예제 #1
0
 function db_login($user, $pass)
 {
     $login = "******";
     $result = @mysql_query($login) or die('<pre>' . mysql_error() . '</pre>');
     if ($result && mysql_num_rows($result) == 1) {
         // Login Successful...
         blobMessagePush("You have logged in as '" . $user . "'");
         blobLogin($user);
         blobRedirect('index.php');
     }
 }
예제 #2
0
function blobPageStartup($pActions)
{
    if (in_array('authenticated', $pActions)) {
        if (!blobIsLoggedIn()) {
            blobRedirect(BLOB_WEB_PAGE_TO_ROOT . 'login.php');
        }
    }
    if (in_array('notauthenticated', $pActions)) {
        if (blobIsLoggedIn()) {
            blobMessagePush("You are logged in!");
            blobRedirect(BLOB_WEB_PAGE_TO_ROOT . 'index.php');
        }
    }
    if (in_array('admin', $pActions)) {
        if (!blobIsAdmin()) {
            blobMessagePush("You are not admin!");
            blobRedirect(BLOB_WEB_PAGE_TO_ROOT . 'index.php');
        }
    }
}
예제 #3
0
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
define('BLOB_WEB_PAGE_TO_ROOT', '../');
require_once BLOB_WEB_PAGE_TO_ROOT . 'blob/includes/blobPage.inc.php';
blobPageStartup(array('authenticated'));
$page = blobPageNewGrab();
blobDatabaseConnect();
$user = blobCurrentUser();
$user_id = blobGetUserID($user);
if (isset($_GET['user'])) {
    $page['title'] .= $page['title_separator'] . 'Follow User';
    $page['page_id'] = 'followuser';
    $user = $_GET['user'];
    $user = mysql_real_escape_string($user);
    // Check if the user exists
    if (!blobExistUser($user)) {
        blobMessagePush("'" . $user . "' does not exist!");
        blobRedirect('follow.php');
    }
    $fullName = blobGetUserFullName($user);
    $avatar = getAvatar($user);
    $followHTML = blobFollowUser($user);
    $profilepage = BLOB_WEB_PAGE_TO_ROOT . 'profile/view.php?user='******'body'] .= "\r\n<div class=\"body_padded\">\r\n\t<h2>Following User: {$user}</h2>\r\n\r\n\t<div class=\"vulnerable_code_area\">\r\n\t\t<div style=\"float: left; padding-right: 10px; border-right: 2px solid #C0C0C0;\">\r\n\t\t\t<img src=\"{$avatar}\" width=\"100\" />\r\n\t\t</div>\r\n\t\t<div style=\"margin-left: 120px;\">\r\n\t\t\t" . blobInternalLinkUrlGet($profilepage, $fullName) . "\r\n\t\t\t<br /><br />\r\n\t\t\t{$followHTML}\r\n\t\t\t<br /><br />\r\n\t\t</div>\r\n\t</div>\r\n\r\n\t<br />\r\n\t<b>View user's profile:</b> " . blobInternalLinkUrlGet($profilepage, $fullName) . "\r\n\t<br /><br /><br />\r\n\r\n</div>\r\n";
} else {
    $page['title'] .= $page['title_separator'] . 'User List';
    $page['page_id'] = 'othersprofile';
    $page['body'] .= "\r\n<div class=\"body_padded\">\r\n\t<h2>User List</h2>\r\n\r\n\t" . blobUserList() . "\r\n\t<br /> <br />\r\n\r\n</div>\r\n";
}
blobHtmlEcho($page);
예제 #4
0
            }
        }
    }
}
if (isset($_POST['deleteUser'])) {
    $un = $_POST['username'];
    $un = stripslashes($un);
    $un = mysql_real_escape_string($un);
    if ($un == "") {
        blobMessagePush("Please enter a User name!");
        blobRedirect(".");
    } else {
        if (!blobExistUser($un)) {
            blobMessagePush("This username does not exist!");
            blobRedirect(".");
        } else {
            if ($un == $user) {
                blobMessagePush("That's You!");
                blobRedirect(".");
            } else {
                $qry = "DELETE FROM `users` WHERE user='******';";
                $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
                blobMessagePush("User '{$un}' deleted!");
                blobRedirect('.');
            }
        }
    }
}
$userList = blobGetSiteUsers();
$page['body'] .= "\r\n<div class=\"body_padded\">\r\n\t<h2>Admin Area</h2>\r\n\r\n\t<hr><center>\r\n\t<div class=\"table-wrap\">\r\n\t<p class=\"heading\"><b>User List [+/-]</b></p>\r\n\t<div class=\"content\">\r\n\t{$userList}\r\n\t</div>\r\n\t</div>\r\n\t</center><hr>\r\n\t<br />\r\n\t<div class=\"vulnerable_code_area\">\r\n\t\t<form method=\"post\" name=\"updateuserlevel\">\r\n\t\t\t<h3>Update User level</h3>\r\n\t\t\t<label for=\"user\">Username</label> <input type=\"text\" class=\"loginInput\" style=\"width:220px;\" size=\"10\" name=\"username\">\r\n\t\t\t<span><select class=\"button\" name=\"levelNumber\"><option value=\"0\">Normal User</option><option value=\"1\">Admin</option></select></span>\r\n\t\t\t<input class=\"button\" name=\"updateLevel\" type=\"submit\" value=\"Update Level\" \">\r\n\t\t</form>\r\n\t</div>\r\n\r\n\t<div class=\"vulnerable_code_area\">\r\n\t\t<form method=\"post\" name=\"deleteUser\">\r\n\t\t\t<h3>Delete User</h3>\r\n\t\t\t<label for=\"user\">Username</label> <input type=\"text\" class=\"loginInput\" style=\"width:220px;\" size=\"10\" name=\"username\">\r\n\t\t\t<span style=\"margin-left: 20px;\"></span>\r\n\t\t\t<input class=\"button\" name=\"deleteUser\" type=\"submit\" value=\"Delete User\" \">\r\n\t\t</form>\r\n\t</div>\r\n\r\n\t<div class=\"vulnerable_code_area\">\r\n\t\t<form method=\"get\" action=\"status.php\">\r\n\t\t\t<h3>View Status</h3>\r\n\t\t\t<label for=\"user\">User ID</label> <input type=\"text\" class=\"loginInput\" style=\"width:220px;\" size=\"10\" name=\"user\">\r\n\t\t\t<span style=\"margin-left: 20px;\"></span>\r\n\t\t\t<input class=\"button\" type=\"submit\" value=\"View Status\" \">\r\n\t\t</form>\r\n\t</div>\r\n\r\n\t<div class=\"clear\"></div>\r\n\r\n\r\n\t<br />\r\n\r\n</div>\r\n";
blobHtmlEcho($page);
예제 #5
0
            }
        }
        $qry = "UPDATE `users` SET avatar='{$profUrl}' WHERE user='******';";
        $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
        blobMessagePush("Updated the new Image!");
    }
    if ($profile["fn"] != $fn || $profile["ln"] != $ln || $key_new != $key) {
        $qry = "UPDATE `users` SET first_name='{$fn}', last_name='{$ln}', sec_key='{$key_new}' WHERE user='******';";
        $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
        blobMessagePush("Profile updated");
    } else {
        blobMessagePush("Profile was not updated");
    }
    if ($pass != "") {
        $pass = stripslashes($pass);
        $pass = mysql_real_escape_string($pass);
        $pass = md5($pass);
        $qry = "UPDATE `users` SET password='******' WHERE user='******';";
        $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
        blobMessagePush("Password changed. You Need to re-login");
        blobRedirect('../logout.php');
    }
    blobRedirect('edit.php');
}
$page = blobPageNewGrab();
$page['title'] .= $page['title_separator'] . 'Edit Profile: ' . $user;
$page['page_id'] = 'editprofile';
$page['onload'] = "onLoad=\"document.form.firstname.focus()\"";
$page['script'] .= "<script language=\"javascript\">function doEnable(){ document.form.key.readOnly=false; document.form.key_edit_btn.disabled=true; }</script>";
$page['body'] .= "\r\n<div class=\"body_padded\" align=\"center\">\r\n                        <h2>Edit Profile: {$user}</h2>\r\n\r\n                        <div class=\"main_body_box\" style=\"width: 400px;\">\r\n                            <form action=\"edit.php\" name=\"form\" method=\"post\" enctype=\"multipart/form-data\">\r\n                            <input type=\"hidden\" name=\"edit.php\" value=\"edit.php\" />\r\n\r\n\t<fieldset>\r\n\t<div style=\"float: left\">\r\n\t\t\t<label for=\"firstname\">First Name <font color=\"red\">*</font></label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"firstname\" value=\"{$profile["fn"]}\"><br />\r\n\t\t\t</div>\r\n\t\t\t<div style=\"float: left\">\r\n\t\t\t<label for=\"lastname\">Last Name <font color=\"red\">*</font></label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"lastname\" value=\"{$profile["ln"]}\"><br />\r\n\t\t\t</div>\r\n\t\t\t<div style=\"float: left\">\r\n\t\t\t<label for=\"pass\">Password <font color=\"red\">(Not changed if blank)</font></label> <input type=\"password\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"password\">\r\n\t\t\t</div>\r\n\t\t\t<div style=\"float: left\">\r\n\t\t\t<label for=\"key\">Secret Key <font color=\"red\"><input type=\"button\" value=\"Edit\" name=\"key_edit_btn\" onclick=\"doEnable()\"></font></label> <input type=\"text\" readonly class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" id=\"key\" name=\"key\" value=\"{$key}\">\r\n\t\t\t</div>\r\n\t\t\t<div style=\"float: left; padding-right: 10px; border-right: 2px solid #C0C0C0;\">\r\n\t\t\t\t<img src=\"{$avatar}\" width=\"100\" />\r\n\t\t\t</div>\r\n\t\t\t<div style=\"float: left; margin-left: 120px; margin-top: -70px;\">\r\n\t\t\t\t<label for=\"pass\">Profile Image <font color=\"red\"><br />(Not changed if blank)</font></label> <br /><input type=\"file\" class=\"loginInput\" class=\"button\" name=\"file\" id=\"file\" /><br />\r\n\t\t\t</div>\r\n\t\t\t<div style=\"float: left; width: 100%;\">\r\n\t\t\t<p class=\"submit\"><input class=\"button\" type=\"submit\" value=\"Edit Profile\" name=\"EditProfile\">&nbsp;&nbsp;\r\n\t\t\t<input class=\"button\" type=\"submit\" value=\"Delete Profile\" name=\"DeleteProfile\"></p>\r\n\t\t\t</div>\r\n\t</fieldset>\r\n\r\n\t</form>\r\n\r\n                        </div>\r\n</div>\r\n\r\n";
blobHtmlEcho($page);
예제 #6
0
                blobRegMessagePush("key", $key);
            }
            blobRedirect('join.php');
        }
    }
    $qry = "INSERT INTO users (user_id, first_name, last_name, user, password, sec_key, avatar) VALUES ( 'NULL', '{$fn}', '{$ln}', '{$user}', '{$pass}', '{$key}', '{$profUrl}') ;";
    $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
    $user_id = blobGetUserID($user);
    $qry = "UPDATE `users` SET follow='{$user_id}' WHERE user='******';";
    $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
    if ($result) {
        // Registration Successful...
        blobMessagePush("You have registered as '" . $user . "'");
        blobRedirect('login.php');
    }
    // Registration failed
    blobMessagePush("Registration failed");
    blobRedirect('join.php');
}
$fn_pop = blobRegMessagePop("fn");
$ln_pop = blobRegMessagePop("ln");
$user_pop = blobRegMessagePop("user");
$pass_pop = blobRegMessagePop("pass");
$key_pop = blobRegMessagePop("key");
$page = blobPageNewGrab();
$page['title'] .= $page['title_separator'] . 'Join';
$page['page_id'] = 'join';
$page['onload'] = "onLoad=\"document.form.firstname.focus()\"";
$page['body'] .= "                    <div class=\"body_padded\" align=\"center\">\r\n                        <h2>Join Greenify</h2>\r\n\r\n                        <div class=\"main_body_box\" style=\"width: 350px;\">\r\n                            <form action=\"join.php\" name=\"form\" method=\"post\" enctype=\"multipart/form-data\">\r\n\r\n\t<fieldset>\r\n\t<div style=\"float: left\">\r\n\t\t\t<input type=\"hidden\" size=\"20\" name=\"join.php\" value=\"join.php\">\r\n\t\t\t<label for=\"firstname\">First Name <font color=\"red\">*</font></label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"firstname\" value=\"{$fn_pop}\"><br />\r\n\t\t\t<label for=\"lastname\">Last Name <font color=\"red\">*</font></label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"lastname\" value=\"{$ln_pop}\"><br />\r\n\t\t\t<label for=\"user\">Username <font color=\"red\">*</font></label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"username\" value=\"{$user_pop}\"><br />\r\n\t\t\t<label for=\"pass\">Password <font color=\"red\">*</font></label> <input type=\"password\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"password\" value=\"{$pass_pop}\"><br />\r\n\t\t\t<label for=\"user\">Secret Key <font color=\"red\">*</font> <small>Will be used during password reset</small></label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"key\" value=\"{$key_pop}\"><br />\r\n\t\t\t<label for=\"pass\">Profile Image <font color=\"red\">*</font></label> <input type=\"file\" class=\"loginInput\" class=\"button\" name=\"file\" id=\"file\" /><br />\r\n\t\t\t<p class=\"submit\"><input class=\"button\" type=\"submit\" value=\"Join\" name=\"Join\"></p>\r\n\t</div>\r\n\t</fieldset>\r\n\r\n\t</form>\r\n\r\n                        </div>\r\n</div>\r\n\r\n";
$right = "\r\n<center><b>Already have a blob account?</b><br /><br />\r\nEasy, free, and instant updates. Get access to the information that interests you most.\r\n<br><br>\r\n<div class=\"join\">\r\n<form action=\"login.php\">\r\n<input id=\"login\" value=\"Login!\" type=\"submit\">\r\n</form>\r\n</div>\r\n";
blobNoLoginHtmlEcho($page, $right);
예제 #7
0
        blobRedirect('forgot.php');
    }
    $user = stripslashes($user);
    $user = mysql_real_escape_string($user);
    $pass = stripslashes($pass);
    $pass = mysql_real_escape_string($pass);
    $key = stripslashes($key);
    $key = mysql_real_escape_string($key);
    if (blobExistUser($user)) {
        $old_key = getSecKey($user);
        if ($old_key == $key) {
            $pass = md5($pass);
            $qry = "UPDATE `users` SET password='******' WHERE user='******';";
            $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
            blobMessagePush("Password changed!");
            blobRedirect('login.php');
        } else {
            blobMessagePush("Security Key does not match!");
        }
    } else {
        blobMessagePush("This user does not exist!");
    }
    blobRedirect('forgot.php');
}
$page = blobPageNewGrab();
$page['title'] .= $page['title_separator'] . 'Forgot Password';
$page['page_id'] = 'forgotpass';
$page['onload'] = "onLoad=\"document.form.username.focus()\"";
$page['body'] .= "\r\n\t<div class=\"body_padded\" align=\"center\">\r\n\t\t<h2>Forgot Password!</h2>\r\n\t\t<div class=\"main_body_box\" style=\"width: 400px;\">\r\n\t\t\t<form action=\"forgot.php\" name=\"form\" method=\"post\" enctype=\"multipart/form-data\"> <fieldset>\r\n\t\t\t<input type=\"hidden\" name=\"forgot.php\" value=\"forgot.php\" />\r\n\t\t\t\t<div style=\"float: left\">\r\n\t\t\t\t\t<label for=\"username\">User Name <font color=\"red\">*</font></label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"username\" value=\"\"><br />\r\n\t\t\t\t</div>\r\n\t\t\t\t<div style=\"float: left\">\r\n\t\t\t\t\t<label for=\"pass\">New Password <font color=\"red\">*</font></label> <input type=\"password\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"password\">\r\n\t\t\t\t</div>\r\n\t\t\t\t<div style=\"float: left\">\r\n\t\t\t\t\t<label for=\"key\">Secret Key <font color=\"red\">*</font></label> <input type=\"text\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"key\">\r\n\t\t\t\t</div>\r\n\t\t\t\t<div style=\"float: left; width: 100%;\">\r\n\t\t\t\t\t<p class=\"submit\"><input class=\"button\" type=\"submit\" value=\"Change Password\" name=\"EditPassword\"></p>\r\n\t\t\t\t</div>\r\n\t\t\t</fieldset> </form>\r\n\t\t</div>\r\n\t</div>";
$right = "\r\n<center><strong>New to blob?</strong></center>\r\n<br />\r\n<div class=\"join\">\r\n<form action=\"register.php\">\r\n<input id=\"join\" value=\"Join!\" type=\"submit\">\r\n</form>\r\n</div><br />\r\n<center><b>Already have a blob account?</b><br /><br />\r\n<div class=\"join\">\r\n<form action=\"login.php\">\r\n<input id=\"login\" value=\"Login!\" type=\"submit\">\r\n</form>\r\n</div>\r\n<br /><br />Easy, free, and instant updates. Get access to the information that interests you most.\r\n";
blobNoLoginHtmlEcho($page, $right);
예제 #8
0
 * blob is a micro-blogging service where you can share notices
 * about yourself with friends, family, and colleagues!
 *
 * Copyright (C) 2011  Avinash Joshi <*****@*****.**>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
define('BLOB_WEB_PAGE_TO_ROOT', '');
require_once BLOB_WEB_PAGE_TO_ROOT . 'blob/includes/blobPage.inc.php';
if (!blobIsLoggedIn()) {
    // The user shouldn't even be on this page
    //	blobMessagePush( "You were not logged in!!" );
    blobRedirect('login.php');
}
blobLogout();
blobMessagePush("You have logged out");
blobRedirect('login.php');
?>

예제 #9
0
    $user = $_POST['username'];
    $user = stripslashes($user);
    $user = mysql_real_escape_string($user);
    $pass = $_POST['password'];
    $pass = stripslashes($pass);
    $pass = mysql_real_escape_string($pass);
    $pass = md5($pass);
    $qry = "SELECT * FROM `users` WHERE user='******' AND password='******';";
    $result = @mysql_query($qry) or die('<pre>' . mysql_error() . '</pre>');
    if ($result && mysql_num_rows($result) == 1) {
        // Login Successful...
        blobMessagePush("You have logged in as '" . $user . "'");
        blobLogin($user);
        $row = mysql_fetch_assoc($result);
        if ($row["isadmin"] == "1") {
            blobAdminLogin();
        }
        blobRedirect('index.php');
    }
    // Login failed
    blobMessagePush("Login failed");
    blobRedirect('login.php');
}
$forgotUrl = BLOB_WEB_PAGE_TO_ROOT . "forgot.php";
$page = blobPageNewGrab();
$page['title'] .= $page['title_separator'] . 'Login';
$page['page_id'] = 'login';
$page['onload'] = "onLoad=\"document.form.username.focus()\"";
$page['body'] .= "\r\n\t<div class=\"body_padded\" align=\"center\">\r\n\t\t<h2>Login</h2>\r\n\r\n\t\t<div class=\"main_body_box\" style=\"width: 350px;\">\r\n\t\t\t<form action=\"login.php\" method=\"post\" name=\"form\"> <fieldset>\r\n\t\t\t<input type=\"hidden\" name=\"login.php\" value=\"login.php\" />\r\n\t\t\t\t<div style=\"float: left\">\r\n\t\t\t\t\t<label for=\"user\">Username</label> <input type=\"text\" class=\"loginInput\" size=\"20\" name=\"username\"><br />\r\n\t\t\t\t\t<label for=\"pass\">Password</label> <input type=\"password\" class=\"loginInput\" AUTOCOMPLETE=\"off\" size=\"20\" name=\"password\"><br />\r\n\r\n\t\t\t\t\t<p align=\"center\"><input class=\"button\" type=\"submit\" value=\"Login\" name=\"Login\">\r\n\t\t\t\t\t<span style=\"margin-left: 10px;\"></span><input class=\"button\" name=\"forgot\" type=\"button\" value=\"Forgot Password?\" onclick=\"window.location='{$forgotUrl}'\"></p>\r\n\t\t\t\t</div>\r\n\t\t\t</fieldset> </form>\r\n\t\t</div>\r\n\t</div>";
$right = "\r\n<center><b>New to Greenify?</b><br>\r\nEasy, free, and instant updates. Get access to the information that interests you most.\r\n<br><br><strong>Create Your Account</strong></center>\r\n<br />\r\n<div class=\"join\">\r\n<form action=\"join.php\">\r\n<input id=\"join\" value=\"Join!\" type=\"submit\">\r\n</form>\r\n</div>";
blobNoLoginHtmlEcho($page, $right);
예제 #10
0
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
define('BLOB_WEB_PAGE_TO_ROOT', '../');
require_once BLOB_WEB_PAGE_TO_ROOT . 'blob/includes/blobPage.inc.php';
blobPageStartup(array('authenticated', 'admin'));
$page = blobPageNewGrab();
$page['title'] .= $page['title_separator'] . 'View Status of users';
$page['page_id'] = 'viewstatus';
blobDatabaseConnect();
$user = blobCurrentUser();
if (isset($_GET['user'])) {
    $user_id = $_GET['user'];
}
$user = blobGetUserName($user_id);
// Check if the user exists
if (!blobExistUser($user)) {
    blobMessagePush("Sorry, but user does not exist!");
}
$fullName = blobGetUserFullName($user);
$avatar = getAvatar($user);
$showStatusHTML = blobShowUserStatusbyID($user_id);
$page['body'] .= "\r\n<div class=\"body_padded\">\r\n\t<h2>User Profile: {$user}</h2>\r\n\r\n\t<div class=\"vulnerable_code_area\">\r\n\t\t<div style=\"float: left; padding-right: 10px; border-right: 2px solid #C0C0C0;\">\r\n\t\t\t<img src=\"{$avatar}\" width=\"100\" />\r\n\t\t</div>\r\n\t\t<div style=\"margin-left: 120px;\">\r\n\t\t\t{$fullName}\r\n\t\t</div>\r\n\t</div>\r\n\r\n\t<div class=\"clear\"></div>\r\n\t<pre>User's status updates:</pre>\r\n\t{$showStatusHTML}\r\n\t<br /><br /><br />\r\n\r\n</div>\r\n";
blobHtmlEcho($page);
예제 #11
0
require_once BLOB_WEB_PAGE_TO_ROOT . 'blob/includes/blobPage.inc.php';
blobPageStartup(array('authenticated'));
$page = blobPageNewGrab();
$page['title'] .= $page['title_separator'] . 'What\'s on your mind?';
$page['page_id'] = 'home';
$page['onload'] = "onLoad=\"document.statusupdate.statusMsg.focus()\"";
blobDatabaseConnect();
$user = blobCurrentUser();
$user_id = blobGetUserID($user);
if (isset($_POST['btnUpdate'])) {
    if ($_POST['statusMsg'] == "") {
        blobMessagePush("Status cannot be empty!");
        blobRedirect('index.php');
    }
    $message = trim($_POST['statusMsg']);
    // Sanitize message input
    $message = stripslashes($message);
    $message = mysql_real_escape_string($message);
    // Sanitize name input
    $name = mysql_real_escape_string($name);
    $query = "INSERT INTO status (user_id, status, date_set) VALUES ('{$user_id}','{$message}', NOW());";
    $result = mysql_query($query) or die('<pre>' . mysql_error() . '</pre>');
}
if (isset($_GET['delete'])) {
    $status_id = $_GET['delete'];
    $status = blobDeleteStatus($status_id);
    blobMessagePush($status);
    blobRedirect('index.php');
}
$page['body'] .= "\r\n\t<div class=\"body_padded\">\r\n\t\t<h2>What's on your mind?</h2>\r\n\t\t<div class=\"vulnerable_code_area\">\r\n\t\t\t<form method=\"post\" name=\"statusupdate\">\r\n\t\t\t\t<input type=\"hidden\" name=\"index.php\" value=\"index.php\" />\r\n\t\t\t\t<table width=\"550\" border=\"0\" cellpadding=\"2\" cellspacing=\"1\">\r\n\t\t\t\t\t<tr>\r\n\t\t\t\t\t\t<td><textarea style=\"padding: 5px;\" name=\"statusMsg\" cols=\"60\" rows=\"3\" maxlength=\"140\"></textarea></td>\r\n\t\t\t\t\t</tr>\r\n\t\t\t\t\t<tr>\r\n\t\t\t\t\t\t<td><input class=\"button\" name=\"btnUpdate\" type=\"submit\" value=\"Update Status\" > ( Max 140 characters )</td>\r\n\t\t\t\t\t</tr>\r\n\t\t\t\t</table>\r\n\t\t\t</form>\r\n\t\t</div>\r\n\t\t<div class=\"clear\"></div>\r\n\t\t<pre>Your previous status updates:</pre>\r\n\t\t" . blobShowUserStatus($user) . "\r\n\t\t<br />\r\n\t</div>";
blobHtmlEcho($page);
예제 #12
0
if (!@mysql_query($drop_db)) {
    blobMessagePush("Could not drop existing database<br />SQL: " . mysql_error());
    blobPageReload();
}
$create_db = "CREATE DATABASE `blob`;";
if (!@mysql_query($create_db)) {
    blobMessagePush("Could not create database<br />SQL: " . mysql_error());
    blobPageReload();
}
blobMessagePush("Database has been created.");
// Create table 'users'
if (!@mysql_select_db($_BLOB['db_database'])) {
    blobMessagePush('Could not connect to database.');
    blobPageReload();
}
$create_tb = "CREATE TABLE users (user_id int(6) AUTO_INCREMENT,first_name varchar(15),last_name varchar(15), user varchar(20), password varchar(32), sec_key varchar(255) NOT NULL, follow text NOT NULL, isadmin int(1) DEFAULT '0' NOT NULL, avatar varchar(70), PRIMARY KEY (user_id)) ENGINE = InnoDB;";
if (!mysql_query($create_tb)) {
    blobMessagePush("Table could not be created<br />SQL: " . mysql_error());
    blobPageReload();
}
blobMessagePush("'users' table was created.");
//Cerate status table
$create_tb_status = "CREATE TABLE status (status_id mediumint(10) unsigned NOT NULL AUTO_INCREMENT, user_id int(6), status varchar(150) NOT NULL, date_set datetime NOT NULL, PRIMARY KEY (status_id), INDEX(user_id), FOREIGN KEY (user_id) REFERENCES users(user_id) on update cascade on delete cascade ) ENGINE = InnoDB;";
if (!mysql_query($create_tb_status)) {
    blobMessagePush("Table could not be created<br />SQL: " . mysql_error());
    blobPageReload();
}
blobMessagePush("'status' table was created.");
//Setup complete and successful
blobMessagePush("Setup successful!");
blobPageReload();