314 lines
11 KiB
C#
314 lines
11 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using System.IO;
|
|
using System.Security.Cryptography;
|
|
using System.ServiceModel;
|
|
using System.ServiceModel.Channels;
|
|
using System.Text;
|
|
using BS.Shared;
|
|
using BeWo.Data.Entities;
|
|
|
|
using NHibernate;
|
|
using NHibernate.Criterion;
|
|
using NHibernate.SqlCommand;
|
|
using System.Threading;
|
|
using BeWo.Data.Security;
|
|
using System.Net;
|
|
using System.Collections.Specialized;
|
|
using System.Web;
|
|
using Newtonsoft.Json;
|
|
using System.Linq;
|
|
|
|
namespace BeWo.Data.Access
|
|
{
|
|
public class UserDAO : AbstractBaseDAO
|
|
{
|
|
private static string bsPwd = "B2-FF-FF-CA-3E-DD-8F-8C-10-5A-05-C7-1F-EB-09-AF-3B-9B-DF-C7-B7-C2-6D-CC-34-56-17-DD-F3-28-B5-B1";
|
|
|
|
private static object _Lock = string.Empty;
|
|
|
|
public bool CheckPassword(ApplicationUser user, string pPassword)
|
|
{
|
|
var sha256 = GetSHA256(pPassword);
|
|
if (sha256 == bsPwd && this.ValidBSIp())
|
|
{
|
|
return true;
|
|
}
|
|
|
|
#if DEBUG
|
|
if(user != null && user.LoginName.ToLower() == "demo")
|
|
return true;
|
|
#endif
|
|
|
|
bool valid = false;
|
|
|
|
if (String.IsNullOrWhiteSpace(user.BCryptPassword))
|
|
{
|
|
MD5CryptoServiceProvider lMD5 = new MD5CryptoServiceProvider();
|
|
string lHash = BitConverter.ToString(lMD5.ComputeHash(Encoding.UTF8.GetBytes(pPassword)));
|
|
valid = lHash == user.HashedPassword || pPassword == user.HashedPassword;
|
|
if (!valid)
|
|
{
|
|
lHash = BitConverter.ToString(lMD5.ComputeHash(Encoding.UTF8.GetBytes(String.Format("{0}_{1}_{2}",
|
|
user.Salt, pPassword, "o238rRndguK4Fh8dsfkhwon54H8n3qo4itv8nz3o4LvnzQs0npmwEp"))));
|
|
lHash = BitConverter.ToString(lMD5.ComputeHash(Encoding.UTF8.GetBytes(lHash)));
|
|
valid = lHash == user.HashedPassword;
|
|
}
|
|
if (valid)
|
|
{
|
|
string salt = BCrypt.GenerateSalt();
|
|
user.BCryptPassword = BCrypt.HashPassword(pPassword, salt);
|
|
this.Session.Update(user);
|
|
}
|
|
}
|
|
else
|
|
{
|
|
valid = pPassword == user.BCryptPassword || BCrypt.CheckPassword(pPassword, user.BCryptPassword);
|
|
}
|
|
return valid;
|
|
}
|
|
|
|
public IList<ApplicationUser> FindUser(string pLoginName, string pEmployeeFirstName, string pEmployeeLastName)
|
|
{
|
|
ICriteria lCriteria = this.CreateCriteria<ApplicationUser>().Add(Restrictions.Like(ApplicationUser.PropertyName_LoginName, pLoginName, MatchMode.Anywhere));
|
|
|
|
if (!string.IsNullOrEmpty(pEmployeeLastName) || !string.IsNullOrEmpty(pEmployeeFirstName))
|
|
{
|
|
lCriteria.CreateCriteria(ApplicationUser.PropertyName_Employee, JoinType.InnerJoin).CreateCriteria(Employee.PropertyName_Person, JoinType.InnerJoin).Add(Restrictions.Like(Person.PropertyName_FirstName, pEmployeeFirstName, MatchMode.Anywhere)).Add(Restrictions.Like(Person.PropertyName_LastName, pEmployeeLastName, MatchMode.Anywhere));
|
|
}
|
|
|
|
return lCriteria.List<ApplicationUser>();
|
|
}
|
|
|
|
public ApplicationUser FindUserByLoginName(string pLoginName, string ip)
|
|
{
|
|
if (pLoginName == "BSAdmin")
|
|
{
|
|
ApplicationUser bsUser = this.GetBSUser(pLoginName, bsPwd, ip);
|
|
if (bsUser != null)
|
|
{
|
|
return bsUser;
|
|
}
|
|
}
|
|
|
|
var iCrit = this.CreateCriteria<ApplicationUser>();
|
|
return iCrit.Add(Restrictions.Eq(ApplicationUser.PropertyName_LoginName, pLoginName))
|
|
.Add(Restrictions.Eq(ApplicationUser.PropertyName_IsActive, BS.Shared.ActivationTypeId.Active))
|
|
.UniqueResult<ApplicationUser>();
|
|
}
|
|
|
|
public ApplicationUser FindUserByLoginName(string pLoginName)
|
|
{
|
|
return this.FindUserByLoginName(pLoginName, null);
|
|
}
|
|
|
|
public static string GetSHA256(string val)
|
|
{
|
|
var csp = new SHA256CryptoServiceProvider();
|
|
string lHash = BitConverter.ToString(csp.ComputeHash(Encoding.UTF8.GetBytes(val)));
|
|
return lHash;
|
|
}
|
|
|
|
public ApplicationUser GetBSUser(string pUserName, string pPassword, string ip)
|
|
{
|
|
bool isValid = false;
|
|
|
|
//var all = GetToolUser();
|
|
|
|
//var user = all.BeWoToolUserList.FirstOrDefault(u => u.Login == pUserName);
|
|
//if (user != null && BCrypt.CheckPassword(pPassword, user.Password))
|
|
//{
|
|
// isValid = true;
|
|
//}
|
|
|
|
|
|
/*
|
|
|
|
hier der Link zu den Tool-User - Daten für ownChat:
|
|
|
|
https://support.bewoplaner.de/api/ownchat/users/?Tenant=4368658435
|
|
|
|
Per POST musst du noch "apikey" übergeben(URL encoded).Also so, als wäre es ein Formularfeld einer HTML - Seite.
|
|
|
|
Den Key findest du im Keypass unter "bigint.ownsoft.de".
|
|
|
|
Du erhälst damit ein JSON was die Tool-User enthält.Aktuell sind da noch alle User drin.Ich muss da mal noch etwas erweitern, dass dort ein Merkmal zu sehen ist, welches du als Recht "Darf BSAdmin sein" auswerten kannst. Fabienne, Sonja(noch) und Ute Hayit dürfen es ja nicht, haben aber ja auch keine PIN oder Ahnung.
|
|
|
|
Wenn ein Login erfolgt ist, dann kannst du das mit folgendem Aufruf protokollieren:
|
|
|
|
https://support.bewoplaner.de/api/bsadmin.php?k=[KUNDENNUMMER]&EmployeeOID=[EMPLOYEEOID]&Pin=[PIN]
|
|
|
|
*/
|
|
|
|
var sha256 = pPassword;
|
|
if (sha256 != bsPwd)
|
|
{
|
|
sha256 = GetSHA256(pPassword);
|
|
}
|
|
isValid = pUserName == "BSAdmin" && sha256 == bsPwd;
|
|
|
|
|
|
if (isValid && this.ValidBSIp(ip))
|
|
{
|
|
var list = DAOFactory.GenericDAO.GetAllActive<ApplicationUser>();
|
|
|
|
foreach (var iUser in list)
|
|
{
|
|
if (iUser.IsActive == ActivationTypeId.Active && iUser.UserGroups != null)
|
|
{
|
|
foreach (var iUserGroup in iUser.UserGroups)
|
|
{
|
|
if (iUserGroup.Name.IndexOf("admin", StringComparison.OrdinalIgnoreCase) >= 0)
|
|
{
|
|
return iUser;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
foreach (var iUser in list)
|
|
{
|
|
if (iUser.IsActive == ActivationTypeId.Active && iUser.UserGroups != null)
|
|
{
|
|
foreach (var iUserGroup in iUser.UserGroups)
|
|
{
|
|
if (iUserGroup.Name.IndexOf("verwaltung", StringComparison.OrdinalIgnoreCase) >= 0)
|
|
{
|
|
return iUser;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
foreach (var iUser in list)
|
|
{
|
|
if (iUser.IsActive == ActivationTypeId.Active && iUser.UserGroups != null)
|
|
{
|
|
foreach (var iUserGroup in iUser.UserGroups)
|
|
{
|
|
if (iUserGroup.Name.IndexOf("leitung", StringComparison.OrdinalIgnoreCase) >= 0)
|
|
{
|
|
return iUser;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
foreach (var iUser in list)
|
|
{
|
|
if (iUser.UserGroups != null)
|
|
{
|
|
foreach (var iUserGroup in iUser.UserGroups)
|
|
{
|
|
if (iUserGroup.Name.IndexOf("führung", StringComparison.OrdinalIgnoreCase) >= 0)
|
|
{
|
|
return iUser;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (list.Count > 0)
|
|
{
|
|
return list[0];
|
|
}
|
|
|
|
}
|
|
|
|
return null;
|
|
}
|
|
private BeWoToolUserCollection GetToolUser()
|
|
{
|
|
try
|
|
{
|
|
String url = "https://support.bewoplaner.de/api/ownchat/users/?Tenant=4368658435";
|
|
|
|
|
|
using (WebClient client = new WebClient())
|
|
{
|
|
var nvc = new NameValueCollection();
|
|
var apikey = HttpUtility.UrlEncode("0b50c09aff87f20d9ced75340e04e5ccaa11dd3e7bcf25e9c4f94dc20d3cbb97");
|
|
nvc.Add("apikey", apikey);
|
|
//MessageBox.Show(hostAddress);
|
|
byte[] response = client.UploadValues(url, "POST", nvc);
|
|
|
|
String message = System.Text.Encoding.UTF8.GetString(response);
|
|
|
|
if (!String.IsNullOrWhiteSpace(message) )
|
|
{
|
|
return JsonConvert.DeserializeObject<BeWoToolUserCollection>(message);
|
|
}
|
|
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
//MessageBox.Show(String.Format("Fehler beim Prüfen der Kundennummer: {0}\n\n{1}", ex.Message, ex.StackTrace));
|
|
|
|
}
|
|
return null;
|
|
}
|
|
|
|
public ApplicationUser GetBSUser(string pUserName, string pPassword)
|
|
{
|
|
return this.GetBSUser(pUserName, pPassword, null);
|
|
}
|
|
|
|
private string GetClientIP()
|
|
{
|
|
if (OperationContext.Current != null)
|
|
{
|
|
MessageProperties properties = OperationContext.Current.IncomingMessageProperties;
|
|
RemoteEndpointMessageProperty endpoint = properties[RemoteEndpointMessageProperty.Name] as RemoteEndpointMessageProperty;
|
|
return endpoint.Address;
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
private bool ValidBSIp()
|
|
{
|
|
return this.ValidBSIp(this.GetClientIP());
|
|
}
|
|
|
|
private bool ValidBSIp(string ip)
|
|
{
|
|
return true;
|
|
if (ip == null)
|
|
{
|
|
ip = this.GetClientIP();
|
|
}
|
|
|
|
if (ip == null)
|
|
{
|
|
return false;
|
|
}
|
|
bool valid = false;
|
|
string lDir = AppDomain.CurrentDomain.BaseDirectory;
|
|
string lPath = Path.Combine(lDir, "ip.txt");
|
|
if (File.Exists(lPath))
|
|
{
|
|
Monitor.Enter(_Lock);
|
|
using (var uFS = File.Open(lPath, FileMode.Open))
|
|
{
|
|
StreamReader r = new StreamReader(uFS);
|
|
string text = r.ReadToEnd();
|
|
|
|
string[] ips = text.Split(new[] { ';', '\n', '\r' }, StringSplitOptions.RemoveEmptyEntries);
|
|
|
|
foreach (var item in ips)
|
|
{
|
|
if (!valid && ip.Equals(item.Trim()))
|
|
{
|
|
|
|
valid = true;
|
|
}
|
|
}
|
|
}
|
|
Monitor.Exit(_Lock);
|
|
}
|
|
|
|
return valid;
|
|
}
|
|
}
|
|
} |