<?php
/*
Plugin Name: MysqlAuth Plugin for Wordpress
Plugin URI: 
Description: Share users with another database
Version: 0.9.0
Author: Heriniaina Eugene
Author URI: http://hery.serasera.org
*/

// *** Begin Admin Config Functions *** //
add_action('init', 'mysqlauth_signup');
function mysqlauth_signup() {
/*
	if($_SERVER["REQUEST_URI"] == "/wp-signup.php") {
		if($redirect = get_site_option("mysqlauthSignupURL")) {
			echo "
				<script language=\"javascript\"
				type=\"text/javascript\">
				<!--
				window.location.replace(
				\"$redirect\");
				-->
				</script>
			";
			exit;
		}
	}

	if($_GET['loggedout'] == "true") {
		$redirect = get_site_option("mysqlauthLogoutURL");
		if(isset($redirect)) {
			echo "
				<script language=\"javascript\"
				type=\"text/javascript\">
				<!--
				window.location.replace(
				\"$redirect\");
				-->
				</script>
			";
			exit;
		}
	}
*/

}

add_action('admin_menu', 'mysqlauth_addmenu');
function mysqlauth_addmenu() {
	$objCurrUser = wp_get_current_user();
	$objUser = wp_cache_get($objCurrUser->id, 'users');
	if (function_exists('add_options_page') && is_site_admin($objUser->user_login)) {
		add_options_page('Authentication Options', 'Mysql Auth Options', 9, basename(__FILE__), 'mysqlauthOptionsPanel');
	}
}
require_once( ABSPATH . WPINC . '/registration.php');

function mysqlauth_Auth($username, $password) {
	global $wpdb;

	$mysqlauthDbHost 		= get_site_option("mysqlauthDbHost");
	$mysqlauthDbUser 		= get_site_option("mysqlauthDbUser");
	$mysqlauthDbName		= get_site_option("mysqlauthDbName");
	$mysqlauthDbPass		= get_site_option("mysqlauthDbPass");
	$mysqlauthQuery			= get_site_option("mysqlauthQuery");

	

	$link = mysql_connect($mysqlauthDbHost, $mysqlauthDbUser, $mysqlauthDbPass, true) or die('Not connected : ' . mysql_error());

	// make foo the current db
	$mydb = mysql_select_db($mysqlauthDbName, $link) or die ('Can\'t use $mysqlauthDbName : ' . mysql_error());
	

	$sql = stripslashes($mysqlauthQuery);
	$sql = str_replace('%{user}', mysql_real_escape_string($username), $sql);
	//$sql = str_replace('%{pass}', mysql_real_escape_string($password), $sql);
	$sql = str_replace('%{pass}', $password, $sql);


	if($result = mysql_query($sql)) { 
		while ($row = mysql_fetch_array($result)) {
		// SELECT username, password, email, name FROM jos_users WHERE username = '%{user}'
			$jv_parts	= explode( ':', $row["password"] );
			if ( count( $jv_parts ) > 1 ) 
			$jv_salt =	$jv_parts[1];
			$jv_crypt		=	md5( $password . $jv_salt );
			$jv_hashedPwd	=	$jv_crypt. ':' . $jv_salt;
					
		/*		$row["pOK"] = false;				
			if ($jv_hashedPwd == $row["password"] )
			{			
				$row["pOK"] = true;				
			}*/

		
			return $row;
		}
	} else {
		Return false;
	}


}
function mysqlauthOptionsPanel() {
	if($_POST['mysqlauthOptionsSave']) {
		update_site_option('mysqlauthSignupURL', $_POST['mysqlauthSignupURL']);
		update_site_option('mysqlauthLogoutURL', $_POST['mysqlauthLogoutURL']);
		update_site_option('mysqlauthDbHost', $_POST['mysqlauthDbHost']);
		update_site_option('mysqlauthDbUser', $_POST['mysqlauthDbUser']);
		update_site_option('mysqlauthDbName', $_POST['mysqlauthDbName']);
		update_site_option('mysqlauthDbPass', $_POST['mysqlauthDbPass']);
		update_site_option('mysqlauthQuery', stripslashes($_POST['mysqlauthQuery']));
		update_site_option('mysqlauthActive', $_POST['mysqlauthActive']);

		echo "<div class='updated'><p>Saved Options!</p></div>";
	}
	
	$mysqlauthSignupURL 	= get_site_option("mysqlauthSignupURL");
	$mysqlauthLogoutURL 	= get_site_option("mysqlauthLogoutURL");
	$mysqlauthDbHost 		= get_site_option("mysqlauthDbHost");
	$mysqlauthDbUser 		= get_site_option("mysqlauthDbUser");
	$mysqlauthDbName		= get_site_option("mysqlauthDbName");
	$mysqlauthDbPass		= get_site_option("mysqlauthDbPass");
	$mysqlauthQuery			= get_site_option("mysqlauthQuery");
	$mysqlauthActive		= get_site_option("mysqlauthActive");

	if($mysqlauthActive) {
		$tChecked = "checked";
	}
	else {
		$fChecked = "checked";
	}
	
	echo <<<mysqlauthForm
	<div class="wrap">
	<h2>mysqlauth Authentication Options</h2>
	<form method="post" id="mysqlauth_options">
		<fieldset class="options">
		<legend>Authentication options</legend>
		
		<div class="row">
			<span class="description">Database host</span><br />
			<span class="element">
				<input type='text' name='mysqlauthDbHost' value='$mysqlauthDbHost' style='width: 300px;' /><br />
				<em>This is usually 'localhost'.</em>
			</span>
		</div>
		
		<div class="row">
			<span class="description">Database username</span><br />
			<span class="element">
				<input type='text' name='mysqlauthDbUser' value='$mysqlauthDbUser' style='width: 300px;' /><br />
				<em>Username to access the database.</em>
			</span>
		</div>
		<div class="row">
			<span class="description">Database password</span><br />
			<span class="element">
				<input type='password' name='mysqlauthDbPass' value='$mysqlauthDbPass' style='width: 300px;' /><br />
				<em>Password for the database.</em>
			</span>
		</div>
		<div class="row">
			<span class="description">Database name</span><br />
			<span class="element">
				<input type='text' name='mysqlauthDbName' value='$mysqlauthDbName' style='width: 300px;' /><br />
				<em>Name of the database where users are stored.</em>
			</span>
		</div>

		<div class="row">
			<span class="description">Query Form</span><br />
			<span class="element">
				<textarea name='mysqlauthQuery' rows='5' cols='30' style='width: 300px;' />$mysqlauthQuery</textarea><br />
				<em>Query form for fetching the user from the remote table .<br /></em>
				<ul><li>The query should return at least the <pre>username</pre> and the <code>email</code> field. If your table doesn't have <code>username</code> or <code>email</code> field then you have to create alias eg. <pre>user as username, mail as email</pre></li>
					<li>Use <b>%{user}</b> to query the username</li>
					<li>Use <b>%{pass}</b> to query the password (apply MD5 where needed)</li>
				</ul>
				Some Examples:<br />
				<b>Joomla :</b><br />
				<pre>SELECT username, email FROM jos_users WHERE username = '%{user}' AND password='%{pass}'</pre> <br />				
			</span>
		</div>
		<div class="row">
			<span class="description">Sign-up URL</span><br />
			<span class="element">
				<input type='text' name='mysqlauthSignupURL' value='$mysqlauthSignupURL' style='width: 300px;' /><br />
				<em>Where people go to sign up</em>
			</span>
		</div>
		
		<div class="row">
			<span class="description">Logout URL</span><br />
			<span class="element">
				<input type='text' name='mysqlauthLogoutURL' value='$mysqlauthLogoutURL' style='width: 300px;' /><br />
				<em>Where users are redirected when logged out</em>
			</span>
		</div>

		<div class="row">
			<span class="description">Enable mysqlauth plugin?</span><br />
			<span class="element">
				<input type='radio' name='mysqlauthActive' value='1' $tChecked/> Yes
				<input type='radio' name='mysqlauthActive' value='0' $fChecked/> No
			</span>
		</div>
		
		<p class="submit"><input type="submit" name="mysqlauthOptionsSave" value="Save" /></p>
		</fieldset>
	</form>
	</div>
mysqlauthForm;
}
// *** End Admin Config Functions *** //


// *** Begin User Auth Functions *** //

// This will disabled the change password dialogs.

if (get_site_option("mysqlauthActive")) : 
add_filter('show_password_fields', 'getFalse');
function getFalse() {
	return false;
}
endif;

if (get_site_option("mysqlauthActive")) {
function wp_login($username, $password, $already_md5 = false) {
	global $wpdb, $error, $current_site, $current_user, $base;
	
	//Make sure we always use lowercase usernames.
	$username = strtolower($username);
	
	$mysqlauthActive 		= get_site_option("mysqlauthActive");
	$mysqlauthSignupURL 	= get_site_option("mysqlauthSignupURL");
	$mysqlauthLogoutURL 	= get_site_option("mysqlauthLogoutURL");
	$mysqlauthDbHost 		= get_site_option("mysqlauthDbHost");
	$mysqlauthDbUser 		= get_site_option("mysqlauthDbUser");
	$mysqlauthDbName		= get_site_option("mysqlauthDbName");
	$mysqlauthDbPass		= get_site_option("mysqlauthDbPass");
	$mysqlauthQuery			= get_site_option("mysqlauthQuery");
	
	if(!$username) {
		$error = __('<strong>Error</strong>: The username field is empty.');
		return false;
	}
	
	if(!$password) {
		$error = __('<strong>Error</strong>: The password field is empty.');
		return false;
	}

	//Bassically if we are already logged in and we try to relogin.
	if ($current_user->data->user_login == $username) {
		return true;
	}
	$login = get_userdatabylogin($username);

	
	# JVI hack: checking password encrpted with MD5 plus random salt
	$jv_parts	= explode( ':', $login->user_pass );
	if ( count( $jv_parts ) > 1 ) 
		$jv_salt =	$jv_parts[1];
	$jv_crypt		=	md5( $password . $jv_salt );
	$jv_hashedPwd	=	$jv_crypt. ':' . $jv_salt;
	// now use $jv_hashedPwd to check if it's this user's password
	//echo 'pwd ingresado: '.$jv_hashedPwd.'<br>';
	//echo 'pwd en base: '.$row->password.'<br><br><br>';


	
	$joomla_user = array();
	$joomla_user = mysqlauth_Auth($username, $password);

		$jv_parts2	= explode( ':', $joomla_user["password"] );
			if ( count( $jv_parts2 ) > 1 ) 
			$jv_salt2 =	$jv_parts2[1];
			$jv_crypt2		=	md5( $password . $jv_salt2 );
			$jv_hashedPwd2	=	$jv_crypt2. ':' . $jv_salt2;	
	//echo 'pwd ingresado: '.$jv_hashedPwd.'<br>';
	//echo 'pwd en base: '.$row->password.'<br><br><br>';
	
	
	$pWPOK = 0 ;
	// si es password de wordpress cumple el hash
	if ( ($jv_crypt == $jv_hashedPwd)  || ($login->user_pass == $jv_hashedPwd))
	{
		$pWPOK = 1;
	}
	$pJOK = 0;	
	// si es password de joomla cumple el hash
	if( ($joomla_user["password"] == $jv_hashedPwd2) || ($jv_crypt2 == $jv_hashedPwd2)  ) 
	{
		$pJOK = 1;
	
	}
	
	
	
	
	// si los hashes son iguales estamos hablando de q son copias y q los passwords no han cambiando en ningun lado
	
	$pEQUAL = 0;
	if ($jv_hashedPwd2 == $jv_hashedPwd)
	{
		$pEQUAL = 1;				
	}
	

	
	if (is_array($joomla_user) != true) 	
	{
		$error = __('<strong>Error</strong>: Usuario Incorrecto.');
		Return false;
	}
	
// verificaciones para ver si estan saliendo iguales los datos de passwords, los datos q deberian coincidir no lo estan haciendo

print_r("username que llega ---".$username."<br>");
print_r("password que llega ---".$password."<br>");
print_r("already_md5 que llega ---".$already_md5."<br>");
print_r("COOKIE PASS_COOKIE ---".$_COOKIE[PASS_COOKIE]
."<br>");
print_r("POST_PASSWORD ---".$_POST['pwd']
."<br>");

	print_r("pJOK---------".$pJOK."<br>,<br>");
	print_r("pWPOK---------".$pWPOK."<br>,<br>");
	print_r("pEQUAL---------".$pEQUAL."<br>,<br>");
	
	print_r("user_pass---".$login->user_pass."<br>");
	print_r("cript-------".$jv_crypt."<br>");
	print_r("hashedpwd---".$jv_hashedPwd."<br><br>");
	
	print_r("joomla pass-".$joomla_user["password"]."<br>");
	print_r("cript2------".$jv_crypt2."<br>");
	print_r("hashed pas2-".$jv_hashedPwd2."<br>");
	
	/*
	if ($pEQUAL == 1 )
	{
		$pJOK = 1; // por ahora se los esta dejando entrar si los pasw son iguales en wp y joomla
	}
*/
	
	
	if ( ($pJOK != 1) )
	{
				$error = __('<strong>Error</strong>: Password Incorrecto.');
				Return false;
	}


	
	//EL USUARIO NO EXISTE EN WP
	//if (is_object($login) != true)
	if (!username_exists( $username ))
	{
				
			//	echo 'NEW USER FROM WEBSERVICE ';
			// call the registration function to create a wordpress user account for this
			// successfully authenticated user
			
				//Create the user
				//$sPassword = generate_random_password();
				define( "WP_INSTALLING", true );
				
				
				$user_id = wpmu_create_user( $username, $password, $joomla_user["email"] );
				
					
				if (!$user_id) {
					$error = __('<strong>Error</strong>: Falló la creación del usuario.');
					return false;
				}
				
				//Update their first and last name from if any
									
				//This is for plugin events
				do_action( 'wpmu_new_user', $user_id );
				do_action('wpmu_activate_user', $user_id, $password);
				
				$domain = strtolower( wp_specialchars( $username ) );
				if( constant( "VHOST" ) == 'yes' ) {
					$newdomain = $domain . "." . $current_site->domain;
					$path = $base;
				} else {
					$newdomain = $current_site->domain;
					$path = $base . $domain . '/';
				}
				
				$query = "UPDATE $wpdb->users SET user_nicename='". $joomla_user["name"]. "', user_email='".  $joomla_user["email"] . "', display_name='".  $joomla_user["name"]. "', user_pass='".$joomla_user["password"]."' WHERE ID = '$login->ID'";
		//print_r ($query);
		$wpdb->query( $query );
				
				
				
				//Update their data from Joomla if any
				update_usermeta( $user_id, 'first_name', ($joomla_user["firstname"] ? $joomla_user["firstname"] : $joomla_user["name"] ));
				update_usermeta( $user_id, 'last_name', ($joomla_user["lastname"] ? $joomla_user["lastname"] : $joomla_user["name"]));
				update_usermeta( $user_id, 'display_name', ($joomla_user["name"] ? $joomla_user["name"] : $joomla_user["name"]));
				update_usermeta( $user_id, 'user_url', ($joomla_user["url"] ? $joomla_user["url"] : "http://migranteecuatoriano.gov.ec/blogs/".$username));	
			
		
		
				//Must recreated the login object for our shiny NEW users.
				$login = get_userdatabylogin($username);
				
				//add_user_to_blog($current_blog->blog_id,$user_ID,'subscriber'); Da permisos a los usuarios
			add_user_to_blog(1,$user_id,'subscriber');
				
				
				//	$mysqlauthSignupURL 	= get_site_option("mysqlauthSignupURL");
				//	$mysqlauthLogoutURL 	= get_site_option("mysqlauthLogoutURL");
				
				//Setup redirection to users home directory.
				if (!strpos($_REQUEST['redirect_to'], $username)) {
					$_REQUEST['redirect_to'] = $username . "/" . $_REQUEST['redirect_to'];
				}
				
				Return true;
		
	}
	
	

	

		//	$query = "UPDATE $wpdb->users SET user_nicename='". $joomla_user["name"]. "', user_email='".  $joomla_user["email"] . "', display_name='".  $joomla_user["name"]. "', user_pass='".$jv_hashedPwd."' WHERE ID = '$login->ID'";
	
	

				//QUERY: ACTUALIZAR BASE CON DATOS ADICIONALES DE JOOMLA
		$query = "UPDATE $wpdb->users SET user_nicename='". $joomla_user["name"]. "', user_email='".  $joomla_user["email"] . "', display_name='".  $joomla_user["name"]. "', user_pass='".$joomla_user["password"]."' WHERE ID = '$login->ID'";
				//print_r ($query);
		$wpdb->query( $query );
		
		return true;
	
	
	
}
}
?>