Index: includes/bootstrap.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v retrieving revision 1.80 diff -u -r1.80 bootstrap.inc --- includes/bootstrap.inc 5 Jan 2006 10:51:47 -0000 1.80 +++ includes/bootstrap.inc 8 Jan 2006 15:38:29 -0000 @@ -860,7 +860,9 @@ timer_start('page'); // deny access to hosts which were banned. t() is not yet available. - if (drupal_is_denied('host', $_SERVER['REMOTE_ADDR'])) { + // try to protect user1 in case he is logged in and someone banned his IP. $user is available. + global $user; + if (drupal_is_denied('host', $_SERVER['REMOTE_ADDR']) && $user->uid != 1) { header('HTTP/1.0 403 Forbidden'); print 'Sorry, '. $_SERVER['REMOTE_ADDR']. ' has been banned.'; exit(); Index: modules/user.module =================================================================== RCS file: /cvs/drupal/drupal/modules/user.module,v retrieving revision 1.548 diff -u -r1.548 user.module --- modules/user.module 6 Jan 2006 07:42:31 -0000 1.548 +++ modules/user.module 8 Jan 2006 15:38:33 -0000 @@ -857,11 +857,12 @@ function user_login_validate($form_id, $form_values) { if (isset($form_values['name'])) { + $user_one = db_result(db_query('SELECT name FROM {users} WHERE uid = 1')); if (user_is_blocked($form_values['name'])) { // blocked in user administration form_set_error('login', t('The username %name has been blocked.', array('%name' => theme('placeholder', $form_values['name'])))); } - else if (drupal_is_denied('user', $form_values['name'])) { + else if (drupal_is_denied('user', $form_values['name']) && $form_values['name'] != $user_one) { // denied by access controls form_set_error('login', t('The name %name is a reserved username.', array('%name' => theme('placeholder', $form_values['name'])))); } @@ -1363,60 +1364,67 @@ * Menu callback: check an access rule */ function user_admin_access_check() { - $op = isset($_POST['op']) ? $_POST['op'] : ''; - $edit = isset($_POST['edit']) ? $_POST['edit'] : ''; - - if (!empty($op)) { - if (!empty($edit['user']['test'])) { - if (drupal_is_denied('user', $edit['user']['test'])) { - drupal_set_message(t('The username %name is not allowed.', array('%name' => theme('placeholder', $edit['user']['test'])))); - } - else { - drupal_set_message(t('The username %name is allowed.', array('%name' => theme('placeholder', $edit['user']['test'])))); - } - } - if (!empty($edit['mail']['test'])) { - if (drupal_is_denied('mail', $edit['mail']['test'])) { - drupal_set_message(t('The e-mail address %mail is not allowed.', array('%mail' => theme('placeholder', $edit['mail']['test'])))); - } - else { - drupal_set_message(t('The e-mail address %mail is allowed.', array('%mail' => theme('placeholder', $edit['mail']['test'])))); - } - } - if (!empty($edit['host']['test'])) { - if (drupal_is_denied('host', $edit['host']['test'])) { - drupal_set_message(t('The hostname %host is not allowed.', array('%host' => theme('placeholder', $edit['host']['test'])))); - } - else { - drupal_set_message(t('The hostname %host is allowed.', array('%host' => theme('placeholder', $edit['host']['test'])))); - } - } - } - $form['user'] = array('#type' => 'fieldset', '#title' => t('Username')); $form['user']['test'] = array('#type' => 'textfield', '#title' => '', '#description' => t('Enter a username to check if it will be denied or allowed.'), '#size' => 30, '#maxlength' => 64); $form['user']['type'] = array('#type' => 'hidden', '#value' => 'user'); $form['user']['submit'] = array('#type' => 'submit', '#value' => t('Check username')); - $output .= drupal_get_form('check_user', $form); + $output .= drupal_get_form('check_user', $form, 'user_admin_access_check'); unset($form); // prevent endless loop? $form['mail'] = array('#type' => 'fieldset', '#title' => t('E-mail')); $form['mail']['test'] = array('#type' => 'textfield', '#title' => '', '#description' => t('Enter an e-mail address to check if it will be denied or allowed.'), '#size' => 30, '#maxlength' => 64); $form['mail']['type'] = array('#type' => 'hidden', '#value' => 'mail'); $form['mail']['submit'] = array('#type' => 'submit', '#value' => t('Check e-mail')); - $output .= drupal_get_form('check_mail', $form); + $output .= drupal_get_form('check_mail', $form, 'user_admin_access_check'); unset($form); // prevent endless loop? $form['host'] = array('#type' => 'fieldset', '#title' => t('Hostname')); $form['host']['test'] = array('#type' => 'textfield', '#title' => '', '#description' => t('Enter a hostname or IP address to check if it will be denied or allowed.'), '#size' => 30, '#maxlength' => 64); $form['host']['type'] = array('#type' => 'hidden', '#value' => 'host'); $form['host']['submit'] = array('#type' => 'submit', '#value' => t('Check hostname')); - $output .= drupal_get_form('check_host', $form); + $output .= drupal_get_form('check_host', $form, 'user_admin_access_check'); unset($form); // prevent endless loop? return $output; } +function user_admin_access_check_validate($form_id, $edit) { + if (empty($edit['test'])) { + form_set_error($edit['type'], t('No value entered. Please enter a test string and try again.')); + } +} + +function user_admin_access_check_submit($form_id, $edit) { + switch ($edit['type']) { + case 'user': + if (drupal_is_denied('user', $edit['test'])) { + drupal_set_message(t('The username %name is not allowed.', array('%name' => theme('placeholder', $edit['test'])))); + } + else { + drupal_set_message(t('The username %name is allowed.', array('%name' => theme('placeholder', $edit['test'])))); + } + break; + case 'mail': + if (drupal_is_denied('mail', $edit['test'])) { + drupal_set_message(t('The e-mail address %mail is not allowed.', array('%mail' => theme('placeholder', $edit['test'])))); + } + else { + drupal_set_message(t('The e-mail address %mail is allowed.', array('%mail' => theme('placeholder', $edit['test'])))); + } + break; + case 'host': + if (drupal_is_denied('host', $edit['test'])) { + drupal_set_message(t('The hostname %host is not allowed.', array('%host' => theme('placeholder', $edit['test'])))); + } + else { + drupal_set_message(t('The hostname %host is allowed.', array('%host' => theme('placeholder', $edit['test'])))); + } + break; + default: + break; + } +} + /** * Menu callback: add an access rule */ @@ -1772,7 +1780,7 @@ $form['registration']['user_registration_help'] = array('#type' => 'textarea', '#title' => t('User registration guidelines'), '#default_value' => variable_get('user_registration_help', ''), '#description' => t('This text is displayed at the top of the user registration form. It\'s useful for helping or instructing your users.')); // User e-mail settings. - $form['email'] = array('#type' => 'fieldset', '#title' => t('User email settings')); + $form['email'] = array('#type' => 'fieldset', '#title' => t('User e-mail settings')); $form['email']['user_mail_welcome_subject'] = array('#type' => 'textfield', '#title' => t('Subject of welcome e-mail'), '#default_value' => _user_mail_text('welcome_subject'), '#maxlength' => 180, '#description' => t('Customize the subject of your welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri, %login_url.'); $form['email']['user_mail_welcome_body'] = array('#type' => 'textarea', '#title' => t('Body of welcome e-mail'), '#default_value' => _user_mail_text('welcome_body'), '#rows' => 15, '#description' => t('Customize the body of the welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %login_uri, %edit_uri, %login_url.'); $form['email']['user_mail_approval_subject'] = array('#type' => 'textfield', '#title' => t('Subject of welcome e-mail (awaiting admin approval)'), '#default_value' => _user_mail_text('approval_subject'), '#maxlength' => 180, '#description' => t('Customize the subject of your awaiting approval welcome e-mail, which is sent to new members upon registering.') .' '. t('Available variables are:') .' %username, %site, %password, %uri, %uri_brief, %mailto, %date, %login_uri, %edit_uri, %login_url.'); @@ -1849,7 +1857,7 @@ case 'admin/user/account/create': return t('

This web page allows the administrators to register a new users by hand. Note that you cannot have a user where either the e-mail address or the username match another user in the system.

'); case strstr($section, 'admin/access/rules'): - return t('

Set up username and e-mail address access rules for new accounts. If a username or email address for a new account matches any deny rule, but not an allow rule, then the new account will not be allowed to be created. A host rule is effective for every page view, not just registrations.

'); + return t('

Set up username and e-mail address access rules for new and existing accounts (currently logged in accounts will not be logged out). If a username or e-mail address for an account matches any deny rule, but not an allow rule, then the account will not be allowed to be created or to log in. A host rule is effective for every page view, not just registrations.

'); case 'admin/access': return t('

Permissions let you control what users can do on your site. Each user role (defined on the user roles page) has its own set of permissions. For example, you could give users classified as "Administrators" permission to "administer nodes" but deny this power to ordinary, "authenticated" users. You can use permissions to reveal new features to privileged users (those with subscriptions, for example). Permissions also allow trusted users to share the administrative burden of running a busy site.

', array('%role' => url('admin/access/roles'))); case 'admin/access/roles':