Exemplo n.º 1
1
function session_pagestart($user_ip, $thispage_id)
{
    global $db, $lang, $board_config;
    global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
    $cookiename = $board_config['cookie_name'];
    $cookiepath = $board_config['cookie_path'];
    $cookiedomain = $board_config['cookie_domain'];
    $cookiesecure = $board_config['cookie_secure'];
    $current_time = time();
    unset($userdata);
    if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
        $sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();
        $session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
        $sessionmethod = SESSION_METHOD_COOKIE;
    } else {
        $sessiondata = array();
        $session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
        $sessionmethod = SESSION_METHOD_GET;
    }
    //
    if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
        $session_id = '';
    }
    $thispage_id = (int) $thispage_id;
    //
    // Does a session exist?
    //
    if (!empty($session_id)) {
        //
        // session_id exists so go ahead and attempt to grab all
        // data in preparation
        //
        $sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id";
        if (!($result = $db->sql_query($sql))) {
            message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
        }
        $userdata = $db->sql_fetchrow($result);
        //
        // Did the session exist in the DB?
        //
        if (isset($userdata['user_id'])) {
            // Added by FAI
            // Find Public Whip user id
            $logged_into_pw = user_isloggedin();
            global $user_name;
            // Look it up in PHPBB user account list
            $result = $db->sql_query("select user_id from phpbb_users where username = '******'");
            if ($result) {
                $row = $db->sql_fetchrow($result);
                $user_id_for_phpbb = $row['user_id'];
            }
            $url = !empty($HTTP_POST_VARS['redirect']) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : str_replace("/forum/", "", $_SERVER['REQUEST_URI']);
            if ($logged_into_pw) {
                // If user id is wrong, log into it
                if ($user_id_for_phpbb && $user_id_for_phpbb != $userdata['user_id']) {
                    if ($userdata['user_id'] > 0) {
                        session_end($userdata['session_id'], $userdata['user_id']);
                        redirect(append_sid($url, true));
                    }
                    $session_id = session_begin($user_id_for_phpbb, $user_ip, PAGE_INDEX, FALSE, TRUE);
                    redirect(append_sid($url, true));
                    exit;
                }
                // Otherwise make new account
                if (!$user_id_for_phpbb) {
                    // Log out first if logged in
                    if ($userdata['user_id'] > 0) {
                        session_end($userdata['session_id'], $userdata['user_id']);
                        redirect(append_sid($url, true));
                        exit;
                    }
                    $sql = "SELECT MAX(user_id) AS total FROM " . USERS_TABLE;
                    if (!($result = $db->sql_query($sql))) {
                        message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
                    }
                    if (!($row = $db->sql_fetchrow($result))) {
                        message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
                    }
                    $user_id = $row['total'] + 1;
                    $notifyreply = 1;
                    $sql = "INSERT INTO " . USERS_TABLE . "\t \nVALUES ('" . mysql_escape_string($user_id) . "',1,'" . mysql_escape_string($user_name) . "','NEVER***',0,0,0," . time() . ",0,0,0.00,1,'english','D M d, Y g:i a',0,0,0,NULL,0,1,1,1,1,1,1,1,1,1,1,0,'',0,'" . mysql_escape_string(user_getemail()) . "','','','','','','','','','','','',NULL,0,0)";
                    /*				VALUES ($user_id, '" . str_replace("\'", "''", $user_name) . "', " . time() . ", '" . str_replace("\'", "''", "NOT VALID ***") . "', '" . str_replace("\'", "''", user_getemail()) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, ";
                    */
                    if (!($result = $db->sql_query($sql, BEGIN_TRANSACTION))) {
                        message_die(GENERAL_ERROR, 'Could not insert data into users table', '', __LINE__, __FILE__, $sql);
                    }
                    $sql = "INSERT INTO " . GROUPS_TABLE . " (group_name, group_description, group_single_user, group_moderator)\n\t\t\t\tVALUES ('', 'Personal User', 1, 0)";
                    if (!($result = $db->sql_query($sql))) {
                        message_die(GENERAL_ERROR, 'Could not insert data into groups table', '', __LINE__, __FILE__, $sql);
                    }
                    $group_id = $db->sql_nextid();
                    $sql = "INSERT INTO " . USER_GROUP_TABLE . " (user_id, group_id, user_pending)\n\t\t\t\tVALUES ({$user_id}, {$group_id}, 0)";
                    if (!($result = $db->sql_query($sql, END_TRANSACTION))) {
                        message_die(GENERAL_ERROR, 'Could not insert data into user_group table', '', __LINE__, __FILE__, $sql);
                    }
                    $session_id = session_begin($user_id, $user_ip, PAGE_INDEX, FALSE, TRUE);
                    redirect(append_sid($url, true));
                    exit;
                }
            } else {
                if ($userdata['user_id'] > 0) {
                    session_end($userdata['session_id'], $userdata['user_id']);
                    redirect(append_sid($url, true));
                    exit;
                }
            }
            // End added by FAI
            //
            // Do not check IP assuming equivalence, if IPv4 we'll check only first 24
            // bits ... I've been told (by vHiker) this should alleviate problems with
            // load balanced et al proxies while retaining some reliance on IP security.
            //
            $ip_check_s = substr($userdata['session_ip'], 0, 6);
            $ip_check_u = substr($user_ip, 0, 6);
            if ($ip_check_s == $ip_check_u) {
                $SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
                //
                // Only update session DB a minute or so after last update
                //
                if ($current_time - $userdata['session_time'] > 60) {
                    // A little trick to reset session_admin on session re-usage
                    $update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : '';
                    $sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
                    if (!$db->sql_query($sql)) {
                        message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                    }
                    if ($userdata['user_id'] != ANONYMOUS) {
                        $sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
                        if (!$db->sql_query($sql)) {
                            message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                        }
                    }
                    session_clean($userdata['session_id']);
                    setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
                    setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
                }
                // Add the session_key to the userdata array if it is set
                if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
                    $userdata['session_key'] = $sessiondata['autologinid'];
                }
                return $userdata;
            }
        }
    }
    //
    // If we reach here then no (valid) session exists. So we'll create a new one,
    // using the cookie user_id if available to pull basic user prefs.
    //
    $user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
    if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
        message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
    }
    return $userdata;
}
Exemplo n.º 2
0
function session_pagestart($user_ip, $thispage_id)
{
    global $db, $lang, $board_config;
    global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
    $cookiename = $board_config['cookie_name'];
    $cookiepath = $board_config['cookie_path'];
    $cookiedomain = $board_config['cookie_domain'];
    $cookiesecure = $board_config['cookie_secure'];
    $current_time = time();
    unset($userdata);
    if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
        $sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();
        $session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
        $sessionmethod = SESSION_METHOD_COOKIE;
    } else {
        $sessiondata = array();
        $session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
        $sessionmethod = SESSION_METHOD_GET;
    }
    //
    if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
        $session_id = '';
    }
    $thispage_id = (int) $thispage_id;
    //
    // Does a session exist?
    //
    if (!empty($session_id)) {
        //
        // session_id exists so go ahead and attempt to grab all
        // data in preparation
        //
        $sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id";
        if (!($result = $db->sql_query($sql))) {
            message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
        }
        $userdata = $db->sql_fetchrow($result);
        //
        // Did the session exist in the DB?
        //
        if (isset($userdata['user_id'])) {
            //
            // Do not check IP assuming equivalence, if IPv4 we'll check only first 24
            // bits ... I've been told (by vHiker) this should alleviate problems with
            // load balanced et al proxies while retaining some reliance on IP security.
            //
            $ip_check_s = substr($userdata['session_ip'], 0, 6);
            $ip_check_u = substr($user_ip, 0, 6);
            if ($ip_check_s == $ip_check_u) {
                $SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
                //
                // Only update session DB a minute or so after last update
                //
                if ($current_time - $userdata['session_time'] > 60) {
                    // A little trick to reset session_admin on session re-usage
                    $update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : '';
                    $sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin} \n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
                    if (!$db->sql_query($sql)) {
                        message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                    }
                    if ($userdata['user_id'] != ANONYMOUS) {
                        $sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id} \n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
                        if (!$db->sql_query($sql)) {
                            message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                        }
                    }
                    session_clean($userdata['session_id']);
                    setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
                    setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
                }
                // Add the session_key to the userdata array if it is set
                if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
                    $userdata['session_key'] = $sessiondata['autologinid'];
                }
                return $userdata;
            }
        }
    }
    //
    // If we reach here then no (valid) session exists. So we'll create a new one,
    // using the cookie user_id if available to pull basic user prefs.
    //
    $user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
    if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
        message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
    }
    return $userdata;
}
Exemplo n.º 3
0
<?php

require_once 'func.php';
//$chapter = xss($_POST['c']);
session_begin();
if (!isset($_SESSION['user']) || !isset($_SESSION['pass'])) {
    jump('unit.php');
}
require_once 'config.php';
$link = conn_db($hostname, $username, $password, $database);
if (!$link) {
    echo "Mysql conncet ERROR";
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>错题回顾</title>
<link href="http://libs.baidu.com/bootstrap/3.0.3/css/bootstrap.min.css" rel="stylesheet">
<script src="http://libs.baidu.com/jquery/2.0.0/jquery.min.js"></script>
<script src="http://libs.baidu.com/bootstrap/3.0.3/js/bootstrap.min.js"></script>
</head>

<body>
<h1><center>信息论课程在线答题系统</center></h1>

<div align="right">
<table width="20%" style="margin-right:20px;margin_top:0px" border='0'>
<tr align="right">
<td>
Exemplo n.º 4
0
function session_pagestart($user_ip, $thispage_id)
{
    global $db, $lang, $board_config;
    global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
    $cookiename = $board_config['cookie_name'];
    $cookiepath = $board_config['cookie_path'];
    $cookiedomain = $board_config['cookie_domain'];
    $cookiesecure = $board_config['cookie_secure'];
    $current_time = time();
    unset($userdata);
    if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
        $sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : '';
        $session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
        $sessionmethod = SESSION_METHOD_COOKIE;
    } else {
        $sessiondata = '';
        $session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
        $sessionmethod = SESSION_METHOD_GET;
    }
    //
    // Does a session exist?
    //
    if (!empty($session_id)) {
        //
        // session_id exists so go ahead and attempt to grab all
        // data in preparation
        //
        $sql = "SELECT u.*, s.*\r\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\r\n\t\t\tWHERE s.session_id = '{$session_id}'\r\n\t\t\t\tAND u.user_id = s.session_user_id";
        if (!($result = $db->sql_query($sql))) {
            message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
        }
        $userdata = $db->sql_fetchrow($result);
        //
        // Did the session exist in the DB?
        //
        if (isset($userdata['user_id'])) {
            //
            // Do not check IP assuming equivalence, if IPv4 we'll check only first 24
            // bits ... I've been told (by vHiker) this should alleviate problems with
            // load balanced et al proxies while retaining some reliance on IP security.
            //
            $ip_check_s = substr($userdata['session_ip'], 0, 6);
            $ip_check_u = substr($user_ip, 0, 6);
            if ($ip_check_s == $ip_check_u) {
                $SID = $sessionmethod == SESSION_METHOD_GET ? 'sid=' . $session_id : '';
                //
                // Only update session DB a minute or so after last update
                //
                if ($current_time - $userdata['session_time'] > 60) {
                    $sql = "UPDATE " . SESSIONS_TABLE . " \r\n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id} \r\n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
                    if (!$db->sql_query($sql)) {
                        message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                    }
                    if ($userdata['user_id'] != ANONYMOUS) {
                        $sql = "UPDATE " . USERS_TABLE . " \r\n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id} \r\n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
                        if (!$db->sql_query($sql)) {
                            message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                        }
                    }
                    //
                    // Delete expired sessions
                    //
                    $expiry_time = $current_time - $board_config['session_length'];
                    $sql = "DELETE FROM " . SESSIONS_TABLE . " \r\n\t\t\t\t\t\tWHERE session_time < {$expiry_time} \r\n\t\t\t\t\t\t\tAND session_id <> '{$session_id}'";
                    if (!$db->sql_query($sql)) {
                        message_die(CRITICAL_ERROR, 'Error clearing sessions table', '', __LINE__, __FILE__, $sql);
                    }
                    setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
                    setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
                }
                $user_id = $userdata['user_id'];
                //
                // Ban check against user id, IP and email address
                //
                preg_match('/(..)(..)(..)(..)/', $user_ip, $user_ip_parts);
                $sql = "SELECT ban_ip, ban_userid, ban_email \r\n\t\t\t\t\tFROM " . BANLIST_TABLE . " \r\n\t\t\t\t\tWHERE ban_ip IN ('" . $user_ip_parts[1] . $user_ip_parts[2] . $user_ip_parts[3] . $user_ip_parts[4] . "', '" . $user_ip_parts[1] . $user_ip_parts[2] . $user_ip_parts[3] . "ff', '" . $user_ip_parts[1] . $user_ip_parts[2] . "ffff', '" . $user_ip_parts[1] . "ffffff')\r\n\t\t\t\t\t\tOR ban_userid = {$user_id}";
                if ($user_id != ANONYMOUS) {
                    $sql .= " OR ban_email LIKE '" . str_replace("\\'", "''", $userdata['user_email']) . "' \r\n\t\t\t\t\t\tOR ban_email LIKE '" . substr(str_replace("\\'", "''", $userdata['user_email']), strpos(str_replace("\\'", "''", $userdata['user_email']), "@")) . "'";
                }
                if (!($result = $db->sql_query($sql))) {
                    message_die(CRITICAL_ERROR, 'Could not obtain ban information', '', __LINE__, __FILE__, $sql);
                }
                if ($ban_info = $db->sql_fetchrow($result)) {
                    if ($ban_info['ban_ip'] || $ban_info['ban_userid'] || $ban_info['ban_email']) {
                        message_die(CRITICAL_MESSAGE, 'You_been_banned');
                    }
                }
                return $userdata;
            }
        }
    }
    //
    // If we reach here then no (valid) session exists. So we'll create a new one,
    // using the cookie user_id if available to pull basic user prefs.
    //
    $user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
    if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
        message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
    }
    return $userdata;
}
Exemplo n.º 5
0
 if ((isset($HTTP_POST_VARS['login']) || isset($HTTP_GET_VARS['login'])) && !$userdata['session_logged_in']) {
     $username = isset($HTTP_POST_VARS['username']) ? trim(htmlspecialchars($HTTP_POST_VARS['username'])) : '';
     $username = substr(str_replace("\\'", "'", $username), 0, 25);
     $username = str_replace("'", "\\'", $username);
     $password = isset($HTTP_POST_VARS['password']) ? $HTTP_POST_VARS['password'] : '';
     $sql = "SELECT user_id, username, user_password, user_active, user_level\n\t\t\tFROM " . USERS_TABLE . "\n\t\t\tWHERE username = '******'", "''", $username) . "'";
     if (!($result = $db->sql_query($sql))) {
         message_die(GENERAL_ERROR, 'Error in obtaining userdata', '', __LINE__, __FILE__, $sql);
     }
     if ($row = $db->sql_fetchrow($result)) {
         if ($row['user_level'] != ADMIN && $board_config['board_disable']) {
             redirect(append_sid("index.{$phpEx}", true));
         } else {
             if (md5($password) == $row['user_password'] && $row['user_active']) {
                 $autologin = isset($HTTP_POST_VARS['autologin']) ? TRUE : 0;
                 $session_id = session_begin($row['user_id'], $user_ip, PAGE_INDEX, FALSE, $autologin);
                 if ($session_id) {
                     $url = !empty($HTTP_POST_VARS['redirect']) ? $HTTP_POST_VARS['redirect'] : "index.{$phpEx}";
                     redirect(append_sid($url, true));
                 } else {
                     message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
                 }
             } else {
                 $redirect = !empty($HTTP_POST_VARS['redirect']) ? $HTTP_POST_VARS['redirect'] : '';
                 $redirect = str_replace('?', '&', $redirect);
                 $template->assign_vars(array('META' => "<meta http-equiv=\"refresh\" content=\"3;url=login.{$phpEx}?redirect={$redirect}\">"));
                 $message = $lang['Error_login'] . '<br /><br />' . sprintf($lang['Click_return_login'], "<a href=\"login.{$phpEx}?redirect={$redirect}\">", '</a>') . '<br /><br />' . sprintf($lang['Click_return_index'], '<a href="' . append_sid("index.{$phpEx}") . '">', '</a>');
                 message_die(GENERAL_MESSAGE, $message);
             }
         }
     } else {
Exemplo n.º 6
0
function session_show($sessid)
{
    $john = new johnSession($sessid);
    return $john->listCracked();
}
function unlink_sess($sessid)
{
    $john = new johnSession($sessid);
    return $john->delete();
}
function list_formats()
{
    return johnSession::getFormats();
}
if (!empty($_POST['action']) && $_POST['action'] == 'crack') {
    session_begin($_POST['sess_name'], $_POST['hashes'], $_POST['format'], $_POST['options'], $_POST['mode'], $_POST['dictionnary'], $_POST['rules']);
}
if (!empty($_POST['action']) && $_POST['action'] == 'delete') {
    session_delete($_POST['sessionid']);
}
if (!empty($_POST['json']) && ($_POST['json'] = 1)) {
    if (!empty($_POST['action']) && $_POST['action'] == 'list') {
        print json_encode(list_sessions());
    }
    if (!empty($_POST['action']) && $_POST['action'] == 'resume') {
        $result = FALSE;
        if (!empty($_POST['sessionid'])) {
            $result = session_resume($_POST['sessionid']);
        }
        print json_encode(array('result' => $result));
    }
Exemplo n.º 7
0
function session_pagestart($user_ip, $thispage_id)
{
    global $db, $lang, $board_config;
    global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
    $cookiename = $board_config['cookie_name'];
    $cookiepath = $board_config['cookie_path'];
    $cookiedomain = $board_config['cookie_domain'];
    $cookiesecure = $board_config['cookie_secure'];
    $cookiesecure = $board_config['cookie_secure'] ? '; secure' : '';
    $current_time = time();
    unset($userdata);
    if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
        $sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : '';
        $session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
        $sessionmethod = SESSION_METHOD_COOKIE;
    } else {
        $session_data = '';
        $session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
        $sessionmethod = SESSION_METHOD_GET;
    }
    //
    // Does a session exist?
    //
    if (!empty($session_id)) {
        //
        // session_id exists so go ahead and attempt to grab all
        // data in preparation
        //
        $sql = "SELECT u.*, s.*\r\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\r\n\t\t\tWHERE s.session_id = '{$session_id}'\r\n\t\t\t\tAND u.user_id = s.session_user_id \r\n\t\t\t\tAND s.session_ip = '{$user_ip}'";
        if (!($result = $db->sql_query($sql))) {
            message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch : session_pagestart', '', __LINE__, __FILE__, $sql);
        }
        $userdata = $db->sql_fetchrow($result);
        //
        // Did the session exist in the DB?
        //
        if (isset($userdata['user_id'])) {
            $SID = $sessionmethod == SESSION_METHOD_GET ? 'sid=' . $session_id : '';
            //
            // Only update session DB a minute or so after last update
            //
            $last_update = $userdata['user_id'] == ANONYMOUS ? $userdata['session_time'] : $userdata['user_session_time'];
            if ($current_time - $last_update > 60) {
                // || $userdata['user_session_page'] != $thispage_id
                $sql = $userdata['user_id'] == ANONYMOUS ? "UPDATE " . SESSIONS_TABLE . " SET session_time = {$current_time}, session_page = {$thispage_id} WHERE session_id = '" . $userdata['session_id'] . "' AND session_ip = '{$user_ip}'" : "UPDATE " . USERS_TABLE . " SET user_session_time = {$current_time}, user_session_page = {$thispage_id} WHERE user_id = " . $userdata['user_id'];
                if (!$db->sql_query($sql)) {
                    message_die(CRITICAL_ERROR, 'Error updating sessions table : session_pagestart', '', __LINE__, __FILE__, $sql);
                }
                //
                // Delete expired sessions
                //
                $expiry_time = $current_time - $board_config['session_length'];
                $sql = "DELETE FROM " . SESSIONS_TABLE . " \r\n\t\t\t\t\tWHERE session_time < {$expiry_time} \r\n\t\t\t\t\t\tAND session_id <> '{$session_id}'";
                if (!($result = $db->sql_query($sql))) {
                    message_die(CRITICAL_ERROR, 'Error clearing sessions table : session_pagestart', '', __LINE__, __FILE__, $sql);
                }
                setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
                setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
                //				header('Set-cookie: ' . $cookiename . '_data=' . urlencode(serialize($sessiondata)) . '; expires=' . gmdate("l, d-M-Y H:i:s", $current_time + 31536000) . ' GMT; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure);
                //				header('Set-cookie: ' . $cookiename . '_sid=' . $session_id . '; domain=' . $cookiedomain . '; path=' . $cookiepath . $cookiesecure);
            }
            return $userdata;
        }
    }
    //
    // If we reach here then no (valid) session exists. So we'll create a new one,
    // using the cookie user_id if available to pull basic user prefs.
    //
    $user_id = isset($sessiondata['userid']) ? $sessiondata['userid'] : ANONYMOUS;
    if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
        message_die(CRITICAL_ERROR, 'Error creating user session : session_pagestart', '', __LINE__, __FILE__, $sql);
    }
    return $userdata;
}
Exemplo n.º 8
0
function check_bit_user(&$p_user_data)
{
    // We have a valid bitweaver user, however we do not have a phpBB user
    global $db, $gBitSystem, $gBitUser, $userlib, $HTTP_GET_VARS;
    $anon = $p_user_data['user_id'] == ANONYMOUS;
    if (empty($p_user_data['user_id']) || $anon || $gBitUser->isRegistered() && $gBitUser->mUserId != $p_user_data['user_id']) {
        if ($gBitUser->isRegistered()) {
            //
            // Try and pull the last time stored in a cookie, if it exists
            //
            $sql = "SELECT *\n\t\t\t\tFROM " . USERS_TABLE . "\n\t\t\t\tWHERE user_id = '" . $gBitUser->mUserId . "'";
            if (!($result = $db->sql_query($sql))) {
                message_die(CRITICAL_ERROR, 'Could not obtain bitweaver user from phpBB user table', '', __LINE__, __FILE__, $sql);
            }
            $user_row = $db->sql_fetchrow($result);
            //vd( $user_row );
            $md5 = $gBitSystem->isFeatureActive('users_clear_passwords');
            $phpbb_password = $md5 ? $gBitUser->mInfo['password'] : md5($gBitUser->mInfo['password']);
            // nuke their existing session cause it stores anonymous_id (-1) initially
            $sql = "DELETE FROM " . SESSIONS_TABLE . "\n\t\t\t\t\tWHERE session_id = '" . $p_user_data['session_id'] . "'";
            if (!$db->sql_query($sql)) {
                message_die(CRITICAL_ERROR, 'Error clearing sessions table', '', __LINE__, __FILE__, $sql);
            }
            if (empty($user_row['user_id'])) {
                $sql = "INSERT INTO " . USERS_TABLE . " (user_id, username, user_regdate, user_password, user_email, user_icq, user_website, user_occ, user_from, user_interests, user_sig, user_sig_bbcode_uid, user_avatar, user_avatar_type, user_viewemail, user_aim, user_yim, user_msnm, user_attachsig, user_allowsmile, user_allowhtml, user_allowbbcode, user_allow_viewonline, user_notify, user_notify_pm, user_popup_pm, user_timezone, user_dateformat, user_lang, user_style, user_level, user_allow_pm, user_active, user_actkey)\n\t\t\t\t\t\tVALUES ( " . $gBitUser->mInfo['user_id'] . ", " . $gBitSystem->mDb->qstr($gBitUser->mInfo['login'], get_magic_quotes_gpc()) . ", " . strtotime('now') . ", " . $gBitSystem->mDb->qstr($phpbb_password, get_magic_quotes_gpc()) . ", '" . $gBitUser->mInfo['email'] . "',\n\t\t\t\t\tNULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 0, 0, NULL, NULL, NULL, 0, 1, 0, 1, 1, 0, 1, 1, 0, 'd M Y h:i a', 'english', 1, " . (int) $gBitUser->isAdmin() . ", 0, 1, NULL)";
                if (!($result = $db->sql_query($sql))) {
                    message_die(CRITICAL_ERROR, 'Could not create bitweaver user for phpBB', '', __LINE__, __FILE__, $sql);
                }
            } else {
                // Has user data changed?
                if ($user_row['user_email'] != $gBitUser->mInfo['email'] || $user_row['user_password'] != $phpbb_password || $user_row['username'] != $gBitUser->mInfo['login']) {
                    $sql = "UPDATE " . USERS_TABLE . " SET username="******", user_email = " . $gBitSystem->mDb->qstr($gBitUser->mInfo['email'], get_magic_quotes_gpc()) . ", user_password="******"\n\t\t\t\t\t\t\tWHERE  user_id = " . $user_row['user_id'];
                    if (!($result = $db->sql_query($sql))) {
                        message_die(CRITICAL_ERROR, 'Could not create bitweaver user for phpBB', '', __LINE__, __FILE__, $sql);
                        die;
                    }
                }
            }
            // Restart the session because somehow we lost it.
            $p_user_data = session_begin($gBitUser->mUserId, $p_user_data['session_ip'], $p_user_data['session_page'], TRUE, TRUE, (int) $gBitUser->isAdmin());
        } else {
            // We have an anonymous session
            $user_id = isset($p_user_data['user_id']) ? intval($p_user_data['user_id']) : ANONYMOUS;
            if (!($p_user_data = session_begin($user_id, $p_user_data['user_ip'], $p_user_data['session_page'], TRUE, TRUE))) {
                message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
            }
        }
    } elseif ($gBitUser->isRegistered()) {
        if (empty($p_user_data['session_id'])) {
            // we need a session
            $p_user_data = session_begin($gBitUser->mUserId, $p_user_data['session_ip'], $p_user_data['session_page'], TRUE, TRUE, (int) $gBitUser->isAdmin());
        }
    } else {
        if ($p_user_data['session_logged_in']) {
            //our Tiki session has ended before our phpBB session
            session_end($p_user_data['session_id'], $p_user_data['user_id']);
            $p_user_data = session_begin(ANONYMOUS, $p_user_data['session_ip'], $p_user_data['session_page']);
        }
    }
}
Exemplo n.º 9
0
function bblogin($nukeuser, $session_id)
{
    global $nukeuser, $userdata, $user_ip, $session_length, $session_id, $db, $nuke_file_path;
    define("IN_LOGIN", true);
    $cookie = explode(":", $nukeuser);
    $nuid = $cookie[0];
    $sql = "SELECT s.*\n                FROM " . SESSIONS_TABLE . " s\n                WHERE s.session_id = '{$session_id}'\n                AND s.session_ip = '{$user_ip}'";
    if (!($result = $db->sql_query($sql))) {
        message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch : session_pagestar');
    }
    $logindata = $db->sql_fetchrow($result);
    if ($nuid != $logindata['session_user_id']) {
        $nusername = $cookie[1];
        $sql = "SELECT user_id, username, user_password, user_active, user_level\n                    FROM " . USERS_TABLE . "\n                    WHERE username = '******'", "''", $nusername) . "'";
        $result = $db->sql_query($sql);
        if (!$result) {
            message_die(GENERAL_ERROR, "Error in obtaining userdata : login", "", __LINE__, __FILE__, $sql);
        }
        $rowresult = $db->sql_fetchrow($result);
        $password = $cookie[2];
        if (count($rowresult)) {
            if ($rowresult['user_level'] != ADMIN && $board_config['board_disable']) {
                header("Location: " . append_sid("index.php", true));
            } else {
                if ($password == $rowresult['user_password'] && $rowresult['user_active']) {
                    $autologin = 0;
                    $userdata = session_begin($rowresult['user_id'], $user_ip, PAGE_INDEX, $session_length, FALSE, $autologin);
                    $session_id = $userdata['session_id'];
                    if (!$session_id) {
                        message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
                    } else {
                    }
                } else {
                    $message = $lang['Error_login'] . "<br /><br />" . sprintf($lang['Click_return_login'], "<a href=\"" . append_sid("modules.php?name=Forums&file=login&{$redirect}") . "\">", "</a> ") . "<br /><br />" . sprintf($lang['Click_return_index'], "<a href=\"" . append_sid("index.php") . "\">", "</a> ");
                    message_die(GENERAL_MESSAGE, $message);
                }
            }
        } else {
            $message = $lang['Error_login'] . "<br /><br />" . sprintf($lang['Click_return_login'], "<a href=\"" . append_sid("modules.php?name=Forums&file=login&{$redirect}") . "\">", "</a> ") . "<br /><br />" . sprintf($lang['Click_return_index'], "<a href=\"" . append_sid("index.php") . "\">", "</a> ");
            message_die(GENERAL_MESSAGE, $message);
        }
    }
}
Exemplo n.º 10
0
function session_pagestart($user_ip, $thispage_id)
{
    global $db, $lang, $board_config;
    global $SID;
    $cookiename = $board_config['cookie_name'];
    $cookiepath = $board_config['cookie_path'];
    $cookiedomain = $board_config['cookie_domain'];
    $cookiesecure = $board_config['cookie_secure'];
    $current_time = time();
    unset($userdata);
    if (isset($_COOKIE[$cookiename . '_sid']) || isset($_COOKIE[$cookiename . '_data'])) {
        $sessiondata = isset($_COOKIE[$cookiename . '_data']) ? unserialize(stripslashes($_COOKIE[$cookiename . '_data'])) : array();
        $session_id = isset($_COOKIE[$cookiename . '_sid']) ? $_COOKIE[$cookiename . '_sid'] : '';
        $sessionmethod = SESSION_METHOD_COOKIE;
    } else {
        $sessiondata = array();
        $session_id = isset($_GET['sid']) ? $_GET['sid'] : '';
        $sessionmethod = SESSION_METHOD_GET;
    }
    //
    if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
        $session_id = '';
    }
    $thispage_id = (int) $thispage_id;
    //
    // Does a session exist?
    //
    if (!empty($session_id)) {
        //
        // session_id exists so go ahead and attempt to grab all
        // data in preparation
        //
        $sql = "SELECT u.*, s.*\n            FROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n            WHERE s.session_id = '{$session_id}'\n                AND u.user_id = s.session_user_id";
        if (!($result = $db->sql_query($sql))) {
            message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
        }
        $userdata = $db->sql_fetchrow($result);
        //
        // Did the session exist in the DB?
        //
        if (isset($userdata['user_id'])) {
            // Begin PNphpBB2 Module
            // OK we found a session, now determine if it should be logged in or not
            // Fix by Allan (Poster on PNphpBB.com)
            /* Adsense interferes with PNphpBB2 session handling.
             * Adsense agent scans the page to find relevant words
             * and appears as an anonymous user, forcing the expire
             * of the session.
             */
            $is_adsense = isset($_SERVER['HTTP_USER_AGENT']) && strstr($_SERVER['HTTP_USER_AGENT'], 'Google');
            if (!UserUtil::isLoggedIn() && $userdata['user_id'] != ANONYMOUS && !$is_adsense) {
                // PN user not logged in so this session should not be logged in.
                session_end($userdata['session_id'], $userdata['user_id']);
                unset($sessiondata['userid']);
                if (!($userdata = session_begin(ANONYMOUS, $user_ip, $thispage_id, FALSE))) {
                    message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
                }
                init_userprefs($userdata);
                return $userdata;
            }
            if (UserUtil::isLoggedIn() && $userdata['user_id'] != UserUtil::getVar('uid')) {
                // PN user not logged in so this session should not be logged in.
                session_end($userdata['session_id'], $userdata['user_id']);
                if (!($userdata = session_begin(UserUtil::getVar('uid'), $user_ip, $thispage_id, FALSE))) {
                    message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
                }
            }
            // End PNphpBB2 Module
            //
            // Do not check IP assuming equivalence, if IPv4 we'll check only first 24
            // bits ... I've been told (by vHiker) this should alleviate problems with
            // load balanced et al proxies while retaining some reliance on IP security.
            //
            $ip_check_s = substr($userdata['session_ip'], 0, 6);
            $ip_check_u = substr($user_ip, 0, 6);
            if ($ip_check_s == $ip_check_u) {
                $SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
                //
                // Only update session DB a minute or so after last update
                //
                if ($current_time - $userdata['session_time'] > 60) {
                    // A little trick to reset session_admin on session re-usage
                    // Begin PNphpBB2 Module
                    //					$update_admin = (!defined('IN_ADMIN') && $current_time - $userdata['session_time'] > ($board_config['session_length']+60)) ? ', session_admin = 0' : '';
                    // End PNphpBB2 Module
                    $sql = "UPDATE " . SESSIONS_TABLE . " \n                        SET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n                        WHERE session_id = '" . $userdata['session_id'] . "'";
                    if (!$db->sql_query($sql)) {
                        message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                    }
                    if ($userdata['user_id'] != ANONYMOUS) {
                        $sql = "UPDATE " . USERS_TABLE . " \n                            SET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n                            WHERE user_id = " . $userdata['user_id'];
                        if (!$db->sql_query($sql)) {
                            message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
                        }
                    }
                    session_clean($userdata['session_id']);
                    setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
                    setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
                }
                // Add the session_key to the userdata array if it is set
                if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
                    $userdata['session_key'] = $sessiondata['autologinid'];
                }
                return $userdata;
            }
        }
    }
    //
    // If we reach here then no (valid) session exists. So we'll create a new one,
    // using the cookie user_id if available to pull basic user prefs.
    //
    $user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
    if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
        message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
    }
    return $userdata;
}