode( array( 'response' => 'ok', 'list' => $list ));
258
259
260 }
261 function get_userdata( $username, $domain )
262 {
263 global $config;
264 if ( is_kamailio_subscriber( $username, $domain ) // User must be present in both!
265 && is_provision_user( $username, $domain ) ) $type = 'local';
266 else if ( is_provision_user( $username, $domain ) ) $type = 'remote';
267 else return null;
268
269 $provision_data = null;
270 $kamailio_data = null;
271
272 $query_provision = sprintf ("SELECT id, username, password, displayname, domain, registrar, r_port, proxy, p_port, dialplan, authid, linetext FROM %s WHERE username = '%s' AND domain = '%s'",
273 $config['provision_users_table'],
274 sql_clean($username),
275 sql_clean($domain));
276
277 $provision_data = sql_dbquery_single( $config['provision_db'] , $query_provision );
278 if ( ! $provision_data ) return false;
279
280 if ( $type == 'local' )
281 {
282 // WARNING: Note the typo in the name of the 'permittedcalls' column!
283 $query_kamailio = sprintf ("SELECT id, username, domain, password, email_address, ha1, ha1b, rpid, permitedcalls FROM %s WHERE username = '%s' AND domain = '%s'",
284 $config['kamailio_subscriber_table'],
285 sql_clean($username),
286 sql_clean($domain));
287 $kamailio_data = sql_dbquery_single( $config['kamailio_db'] , $query_kamailio );
288 if ( ! $kamailio_data ) return false;
289 }
290 $user['type'] = $type;
291 $user['username'] = $provision_data['username'];
292 $user['password'] = $provision_data['password'];
293 $user['domain'] = $provision_data['domain'];
294 $user['authid'] = $provision_data['authid'];
295 $user['registrar'] = $provision_data['registrar'];
296 $user['r_port'] = $provision_data['r_port'];
297 $user['proxy'] = $provision_data['proxy'];
298 $user['p_port'] = $provision_data['p_port'];
299 $user['dialplan'] = $provision_data['dialplan'];
300 $user['displayname'] = $provision_data['displayname'];
301 $user['linetext'] = $provision_data['linetext'];
302 if ( $type == 'local' )
303 {
304 $user['email'] = $kamailio_data['email_address'];
305 $user['ha1'] = $kamailio_data['ha1'];
306 $user['ha1b'] = $kamailio_data['ha1b'];
307 $user['rpid'] = $kamailio_data['rpid'];
308 $user['permittedcalls'] = $kamailio_data['permitedcalls'];
309 }
310
311 return $user;
312 }
313
314 ?>