-
';
+echo '
';
if($_SESSION['username'] == 'guest'){
- echo 'You are logged in as '.$_SESSION['username'].', login here';
- if ($users_register_themselves)
- echo ', or register to our community.';
+// echo 'You are logged in as '.$_SESSION['username'].', login here';
+// if ($users_register_themselves)
+// echo ', or register to our community.';
}
else
{
- echo "Welcome ".$_SESSION['username'].",
+ echo "Welcome ".$_SESSION['username']."
- [Edit profile]
- ";
+ ";
}
echo '
WiFiAdmin
WiFiAdmin, The Free WiFi Web Interface
@@ -71,22 +72,36 @@
Only in admin/include: if_functions.php
Only in admin/include: ip_functions.php
diff -ru /home/rob/pebble/src/wifiadmin-0.0.4/include/passwd_functions.php admin/include/passwd_functions.php
--- /home/rob/pebble/src/wifiadmin-0.0.4/include/passwd_functions.php 2004-12-13 16:47:06.000000000 -0800
+++ admin/include/passwd_functions.php 2005-02-10 15:20:27.000000000 -0800
@@ -1,4 +1,4 @@
- passwd file could not be created, check filesystem permissions, httpd user, should have permission to write in include directory ";
- return false;
- }
- fwrite($fp,"username:password:view_status:view_macs:ban_users:access_ifs:edit_users\n
- admin:c178d9bb85c3e412dbc478d76320c2be:true:true:true:true:true\n
- guest:d41d8cd98f00b204e9800998ecf8427e:true:false:false:false:false");
- fclose($fp);
- }
-
- //returns an array of passwd file lines
- function read_passwd_file(){
- global $passwd_filename;
- $filename = $passwd_filename;
- //if passwd file does not exist, create the default one
- if (!file_exists($filename)) {
- create_default_passwd_file();
- }
- $fp = fopen($filename,"r");
- $file_contents=fread($fp,filesize($filename));
- fclose($fp);
- $whole_lines=explode("\n",$file_contents);
-
- $lines_count = 0;
- foreach ($whole_lines as $whole_line){
- $whole_line = trim($whole_line);
- //ignore empty lines
- if ($whole_line == "")
- continue;
- $lines[$lines_count] = explode(":", $whole_line);
- $lines_count++;
- }
- //first line of file is the attribute names
- $attribute_names = $lines[0];
-
- //for each of the lines
- for ($line_index = 1; $line_index < count($lines); $line_index++){
- //for each attribute
- $attribute_index = 0;
- foreach ($attribute_names as $attribute_name){
- $user_attributes[$attribute_name] = $lines[$line_index][$attribute_index];
- $attribute_index++;
- }
- $return_array[$line_index - 1] = $user_attributes;
- }
- return $return_array;
- }
-
- function write_passwd_file($users_attributes){
- global $passwd_filename;
- $filename = $passwd_filename;
- if ( ($fp = fopen($filename,"r+")) == false){
- echo "
"; - if($auth_results) echo $auth_results; @@ -47,10 +40,14 @@ { ?>
-
could not open passwd file, check permissions
"; - return false; - } - $fp = fopen($filename,"r+"); - $attribute_index = 0; - foreach($users_attributes[0] as $attribute_name => $attribute_value){ - if ($attribute_index == 0) - $passwd_string = $attribute_name; - else - $passwd_string = $passwd_string.":".$attribute_name; - $attribute_index++; - } - - foreach ($users_attributes as $user_attributes){ - $passwd_string = $passwd_string."\n"; - $attribute_index = 0; - foreach($user_attributes as $attribute_name => $attribute_value){ - if ($attribute_index == 0) - $passwd_string = $passwd_string.$attribute_value; - else - $passwd_string = $passwd_string.":".$attribute_value; - $attribute_index++; - } - } - ftruncate($fp,0); - fwrite($fp,$passwd_string); - fclose($fp); - } +function create_default_passwd_file () +{ + global $passwd_filename; + $filename = $passwd_filename; + if (($fp = fopen ($filename, "w")) == false) + { + echo "passwd file could not be created, check filesystem permissions, httpd user, should have permission to write in include directory
"; + return false; + } + fwrite ($fp, +"username:password:view_status:view_macs:ban_users:access_ifs:edit_users +root:x:true:true:true:true:true +guest:x:false:false:false:false:false\n"); + fclose ($fp); +} + + //returns an array of passwd file lines +function read_passwd_file () +{ + global $passwd_filename; + $filename = $passwd_filename; + //if passwd file does not exist, create the default one + if (!file_exists ($filename)) + { + privcmd ("remountrw", false); + create_default_passwd_file (); + privcmd ("remountro", false); + } + $fp = fopen ($filename, "r"); + $file_contents = fread ($fp, filesize ($filename)); + fclose ($fp); + $whole_lines = explode ("\n", $file_contents); + + $lines_count = 0; + foreach ($whole_lines as $whole_line) + { + $whole_line = trim($whole_line); + //ignore empty lines + if ($whole_line == "") + continue; + $lines[$lines_count] = explode (":", $whole_line); + $lines_count++; + } + //first line of file is the attribute names + $attribute_names = $lines[0]; + + //for each of the lines + for ($line_index = 1; $line_index < count ($lines); $line_index++) + { + //for each attribute + $attribute_index = 0; + foreach ($attribute_names as $attribute_name) + { + $user_attributes[$attribute_name] = + $lines[$line_index][$attribute_index]; + $attribute_index++; + } + $return_array[$line_index - 1] = $user_attributes; + } + return $return_array; +} + +function write_passwd_file ($users_attributes) +{ + global $passwd_filename; + $filename = $passwd_filename; + if (($fp = fopen ($filename, "r+")) == false) + { + echo "could not open passwd file, check permissions
"; + return false; + } + $fp = fopen ($filename, "r+"); + $attribute_index = 0; + foreach ($users_attributes[0] as $attribute_name => $attribute_value) + { + if ($attribute_index == 0) + $passwd_string = $attribute_name; + else + $passwd_string = $passwd_string.":".$attribute_name; + $attribute_index++; + } + + foreach ($users_attributes as $user_attributes) + { + $passwd_string = $passwd_string."\n"; + $attribute_index = 0; + foreach ($user_attributes as $attribute_name => $attribute_value) + { + if ($attribute_index == 0) + $passwd_string = $passwd_string.$attribute_value; + else + $passwd_string = $passwd_string.":".$attribute_value; + $attribute_index++; + } + } + ftruncate ($fp, 0); + fwrite ($fp, $passwd_string); + fclose ($fp); +} //assign privileges for the user $_SESSION["username"] - function assign_privileges() +function assign_privileges () +{ + global $use_mysql; + if ($use_mysql == true) + { + $link = connect_to_users_db (); + $sql = + 'SELECT * FROM `privileges` WHERE username = "'.$_SESSION["username"]. + '"'; + $result = + mysql_query ($sql) or die (" $result Error: $sql".mysql_error ()); + while ($row = mysql_fetch_assoc ($result)) { - global $use_mysql; - if ($use_mysql == true){ - $link = connect_to_users_db(); - $sql = 'SELECT * FROM `privileges` WHERE username = "'.$_SESSION["username"].'"'; - $result = mysql_query($sql) or die(" $result Error: $sql
" . mysql_error()); - while ($row = mysql_fetch_assoc($result)) { - if($row["username"] == $_SESSION["username"] ){ - /* set the php session */ - foreach ( $row as $attribute_name => $attribute_value){ - $_SESSION[$attribute_name] = $attribute_value; - } - break; - } - } - /* Free resultset */ - mysql_free_result($result); - /* Closing connection */ - mysql_close($link); - } - else{ - $users_attributes = read_passwd_file(); - foreach($users_attributes as $user_attributes){ - if($user_attributes["username"] == $_SESSION["username"] ){ - /* set the php session */ - foreach ( $user_attributes as $attribute_name => $attribute_value){ - $_SESSION[$attribute_name] = $attribute_value; - } - break; - } - } - } + if ($row["username"] == $_SESSION["username"]) + { + /* set the php session */ + foreach ($row as $attribute_name => $attribute_value) + { + $_SESSION[$attribute_name] = $attribute_value; + } + break; + } } - - function authenticate_user($given_username, $given_password){ - global $use_mysql, $confirm_new_account; - $found = 0; - $return = ''; - if ($use_mysql == true){ - $link = connect_to_users_db(); - $sql = 'SELECT * FROM `user` WHERE username = "'.$given_username.'"'; - $result = mysql_query($sql) or die(" $result Error: $sql
" . mysql_error()); - $row = mysql_fetch_assoc($result); - if ($row["password"] == md5($given_password)){ - //check if account is confirmed (if needed) - if ($confirm_new_account){ - $sql = 'SELECT * FROM `user_tokens` WHERE username = "'.$given_username.'"'; - $query = mysql_query($sql) or die(" $result Error: $sql
" . mysql_error()); - if (!$query || (mysql_num_rows($query) == 0)) { - return "
No token exists for such a user.
"; - } - $row = mysql_fetch_assoc($query); - if ($row["status"] == "unconfirmed"){ - return "This account has not yet been confirmed.Check your email
"; - } - } - $_SESSION["username"] = $given_username; - assign_privileges(); - $found = 1; - } - + /* Free resultset */ + mysql_free_result ($result); + /* Closing connection */ + mysql_close ($link); + } + else + { + $users_attributes = read_passwd_file (); + foreach ($users_attributes as $user_attributes) + { + if ($user_attributes["username"] == $_SESSION["username"]) + { + /* set the php session */ + foreach ($user_attributes as $attribute_name => $attribute_value) + { + $_SESSION[$attribute_name] = $attribute_value; + } + break; + } + } + } +} + +function authenticate_user ($given_username, $given_password) +{ + global $use_mysql, $confirm_new_account; + $found = 0; + $return = ''; + if ($use_mysql == true) + { + $link = connect_to_users_db (); + $sql = 'SELECT * FROM `user` WHERE username = "'.$given_username.'"'; + $result = + mysql_query ($sql) or die (" $result Error: $sql".mysql_error ()); + $row = mysql_fetch_assoc ($result); + if ($row["password"] == md5 ($given_password)) + { + //check if account is confirmed (if needed) + if ($confirm_new_account) + { + $sql = + 'SELECT * FROM `user_tokens` WHERE username = "'. + $given_username.'"'; + $query = + mysql_query ($sql) or die (" $result Error: $sql
". + mysql_error ()); + if (!$query || (mysql_num_rows ($query) == 0)) + { + return + "
No token exists for such a user.
"; } - else{ - $users_attributes = read_passwd_file(); - foreach($users_attributes as $user_attributes) - { - if(($user_attributes["username"] == $given_username) && ($user_attributes["password"] == md5($given_password) )) - { - /* set the php session */ - $_SESSION["username"] = $_POST["username"]; - assign_privileges(); - $found = 1; - break; - } - } + $row = mysql_fetch_assoc ($query); + if ($row["status"] == "unconfirmed") + { + return + "This account has not yet been confirmed.Check your email
"; } - if(!$found) - return "Wrong username and/or password. Authentication failed.
"; + } + $_SESSION["username"] = $given_username; + assign_privileges (); + $found = 1; } - - - + } + else + { + $users_attributes = read_passwd_file (); + foreach ($users_attributes as $user_attributes) + { +// if(($user_attributes["username"] == $given_username) && ($user_attributes["password"] == md5($given_password) )) + if (($user_attributes["username"] == $given_username) && + (check_real_password($user_attributes["username"], $given_password))) + { + /* set the php session */ + $_SESSION["username"] = $_POST["username"]; + assign_privileges (); + $found = 1; + break; + } + } + } + if (!$found) + return + "Wrong username and/or password. Authentication failed.
"; +} ?> Only in admin/include: popup.js diff -ru /home/rob/pebble/src/wifiadmin-0.0.4/index.php admin/index.php --- /home/rob/pebble/src/wifiadmin-0.0.4/index.php 2004-12-11 14:40:30.000000000 -0800 +++ admin/index.php 1980-01-05 15:36:00.000000000 -0800 @@ -23,6 +23,7 @@ include_once("./include/auth.php"); include_once("./include/passwd_functions.php"); + //AUTHENTICATION $auth_results = 0; if( !empty($_POST["username"]) && !empty($_POST["password"])&& $_SESSION["username"] == "guest" ) @@ -32,14 +33,6 @@ include("./include/header.php"); //echo the default Header entries - -$wifs = get_wifs(); -$s = "s"; -if(sizeof($wifs) == 2) //fix "s" in wireless NIC(s) :) a size of 2 means one NIC - $s = ""; -echo "Running on ".kernel()." node ".chostname().", managing ".(sizeof($wifs)/2)." wireless NIC$s
Up for ".uptime()."
-"; - if($auth_results) echo $auth_results; @@ -47,10 +40,14 @@ { ?>
Back to Wireless Settings"; } - /*?> - List of users registered in our community-
Wireless Status+StatisticsAssosiated MACs list on Master-mode device ".$current['name']."\n"; + if(!strstr($current['name'],"wlan")) + echo "Note: graphing in Master mode is currently only supported in HostAP. "; + + echo "Associated MACs list on Master-mode device ".$current['name']."\n"; $command = "cat ".$hostap_device_path.$current['name']."/0*"; //command that accumulates association data $associations = trim(`$command`); @@ -170,7 +177,7 @@ if($IP = resolve_mac($data['macs'][$j])) //get IP or name from a MAC address { - if($resolve) //resolve the IPs found assosiated? + if($resolve) //resolve the IPs found associated? $name = ar_gethostbyaddr($IP); else $name = $IP; @@ -246,9 +253,7 @@Noise |
".$data['type']." | ".$data['mode']." | ".$data['essid']." | ".$data['channel']." | ";
if($_SESSION['view_macs'] == 'true'){ //check users priviledge to see MAC addresses
@@ -294,9 +299,7 @@
Noise |
".$data['type']." | ".$data['mode']." | ".$data['essid']." | ".$data['channel']." | ";
if($_SESSION['view_macs'] == 'true'){ //check users priviledge to see MAC addresses
Only in /home/rob/pebble/src/wifiadmin-0.0.4/: mysql.sql
Only in /home/rob/pebble/src/wifiadmin-0.0.4/: register.php
Only in admin/: routing.php
Only in admin/: rrd_database
Only in admin/: system.php
Only in admin/: update-graphs.php
diff -ru /home/rob/pebble/src/wifiadmin-0.0.4/users.php admin/users.php
--- /home/rob/pebble/src/wifiadmin-0.0.4/users.php 2004-12-12 17:00:06.000000000 -0800
+++ admin/users.php 2005-02-04 21:37:54.000000000 -0800
@@ -52,11 +52,11 @@
";
break;
- case "delete_user_confirm":
+/* case "delete_user_confirm":
echo "You are about to delete user ".$_GET["username"].". Are you sure?"; break; - - case "list_users" :case "delete_user": +*/ + case "list_users" : $users_attributes = read_passwd_file(); - if ($_GET["action"] == "delete_user" ){ +/* if ($_GET["action"] == "delete_user" ){ unset ( $users_attributes[ $_GET["user_id"]]); if (check_users_attributes( $users_attributes )) write_passwd_file($users_attributes); else $users_attributes = read_passwd_file(); } +*/ if ( isset($_POST["action"]) && ( $_POST["action"] == "save_user")){ $user_attributes = $users_attributes[$_POST["user_id"]]; @@ -129,9 +129,11 @@ } //check if username or password contain : - if ( strpos($_POST["password"], ':')){ + if(isset($_POST["password"])) { + if ( strpos($_POST["password"], ':')){ echo "Password contains illegal character :"; break; + } } if ( strpos($_POST["username"], ':')){ @@ -142,8 +144,14 @@ //ok, save the user foreach($user_attributes as $attribute_name => $attribute_value){ if($attribute_name == "password"){ - if ( isset( $_POST["password"]) ) - $user_attributes["password"] = md5($_POST["password"]); + if ( isset( $_POST["password"]) ) { + // $user_attributes["password"] = md5($_POST["password"]); + $pw = escapeshellcmd($_POST["password"]); + if($pw) { + $username = escapeshellcmd($user_attributes["username"]); + `echo $username:$pw | sudo chpasswd -m`; + } + } } else if($attribute_name == "username") $user_attributes["username"] = $_POST["username"]; @@ -155,12 +163,17 @@ } } $users_attributes[$_POST["user_id"]] = $user_attributes; - if (check_users_attributes( $users_attributes )) + if (check_users_attributes( $users_attributes )) { + privcmd("remountrw",false); write_passwd_file($users_attributes); - else + privcmd("remountro",false); + } + else { $users_attributes = read_passwd_file(); + } } +/* if ( isset($_POST["action"]) && $_POST["action"] == "add_user"){ //check if username and pass are given if (!isset($_POST["username"]) || trim($_POST["username"]) == ""){ @@ -221,8 +234,9 @@ else $users_attributes = read_passwd_file(); } +*/ - ?>Select a user to edit or delete+ ?>Select a user to edit
[ Add new user ]"; break; - +/* case "add_user_form": $users_attributes = read_passwd_file(); echo " Add new User@@ -256,6 +269,7 @@Back to user list | | ||||||||||||
![](\"/images/metrix.gif\")