[plugins] weblogin and weblogout plugins conected to manager

because couldent decript the password of a modx user md5 i made two plugins for login every times and every people to the same webuser (but retain the admin pribilegies)
simply change two variables and voila
event OnManagerLogin

$e = $modx->Event;
switch ($e->name) {
case "OnManagerLogin":


$dbase = $modx->dbConfig[’dbase’];
$table_prefix = $modx->dbConfig[’table_prefix’];

# process login

$username = heretheusername;
$givenPassword = herethepassword;
$captcha_code = isset($_POST[’captcha_code’])? $_POST[’captcha_code’]: ’’;

// invoke OnBeforeWebLogin event
$modx->invokeEvent("OnBeforeWebLogin",
array(
"username" => $username,
"userpassword" => $givenPassword,
"rememberme" => $_POST[’rememberme’]
));

$sql = "SELECT $dbase.".$table_prefix."web_users.*, $dbase.".$table_prefix."web_user_attributes.* FROM $dbase.".$table_prefix."web_users, $dbase.".$table_prefix."web_user_attributes WHERE $dbase.".$table_prefix."web_users.username REGEXP BINARY ’^".$username."$’ and $dbase.".$table_prefix."web_user_attributes.internalKey=$dbase.".$table_prefix."web_users.id;";
$ds = $modx->dbQuery($sql);
$limit = $modx->db->getRecordCount($ds);

if($limit==0 || $limit>1) {
$output = webLoginAlert("Incorrect username or password entered!");
return;
}

$row = $modx->db->getRow($ds);

$internalKey = $row[’internalKey’];
$dbasePassword = $row[’password’];
$failedlogins = $row[’failedlogincount’];
$blocked = $row[’blocked’];
$blockeduntildate = $row[’blockeduntil’];
$blockedafterdate = $row[’blockedafter’];
$registeredsessionid = $row[’sessionid’];
$role = $row[’role’];
$lastlogin = $row[’lastlogin’];
$nrlogins = $row[’logincount’];
$fullname = $row[’fullname’];
//$sessionRegistered = checkSession();
$email = $row[’email’];

// load user settings
if($internalKey){
$result = $modx->dbQuery("SELECT setting_name, setting_value FROM ".$dbase.".".$table_prefix."web_user_settings WHERE webuser=’$internalKey’");
while ($row = $modx->fetchRow($result, ’both’)) $modx->config[$row[0]] = $row[1];
}

if($failedlogins>=3 && $blockeduntildate>time()) { // blocked due to number of login errors.
session_destroy();
session_unset();
$output = webLoginAlert("Due to three or more failed logins, you have been blocked!");
return;
}

if($failedlogins>=3 && $blockeduntildate<time()) { // blocked due to number of login errors, but get to try again
$sql = "UPDATE $dbase.".$table_prefix."user_attributes SET failedlogincount=’0’, blockeduntil=’".(time()-1)."’ where internalKey=$internalKey";
$ds = $modx->dbQuery($sql);
}

if($blocked=="1") { // this user has been blocked by an admin, so no way he’s loggin in!
session_destroy();
session_unset();
$output = webLoginAlert("You are blocked and cannot log in!");
return;
}

// blockuntil
if($blockeduntildate>time()) { // this user has a block until date
session_destroy();
session_unset();
$output = webLoginAlert("You are blocked and cannot log in! Please try again later.");
return;
}

// blockafter
if($blockedafterdate>0 && $blockedafterdate<time()) { // this user has a block after date
session_destroy();
session_unset();
$output = webLoginAlert("You are blocked and cannot log in! Please try again later.");
return;
}

// allowed ip
if (isset($modx->config[’allowed_ip’])) {
if (strpos($modx->config[’allowed_ip’],$_SERVER[’REMOTE_ADDR’])===false) {
$output = webLoginAlert("You are not allowed to login from this location.");
return;
}
}

// allowed days
if (isset($modx->config[’allowed_days’])) {
$date = getdate();
$day = $date[’wday’]+1;
if (strpos($modx->config[’allowed_days’],"$day")===false) {
$output = webLoginAlert("You are not allowed to login at this time. Please try again later.");
return;
}
}

// invoke OnWebAuthentication event
$rt = $modx->invokeEvent("OnWebAuthentication",
array(
"userid" => $internalKey,
"username" => $username,
"userpassword" => $givenPassword,
"savedpassword" => $dbasePassword,
"rememberme" => $_POST[’rememberme’]
));
// check if plugin authenticated the user
if (!$rt||(is_array($rt) && !in_array(TRUE,$rt))) {
// check user password - local authentication
if($dbasePassword != md5($givenPassword)) {
$output = webLoginAlert("Incorrect username or password entered!");
$newloginerror = 1;
}
}

if(isset($use_captcha) && $use_captcha==1) {
if($_SESSION[’veriword’]!=$captcha_code) {
$output = webLoginAlert("The security code you entered didn’t validate! Please try to login again!");
$newloginerror = 1;
}
}

if(isset($newloginerror) && $newloginerror==1) {
$failedlogins += $newloginerror;
if($failedlogins>=3) { //increment the failed login counter, and block!
$sql = "update $dbase.".$table_prefix."web_user_attributes SET failedlogincount=’$failedlogins’, blockeduntil=’".(time()+(1*60*60))."’ where internalKey=$internalKey";
$ds = $modx->dbQuery($sql);
} else { //increment the failed login counter
$sql = "update $dbase.".$table_prefix."web_user_attributes SET failedlogincount=’$failedlogins’ where internalKey=$internalKey";
$ds = $modx->dbQuery($sql);
}
session_destroy();
session_unset();
return;
}

$currentsessionid = session_id();

if(!isset($_SESSION[’webValidated’])) {
$sql = "update $dbase.".$table_prefix."web_user_attributes SET failedlogincount=0, logincount=logincount+1, lastlogin=thislogin, thislogin=".time().", sessionid=’$currentsessionid’ where internalKey=$internalKey";
$ds = $modx->dbQuery($sql);
}

$_SESSION[’webShortname’]=$username;
$_SESSION[’webFullname’]=$fullname;
$_SESSION[’webEmail’]=$email;
$_SESSION[’webValidated’]=1;
$_SESSION[’webInternalKey’]=$internalKey;
$_SESSION[’webValid’]=base64_encode($givenPassword);
$_SESSION[’webUser’]=base64_encode($username);
$_SESSION[’webFailedlogins’]=$failedlogins;
$_SESSION[’webLastlogin’]=$lastlogin;
$_SESSION[’webnrlogins’]=$nrlogins;
$_SESSION[’webUserGroupNames’] = ’’; // reset user group names

// get user’s document groups
$dg=’’;$i=0;
$tblug = $dbase.".".$table_prefix."web_groups";
$tbluga = $dbase.".".$table_prefix."webgroup_access";
$sql = "SELECT uga.documentgroup
FROM $tblug ug
INNER JOIN $tbluga uga ON uga.webgroup=ug.webgroup
WHERE ug.webuser =".$internalKey;
$ds = $modx->db->query($sql);
while ($row = $modx->db->getRow($ds,’num’)) $dg[$i++]=$row[0];
$_SESSION[’webDocgroups’] = $dg;



// update active users list if redirectinq to another page
if($id!=$modx->documentIdentifier) {
if (getenv("HTTP_CLIENT_IP")) $ip = getenv("HTTP_CLIENT_IP");else if(getenv("HTTP_X_FORWARDED_FOR")) $ip = getenv("HTTP_X_FORWARDED_FOR");else if(getenv("REMOTE_ADDR")) $ip = getenv("REMOTE_ADDR");else $ip = "UNKNOWN";$_SESSION[’ip’] = $ip;
$itemid = isset($_REQUEST[’id’]) ? $_REQUEST[’id’] : ’NULL’ ;$lasthittime = time();$a = 998;
if($a!=1) {
// web users are stored with negative id
$sql = "REPLACE INTO $dbase.".$table_prefix."active_users(internalKey, username, lasthit, action, id, ip) values(-".$_SESSION[’webInternalKey’].", ’".$_SESSION[’webShortname’]."’, ’".$lasthittime."’, ’".$a."’, ’".$itemid."’, ’$ip’)";
if(!$ds = $modx->dbQuery($sql)) {
$output = "error replacing into active users! SQL: ".$sql;
return;
}
}
}

// invoke OnWebLogin event
$modx->invokeEvent("OnWebLogin",
array(
"userid" => $internalKey,
"username" => $username,
"userpassword" => $givenPassword,
"rememberme" => $_POST[’rememberme’]
));



return;
break;
default :
return; // stop here - this is very important.
break;
}

and here the weblogout

$e = $modx->Event;
switch ($e->name) {
case "OnManagerLogout":
if ($isLogOut==1){
$internalKey = $_SESSION[’webInternalKey’];
$username = $_SESSION[’webShortname’];

// invoke OnBeforeWebLogout event
$modx->invokeEvent("OnBeforeWebLogout",
array(
"userid" => $internalKey,
"username" => $username
));

// if we were launched from the manager
// do NOT destroy session
if(isset($_SESSION[’mgrValidated’])) {
unset($_SESSION[’webShortname’]);
unset($_SESSION[’webFullname’]);
unset($_SESSION[’webEmail’]);
unset($_SESSION[’webValidated’]);
unset($_SESSION[’webInternalKey’]);
unset($_SESSION[’webValid’]);
unset($_SESSION[’webUser’]);
unset($_SESSION[’webFailedlogins’]);
unset($_SESSION[’webLastlogin’]);
unset($_SESSION[’webnrlogins’]);
unset($_SESSION[’webUsrConfigSet’]);
unset($_SESSION[’webUserGroupNames’]);
unset($_SESSION[’webDocgroups’]);
}
else {
// Unset all of the session variables.
$_SESSION = array();
// destroy session cookie
if (isset($_COOKIE[session_name()])) {
setcookie(session_name(), ’’, time()-42000, ’/’);
}
session_destroy();
$sessionID = md5(date(’d-m-Y H:i:s’));
session_id($sessionID);
startCMSSession();
session_destroy();
}

// invoke OnWebLogout event
$modx->invokeEvent("OnWebLogout",
array(
"userid" => $internalKey,
"username" => $username
));
break;
default :
return; // stop here - this is very important.
break;
}

for me is very usefull.. (going crazi to do and very cut and plaste)
hi

Hi, This is very useful indeed! I noticed a little error in your code: A closing bracket is missing at the end of the Weblogout plugin:



One should insert a ’}’ before the ’break;’, like that:



These two plugins actually solve the problem of Manager Users not able to see in the front-end the hidden documents for which they have access in the back-end. Thank you for that!

Hi, I have Management-users and Web-users with the same username and same password....
If I use this, will it mean that when I login on frontend web-user login snippet, I will also be logged in into the back-end manager? (which will save me time, because I won’t have to log in twice....?)??

If so, can anyone tell me exactly what to do, because I don’t really understand what is explained in the first post....???

No, the two user types are completely separate. There are snippets that will let you log in to the manager from the front-end.
http://modxcms.com/extras/package/254

The first post describes two plugins, one used when a manager user logs in (using the OnManagerLogin event) to also make him logged in to the front-end, and the other for when the user logs out, to log him out from both accounts. It’s basically a matter of getting the web user data and loading the SESSION values for the web user type when logging in, plus updating the active_users table in the database, and again for clearing the SESSION for the web user type when logging out (onManagerLogout). Of course, it should be one plugin using the PHP switch construct to determine which one to do.

http://www.sottwell.com/article-sessions.html

So if I make sure that every web user has a corresponding manager account (with Web2manager add-on...) and I put instead of a webuser login, a manager-user login (ManagerLogin) part on my front-end website...

...the first plugin in this topic will make everybody logged in to the manager (back-end), and also the frontend (do you mean private pages/webuser...?????? please do)

and the second plugin mentioned above will log them out of both web- and manager-accounts....

So it’s the reverse of what I said in my earlier post, so manager-login will cause web-user login?

(I’m not great, actually nothing, with sessions etc, I know some do-it-yourself php, so I’ll give your second link about sessions a go....)

With those plugins, yes. Log in as a manager user, and you’re also logged in as the web user.

Thanks!!

I’m still trying to figure out the starting post in this topic....
I’m able to install add-ons etc, but is this changing some existing file, or is it a new snippet or.....? ? ?

If someone could give me an understandable first step, second step etc list (like in add-ons) I’d be verryyyy happyy!

Those are plugins; they intercept MODx processing to add functionality without hacking the MODx core files. You create/edit them in Elements, Manage Elements and the Plugins tab. All plugins must have the events they "listen" for check in their System Events tab; in this case onManagerLogin and onManagerLogout.

The two plugins should be combined into one:

Thanks for the help!
I’m doing the copy/paste in Dreamweaver....removing the double breaks/returns/defaults etc.

two questions...:
1) in the OnManagerLogin event is says:

$username = heretheusername;
$givenPassword = herethepassword;

the underlined bit, is this right???? (I want to use for several users, is this a variable or a static string I have to input for only one user?)

2) in the OnManagerLogout event, there is no "return".... is this right (it is in the Login event and in the deafult event....)

Again thanks for the help..! I see nicochto is posting links to this plugin on several pages in the forum, so I wasn’t the only one who needed this!

MaraMara, did you get this working?
If so, could you outline the steps involved? Or maybe someone else?

-Andrea