Changed database-references, 'provision' is now called 'hermes', reflects that this...

[hermes] / api / lib / user_functions.php

diff --git a/api/lib/user_functions.php b/api/lib/user_functions.php
index e618d4c5bdb5bd83f143dc8a4ecac65f8ebc0abd..f1e660bb55e87ad84caf365d1b82fb49fc50f89d 100644 (file)
--- a/api/lib/user_functions.php
+++ b/api/lib/user_functions.php
@@ -5,12 +5,17 @@ require_once('lib/db_functions.php');
 
 $config = get_config();
 
+// Default length 24 characters to provide a long password
+// that still is short enough that Cisco SPA phones can use it
 function generate_password( $length = 24 )
 {
        $string = "";
         while ( strlen( $string ) < $length )
-               $string .= substr(md5(rand().rand()), 0, $length);
-       return substr( $string, 0, $length );
+        {
+               $string .= crypt(substr(md5(rand().rand()), 0, $length+1));
+               $string = preg_replace( '/\W/', '', $string);
+        }
+       return substr( $string, 1, $length );
 
 }
 
@@ -30,11 +35,11 @@ function is_provision_user ( $user, $domain )
 {
        global $config;
        $query = sprintf("SELECT username FROM %s WHERE username = '%s' AND domain = '%s'",
-               $config['provision_users_table'],
+               $config['hermes_users_table'],
                sql_clean( $user ),
                sql_clean( $domain )
        );
-       return sql_dbtest_numrows( $config['provision_db'], $query, 1);
+       return sql_dbtest_numrows( $config['hermes_db'], $query, 1);
 }
 
 function add_kamailio_subscriber( $username, $domain, $password, $email )
@@ -127,7 +132,7 @@ function add_provision_user( $username, $password, $domain, $authid, $registrar,
        if ( is_provision_user( $username, $password ) ) return false;
        $query = sprintf ("INSERT INTO %s ( username, password, displayname, domain, registrar, r_port, proxy, p_port, dialplan, authid, linetext )
                VALUES ('%s', '%s', '%s', '%s', '%s', %d, '%s', %d, '%s', '%s', '%s')",
-               $config['provision_users_table'],
+               $config['hermes_users_table'],
                sql_clean($username), 
                sql_clean($password), 
                sql_clean($displayname), 
@@ -140,7 +145,7 @@ function add_provision_user( $username, $password, $domain, $authid, $registrar,
                sql_clean($authid), 
                sql_clean($linetext)
        );
-       if ( ! sql_dbexec( $config['provision_db'], $query ) ) return false;
+       if ( ! sql_dbexec( $config['hermes_db'], $query ) ) return false;
        return true;
 }
 function get_provision_userid ( $username, $domain )
@@ -148,12 +153,12 @@ function get_provision_userid ( $username, $domain )
        global $config;
 
        $query = sprintf("SELECT id FROM %s WHERE username = '%s' AND domain = '%s'",
-               $config['provision_users_table'],
+               $config['hermes_users_table'],
                sql_clean($username),
                sql_clean($domain)
        );
 
-       $row = sql_dbquery_single( $config['provision_db'], $query );
+       $row = sql_dbquery_single( $config['hermes_db'], $query );
        if  (!$row) return false;
        $user_rowid = $row['id'];
        return $user_rowid;
@@ -167,12 +172,12 @@ function delete_provision_user( $username, $domain )
        if ( !$user_rowid ) return false;
 
        $query = sprintf( "DELETE FROM  %s WHERE id = %d AND username = '%s' AND domain = '%s'",
-               $config['provision_users_table'],
+               $config['hermes_users_table'],
                $user_rowid,
                sql_clean($username),
                sql_clean($domain)
        );
-       if ( sql_dbexec_rows( $config['provision_db'], $query) != 1 ) return false;
+       if ( sql_dbexec_rows( $config['hermes_db'], $query) != 1 ) return false;
        return true;
 }
 
@@ -198,14 +203,14 @@ function update_provision_data ( $param, $username, $domain, $data )
                return -2;
 
        $query = sprintf("UPDATE %s SET %s = '%s' WHERE username = '%s' AND domain = '%s'",
-               $config['provision_users_table'],
+               $config['hermes_users_table'],
                sql_clean($param),
                sql_clean($data),
                sql_clean($username),
                sql_clean($domain)
        
        );
-       $res = sql_dbexec_rows( $config['provision_db'], $query);
+       $res = sql_dbexec_rows( $config['hermes_db'], $query);
 
        if ( $res < 0 ) return -2;
        if ( $res > 1 ) return -2;
@@ -220,31 +225,31 @@ function update_provision_pw ( $username, $domain, $password )
                return false;
 
        $query = sprintf("UPDATE %s SET password = '%s' WHERE username = '%s' AND domain = '%s'",
-               $config['provision_users_table'],
+               $config['hermes_users_table'],
                sql_clean($password),
                sql_clean($username),
                sql_clean($domain)
        
        );
-       if ( sql_dbexec_rows( $config['provision_db'], $query) != 1 ) return false;
+       if ( sql_dbexec_rows( $config['hermes_db'], $query) != 1 ) return false;
        return true;
 }
 
 function list_users ( $search = null )
 {
        global $config;
-       $query = sprintf("SELECT CONCAT(username, '@', domain), displayname FROM %s ORDER BY username,domain", $config['provision_users_table'] );
+       $query = sprintf("SELECT CONCAT(username, '@', domain), displayname FROM %s ORDER BY username,domain", $config['hermes_users_table'] );
 
-       if ( array_key_exists ( 'search', $_GET ) )
+       if ( array_key_exists ( 'search', $_POST ) )
        {
-               $search = $_GET['search']; // TODO: Add some sanitation and input validation!
-               $query = sprintf("SELECT CONCAT(username, '@', domain) FROM %s WHERE CONCAT(username, '@', domain) LIKE '%%%s%%' ORDER BY username,domain", $config['provision_users_table'], sql_clean( $search ) );
+               $search = $_POST['search']; // TODO: Add some sanitation and input validation!
+               $query = sprintf("SELECT CONCAT(username, '@', domain) FROM %s WHERE CONCAT(username, '@', domain) LIKE '%%%s%%' ORDER BY username,domain", $config['hermes_users_table'], sql_clean( $search ) );
        }
 
-       $result = sql_dbquery( $config['provision_db'], $query );
+       $result = sql_dbquery( $config['hermes_db'], $query );
        if ( !$result ) return null;
        $list = array();
-       while ( $row = mysql_fetch_row( $result ) )
+       while ( $row = @mysql_fetch_row( $result ) )
        {
                array_push( $list, array( "user" => $row[0], "displayname" => $row[1] ) );
        }
@@ -265,11 +270,11 @@ function get_userdata( $username, $domain )
        $kamailio_data = null;
 
        $query_provision = sprintf ("SELECT id, username, password, displayname, domain, registrar, r_port, proxy, p_port, dialplan, authid, linetext FROM %s WHERE username = '%s' AND domain = '%s'",
-               $config['provision_users_table'],
+               $config['hermes_users_table'],
                sql_clean($username),
                sql_clean($domain));
 
-       $provision_data = sql_dbquery_single( $config['provision_db'] , $query_provision );
+       $provision_data = sql_dbquery_single( $config['hermes_db'] , $query_provision );
        if ( ! $provision_data ) return false;
 
        if ( $type == 'local' )