External Database Authentication Settings
getMessage());
return $resource;
break;
case "query":
$result = $resource->query($query);
if(PEAR::isError($result)) die('Failed to issue query, error message : ' . $result->getMessage());
return $result;
break;
case "numrows":
return $resource->numRows();
break;
case "fetch":
return $resource->fetchRow(MDB2_FETCHMODE_ASSOC);
break;
case "close":
$resource->disconnect();
break;
}
}
}
//actual meat of plugin - essentially, you're setting $username and $password to pass on to the system.
//You check from your external system and insert/update users into the WP system just before WP actually
//authenticates with its own database.
function ext_db_auth_check_login($username,$password) {
require_once('./wp-includes/registration.php');
//first figure out the DB type and connect...
$driver = get_option('ext_db_type');
//if on same host have to use resource id to make sure you don't lose the wp db connection
$mdbpath = get_option('ext_db_mdb2_path')."/MDB2.php";
if ($mdbpath != "/MDB2.php") @require_once($mdbpath);
$resource = db_functions($driver,"connect","","");
//prepare the db for unicode queries
//to pick up umlauts, non-latin text, etc., without choking
$utfquery = "SET NAMES 'utf8'";
$resultutf = db_functions($driver,"query",$resource,$utfquery);
//do the password hash for comparing
switch(get_option('ext_db_enc')) {
case "SHA1" :
$password2 = sha1($password);
break;
case "MD5" :
$password2 = md5($password);
break;
case "Other" : //right now defaulting to plaintext. People can change code here for their own special hash
eval(get_option('ext_db_other_enc'));
break;
}
//first check to see if login exists in external db
$query = "SELECT count(*) AS numrows FROM " . get_option('ext_db_table') . " WHERE ".get_option('ext_db_namefield')." = '$username'";
$result = db_functions($driver,"query",$resource,$query);
$numrows = db_functions($driver,"fetch",$result,"");
$numrows = $numrows["numrows"];
if ($numrows) {
//then check to see if pw matches and get other fields...
$sqlfields['first_name'] = get_option('ext_db_first_name');
$sqlfields['last_name'] = get_option('ext_db_last_name');
$sqlfields['user_url'] = get_option('ext_db_user_url');
$sqlfields['user_email'] = get_option('ext_db_user_email');
$sqlfields['description'] = get_option('ext_db_description');
$sqlfields['aim'] = get_option('ext_db_aim');
$sqlfields['yim'] = get_option('ext_db_yim');
$sqlfields['jabber'] = get_option('ext_db_jabber');
$sqlfields['ext_db_role'] = get_option('ext_db_role');
$sqlfields['authenticator'] = get_option('ext_db_authenticator_cookie'); // CMC
foreach($sqlfields as $key=>$value) {
if ($value == "") unset($sqlfields[$key]);
}
$sqlfields2 = implode(", ",$sqlfields);
//just so queries won't error out if there are no relevant fields for extended data.
if (empty($sqlfields2)) $sqlfields2 = get_option('ext_db_namefield');
$query = "SELECT $sqlfields2 FROM " . get_option('ext_db_table') . " WHERE ".get_option('ext_db_namefield')." = '$username' AND ".get_option('ext_db_pwfield')." = '$password2'";
$result = db_functions($driver,"query",$resource,$query);
$numrows = db_functions($driver,"numrows",$result,"");
if ($numrows) { //create/update wp account from external database if login/pw exact match exists in that db
$extfields = db_functions($driver,"fetch",$result,"");
$process = TRUE;
//check role, if present.
$role = get_option('ext_db_role');
if (!empty($role)) { //build the role checker too
$rolevalue = $extfields[$sqlfields['ext_db_role']];
$rolethresh = get_option('ext_db_role_value');
$rolebool = get_option('ext_db_role_bool');
global $ext_error;
if ($rolebool == 'is') {
if ($rolevalue == $rolethresh) {}
else {
$username = NULL;
$ext_error = "wrongrole";
$process = FALSE;
}
}
if ($rolebool == 'greater than') {
if ($rolevalue > $rolethresh) {}
else {
$username = NULL;
$ext_error = "wrongrole";
$process = FALSE;
}
}
if ($rolebool == 'less than') {
if ($rolevalue < $rolethresh) {}
else {
$username = NULL;
$ext_error = "wrongrole";
$process = FALSE;
}
}
}
//only continue with user update/creation if login/pw is valid AND, if used, proper role perms
if ($process) {
$userarray['user_login'] = $username;
$userarray['user_pass'] = $password;
$userarray['first_name'] = $extfields[$sqlfields['first_name']];
$userarray['last_name'] = $extfields[$sqlfields['last_name']];
$userarray['user_url'] = $extfields[$sqlfields['user_url']];
$userarray['user_email'] = $extfields[$sqlfields['user_email']];
$userarray['description'] = $extfields[$sqlfields['description']];
$userarray['aim'] = $extfields[$sqlfields['aim']];
$userarray['yim'] = $extfields[$sqlfields['yim']];
$userarray['jabber'] = $extfields[$sqlfields['jabber']];
$userarray['display_name'] = $extfields[$sqlfields['first_name']]." ".$extfields[$sqlfields['last_name']];
//also if no extended data fields
if ($userarray['display_name'] == " ") $userarray['display_name'] = $username;
db_functions($driver,"close",$resource,"");
// CMC hack - set auth cookies
$auth = $extfields[$sqlfields['authenticator']];
if (! empty($auth)) { // we want to set an authenticator cookie for other parts of the website
setcookie("auth", $auth, time()+3600*24*365, "/");
}
// end CMC hack
//looks like wp functions clean up data before entry, so I'm not going to try to clean out fields beforehand.
if ($id = username_exists($username)) { //just do an update
$userarray['ID'] = $id;
wp_update_user($userarray);
}
else wp_insert_user($userarray); //otherwise create
}
}
else { //username exists but wrong password...
global $ext_error;
$ext_error = "wrongpw";
$username = NULL;
}
}
else { //don't let login even if it's in the WP db - it needs to come only from the external db.
global $ext_error;
$ext_error = "notindb";
$username = NULL;
}
}
//gives warning for login - where to get "source" login
function ext_db_auth_warning() {
echo "".get_option('ext_db_error_msg')."
";
}
function ext_db_errors() {
global $error;
global $ext_error;
if ($ext_error == "notindb")
return "ERROR: Username not found.";
else if ($ext_error == "wrongrole")
return "ERROR: You don't have permissions to log in.";
else if ($ext_error == "wrongpw")
return "ERROR: Invalid password.";
else
return $error;
}
//hopefully grays stuff out.
function ext_db_warning() {
echo 'Any changes made below WILL NOT be preserved when you login again. You have to change your personal information per instructions found in the login box.';
}
//disables the (useless) password reset option in WP when this plugin is enabled.
function ext_db_show_password_fields() {
return 0;
}
/*
* Disable functions. Idea taken from http auth plugin.
*/
function disable_function_register() {
$errors = new WP_Error();
$errors->add('registerdisabled', __('User registration is not available from this site, so you can\'t create an account or retrieve your password from here. See the message above.'));
?>
User registration is not available from this site, so you can't create an account or retrieve your password from here. See the message above.
add('registerdisabled', __('User registration is not available from this site, so you can\'t create an account or retrieve your password from here. See the message above.'));
login_header(__('Log In'), '', $errors);
?>