function session_pagestart($user_ip, $thispage_id) { global $db, $lang, $board_config; global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID; $cookiename = $board_config['cookie_name']; $cookiepath = $board_config['cookie_path']; $cookiedomain = $board_config['cookie_domain']; $cookiesecure = $board_config['cookie_secure']; $current_time = time(); unset($userdata); if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) { $sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array(); $session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : ''; $sessionmethod = SESSION_METHOD_COOKIE; } else { $sessiondata = array(); $session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : ''; $sessionmethod = SESSION_METHOD_GET; } // if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) { $session_id = ''; } $thispage_id = (int) $thispage_id; // // Does a session exist? // if (!empty($session_id)) { // // session_id exists so go ahead and attempt to grab all // data in preparation // $sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id"; if (!($result = $db->sql_query($sql))) { message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql); } $userdata = $db->sql_fetchrow($result); // // Did the session exist in the DB? // if (isset($userdata['user_id'])) { // Added by FAI // Find Public Whip user id $logged_into_pw = user_isloggedin(); global $user_name; // Look it up in PHPBB user account list $result = $db->sql_query("select user_id from phpbb_users where username = '******'"); if ($result) { $row = $db->sql_fetchrow($result); $user_id_for_phpbb = $row['user_id']; } $url = !empty($HTTP_POST_VARS['redirect']) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : str_replace("/forum/", "", $_SERVER['REQUEST_URI']); if ($logged_into_pw) { // If user id is wrong, log into it if ($user_id_for_phpbb && $user_id_for_phpbb != $userdata['user_id']) { if ($userdata['user_id'] > 0) { session_end($userdata['session_id'], $userdata['user_id']); redirect(append_sid($url, true)); } $session_id = session_begin($user_id_for_phpbb, $user_ip, PAGE_INDEX, FALSE, TRUE); redirect(append_sid($url, true)); exit; } // Otherwise make new account if (!$user_id_for_phpbb) { // Log out first if logged in if ($userdata['user_id'] > 0) { session_end($userdata['session_id'], $userdata['user_id']); redirect(append_sid($url, true)); exit; } $sql = "SELECT MAX(user_id) AS total FROM " . USERS_TABLE; if (!($result = $db->sql_query($sql))) { message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql); } if (!($row = $db->sql_fetchrow($result))) { message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql); } $user_id = $row['total'] + 1; $notifyreply = 1; $sql = "INSERT INTO " . USERS_TABLE . "\t \nVALUES ('" . mysql_escape_string($user_id) . "',1,'" . mysql_escape_string($user_name) . "','NEVER***',0,0,0," . time() . ",0,0,0.00,1,'english','D M d, Y g:i a',0,0,0,NULL,0,1,1,1,1,1,1,1,1,1,1,0,'',0,'" . mysql_escape_string(user_getemail()) . "','','','','','','','','','','','',NULL,0,0)"; /* VALUES ($user_id, '" . str_replace("\'", "''", $user_name) . "', " . time() . ", '" . str_replace("\'", "''", "NOT VALID ***") . "', '" . str_replace("\'", "''", user_getemail()) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, "; */ if (!($result = $db->sql_query($sql, BEGIN_TRANSACTION))) { message_die(GENERAL_ERROR, 'Could not insert data into users table', '', __LINE__, __FILE__, $sql); } $sql = "INSERT INTO " . GROUPS_TABLE . " (group_name, group_description, group_single_user, group_moderator)\n\t\t\t\tVALUES ('', 'Personal User', 1, 0)"; if (!($result = $db->sql_query($sql))) { message_die(GENERAL_ERROR, 'Could not insert data into groups table', '', __LINE__, __FILE__, $sql); } $group_id = $db->sql_nextid(); $sql = "INSERT INTO " . USER_GROUP_TABLE . " (user_id, group_id, user_pending)\n\t\t\t\tVALUES ({$user_id}, {$group_id}, 0)"; if (!($result = $db->sql_query($sql, END_TRANSACTION))) { message_die(GENERAL_ERROR, 'Could not insert data into user_group table', '', __LINE__, __FILE__, $sql); } $session_id = session_begin($user_id, $user_ip, PAGE_INDEX, FALSE, TRUE); redirect(append_sid($url, true)); exit; } } else { if ($userdata['user_id'] > 0) { session_end($userdata['session_id'], $userdata['user_id']); redirect(append_sid($url, true)); exit; } } // End added by FAI // // Do not check IP assuming equivalence, if IPv4 we'll check only first 24 // bits ... I've been told (by vHiker) this should alleviate problems with // load balanced et al proxies while retaining some reliance on IP security. // $ip_check_s = substr($userdata['session_ip'], 0, 6); $ip_check_u = substr($user_ip, 0, 6); if ($ip_check_s == $ip_check_u) { $SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : ''; // // Only update session DB a minute or so after last update // if ($current_time - $userdata['session_time'] > 60) { // A little trick to reset session_admin on session re-usage $update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : ''; $sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'"; if (!$db->sql_query($sql)) { message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql); } if ($userdata['user_id'] != ANONYMOUS) { $sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id']; if (!$db->sql_query($sql)) { message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql); } } session_clean($userdata['session_id']); setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure); setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure); } // Add the session_key to the userdata array if it is set if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') { $userdata['session_key'] = $sessiondata['autologinid']; } return $userdata; } } } // // If we reach here then no (valid) session exists. So we'll create a new one, // using the cookie user_id if available to pull basic user prefs. // $user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS; if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) { message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql); } return $userdata; }
function session_pagestart($user_ip, $thispage_id) { global $db, $lang, $board_config; global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID; $cookiename = $board_config['cookie_name']; $cookiepath = $board_config['cookie_path']; $cookiedomain = $board_config['cookie_domain']; $cookiesecure = $board_config['cookie_secure']; $current_time = time(); unset($userdata); if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) { $sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array(); $session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : ''; $sessionmethod = SESSION_METHOD_COOKIE; } else { $sessiondata = array(); $session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : ''; $sessionmethod = SESSION_METHOD_GET; } // if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) { $session_id = ''; } $thispage_id = (int) $thispage_id; // // Does a session exist? // if (!empty($session_id)) { // // session_id exists so go ahead and attempt to grab all // data in preparation // $sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id"; if (!($result = $db->sql_query($sql))) { message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql); } $userdata = $db->sql_fetchrow($result); // // Did the session exist in the DB? // if (isset($userdata['user_id'])) { // // Do not check IP assuming equivalence, if IPv4 we'll check only first 24 // bits ... I've been told (by vHiker) this should alleviate problems with // load balanced et al proxies while retaining some reliance on IP security. // $ip_check_s = substr($userdata['session_ip'], 0, 6); $ip_check_u = substr($user_ip, 0, 6); if ($ip_check_s == $ip_check_u) { $SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : ''; // // Only update session DB a minute or so after last update // if ($current_time - $userdata['session_time'] > 60) { // A little trick to reset session_admin on session re-usage $update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : ''; $sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin} \n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'"; if (!$db->sql_query($sql)) { message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql); } if ($userdata['user_id'] != ANONYMOUS) { $sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id} \n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id']; if (!$db->sql_query($sql)) { message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql); } } session_clean($userdata['session_id']); setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure); setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure); } // Add the session_key to the userdata array if it is set if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') { $userdata['session_key'] = $sessiondata['autologinid']; } return $userdata; } } } // // If we reach here then no (valid) session exists. So we'll create a new one, // using the cookie user_id if available to pull basic user prefs. // $user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS; if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) { message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql); } return $userdata; }
/** * Validate the legitimacy of a session. * Checks may include last-known IP address, or more. * Triggers an error when the session is invalid. * @param object Session object */ function session_validate( $p_session ) { $t_user_ip = ''; if ( isset( $_SERVER['REMOTE_ADDR'] ) ) { $t_user_ip = trim( $_SERVER['REMOTE_ADDR'] ); } if ( is_null( $t_last_ip = $p_session->get( 'last_ip', null ) ) ) { # First session usage $p_session->set( 'last_ip', $t_user_ip ); } else { # Check a continued session request if ( $t_user_ip != $t_last_ip ) { session_clean(); trigger_error( ERROR_SESSION_NOT_VALID, WARNING ); $t_url = config_get_global( 'path' ) . config_get_global( 'default_home_page' ); echo "\t<meta http-equiv=\"Refresh\" content=\"4;URL=$t_url\" />\n"; die(); } } }
/** * Logout the current user and remove any remaining cookies from their browser * Returns true on success, false otherwise * @access public */ function auth_logout() { global $g_cache_current_user_id, $g_cache_cookie_valid; # clear cached userid user_clear_cache($g_cache_current_user_id); $g_cache_current_user_id = null; $g_cache_cookie_valid = null; # clear cookies, if they were set if (auth_clear_cookies()) { helper_clear_pref_cookies(); } if (HTTP_AUTH == config_get('login_method')) { auth_http_set_logout_pending(true); } session_clean(); }
#provides db credentials //Feed.php to be used to store session data include 'Feed.php'; $config->titleTag = smartTitle(); #Fills <title> tag. If left empty will fallback to $config->titleTag in config_inc.php $config->metaDescription = smartTitle() . ' - ' . $config->metaDescription; if (isset($_GET['id']) && (int) $_GET['id'] > 0) { //good data, process $id = (int) $_GET['id']; } else { //bad data, don't process //this is redirection in PHP: header('Location:index.php'); } //clean out session if older than 10 minutes session_clean(600); //END CONFIG AREA ---------------------------------------------------------- get_header(); #defaults to header_inc.php #SQL statement $sql = 'select * from Category as c inner join Subcategory as s on c.CategoryID = s.CategoryID where s.SubcategoryID=' . $id; #IDB::conn() creates a shareable database connection via a singleton class $result = mysqli_query(IDB::conn(), $sql) or die(trigger_error(mysqli_error(IDB::conn()), E_USER_ERROR)); if (mysqli_num_rows($result) > 0) { #there are records - present data while ($row = mysqli_fetch_assoc($result)) { # pull data from associative array //take category and subcategory then turn into string with "+" between each word for google news query $querySplit = explode(" ", $row['CategoryTitle'] . ' ' . $row['SubcategoryTitle']); $query = implode("+", $querySplit); $subCatDescp = $row['SubcategoryDescription'];
function auth_logout() { global $g_cache_current_user_id; # clear cached userid $g_cache_current_user_id = null; # clear cookies, if they were set if (auth_clear_cookies()) { helper_clear_pref_cookies(); } session_clean(); return true; }
#Length of time in hours a session is allowed to be //END CONFIG AREA ---------------------------------------------------------- $collection_seconds = $collection_duration * 3600; #multiply hours x 3600 seconds/hour $access = "developer"; #admin or higher level can view this page include_once INCLUDE_PATH . 'admin_only_inc.php'; #session protected page - level is defined in $access var get_header(); #defaults to header_inc.php ?> <div align="center"><h3>Clean Session Data</h3></div> <p>This page will attempt to clear any session data that is more than <b><?php echo $collection_duration; ?> </b> hours old.</p> <p>The number of sessions successfully cleared out will be identified below.</p> <p>If there is no session data older than <b><?php echo $collection_duration; ?> </b> hours, a message will be generated that zero sessions were cleared.</p> <p>This page will only work if sessions are being stored currently in your database instead of the file system.</p> <?php startSession(); #DB requires session started $cleaned = session_clean($collection_seconds); #forces clearing of old sessions echo '<p align="center"><b>' . $cleaned . '</b> sessions cleaned! (eliminated from database)</p>'; echo '<div align="center"><a href="' . $config->adminDashboard . '">Exit To Admin</a></div>'; get_footer(); #defaults to footer_inc.php
function session_pagestart($user_ip, $thispage_id) { global $db, $lang, $board_config; global $SID; $cookiename = $board_config['cookie_name']; $cookiepath = $board_config['cookie_path']; $cookiedomain = $board_config['cookie_domain']; $cookiesecure = $board_config['cookie_secure']; $current_time = time(); unset($userdata); if (isset($_COOKIE[$cookiename . '_sid']) || isset($_COOKIE[$cookiename . '_data'])) { $sessiondata = isset($_COOKIE[$cookiename . '_data']) ? unserialize(stripslashes($_COOKIE[$cookiename . '_data'])) : array(); $session_id = isset($_COOKIE[$cookiename . '_sid']) ? $_COOKIE[$cookiename . '_sid'] : ''; $sessionmethod = SESSION_METHOD_COOKIE; } else { $sessiondata = array(); $session_id = isset($_GET['sid']) ? $_GET['sid'] : ''; $sessionmethod = SESSION_METHOD_GET; } // if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) { $session_id = ''; } $thispage_id = (int) $thispage_id; // // Does a session exist? // if (!empty($session_id)) { // // session_id exists so go ahead and attempt to grab all // data in preparation // $sql = "SELECT u.*, s.*\n FROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n WHERE s.session_id = '{$session_id}'\n AND u.user_id = s.session_user_id"; if (!($result = $db->sql_query($sql))) { message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql); } $userdata = $db->sql_fetchrow($result); // // Did the session exist in the DB? // if (isset($userdata['user_id'])) { // Begin PNphpBB2 Module // OK we found a session, now determine if it should be logged in or not // Fix by Allan (Poster on PNphpBB.com) /* Adsense interferes with PNphpBB2 session handling. * Adsense agent scans the page to find relevant words * and appears as an anonymous user, forcing the expire * of the session. */ $is_adsense = isset($_SERVER['HTTP_USER_AGENT']) && strstr($_SERVER['HTTP_USER_AGENT'], 'Google'); if (!UserUtil::isLoggedIn() && $userdata['user_id'] != ANONYMOUS && !$is_adsense) { // PN user not logged in so this session should not be logged in. session_end($userdata['session_id'], $userdata['user_id']); unset($sessiondata['userid']); if (!($userdata = session_begin(ANONYMOUS, $user_ip, $thispage_id, FALSE))) { message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql); } init_userprefs($userdata); return $userdata; } if (UserUtil::isLoggedIn() && $userdata['user_id'] != UserUtil::getVar('uid')) { // PN user not logged in so this session should not be logged in. session_end($userdata['session_id'], $userdata['user_id']); if (!($userdata = session_begin(UserUtil::getVar('uid'), $user_ip, $thispage_id, FALSE))) { message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql); } } // End PNphpBB2 Module // // Do not check IP assuming equivalence, if IPv4 we'll check only first 24 // bits ... I've been told (by vHiker) this should alleviate problems with // load balanced et al proxies while retaining some reliance on IP security. // $ip_check_s = substr($userdata['session_ip'], 0, 6); $ip_check_u = substr($user_ip, 0, 6); if ($ip_check_s == $ip_check_u) { $SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : ''; // // Only update session DB a minute or so after last update // if ($current_time - $userdata['session_time'] > 60) { // A little trick to reset session_admin on session re-usage // Begin PNphpBB2 Module // $update_admin = (!defined('IN_ADMIN') && $current_time - $userdata['session_time'] > ($board_config['session_length']+60)) ? ', session_admin = 0' : ''; // End PNphpBB2 Module $sql = "UPDATE " . SESSIONS_TABLE . " \n SET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n WHERE session_id = '" . $userdata['session_id'] . "'"; if (!$db->sql_query($sql)) { message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql); } if ($userdata['user_id'] != ANONYMOUS) { $sql = "UPDATE " . USERS_TABLE . " \n SET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n WHERE user_id = " . $userdata['user_id']; if (!$db->sql_query($sql)) { message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql); } } session_clean($userdata['session_id']); setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure); setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure); } // Add the session_key to the userdata array if it is set if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') { $userdata['session_key'] = $sessiondata['autologinid']; } return $userdata; } } } // // If we reach here then no (valid) session exists. So we'll create a new one, // using the cookie user_id if available to pull basic user prefs. // $user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS; if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) { message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql); } return $userdata; }