0000645: User / Group Access restriction by IP

Index: admin/system_presets/simple/groups_g.php =================================================================== --- admin/system_presets/simple/groups_g.php (revision 14590) +++ admin/system_presets/simple/groups_g.php (working copy) @@ -36,7 +36,7 @@ // fields to hide $hidden_fields = Array ( /*'GroupId', 'Name', 'Description', 'CreatedOn','System', 'Personal', 'Enabled', 'ResourceId',*/ ~~- 'FrontRegistration',~~ + 'FrontRegistration', 'IPRestrictions', ); // virtual fields to hide Index: admin/system_presets/simple/users_u.php =================================================================== --- admin/system_presets/simple/users_u.php (revision 14599) +++ admin/system_presets/simple/users_u.php (working copy) @@ -71,7 +71,7 @@ $hidden_fields = Array ( /* 'PortalUserId', 'Login', 'Password', 'FirstName','LastName', 'Company', 'Email', 'CreatedOn', 'Phone', 'Fax', 'Street', 'Street2', 'City', 'State' , 'Zip', 'Country', 'ResourceId', 'Status', ~~- 'Modified', 'dob', 'tz', 'ip', 'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/~~ + 'Modified', 'dob', 'tz',*/ 'IPAddress', /*'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/ 'IPRestrictions', ); // virtual fields to hide @@ -83,7 +83,7 @@ $required_fields = Array ( /*'PortalUserId',*/ 'Login', /*'Password', 'FirstName', 'LastName', 'Company', */'Email', /*'CreatedOn', 'Phone', 'Fax', 'Street', 'Street2', 'City', 'State' , 'Zip', 'Country', 'ResourceId', 'Status', ~~- 'Modified', 'dob', 'tz', 'ip', 'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/~~ + 'Modified', 'dob', 'tz', 'IPAddress', 'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/ ); // virtual fields to make required @@ -115,5 +115,5 @@ // 'Admins' => Array ('PortalUserId', 'Login', 'FirstName', 'LastName', 'Email'), // users list; section: Users Management -> Users ~~- 'RegularUsers' => Array (/*'PortalUserId', 'Login', 'FirstName', 'LastName', 'Email',*/ 'PrimaryGroup', 'CreatedOn', 'Modified', /* 'Status'*/),~~ + 'RegularUsers' => Array (/*'PortalUserId', 'Login', 'FirstName', 'LastName', 'Email',*/ 'PrimaryGroup', 'CreatedOn', 'Modified', /* 'Status',*/ 'IPAddress'), ); Index: core/admin_templates/groups/groups_edit.tpl =================================================================== --- core/admin_templates/groups/groups_edit.tpl (revision 14590) +++ core/admin_templates/groups/groups_edit.tpl (working copy) @@ -74,12 +74,14 @@ <div id="scroll_container"> <table class="edit-form"> ~~- <inp2:m_RenderElement name="subsection" prefix="g" fields="GroupId,Name,FrontRegistration,Description,Enabled" title="la_section_General"/>~~ + <inp2:m_RenderElement name="subsection" prefix="g" fields="GroupId,Name,FrontRegistration,Description,IPRestrictions,Enabled" title="la_section_General"/> <inp2:m_RenderElement name="inp_id_label" prefix="g" field="GroupId" title="la_fld_GroupId"/> <inp2:m_RenderElement name="inp_edit_box" prefix="g" field="Name" title="la_fld_GroupName"/> <inp2:m_RenderElement name="inp_edit_checkbox" prefix="g" field="FrontRegistration" title="la_fld_FrontRegistration"/> <inp2:m_RenderElement name="inp_edit_textarea" prefix="g" field="Description" title="la_fld_Description" control_options="{max_height: 100}"/> + <inp2:m_RenderElement name="inp_edit_textarea" prefix="g" field="IPRestrictions" allow_html="0" hint_label="la_hint_DomainIPRange" control_options="{max_height: 100}"/> + <inp2:m_if check="m_IsDebugMode"> <inp2:m_RenderElement name="inp_edit_radio" prefix="g" field="Enabled" title="la_fld_Enabled"/> </inp2:m_if> Index: core/admin_templates/users/admins_edit.tpl =================================================================== --- core/admin_templates/users/admins_edit.tpl (revision 14590) +++ core/admin_templates/users/admins_edit.tpl (working copy) @@ -66,13 +66,22 @@ <div id="scroll_container"> <table class="edit-form"> ~~- <inp2:m_RenderElement name="inp_id_label" prefix="u" field="PortalUserId" title="la_fld_Id"/>~~ ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Login" title="la_fld_Username"/>~~ ~~- <inp2:m_RenderElement name="password_fields" />~~ + <inp2:m_RenderElement name="subsection" prefix="u" fields="PortalUserId,Login,Password,FirstName,LastName,Email" title="la_section_General"/> + <inp2:m_RenderElement name="inp_id_label" prefix="u" field="PortalUserId" title="la_fld_Id"/> + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Login" title="la_fld_Username"/> + <inp2:m_RenderElement name="password_fields" /> ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="FirstName" title="la_fld_FirstName"/>~~ ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="LastName" title="la_fld_LastName"/>~~ ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Email" title="la_fld_Email"/>~~ + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="FirstName" title="la_fld_FirstName"/> + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="LastName" title="la_fld_LastName"/> + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Email" title="la_fld_Email"/> + + <inp2:m_RenderElement name="subsection" prefix="u" fields="IPAddress,IPRestrictions" title="la_section_Properties"/> + <inp2:m_if check="u_Field" name="IPAddress"> + <inp2:m_RenderElement name="inp_label" prefix="u" field="IPAddress"/> + </inp2:m_if> + + <inp2:m_RenderElement name="inp_edit_textarea" prefix="u" field="IPRestrictions" allow_html="0" hint_label="la_hint_DomainIPRange" control_options="{max_height: 100}"/> + <inp2:m_RenderElement name="inp_edit_filler"/> </table> </div> Index: core/admin_templates/users/users_edit.tpl =================================================================== --- core/admin_templates/users/users_edit.tpl (revision 14590) +++ core/admin_templates/users/users_edit.tpl (working copy) @@ -83,11 +83,17 @@ <inp2:m_RenderElement name="inp_edit_options" prefix="u" field="Country" has_empty="1"/> <inp2:m_RenderElement name="inp_edit_multioptions" prefix="u" field="DisplayToPublic"/> ~~- <inp2:m_RenderElement name="subsection" prefix="u" fields="Status,CreatedOn,Modified" title="la_section_Properties"/>~~ + <inp2:m_RenderElement name="subsection" prefix="u" fields="Status,CreatedOn,Modified,IPAddress,IPRestrictions" title="la_section_Properties"/> <inp2:m_RenderElement name="inp_edit_radio" prefix="u" field="Status"/> <inp2:m_RenderElement name="inp_edit_date_time" prefix="u" field="CreatedOn"/> <inp2:m_RenderElement name="inp_edit_date_time" prefix="u" field="Modified"/> + <inp2:m_if check="u_Field" name="IPAddress"> + <inp2:m_RenderElement name="inp_label" prefix="u" field="IPAddress"/> + </inp2:m_if> + + <inp2:m_RenderElement name="inp_edit_textarea" prefix="u" field="IPRestrictions" allow_html="0" hint_label="la_hint_DomainIPRange" control_options="{max_height: 100}"/> + <inp2:m_if check="m_ModuleEnabled" module="In-Portal">  <inp2:m_include t="incs/custom_blocks"/> Index: core/install/english.lang =================================================================== --- core/install/english.lang (revision 14629) +++ core/install/english.lang (working copy) @@ -424,6 +424,7 @@ <PHRASE Label="la_fld_InstallModules" Module="Core" Type="1">SW5zdGFsbCBNb2R1bGVz</PHRASE> <PHRASE Label="la_fld_InstallPhraseTypes" Module="Core" Type="1">SW5zdGFsbCBQaHJhc2UgVHlwZXM=</PHRASE> <PHRASE Label="la_fld_IPAddress" Module="Core" Type="1" Column="SVAgQWRkcmVzcw==">SVAgQWRkcmVzcw==</PHRASE> + <PHRASE Label="la_fld_IPRestrictions" Module="Core" Type="1">SVAgUmVzdHJpY3Rpb25z</PHRASE> <PHRASE Label="la_fld_IsBaseCategory" Module="Core" Type="1">VXNlIGN1cnJlbnQgc2VjdGlvbiBhcyByb290IGZvciB0aGUgZXhwb3J0</PHRASE> <PHRASE Label="la_fld_ISOCode" Module="Core" Type="1" Column="SVNPIENvZGU=">SVNPIENvZGU=</PHRASE> <PHRASE Label="la_fld_IsPrimary" Module="Core" Type="1" Column="UHJpbWFyeQ==">UHJpbWFyeQ==</PHRASE> @@ -615,7 +616,7 @@ <PHRASE Label="la_Hide" Module="Core" Type="1">SGlkZQ==</PHRASE> <PHRASE Label="la_hint_AllFiles" Module="Core" Type="1">QWxsIEZpbGVz</PHRASE> <PHRASE Label="la_hint_CSVFiles" Module="Core" Type="1">Q1NWIEZpbGVz</PHRASE> - <PHRASE Label="la_hint_DomainIPRange" Module="Core" Type="1">U2luZ2xlIElQIG9yIHJhbmdlIHJlY29yZCBwZXIgbGluZSAoZm9ybWF0czogMS4yLjMuNCBvciAxLjIuMyBvciAxLjIuMy4zMi0xLjIuMy41NCBvciAxLjIuMy4zMi8yNyBvciAxLjIuMy4zMi8yNTUuMjU1LjI1NS4yMjQp</PHRASE> + <PHRASE Label="la_hint_DomainIPRange" Module="Core" Type="1">U2luZ2xlIElQLCBJUCByYW5nZSwgU3VibmV0IG9yIGhvc3RuYW1lIHJlY29yZCBwZXIgbGluZSAoZm9ybWF0czogMS4yLjMuNCBvciAxLjIuMy4zMi0xLjIuMy41NCBvciAxLjIuMy4zMi8yNyBvciAxLjIuMy4zMi8yNTUuMjU1LjI1NS4yMjQgb3Igd3d3LmluLXBvcnRhbC5jb20p</PHRASE> <PHRASE Label="la_hint_ExportEmailEvents" Module="Core" Type="1">U2luZ2xlIEVtYWlsIEV2ZW50IHBlciBsaW5lIChmb3JtYXRzOiBVU0VSLkFERCwgT1JERVIuU1VCTUlUKQ==</PHRASE> <PHRASE Label="la_hint_ExportPhrases" Module="Core" Type="1">U2luZ2xlIFBocmFzZSBMYWJlbCBwZXIgbGluZSAoZm9ybWF0czogbGFfU2FtcGxlTGFiZWwsIGx1X0Zyb250RW5kTGFiZWwp</PHRASE> <PHRASE Label="la_hint_ForceModRewriteUrlEnding" Module="Core" Type="1">VXNlciB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcmVkaXJlY3RlZCB0byB0aGUgc2VsZWN0ZWQgVXJsIEVuZGluZyBpbiBjYXNlIHdoZW4gY3VycmVudCBwYWdlIHVybCBoYXMgYSBkaWZmZXJlbnQgZW5kaW5n</PHRASE> Index: core/install/install_schema.sql =================================================================== --- core/install/install_schema.sql (revision 14629) +++ core/install/install_schema.sql (working copy) @@ -232,6 +232,7 @@ Personal tinyint(4) NOT NULL DEFAULT '0', Enabled tinyint(4) NOT NULL DEFAULT '1', FrontRegistration tinyint(3) unsigned NOT NULL DEFAULT '0', + IPRestrictions text, PRIMARY KEY (GroupId), UNIQUE KEY `Name` (`Name`), KEY Personal (Personal), @@ -261,7 +262,7 @@ Modified int(11) DEFAULT NULL, dob int(11) DEFAULT NULL, tz int(11) DEFAULT NULL, ~~- ip varchar(20) NOT NULL DEFAULT '',~~ + IPAddress varchar(15) NOT NULL, IsBanned tinyint(1) NOT NULL DEFAULT '0', PwResetConfirm varchar(255) NOT NULL, PwRequestTime int(11) unsigned DEFAULT NULL, @@ -270,6 +271,7 @@ UserType tinyint(4) NOT NULL, PrimaryGroupId int(11) DEFAULT NULL, OldStyleLogin tinyint(4) NOT NULL, + IPRestrictions text, PRIMARY KEY (PortalUserId), UNIQUE KEY ResourceId (ResourceId), KEY CreatedOn (CreatedOn), Index: core/install/upgrades.sql =================================================================== --- core/install/upgrades.sql (revision 14629) +++ core/install/upgrades.sql (working copy) @@ -2130,4 +2130,10 @@ ADD UploadExtensions VARCHAR(255) NOT NULL DEFAULT '' AFTER Validation, ADD UploadMaxSize INT NULL AFTER UploadExtensions; ~~-ALTER TABLE Language ADD SynchronizationModes VARCHAR(255) NOT NULL DEFAULT '';~~ \ No newline at end of file +ALTER TABLE Language ADD SynchronizationModes VARCHAR(255) NOT NULL DEFAULT ''; + +ALTER TABLE PortalUser + CHANGE ip IPAddress VARCHAR(15) NOT NULL, + ADD IPRestrictions TEXT NULL; + +ALTER TABLE PortalGroup ADD IPRestrictions TEXT NULL; \ No newline at end of file Index: core/units/groups/groups_config.php =================================================================== --- core/units/groups/groups_config.php (revision 14590) +++ core/units/groups/groups_config.php (working copy) @@ -117,6 +117,7 @@ 'formatter' => 'kOptionsFormatter', 'options' => Array (1 => 'la_Yes', 0 => 'la_No'), 'use_phrases' => 1, 'not_null' => 1, 'default' => 0 ), + 'IPRestrictions' => Array ('type' => 'string', 'default' => NULL), ), 'VirtualFields' => Array ( Index: core/units/helpers/user_helper.php =================================================================== --- core/units/helpers/user_helper.php (revision 14628) +++ core/units/helpers/user_helper.php (working copy) @@ -185,22 +185,28 @@ function checkLoginPermission() { $object =& $this->getUserObject(); + $ip_restrictions = $object->GetDBField('IPRestrictions'); + if ( $ip_restrictions && !kUtil::ipMatch($ip_restrictions, "\n") ) { + return false; + } + $groups = $object->getMembershipGroups(true); ~~- if (!$groups) {~~ ~~- $groups = Array();~~ + if ( !$groups ) { + $groups = Array (); } if ( $object->GetDBField('UserType') == UserType::USER ) { ~~- array_push($groups, $this->Application->ConfigValue('User_NewGroup') );~~ + array_push($groups, $this->Application->ConfigValue('User_NewGroup')); } elseif ( $object->GetDBField('UserType') == UserType::ADMIN ) { ~~- array_push($groups, $this->Application->ConfigValue('User_AdminGroup') );~~ + array_push($groups, $this->Application->ConfigValue('User_AdminGroup')); } // store groups, because kApplication::CheckPermission will use them! ~~- array_push($groups, $this->Application->ConfigValue('User_LoggedInGroup') );~~ ~~- $this->Application->StoreVar( 'UserGroups', implode(',', $groups), true ); // true for optional~~ + array_push($groups, $this->Application->ConfigValue('User_LoggedInGroup')); + $groups = array_unique($groups); + $this->Application->StoreVar('UserGroups', implode(',', $groups), true); // true for optional return $this->Application->CheckPermission($this->Application->isAdmin ? 'ADMIN' : 'LOGIN', 1); } @@ -295,7 +301,7 @@ // synchronize login $sync_manager =& $this->Application->recallObject('UsersSyncronizeManager', null, Array(), Array ('InPortalSyncronize')); /* @var $sync_manager UsersSyncronizeManager */ - + $sync_manager->performAction('LoginUser', $username, $password); } @@ -360,10 +366,10 @@ public function &getUserObject() { $prefix_special = $this->Application->isAdmin ? 'u.current' : 'u'; // "u" used on front not to change theme - + $object =& $this->Application->recallObject($prefix_special, null, Array('skip_autoload' => true)); /* @var $object UsersItem */ - + return $object; } Index: core/units/users/users_config.php =================================================================== --- core/units/users/users_config.php (revision 14617) +++ core/units/users/users_config.php (working copy) @@ -385,7 +385,7 @@ 'Modified' => Array ('formatter' => 'kDateFormatter', 'default' => NULL), 'dob' => Array ('formatter' => 'kDateFormatter', 'default' => NULL), 'tz' => Array ('default' => NULL), ~~- 'ip' => Array ('default' => ''),~~ + 'IPAddress' => Array ('default' => ''), 'IsBanned' => Array ('default' => 0), 'PwResetConfirm' => Array ('default' => ''), 'PwRequestTime' => Array ('formatter' => 'kDateFormatter', 'default' => NULL), @@ -414,6 +414,7 @@ 'formatter' => 'kOptionsFormatter', 'options' => Array (1 => 'la_Yes', 0 => 'la_No'), 'use_phrases' => 1, 'default' => 0 ), + 'IPRestrictions' => Array ('default' => NULL), ), 'VirtualFields' => Array ( @@ -531,7 +532,7 @@ 'Modified' => Array ('type' => 'int'), 'dob' => Array ('type' => 'int'), 'tz' => Array ('type' => 'int'), ~~- 'ip' => Array ('type' => 'string', 'not_null' => 1),~~ + 'IPAddress' => Array ('type' => 'string', 'not_null' => 1), 'IsBanned' => Array ('type' => 'int', 'not_null' => 1), 'PwResetConfirm' => Array ('type' => 'string', 'not_null' => 1), 'PwRequestTime' => Array ('type' => 'int'), @@ -540,6 +541,7 @@ 'UserType' => Array ('type' => 'int', 'not_null' => 1), 'PrimaryGroupId' => Array ('type' => 'int'), 'OldStyleLogin' => Array ('type' => 'int', 'not_null' => 1), + 'IPRestrictions' => Array ('type' => 'string'), ), 'VirtualFields' => Array ( @@ -632,6 +634,7 @@ 'Status' => Array ('filter_block' => 'grid_options_filter', 'width' => 100, ), 'CreatedOn' => Array ('filter_block' => 'grid_date_range_filter', 'width' => 100), 'Modified' => Array ('filter_block' => 'grid_date_range_filter', 'width' => 100), + 'IPAddress' => Array ('filter_block' => 'grid_date_range_filter', 'width' => 100, 'hidden' => 1), ), ), ), Index: core/units/users/users_event_handler.php =================================================================== --- core/units/users/users_event_handler.php (revision 14617) +++ core/units/users/users_event_handler.php (working copy) @@ -247,13 +247,13 @@ $object->SetFieldsFromHash( $this->getSubmittedFields($event) ); $username = $object->GetDBField('UserLogin'); $password = $object->GetDBField('UserPassword'); ~~- $rember_login = $object->GetDBField('UserRememberLogin') == 1;~~ + $remember_login = $object->GetDBField('UserRememberLogin') == 1; $user_helper =& $this->Application->recallObject('UserHelper'); /* @var $user_helper UserHelper */ $user_helper->event =& $event; ~~- $result = $user_helper->loginUser($username, $password, false, $rember_login);~~ + $result = $user_helper->loginUser($username, $password, false, $remember_login); if ($result != LoginResult::OK) { $event->status = kEvent::erFAIL; @@ -460,6 +460,8 @@ if ( !$user_helper->checkBanRules($object) ) { $object->SetError('Login', 'banned'); } + + $object->SetDBField('IPAddress', $_SERVER['REMOTE_ADDR']); } /** @@ -696,7 +698,6 @@ } $object->SetDBField('Status', STATUS_ACTIVE); // make user subscriber Active by default ~~- $object->SetDBField('ip', $_SERVER['REMOTE_ADDR']);~~ if ( $object->Create() ) { $this->AddSubscriberGroup($object); @@ -1181,11 +1182,14 @@ function checkItemStatus(&$event) { $object =& $event->getObject(); ~~- if (!$object->isLoaded()) {~~ + /* @var $object kDBItem */ + + if ( !$object->isLoaded() ) { return true; } $virtual_users = Array (USER_ROOT, USER_GUEST); + return ($object->GetDBField('Status') == STATUS_ACTIVE) || in_array($object->GetID(), $virtual_users); } Index: core/units/users/users_item.php =================================================================== --- core/units/users/users_item.php (revision 14596) +++ core/units/users/users_item.php (working copy) @@ -19,26 +19,35 @@ /** * Returns IDs of groups to which user belongs and membership is not expired * + * @param bool $force_reload * @return Array * @access public */ ~~- function getMembershipGroups($force_reload = false)~~ + public function getMembershipGroups($force_reload = false) { $user_groups = $this->Application->RecallVar('UserGroups'); ~~- if($user_groups === false || $force_reload)~~ ~~- {~~ + + if ( $user_groups === false || $force_reload ) { // primary group goes first ~~- $sql = 'SELECT GroupId~~ ~~- FROM ' . TABLE_PREFIX . 'UserGroup~~ ~~- WHERE (PortalUserId = ' . $this->GetID() . ') AND ( (MembershipExpires IS NULL) OR ( MembershipExpires >= UNIX_TIMESTAMP() ) )~~ ~~- ORDER BY IF(GroupId = ' . $this->GetDBField('PrimaryGroupId') . ', 1, 0) DESC';~~ + $sql = 'SELECT g.IPRestrictions, ug.GroupId + FROM ' . TABLE_PREFIX . 'UserGroup ug + JOIN ' . TABLE_PREFIX . 'PortalGroup g ON g.GroupId = ug.GroupId + WHERE (ug.PortalUserId = ' . $this->GetID() . ') AND ( (ug.MembershipExpires IS NULL) OR (ug.MembershipExpires >= ' . adodb_mktime() . ') ) + ORDER BY IF(ug.GroupId = ' . $this->GetDBField('PrimaryGroupId') . ', 1, 0) DESC'; + $groups = $this->Conn->GetCol($sql, 'GroupId'); ~~- return $this->Conn->GetCol($sql);~~ + $user_groups = Array (); + + foreach ($groups as $group_id => $ip_restrictions) { + if ( !$ip_restrictions || kUtil::ipMatch($ip_restrictions, "\n") ) { + $user_groups[] = $group_id; + } + } + + return $user_groups; } ~~- else~~ ~~- {~~ ~~- return explode(',', $user_groups);~~ ~~- }~~ + + return explode(',', $user_groups); } function SendEmailEvents() @@ -142,7 +151,7 @@ if ( $ret ) { $sync_manager =& $this->Application->recallObject('UsersSyncronizeManager', null, Array (), Array ('InPortalSyncronize')); /* @var $sync_manager UsersSyncronizeManager */ - + $sync_manager->performAction('deleteUser', $this->FieldValues); }

Index: admin/system_presets/simple/groups_g.php =================================================================== --- admin/system_presets/simple/groups_g.php (revision 14590) +++ admin/system_presets/simple/groups_g.php (working copy) @@ -36,7 +36,7 @@ // fields to hide $hidden_fields = Array ( /*'GroupId', 'Name', 'Description', 'CreatedOn','System', 'Personal', 'Enabled', 'ResourceId',*/ ~~- 'FrontRegistration',~~ + 'FrontRegistration', 'IPRestrictions', ); // virtual fields to hide Index: admin/system_presets/simple/users_u.php =================================================================== --- admin/system_presets/simple/users_u.php (revision 14599) +++ admin/system_presets/simple/users_u.php (working copy) @@ -71,7 +71,7 @@ $hidden_fields = Array ( /* 'PortalUserId', 'Login', 'Password', 'FirstName','LastName', 'Company', 'Email', 'CreatedOn', 'Phone', 'Fax', 'Street', 'Street2', 'City', 'State' , 'Zip', 'Country', 'ResourceId', 'Status', ~~- 'Modified', 'dob', 'tz', 'ip', 'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/~~ + 'Modified', 'dob', 'tz',*/ 'IPAddress', /*'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/ 'IPRestrictions', ); // virtual fields to hide @@ -83,7 +83,7 @@ $required_fields = Array ( /*'PortalUserId',*/ 'Login', /*'Password', 'FirstName', 'LastName', 'Company', */'Email', /*'CreatedOn', 'Phone', 'Fax', 'Street', 'Street2', 'City', 'State' , 'Zip', 'Country', 'ResourceId', 'Status', ~~- 'Modified', 'dob', 'tz', 'ip', 'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/~~ + 'Modified', 'dob', 'tz', 'IPAddress', 'IsBanned', 'PwResetConfirm', 'PwRequestTime',*/ ); // virtual fields to make required @@ -115,5 +115,5 @@ // 'Admins' => Array ('PortalUserId', 'Login', 'FirstName', 'LastName', 'Email'), // users list; section: Users Management -> Users ~~- 'RegularUsers' => Array (/*'PortalUserId', 'Login', 'FirstName', 'LastName', 'Email',*/ 'PrimaryGroup', 'CreatedOn', 'Modified', /* 'Status'*/),~~ + 'RegularUsers' => Array (/*'PortalUserId', 'Login', 'FirstName', 'LastName', 'Email',*/ 'PrimaryGroup', 'CreatedOn', 'Modified', /* 'Status',*/ 'IPAddress'), ); Index: core/admin_templates/groups/groups_edit.tpl =================================================================== --- core/admin_templates/groups/groups_edit.tpl (revision 14590) +++ core/admin_templates/groups/groups_edit.tpl (working copy) @@ -74,12 +74,14 @@ <div id="scroll_container"> <table class="edit-form"> ~~- <inp2:m_RenderElement name="subsection" prefix="g" fields="GroupId,Name,FrontRegistration,Description,Enabled" title="la_section_General"/>~~ + <inp2:m_RenderElement name="subsection" prefix="g" fields="GroupId,Name,FrontRegistration,Description,IPRestrictions,Enabled" title="la_section_General"/> <inp2:m_RenderElement name="inp_id_label" prefix="g" field="GroupId" title="la_fld_GroupId"/> <inp2:m_RenderElement name="inp_edit_box" prefix="g" field="Name" title="la_fld_GroupName"/> <inp2:m_RenderElement name="inp_edit_checkbox" prefix="g" field="FrontRegistration" title="la_fld_FrontRegistration"/> <inp2:m_RenderElement name="inp_edit_textarea" prefix="g" field="Description" title="la_fld_Description" control_options="{max_height: 100}"/> + <inp2:m_RenderElement name="inp_edit_textarea" prefix="g" field="IPRestrictions" allow_html="0" hint_label="la_hint_DomainIPRange" control_options="{max_height: 100}"/> + <inp2:m_if check="m_IsDebugMode"> <inp2:m_RenderElement name="inp_edit_radio" prefix="g" field="Enabled" title="la_fld_Enabled"/> </inp2:m_if> Index: core/admin_templates/users/admins_edit.tpl =================================================================== --- core/admin_templates/users/admins_edit.tpl (revision 14590) +++ core/admin_templates/users/admins_edit.tpl (working copy) @@ -66,13 +66,22 @@ <div id="scroll_container"> <table class="edit-form"> ~~- <inp2:m_RenderElement name="inp_id_label" prefix="u" field="PortalUserId" title="la_fld_Id"/>~~ ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Login" title="la_fld_Username"/>~~ ~~- <inp2:m_RenderElement name="password_fields" />~~ + <inp2:m_RenderElement name="subsection" prefix="u" fields="PortalUserId,Login,Password,FirstName,LastName,Email" title="la_section_General"/> + <inp2:m_RenderElement name="inp_id_label" prefix="u" field="PortalUserId" title="la_fld_Id"/> + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Login" title="la_fld_Username"/> + <inp2:m_RenderElement name="password_fields" /> ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="FirstName" title="la_fld_FirstName"/>~~ ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="LastName" title="la_fld_LastName"/>~~ ~~- <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Email" title="la_fld_Email"/>~~ + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="FirstName" title="la_fld_FirstName"/> + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="LastName" title="la_fld_LastName"/> + <inp2:m_RenderElement name="inp_edit_box" prefix="u" field="Email" title="la_fld_Email"/> + + <inp2:m_RenderElement name="subsection" prefix="u" fields="IPAddress,IPRestrictions" title="la_section_Properties"/> + <inp2:m_if check="u_Field" name="IPAddress"> + <inp2:m_RenderElement name="inp_label" prefix="u" field="IPAddress"/> + </inp2:m_if> + + <inp2:m_RenderElement name="inp_edit_textarea" prefix="u" field="IPRestrictions" allow_html="0" hint_label="la_hint_DomainIPRange" control_options="{max_height: 100}"/> + <inp2:m_RenderElement name="inp_edit_filler"/> </table> </div> Index: core/admin_templates/users/users_edit.tpl =================================================================== --- core/admin_templates/users/users_edit.tpl (revision 14590) +++ core/admin_templates/users/users_edit.tpl (working copy) @@ -83,11 +83,17 @@ <inp2:m_RenderElement name="inp_edit_options" prefix="u" field="Country" has_empty="1"/> <inp2:m_RenderElement name="inp_edit_multioptions" prefix="u" field="DisplayToPublic"/> ~~- <inp2:m_RenderElement name="subsection" prefix="u" fields="Status,CreatedOn,Modified" title="la_section_Properties"/>~~ + <inp2:m_RenderElement name="subsection" prefix="u" fields="Status,CreatedOn,Modified,IPAddress,IPRestrictions" title="la_section_Properties"/> <inp2:m_RenderElement name="inp_edit_radio" prefix="u" field="Status"/> <inp2:m_RenderElement name="inp_edit_date_time" prefix="u" field="CreatedOn"/> <inp2:m_RenderElement name="inp_edit_date_time" prefix="u" field="Modified"/> + <inp2:m_if check="u_Field" name="IPAddress"> + <inp2:m_RenderElement name="inp_label" prefix="u" field="IPAddress"/> + </inp2:m_if> + + <inp2:m_RenderElement name="inp_edit_textarea" prefix="u" field="IPRestrictions" allow_html="0" hint_label="la_hint_DomainIPRange" control_options="{max_height: 100}"/> + <inp2:m_if check="m_ModuleEnabled" module="In-Portal">  <inp2:m_include t="incs/custom_blocks"/> Index: core/install/english.lang =================================================================== --- core/install/english.lang (revision 14629) +++ core/install/english.lang (working copy) @@ -424,6 +424,7 @@ <PHRASE Label="la_fld_InstallModules" Module="Core" Type="1">SW5zdGFsbCBNb2R1bGVz</PHRASE> <PHRASE Label="la_fld_InstallPhraseTypes" Module="Core" Type="1">SW5zdGFsbCBQaHJhc2UgVHlwZXM=</PHRASE> <PHRASE Label="la_fld_IPAddress" Module="Core" Type="1" Column="SVAgQWRkcmVzcw==">SVAgQWRkcmVzcw==</PHRASE> + <PHRASE Label="la_fld_IPRestrictions" Module="Core" Type="1">SVAgUmVzdHJpY3Rpb25z</PHRASE> <PHRASE Label="la_fld_IsBaseCategory" Module="Core" Type="1">VXNlIGN1cnJlbnQgc2VjdGlvbiBhcyByb290IGZvciB0aGUgZXhwb3J0</PHRASE> <PHRASE Label="la_fld_ISOCode" Module="Core" Type="1" Column="SVNPIENvZGU=">SVNPIENvZGU=</PHRASE> <PHRASE Label="la_fld_IsPrimary" Module="Core" Type="1" Column="UHJpbWFyeQ==">UHJpbWFyeQ==</PHRASE> @@ -615,7 +616,7 @@ <PHRASE Label="la_Hide" Module="Core" Type="1">SGlkZQ==</PHRASE> <PHRASE Label="la_hint_AllFiles" Module="Core" Type="1">QWxsIEZpbGVz</PHRASE> <PHRASE Label="la_hint_CSVFiles" Module="Core" Type="1">Q1NWIEZpbGVz</PHRASE> - <PHRASE Label="la_hint_DomainIPRange" Module="Core" Type="1">U2luZ2xlIElQIG9yIHJhbmdlIHJlY29yZCBwZXIgbGluZSAoZm9ybWF0czogMS4yLjMuNCBvciAxLjIuMyBvciAxLjIuMy4zMi0xLjIuMy41NCBvciAxLjIuMy4zMi8yNyBvciAxLjIuMy4zMi8yNTUuMjU1LjI1NS4yMjQp</PHRASE> + <PHRASE Label="la_hint_DomainIPRange" Module="Core" Type="1">U2luZ2xlIElQLCBJUCByYW5nZSwgU3VibmV0IG9yIGhvc3RuYW1lIHJlY29yZCBwZXIgbGluZSAoZm9ybWF0czogMS4yLjMuNCBvciAxLjIuMy4zMi0xLjIuMy41NCBvciAxLjIuMy4zMi8yNyBvciAxLjIuMy4zMi8yNTUuMjU1LjI1NS4yMjQgb3Igd3d3LmluLXBvcnRhbC5jb20p</PHRASE> <PHRASE Label="la_hint_ExportEmailEvents" Module="Core" Type="1">U2luZ2xlIEVtYWlsIEV2ZW50IHBlciBsaW5lIChmb3JtYXRzOiBVU0VSLkFERCwgT1JERVIuU1VCTUlUKQ==</PHRASE> <PHRASE Label="la_hint_ExportPhrases" Module="Core" Type="1">U2luZ2xlIFBocmFzZSBMYWJlbCBwZXIgbGluZSAoZm9ybWF0czogbGFfU2FtcGxlTGFiZWwsIGx1X0Zyb250RW5kTGFiZWwp</PHRASE> <PHRASE Label="la_hint_ForceModRewriteUrlEnding" Module="Core" Type="1">VXNlciB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcmVkaXJlY3RlZCB0byB0aGUgc2VsZWN0ZWQgVXJsIEVuZGluZyBpbiBjYXNlIHdoZW4gY3VycmVudCBwYWdlIHVybCBoYXMgYSBkaWZmZXJlbnQgZW5kaW5n</PHRASE> Index: core/install/install_schema.sql =================================================================== --- core/install/install_schema.sql (revision 14629) +++ core/install/install_schema.sql (working copy) @@ -232,6 +232,7 @@ Personal tinyint(4) NOT NULL DEFAULT '0', Enabled tinyint(4) NOT NULL DEFAULT '1', FrontRegistration tinyint(3) unsigned NOT NULL DEFAULT '0', + IPRestrictions text, PRIMARY KEY (GroupId), UNIQUE KEY `Name` (`Name`), KEY Personal (Personal), @@ -261,7 +262,7 @@ Modified int(11) DEFAULT NULL, dob int(11) DEFAULT NULL, tz int(11) DEFAULT NULL, ~~- ip varchar(20) NOT NULL DEFAULT '',~~ + IPAddress varchar(15) NOT NULL, IsBanned tinyint(1) NOT NULL DEFAULT '0', PwResetConfirm varchar(255) NOT NULL, PwRequestTime int(11) unsigned DEFAULT NULL, @@ -270,6 +271,7 @@ UserType tinyint(4) NOT NULL, PrimaryGroupId int(11) DEFAULT NULL, OldStyleLogin tinyint(4) NOT NULL, + IPRestrictions text, PRIMARY KEY (PortalUserId), UNIQUE KEY ResourceId (ResourceId), KEY CreatedOn (CreatedOn), Index: core/install/upgrades.sql =================================================================== --- core/install/upgrades.sql (revision 14629) +++ core/install/upgrades.sql (working copy) @@ -2130,4 +2130,10 @@ ADD UploadExtensions VARCHAR(255) NOT NULL DEFAULT '' AFTER Validation, ADD UploadMaxSize INT NULL AFTER UploadExtensions; ~~-ALTER TABLE Language ADD SynchronizationModes VARCHAR(255) NOT NULL DEFAULT '';~~ \ No newline at end of file +ALTER TABLE Language ADD SynchronizationModes VARCHAR(255) NOT NULL DEFAULT ''; + +ALTER TABLE PortalUser + CHANGE ip IPAddress VARCHAR(15) NOT NULL, + ADD IPRestrictions TEXT NULL; + +ALTER TABLE PortalGroup ADD IPRestrictions TEXT NULL; \ No newline at end of file Index: core/units/groups/groups_config.php =================================================================== --- core/units/groups/groups_config.php (revision 14590) +++ core/units/groups/groups_config.php (working copy) @@ -117,6 +117,7 @@ 'formatter' => 'kOptionsFormatter', 'options' => Array (1 => 'la_Yes', 0 => 'la_No'), 'use_phrases' => 1, 'not_null' => 1, 'default' => 0 ), + 'IPRestrictions' => Array ('type' => 'string', 'default' => NULL), ), 'VirtualFields' => Array ( Index: core/units/helpers/user_helper.php =================================================================== --- core/units/helpers/user_helper.php (revision 14628) +++ core/units/helpers/user_helper.php (working copy) @@ -185,22 +185,28 @@ function checkLoginPermission() { $object =& $this->getUserObject(); + $ip_restrictions = $object->GetDBField('IPRestrictions'); + if ( $ip_restrictions && !$this->Application->isDebugMode() && !kUtil::ipMatch($ip_restrictions, "\n") ) { + return false; + } + $groups = $object->getMembershipGroups(true); ~~- if (!$groups) {~~ ~~- $groups = Array();~~ + if ( !$groups ) { + $groups = Array (); } if ( $object->GetDBField('UserType') == UserType::USER ) { ~~- array_push($groups, $this->Application->ConfigValue('User_NewGroup') );~~ + array_push($groups, $this->Application->ConfigValue('User_NewGroup')); } elseif ( $object->GetDBField('UserType') == UserType::ADMIN ) { ~~- array_push($groups, $this->Application->ConfigValue('User_AdminGroup') );~~ + array_push($groups, $this->Application->ConfigValue('User_AdminGroup')); } // store groups, because kApplication::CheckPermission will use them! ~~- array_push($groups, $this->Application->ConfigValue('User_LoggedInGroup') );~~ ~~- $this->Application->StoreVar( 'UserGroups', implode(',', $groups), true ); // true for optional~~ + array_push($groups, $this->Application->ConfigValue('User_LoggedInGroup')); + $groups = array_unique($groups); + $this->Application->StoreVar('UserGroups', implode(',', $groups), true); // true for optional return $this->Application->CheckPermission($this->Application->isAdmin ? 'ADMIN' : 'LOGIN', 1); } @@ -295,7 +301,7 @@ // synchronize login $sync_manager =& $this->Application->recallObject('UsersSyncronizeManager', null, Array(), Array ('InPortalSyncronize')); /* @var $sync_manager UsersSyncronizeManager */ - + $sync_manager->performAction('LoginUser', $username, $password); } @@ -360,10 +366,10 @@ public function &getUserObject() { $prefix_special = $this->Application->isAdmin ? 'u.current' : 'u'; // "u" used on front not to change theme - + $object =& $this->Application->recallObject($prefix_special, null, Array('skip_autoload' => true)); /* @var $object UsersItem */ - + return $object; } Index: core/units/users/users_config.php =================================================================== --- core/units/users/users_config.php (revision 14617) +++ core/units/users/users_config.php (working copy) @@ -385,7 +385,7 @@ 'Modified' => Array ('formatter' => 'kDateFormatter', 'default' => NULL), 'dob' => Array ('formatter' => 'kDateFormatter', 'default' => NULL), 'tz' => Array ('default' => NULL), ~~- 'ip' => Array ('default' => ''),~~ + 'IPAddress' => Array ('default' => ''), 'IsBanned' => Array ('default' => 0), 'PwResetConfirm' => Array ('default' => ''), 'PwRequestTime' => Array ('formatter' => 'kDateFormatter', 'default' => NULL), @@ -414,6 +414,7 @@ 'formatter' => 'kOptionsFormatter', 'options' => Array (1 => 'la_Yes', 0 => 'la_No'), 'use_phrases' => 1, 'default' => 0 ), + 'IPRestrictions' => Array ('default' => NULL), ), 'VirtualFields' => Array ( @@ -531,7 +532,7 @@ 'Modified' => Array ('type' => 'int'), 'dob' => Array ('type' => 'int'), 'tz' => Array ('type' => 'int'), ~~- 'ip' => Array ('type' => 'string', 'not_null' => 1),~~ + 'IPAddress' => Array ('type' => 'string', 'not_null' => 1), 'IsBanned' => Array ('type' => 'int', 'not_null' => 1), 'PwResetConfirm' => Array ('type' => 'string', 'not_null' => 1), 'PwRequestTime' => Array ('type' => 'int'), @@ -540,6 +541,7 @@ 'UserType' => Array ('type' => 'int', 'not_null' => 1), 'PrimaryGroupId' => Array ('type' => 'int'), 'OldStyleLogin' => Array ('type' => 'int', 'not_null' => 1), + 'IPRestrictions' => Array ('type' => 'string'), ), 'VirtualFields' => Array ( @@ -632,6 +634,7 @@ 'Status' => Array ('filter_block' => 'grid_options_filter', 'width' => 100, ), 'CreatedOn' => Array ('filter_block' => 'grid_date_range_filter', 'width' => 100), 'Modified' => Array ('filter_block' => 'grid_date_range_filter', 'width' => 100), + 'IPAddress' => Array ('filter_block' => 'grid_date_range_filter', 'width' => 100, 'hidden' => 1), ), ), ), Index: core/units/users/users_event_handler.php =================================================================== --- core/units/users/users_event_handler.php (revision 14617) +++ core/units/users/users_event_handler.php (working copy) @@ -247,13 +247,13 @@ $object->SetFieldsFromHash( $this->getSubmittedFields($event) ); $username = $object->GetDBField('UserLogin'); $password = $object->GetDBField('UserPassword'); ~~- $rember_login = $object->GetDBField('UserRememberLogin') == 1;~~ + $remember_login = $object->GetDBField('UserRememberLogin') == 1; $user_helper =& $this->Application->recallObject('UserHelper'); /* @var $user_helper UserHelper */ $user_helper->event =& $event; ~~- $result = $user_helper->loginUser($username, $password, false, $rember_login);~~ + $result = $user_helper->loginUser($username, $password, false, $remember_login); if ($result != LoginResult::OK) { $event->status = kEvent::erFAIL; @@ -460,6 +460,8 @@ if ( !$user_helper->checkBanRules($object) ) { $object->SetError('Login', 'banned'); } + + $object->SetDBField('IPAddress', $_SERVER['REMOTE_ADDR']); } /** @@ -696,7 +698,6 @@ } $object->SetDBField('Status', STATUS_ACTIVE); // make user subscriber Active by default ~~- $object->SetDBField('ip', $_SERVER['REMOTE_ADDR']);~~ if ( $object->Create() ) { $this->AddSubscriberGroup($object); @@ -1181,11 +1182,14 @@ function checkItemStatus(&$event) { $object =& $event->getObject(); ~~- if (!$object->isLoaded()) {~~ + /* @var $object kDBItem */ + + if ( !$object->isLoaded() ) { return true; } $virtual_users = Array (USER_ROOT, USER_GUEST); + return ($object->GetDBField('Status') == STATUS_ACTIVE) || in_array($object->GetID(), $virtual_users); } Index: core/units/users/users_item.php =================================================================== --- core/units/users/users_item.php (revision 14596) +++ core/units/users/users_item.php (working copy) @@ -19,26 +19,40 @@ /** * Returns IDs of groups to which user belongs and membership is not expired * + * @param bool $force_reload * @return Array * @access public */ ~~- function getMembershipGroups($force_reload = false)~~ + public function getMembershipGroups($force_reload = false) { $user_groups = $this->Application->RecallVar('UserGroups'); ~~- if($user_groups === false || $force_reload)~~ ~~- {~~ + + if ( $user_groups === false || $force_reload ) { // primary group goes first ~~- $sql = 'SELECT GroupId~~ ~~- FROM ' . TABLE_PREFIX . 'UserGroup~~ ~~- WHERE (PortalUserId = ' . $this->GetID() . ') AND ( (MembershipExpires IS NULL) OR ( MembershipExpires >= UNIX_TIMESTAMP() ) )~~ ~~- ORDER BY IF(GroupId = ' . $this->GetDBField('PrimaryGroupId') . ', 1, 0) DESC';~~ + $sql = 'SELECT g.IPRestrictions, ug.GroupId + FROM ' . TABLE_PREFIX . 'UserGroup ug + JOIN ' . TABLE_PREFIX . 'PortalGroup g ON g.GroupId = ug.GroupId + WHERE (ug.PortalUserId = ' . $this->GetID() . ') AND ( (ug.MembershipExpires IS NULL) OR (ug.MembershipExpires >= ' . adodb_mktime() . ') ) + ORDER BY IF(ug.GroupId = ' . $this->GetDBField('PrimaryGroupId') . ', 1, 0) DESC'; + $groups = $this->Conn->GetCol($sql, 'GroupId'); ~~- return $this->Conn->GetCol($sql);~~ + if ( $this->Application->isDebugMode() ) { + return array_keys($groups); + } + else { + $user_groups = Array (); + + foreach ($groups as $group_id => $ip_restrictions) { + if ( !$ip_restrictions || kUtil::ipMatch($ip_restrictions, "\n") ) { + $user_groups[] = $group_id; + } + } + + return $user_groups; + } } ~~- else~~ ~~- {~~ ~~- return explode(',', $user_groups);~~ ~~- }~~ + + return explode(',', $user_groups); } function SendEmailEvents() @@ -142,7 +156,7 @@ if ( $ret ) { $sync_manager =& $this->Application->recallObject('UsersSyncronizeManager', null, Array (), Array ('InPortalSyncronize')); /* @var $sync_manager UsersSyncronizeManager */ - + $sync_manager->performAction('deleteUser', $this->FieldValues); }

Index: units/helpers/user_helper.php =================================================================== --- units/helpers/user_helper.php (revision 14630) +++ units/helpers/user_helper.php (working copy) @@ -196,12 +196,10 @@ $groups = Array (); } ~~- if ( $object->GetDBField('UserType') == UserType::USER ) {~~ ~~- array_push($groups, $this->Application->ConfigValue('User_NewGroup'));~~ + $default_group = $this->getUserTypeGroup(); + if ( $default_group !== false ) { + array_push($groups, $default_group); } ~~- elseif ( $object->GetDBField('UserType') == UserType::ADMIN ) {~~ ~~- array_push($groups, $this->Application->ConfigValue('User_AdminGroup'));~~ ~~- }~~ // store groups, because kApplication::CheckPermission will use them! array_push($groups, $this->Application->ConfigValue('User_LoggedInGroup')); @@ -212,6 +210,57 @@ } /** + * Returns default user group for it's type + * + * @return bool|string + * @access protected + */ + protected function getUserTypeGroup() + { + $group_id = false; + $object =& $this->getUserObject(); + + if ( $object->GetDBField('UserType') == UserType::USER ) { + $group_id = $this->Application->ConfigValue('User_NewGroup'); + } + elseif ( $object->GetDBField('UserType') == UserType::ADMIN ) { + $group_id = $this->Application->ConfigValue('User_AdminGroup'); + } + + $ip_restrictions = $this->getGroupsWithIPRestrictions(); + + if ( !isset($ip_restrictions[$group_id]) || kUtil::ipMatch($ip_restrictions[$group_id], "\n") ) { + return $group_id; + } + + return false; + } + + /** + * Returns groups with IP restrictions + * + * @return Array + * @access public + */ + public function getGroupsWithIPRestrictions() + { + static $cache = null; + + if ( $this->Application->isDebugMode() ) { + return Array (); + } + + if ( !isset($cache) ) { + $sql = 'SELECT IPRestrictions, GroupId + FROM ' . TABLE_PREFIX . 'PortalGroup + WHERE IPRestrictions IS NOT NULL'; + $cache = $this->Conn->GetCol($sql, 'GroupId'); + } + + return $cache; + } + + /** * Performs user logout * */ Index: units/users/users_item.php =================================================================== --- units/users/users_item.php (revision 14630) +++ units/users/users_item.php (working copy) @@ -29,27 +29,25 @@ if ( $user_groups === false || $force_reload ) { // primary group goes first ~~- $sql = 'SELECT g.IPRestrictions, ug.GroupId~~ ~~- FROM ' . TABLE_PREFIX . 'UserGroup ug~~ ~~- JOIN ' . TABLE_PREFIX . 'PortalGroup g ON g.GroupId = ug.GroupId~~ ~~- WHERE (ug.PortalUserId = ' . $this->GetID() . ') AND ( (ug.MembershipExpires IS NULL) OR (ug.MembershipExpires >= ' . adodb_mktime() . ') )~~ ~~- ORDER BY IF(ug.GroupId = ' . $this->GetDBField('PrimaryGroupId') . ', 1, 0) DESC';~~ ~~- $groups = $this->Conn->GetCol($sql, 'GroupId');~~ + $sql = 'SELECT GroupId + FROM ' . TABLE_PREFIX . 'UserGroup + WHERE (PortalUserId = ' . $this->GetID() . ') AND ( (MembershipExpires IS NULL) OR (MembershipExpires >= ' . adodb_mktime() . ') ) + ORDER BY IF(GroupId = ' . $this->GetDBField('PrimaryGroupId') . ', 1, 0) DESC'; + $groups = $this->Conn->GetCol($sql); ~~- if ( $this->Application->isDebugMode() ) {~~ ~~- return array_keys($groups);~~ ~~- }~~ ~~- else {~~ ~~- $user_groups = Array ();~~ + $user_helper =& $this->Application->recallObject('UserHelper'); + /* @var $user_helper UserHelper */ ~~- foreach ($groups as $group_id => $ip_restrictions) {~~ ~~- if ( !$ip_restrictions || kUtil::ipMatch($ip_restrictions, "\n") ) {~~ ~~- $user_groups[] = $group_id;~~ ~~- }~~ ~~- }~~ + $user_groups = Array (); + $ip_restrictions = $user_helper->getGroupsWithIPRestrictions(); ~~- return $user_groups;~~ + foreach ($groups as $group_id) { + if ( !isset($ip_restrictions[$group_id]) || kUtil::ipMatch($ip_restrictions[$group_id], "\n") ) { + $user_groups[] = $group_id; + } } + + return $user_groups; } return explode(',', $user_groups);

Issue History
Date Modified	Username	Field	Change
2012-09-02 10:31	alex	Relationship added	parent of 0001385
2012-07-25 05:33	alex	Note Added: 0005110
2012-07-25 05:33	alex	Status	resolved => closed
2012-02-06 04:03	alex	Relationship added	related to 0001201
2011-10-22 05:30	alex	Estimate Points	=> 2
2011-10-06 05:41	alex	Changeset attached	5.2.x r14643
2011-10-06 05:40	alex	Note Added: 0004030
2011-10-06 05:40	alex	File Added: ip_address_login_restrition_broken_install_data_fix.patch
2011-10-04 09:23	alex	Changeset attached	5.2.x r14631
2011-10-04 09:23	alex	Note Added: 0004002
2011-10-04 09:22	alex	File Added: ip_addr_check_user_group_usertype_fix.patch
2011-10-04 06:59	alex	Note Added: 0004000
2011-10-04 06:59	alex	Status	reviewed and tested => resolved
2011-10-04 06:59	alex	Fixed in Version	=> 5.2.0-B1
2011-10-04 06:59	alex	Resolution	open => fixed
2011-10-04 06:59	alex	Assigned To	!COMMUNITY => alex
2011-10-04 06:59	alex	Changeset attached	5.2.x r14630
2011-10-04 06:59	alex	Note Added: 0003999
2011-10-04 06:59	alex	Status	needs testing => reviewed and tested
2011-10-04 06:59	alex	Time Estimate Removed	2 =>
2011-10-04 06:59	alex	Note Added: 0003998
2011-10-04 06:59	alex	Assigned To	=> !COMMUNITY
2011-10-04 06:59	alex	Developer	=> alex
2011-10-04 06:59	alex	Status	active => needs testing
2011-10-04 06:57	alex	File Added: ip_addr_check_user_group_feat_v2.patch
2011-10-04 06:53	alex	File Added: ip_addr_check_user_group_feat.patch
2011-09-27 06:25	alex	Time Estimate Added	2
2011-09-23 21:43	Dmitry	Target Version	Icebox => 5.2.0
2010-08-31 14:18	alex	version	=> 5.1.0
2010-03-26 14:37	alex	Target Version	=> Icebox
2010-03-26 10:44	Dmitry	Type	bug report => feature request
2010-03-26 10:41	Dmitry	New Issue
2010-03-26 10:41	Dmitry	Reference	=> http://groups.google.com/group/in-portal-dev/browse_thread/thread/375394a2d516c850

Notes
(0003998) alex (manager) 2011-10-04 06:59	Patch "..._v2.patch" adds ability to skip IP checks in debug mode. Also done: 1. IP address is always recorded on user registration (was only recorded for cases, when user subscribed to newsletter) 2. IP address is shown in user list and on user editing form (hidden as before in "simple" interface preset)

(0003999) alex (manager) 2011-10-04 06:59	Will test all together.

(0004000) alex (manager) 2011-10-04 06:59	Fix committed to 5.2.x branch. Commit Message: Fixes 0000645: User / Group Access restriction by IP

(0004002) alex (manager) 2011-10-04 09:23	Patch "ip_addr_check_user_group_usertype_fix.patch" solves problem, when IP restrictions set to Member/admin groups (from config settings) had no effect, since they were added back to user groups based on UserType column.

(0004030) alex (manager) 2011-10-06 05:40	Patch "ip_address_login_restrition_broken_install_data_fix.patch" fixes problem with clean install.

(0005110) alex (manager) 2012-07-25 05:33	Since 5.2.0 version was released.

Related Changesets
In-Portal CMS: 5.2.x r14643 Timestamp: 2011-10-06 05:41:09 Author: alex [ Details ] [ Diff ]	Bug 0000645: User / Group Access restriction by IP 1. problem with clean install fixed
	mod - /in-portal/branches/5.2.x/core/install/install_data.sql	[ Diff ] [ File ]

In-Portal CMS: 5.2.x r14631 Timestamp: 2011-10-04 09:23:45 Author: alex [ Details ] [ Diff ]	Bug 0000645: User / Group Access restriction by IP 1. solves problem, when IP restrictions set to Member/admin groups (from config settings) had no effect, since they were added back to user groups based on UserType column
	mod - /in-portal/branches/5.2.x/core/units/helpers/user_helper.php	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/units/users/users_item.php	[ Diff ] [ File ]

In-Portal CMS: 5.2.x r14630 Timestamp: 2011-10-04 06:59:56 Author: alex [ Details ] [ Diff ]	Fixes 0000645: User / Group Access restriction by IP
	mod - /in-portal/branches/5.2.x/admin/system_presets/simple/groups_g.php	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/admin/system_presets/simple/users_u.php	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/admin_templates/groups/groups_edit.tpl	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/admin_templates/users/admins_edit.tpl	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/admin_templates/users/users_edit.tpl	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/install/english.lang	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/install/install_schema.sql	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/install/upgrades.sql	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/units/groups/groups_config.php	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/units/helpers/user_helper.php	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/units/users/users_config.php	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/units/users/users_event_handler.php	[ Diff ] [ File ]
	mod - /in-portal/branches/5.2.x/core/units/users/users_item.php	[ Diff ] [ File ]

In-Portal Issue Tracker