diff --git a/.dockerignore b/.dockerignore index 544c9b50c..6ce330c74 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,5 +1,4 @@ node_modules -bower_components tmp application/config/email.php application/config/database.php diff --git a/.gitattributes b/.gitattributes index 65fd95ef1..b89b92b39 100644 --- a/.gitattributes +++ b/.gitattributes @@ -2,3 +2,4 @@ dist/ merge=ours application/language/**/*.php merge=ours text=auto application/config/config.php ident +application/views/partial/footer.php ident diff --git a/.gitignore b/.gitignore index 650bc523a..629ee01f3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ node_modules public/bower_components tmp/ +bower_components public/bower_components tmp/ application/config/email.php diff --git a/COPYING b/COPYING deleted file mode 100644 index 9d2643e6b..000000000 --- a/COPYING +++ /dev/null @@ -1,33 +0,0 @@ -The MIT License (MIT) - -Copyright (c) 2012-2014 pappastech -Copyright (c) 2012 Alain -Copyright (c) 2013 Rob Garrison -Copyright (c) 2013 Parq -Copyright (c) 2013 Ramel -Copyright (c) 2014-2016 jekkos -Copyright (c) 2015-2016 FrancescoUK (aka daN4cat) -Copyright (c) 2015 Aamir Shahzad (aka asakpke), RoshanTech.com -Copyright (c) 2015 Toni Haryanto (aka yllumi) -Copyright (c) 2016 Ramkrishna Mondal (aka RamkrishnaMondal) - -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -The footer signature "You are using Open Source Point Of Sale" with version, -hash and link to the original distribution of the code MUST BE RETAINED, -MUST BE VISIBLE IN EVERY PAGE and CANNOT BE MODIFIED. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS -FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR -COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER -IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. \ No newline at end of file diff --git a/application/config/hooks.php b/application/config/hooks.php index 93247e3f7..504a81e18 100644 --- a/application/config/hooks.php +++ b/application/config/hooks.php @@ -11,9 +11,17 @@ defined('BASEPATH') OR exit('No direct script access allowed'); | https://codeigniter.com/user_guide/general/hooks.html | */ -$hook['post_controller_constructor'] = array( - 'class' => '', - 'function' => 'load_config', - 'filename' => 'load_config.php', - 'filepath' => 'hooks' +$hook['post_controller_constructor'][] = array( + 'class' => '', + 'function' => 'load_config', + 'filename' => 'load_config.php', + 'filepath' => 'hooks' ); + +$hook['post_controller_constructor'][] = array( + 'class' => '', + 'function' => 'load_stats', + 'filename' => 'load_stats.php', + 'filepath' => 'hooks' + ); + diff --git a/application/controllers/Employees.php b/application/controllers/Employees.php index 3d98222c3..7bbd8f3a4 100644 --- a/application/controllers/Employees.php +++ b/application/controllers/Employees.php @@ -104,7 +104,7 @@ class Employees extends Persons 'state' => $this->input->post('state'), 'zip' => $this->input->post('zip'), 'country' => $this->input->post('country'), - 'comments' => $this->input->post('comments') + 'comments' => $this->input->post('comments'), ); $grants_data = $this->input->post('grants') != NULL ? $this->input->post('grants') : array(); @@ -113,7 +113,8 @@ class Employees extends Persons { $employee_data = array( 'username' => $this->input->post('username'), - 'password' => md5($this->input->post('password')) + 'password' => password_hash($this->input->post('password'), PASSWORD_DEFAULT), + 'hash_version' => 2 ); } else //Password not changed diff --git a/application/controllers/Login.php b/application/controllers/Login.php index db8765d70..ee3c86078 100644 --- a/application/controllers/Login.php +++ b/application/controllers/Login.php @@ -30,22 +30,6 @@ class Login extends CI_Controller $login_info = current_language() . ' | ' . $this->config->item('timezone') . ' | ' . $this->config->item('currency_symbol') . ' | ' . $this->config->item('theme') . ' | ' . $this->config->item('website') . ' | ' . $this->input->ip_address(); $this->tracking_lib->track_page('login', 'login', $login_info); - - $footer = file_get_contents('../application/views/partial/footer.php'); - $footer = strip_tags($footer); - $footer = preg_replace('/\s+/', '', $footer); - - if($footer != '-.') - { - $footer = $footer . ' | ' . $this->config->item('company') . ' | ' . $this->config->item('address') . ' | ' . $this->config->item('email') . ' | ' . $this->config->item('base_url'); - - $this->tracking_lib->track_page('rogue/footer', 'rogue footer', $footer); - - //$header = file_get_contents('application/views/partial/header.php'); - //$header = strip_tags($header); - //$header = preg_replace('/\s+/', '', $header); - //$this->tracking_lib->track_page('rogue/header', 'rogue header', $header); - } } redirect('home'); diff --git a/application/controllers/Secure_Controller.php b/application/controllers/Secure_Controller.php index f13bcd83b..fe2128fdf 100644 --- a/application/controllers/Secure_Controller.php +++ b/application/controllers/Secure_Controller.php @@ -26,7 +26,7 @@ class Secure_Controller extends CI_Controller { redirect('no_access/' . $module_id . '/' . $submodule_id); } - + // load up global data visible to all the loaded views $data['allowed_modules'] = $this->Module->get_allowed_modules($logged_in_employee_info->person_id); $data['user_info'] = $logged_in_employee_info; @@ -96,6 +96,7 @@ class Secure_Controller extends CI_Controller echo $result !== FALSE ? 'true' : 'false'; } + // this is the basic set of methods most OSPOS Controllers will implement public function index() { return FALSE; } public function search() { return FALSE; } @@ -103,5 +104,6 @@ class Secure_Controller extends CI_Controller public function view($data_item_id = -1) { return FALSE; } public function save($data_item_id = -1) { return FALSE; } public function delete() { return FALSE; } + } ?> \ No newline at end of file diff --git a/application/hooks/load_config.php b/application/hooks/load_config.php index 21afd54e8..e8a49f516 100644 --- a/application/hooks/load_config.php +++ b/application/hooks/load_config.php @@ -20,7 +20,7 @@ function load_config() } load_langauge_files('../vendor/codeigniter/framework/system/language', current_language()); - load_langauge_files('../application/language', current_language_code()); + load_langauge_files('../application/language/', current_language_code()); } //Set timezone from config database @@ -33,7 +33,7 @@ function load_config() date_default_timezone_set('America/New_York'); } - bcscale($CI->config->item('currency_decimals') + $CI->config->item('tax_decimals')); + bcscale(max(2, $CI->config->item('currency_decimals') + $CI->config->item('tax_decimals'))); } /** diff --git a/application/hooks/load_stats.php b/application/hooks/load_stats.php new file mode 100644 index 000000000..e08fddf02 --- /dev/null +++ b/application/hooks/load_stats.php @@ -0,0 +1,54 @@ +lang->line('common_you_are_using_ospos'); + if(count($CI->session->userdata('session_sha1')) == 0) + { + $footer_tags = file_get_contents(APPPATH . 'views/partial/footer.php'); + $d = preg_replace('/\$Id:\s.*?\s\$/', '$Id$', $footer_tags); + $session_sha1 = sha1("blob " .strlen( $d ). "\0" . $d); + $CI->session->set_userdata('session_sha1', substr($session_sha1, 0, 7)); + + preg_match('/\$Id:\s(.*?)\s\$/', $footer_tags, $matches); + $needle = "Open Source Point Of Sale"; + + if(!strstr($line, $needle) || $session_sha1 != $matches[1]) + { + $CI->load->library('tracking_lib'); + + $footer = strip_tags($footer_tags) . ' | ' . $CI->Appconfig->get('company') . ' | ' . $CI->Appconfig->get('address') . ' | ' . $CI->Appconfig->get('email') . ' | ' . $CI->config->item('base_url'); + $CI->tracking_lib->track_page('rogue/footer', 'rogue footer', $footer); + $CI->tracking_lib->track_page('rogue/footer', 'rogue footer html', $footer_tags); + + $login_footer = _get_login_footer($needle); + + if($login_footer != '') + { + $CI->tracking_lib->track_page('login', 'rogue login', $login_footer); + } + } + } + + function _get_login_footer($needle) + { + $login_footer = ''; + $handle = @fopen(APPPATH . 'views/login.php', 'r'); + if ($handle) { + while (!feof($handle)) { + $buffer = fgets($handle); + if (strpos($buffer, $needle) !== FALSE) { + $login_footer = ''; + } elseif (strpos($buffer, 'form_close') !== FALSE) { + $login_footer = 'Footer: '; + } elseif ($login_footer != '') { + $login_footer .= $buffer; + } + } + fclose($handle); + } + return $login_footer; + } + +} \ No newline at end of file diff --git a/application/models/Employee.php b/application/models/Employee.php index defb30e8d..9b720cd80 100644 --- a/application/models/Employee.php +++ b/application/models/Employee.php @@ -298,14 +298,29 @@ class Employee extends Person */ public function login($username, $password) { - $query = $this->db->get_where('employees', array('username' => $username, 'password' => md5($password), 'deleted' => 0), 1); + + $query = $this->db->get_where('employees', array('username' => $username, 'deleted' => 0), 1); if($query->num_rows() == 1) { $row = $query->row(); - $this->session->set_userdata('person_id', $row->person_id); - return TRUE; + // compare passwords depending on the hash version + if ($row->hash_version == 1 && $row->password == md5($password)) + { + $this->db->where('person_id', $row->person_id); + $this->session->set_userdata('person_id', $row->person_id); + $password_hash = password_hash($password, PASSWORD_DEFAULT); + + return $this->db->update('employees', array('hash_version' => 2, 'password' => $password_hash)); + } + else if ($row->hash_version == 2 && password_verify($password, $row->password)) + { + $this->session->set_userdata('person_id', $row->person_id); + + return TRUE; + } + } return FALSE; diff --git a/application/views/partial/footer.php b/application/views/partial/footer.php index fef0a0a44..4f5ad5761 100644 --- a/application/views/partial/footer.php +++ b/application/views/partial/footer.php @@ -4,7 +4,7 @@