Check if login was successful

[z1089]

Hello.
How to find out that logging in succeed?

$sock->set_login($username,$pass);

 

[zEitEr]

Hello,

You should send your request to any API page and check output.

 

[z1089]

Thanks for answer but which request should i use in user level? Using for example CMD_API_SHOW_DOMAINS i got same output when password isn't correct as when user doesn't have any domains.

 

[zEitEr]

Are you sure? And how many accounts do you have without domains? Normally a user account has at least 1 domain.

 

[z1089]

Yes, in both cases i've got an empty output. I need user authentication that works every time.

Using CMD_API_SUBDOMAINS with correct password i've got error "Unable to show subdomains" but with incorrect password i've got an empty output. Could you tell me is it good idea to use it as the only user authentication? After this authentication i would store his username in session to use it by user with my reseller account and login as feature.

Thanks again for your help.

 

[zEitEr]

Using CMD_API_SUBDOMAINS with correct password i've got error "Unable to show subdomains" but with incorrect password i've got an empty output.

That's not a good idea to use CMD_API_SUBDOMAINS.

Using for example CMD_API_SHOW_DOMAINS i got same output when password isn't correct as when user doesn't have any domains.

Then your code is incorrect I'd rather say, or try to authenticate as admin/reseller. For CMD_API_SHOW_DOMAINS you should use user-level credentials. Without a proper authentication a result would be a HTML code of a login page. If even a user ha no domains a result would be epmty array with a single key: "list". This is the code I use just now for a test:

<?php
include_once('httpsocket.php');
$server_ip="127.0.0.1";
$server_login="userbob";
$server_pass="SECRET_PASS";
$server_host="127.0.0.1"; 
$server_ssl=true;
$server_port="2222";
$sock = new HTTPSocket;
if ($server_ssl) {    
    $sock->connect("ssl://".$server_host, $server_port);
} else {
    $sock->connect($server_host, $server_port);
}
$sock->set_login($server_login,$server_pass);
$sock->query('/CMD_API_SHOW_DOMAINS',array());
$result = $sock->fetch_parsed_body();
var_dump($result);

if user has at least one domain it will show:

array(1) {
  ["list"]=>
  array(1) {
    [0]=>
    string(8) "domain.com"
  }
}

if I try to use admin's (or reseller's) password I got this:

array(0) {
}

 

[z1089]

Could you tell me is it secure to validate output like this:

    if(isset($result) && empty($result) || !empty($result['list'])){
        echo "logged in";
    }
    else{
        echo "not logged in";
    }

Thanks.

 

[z1089]

I've also added user level check using CMD_API_SHOW_USERS. It seems to work but i'm not sure is it secure.

    if(isset($result) && empty($result) || !empty($result['list'])){
        echo "logged in";
        
                 $sock->query('/CMD_API_SHOW_USERS');
                 $result = $sock->fetch_parsed_body();
                 if(isset($result) && empty($result) || !empty($result['list'])){
                 echo "reseller";

                 
                }
                 else{
                echo "not reseller";
                }

    }
    else{
        echo "not logged in";
    }

 

[zEitEr]

Could you tell me is it secure to validate output like this:

    if(isset($result) && empty($result) || !empty($result['list'])){
        echo "logged in";
    }
    else{
        echo "not logged in";
    }

Thanks.

If you are going to check

$result = $sock->fetch_parsed_body();

the way you suggested, then it's a bad idea. The variable $result is set and exists, and may be empty for a number of other reasons as well as because of a failed connection to a server.

 

[z1089]

So user has to have any domain in order to make it safe?

 

[zEitEr]

Success Returns	url encoded array in list[]
Failure Returns	Nothing to break here. No domains returns empty list

http://directadmin.com/api.html#user_apis

 

[z1089]

No domains returns:

array(0) { }

I've used your code for testing.

 

[zEitEr]

If I try to use admin's (or reseller's) password I got this:

array(0) {
}

as well.

 

[z1089]

I'm getting this after try to login as normal user (not admin or reseller) with correct password when user has no domains.

 

[zEitEr]

Add a domain then to the user account.

 

[z1089]

I would have to forbid from deleting last domain or add hidden domain when user decides to delete last one. I'm thinking about using this:

   $sock->query('/CMD_API_DOMAIN',
     array(
  'action' => 'create',
  'domain' => '',
  'ubandwidth' => 'unlimited',
  'uquota' => 'unlimited',
  'ssl' => 'OFF',
  'cgi' => 'ON',
  'php' => 'ON'      

));

and then:

if(!empty($result['details'])){
//logged in
}

Is it possible to receive not empty $result['details'] when password is incorrect?