function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
$sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();
$session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
// Added by FAI
// Find Public Whip user id
$logged_into_pw = user_isloggedin();
global $user_name;
// Look it up in PHPBB user account list
$result = $db->sql_query("select user_id from phpbb_users where username = '******'");
if ($result) {
$row = $db->sql_fetchrow($result);
$user_id_for_phpbb = $row['user_id'];
}
$url = !empty($HTTP_POST_VARS['redirect']) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : str_replace("/forum/", "", $_SERVER['REQUEST_URI']);
if ($logged_into_pw) {
// If user id is wrong, log into it
if ($user_id_for_phpbb && $user_id_for_phpbb != $userdata['user_id']) {
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
}
$session_id = session_begin($user_id_for_phpbb, $user_ip, PAGE_INDEX, FALSE, TRUE);
redirect(append_sid($url, true));
exit;
}
// Otherwise make new account
if (!$user_id_for_phpbb) {
// Log out first if logged in
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
exit;
}
$sql = "SELECT MAX(user_id) AS total FROM " . USERS_TABLE;
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
}
if (!($row = $db->sql_fetchrow($result))) {
message_die(GENERAL_ERROR, 'Could not obtain next user_id information', '', __LINE__, __FILE__, $sql);
}
$user_id = $row['total'] + 1;
$notifyreply = 1;
$sql = "INSERT INTO " . USERS_TABLE . "\t \nVALUES ('" . mysql_escape_string($user_id) . "',1,'" . mysql_escape_string($user_name) . "','NEVER***',0,0,0," . time() . ",0,0,0.00,1,'english','D M d, Y g:i a',0,0,0,NULL,0,1,1,1,1,1,1,1,1,1,1,0,'',0,'" . mysql_escape_string(user_getemail()) . "','','','','','','','','','','','',NULL,0,0)";
/* VALUES ($user_id, '" . str_replace("\'", "''", $user_name) . "', " . time() . ", '" . str_replace("\'", "''", "NOT VALID ***") . "', '" . str_replace("\'", "''", user_getemail()) . "', '" . str_replace("\'", "''", $icq) . "', '" . str_replace("\'", "''", $website) . "', '" . str_replace("\'", "''", $occupation) . "', '" . str_replace("\'", "''", $location) . "', '" . str_replace("\'", "''", $interests) . "', '" . str_replace("\'", "''", $signature) . "', '$signature_bbcode_uid', $avatar_sql, $viewemail, '" . str_replace("\'", "''", str_replace(' ', '+', $aim)) . "', '" . str_replace("\'", "''", $yim) . "', '" . str_replace("\'", "''", $msn) . "', $attachsig, $allowsmilies, $allowhtml, $allowbbcode, $allowviewonline, $notifyreply, $notifypm, $popup_pm, $user_timezone, '" . str_replace("\'", "''", $user_dateformat) . "', '" . str_replace("\'", "''", $user_lang) . "', $user_style, 0, 1, ";
*/
if (!($result = $db->sql_query($sql, BEGIN_TRANSACTION))) {
message_die(GENERAL_ERROR, 'Could not insert data into users table', '', __LINE__, __FILE__, $sql);
}
$sql = "INSERT INTO " . GROUPS_TABLE . " (group_name, group_description, group_single_user, group_moderator)\n\t\t\t\tVALUES ('', 'Personal User', 1, 0)";
if (!($result = $db->sql_query($sql))) {
message_die(GENERAL_ERROR, 'Could not insert data into groups table', '', __LINE__, __FILE__, $sql);
}
$group_id = $db->sql_nextid();
$sql = "INSERT INTO " . USER_GROUP_TABLE . " (user_id, group_id, user_pending)\n\t\t\t\tVALUES ({$user_id}, {$group_id}, 0)";
if (!($result = $db->sql_query($sql, END_TRANSACTION))) {
message_die(GENERAL_ERROR, 'Could not insert data into user_group table', '', __LINE__, __FILE__, $sql);
}
$session_id = session_begin($user_id, $user_ip, PAGE_INDEX, FALSE, TRUE);
redirect(append_sid($url, true));
exit;
}
} else {
if ($userdata['user_id'] > 0) {
session_end($userdata['session_id'], $userdata['user_id']);
redirect(append_sid($url, true));
exit;
}
}
// End added by FAI
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
$update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : '';
$sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $HTTP_COOKIE_VARS, $HTTP_GET_VARS, $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) || isset($HTTP_COOKIE_VARS[$cookiename . '_data'])) {
$sessiondata = isset($HTTP_COOKIE_VARS[$cookiename . '_data']) ? unserialize(stripslashes($HTTP_COOKIE_VARS[$cookiename . '_data'])) : array();
$session_id = isset($HTTP_COOKIE_VARS[$cookiename . '_sid']) ? $HTTP_COOKIE_VARS[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($HTTP_GET_VARS['sid']) ? $HTTP_GET_VARS['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n\t\t\tFROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n\t\t\tWHERE s.session_id = '{$session_id}'\n\t\t\t\tAND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
$update_admin = !defined('IN_ADMIN') && $current_time - $userdata['session_time'] > $board_config['session_length'] + 60 ? ', session_admin = 0' : '';
$sql = "UPDATE " . SESSIONS_TABLE . " \n\t\t\t\t\t\tSET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin} \n\t\t\t\t\t\tWHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n\t\t\t\t\t\t\tSET user_session_time = {$current_time}, user_session_page = {$thispage_id} \n\t\t\t\t\t\t\tWHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
/**
* Validate the legitimacy of a session.
* Checks may include last-known IP address, or more.
* Triggers an error when the session is invalid.
* @param object Session object
*/
function session_validate( $p_session ) {
$t_user_ip = '';
if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
$t_user_ip = trim( $_SERVER['REMOTE_ADDR'] );
}
if ( is_null( $t_last_ip = $p_session->get( 'last_ip', null ) ) ) {
# First session usage
$p_session->set( 'last_ip', $t_user_ip );
} else {
# Check a continued session request
if ( $t_user_ip != $t_last_ip ) {
session_clean();
trigger_error( ERROR_SESSION_NOT_VALID, WARNING );
$t_url = config_get_global( 'path' ) . config_get_global( 'default_home_page' );
echo "\t<meta http-equiv=\"Refresh\" content=\"4;URL=$t_url\" />\n";
die();
}
}
}
/**
* Logout the current user and remove any remaining cookies from their browser
* Returns true on success, false otherwise
* @access public
*/
function auth_logout()
{
global $g_cache_current_user_id, $g_cache_cookie_valid;
# clear cached userid
user_clear_cache($g_cache_current_user_id);
$g_cache_current_user_id = null;
$g_cache_cookie_valid = null;
# clear cookies, if they were set
if (auth_clear_cookies()) {
helper_clear_pref_cookies();
}
if (HTTP_AUTH == config_get('login_method')) {
auth_http_set_logout_pending(true);
}
session_clean();
}
#provides db credentials
//Feed.php to be used to store session data
include 'Feed.php';
$config->titleTag = smartTitle();
#Fills <title> tag. If left empty will fallback to $config->titleTag in config_inc.php
$config->metaDescription = smartTitle() . ' - ' . $config->metaDescription;
if (isset($_GET['id']) && (int) $_GET['id'] > 0) {
//good data, process
$id = (int) $_GET['id'];
} else {
//bad data, don't process
//this is redirection in PHP:
header('Location:index.php');
}
//clean out session if older than 10 minutes
session_clean(600);
//END CONFIG AREA ----------------------------------------------------------
get_header();
#defaults to header_inc.php
#SQL statement
$sql = 'select * from Category as c inner join Subcategory as s on c.CategoryID = s.CategoryID where s.SubcategoryID=' . $id;
#IDB::conn() creates a shareable database connection via a singleton class
$result = mysqli_query(IDB::conn(), $sql) or die(trigger_error(mysqli_error(IDB::conn()), E_USER_ERROR));
if (mysqli_num_rows($result) > 0) {
#there are records - present data
while ($row = mysqli_fetch_assoc($result)) {
# pull data from associative array
//take category and subcategory then turn into string with "+" between each word for google news query
$querySplit = explode(" ", $row['CategoryTitle'] . ' ' . $row['SubcategoryTitle']);
$query = implode("+", $querySplit);
$subCatDescp = $row['SubcategoryDescription'];
function auth_logout()
{
global $g_cache_current_user_id;
# clear cached userid
$g_cache_current_user_id = null;
# clear cookies, if they were set
if (auth_clear_cookies()) {
helper_clear_pref_cookies();
}
session_clean();
return true;
}
#Length of time in hours a session is allowed to be //END CONFIG AREA ---------------------------------------------------------- $collection_seconds = $collection_duration * 3600; #multiply hours x 3600 seconds/hour $access = "developer"; #admin or higher level can view this page include_once INCLUDE_PATH . 'admin_only_inc.php'; #session protected page - level is defined in $access var get_header(); #defaults to header_inc.php ?> <div align="center"><h3>Clean Session Data</h3></div> <p>This page will attempt to clear any session data that is more than <b><?php echo $collection_duration; ?> </b> hours old.</p> <p>The number of sessions successfully cleared out will be identified below.</p> <p>If there is no session data older than <b><?php echo $collection_duration; ?> </b> hours, a message will be generated that zero sessions were cleared.</p> <p>This page will only work if sessions are being stored currently in your database instead of the file system.</p> <?php startSession(); #DB requires session started $cleaned = session_clean($collection_seconds); #forces clearing of old sessions echo '<p align="center"><b>' . $cleaned . '</b> sessions cleaned! (eliminated from database)</p>'; echo '<div align="center"><a href="' . $config->adminDashboard . '">Exit To Admin</a></div>'; get_footer(); #defaults to footer_inc.php
function session_pagestart($user_ip, $thispage_id)
{
global $db, $lang, $board_config;
global $SID;
$cookiename = $board_config['cookie_name'];
$cookiepath = $board_config['cookie_path'];
$cookiedomain = $board_config['cookie_domain'];
$cookiesecure = $board_config['cookie_secure'];
$current_time = time();
unset($userdata);
if (isset($_COOKIE[$cookiename . '_sid']) || isset($_COOKIE[$cookiename . '_data'])) {
$sessiondata = isset($_COOKIE[$cookiename . '_data']) ? unserialize(stripslashes($_COOKIE[$cookiename . '_data'])) : array();
$session_id = isset($_COOKIE[$cookiename . '_sid']) ? $_COOKIE[$cookiename . '_sid'] : '';
$sessionmethod = SESSION_METHOD_COOKIE;
} else {
$sessiondata = array();
$session_id = isset($_GET['sid']) ? $_GET['sid'] : '';
$sessionmethod = SESSION_METHOD_GET;
}
//
if (!preg_match('/^[A-Za-z0-9]*$/', $session_id)) {
$session_id = '';
}
$thispage_id = (int) $thispage_id;
//
// Does a session exist?
//
if (!empty($session_id)) {
//
// session_id exists so go ahead and attempt to grab all
// data in preparation
//
$sql = "SELECT u.*, s.*\n FROM " . SESSIONS_TABLE . " s, " . USERS_TABLE . " u\n WHERE s.session_id = '{$session_id}'\n AND u.user_id = s.session_user_id";
if (!($result = $db->sql_query($sql))) {
message_die(CRITICAL_ERROR, 'Error doing DB query userdata row fetch', '', __LINE__, __FILE__, $sql);
}
$userdata = $db->sql_fetchrow($result);
//
// Did the session exist in the DB?
//
if (isset($userdata['user_id'])) {
// Begin PNphpBB2 Module
// OK we found a session, now determine if it should be logged in or not
// Fix by Allan (Poster on PNphpBB.com)
/* Adsense interferes with PNphpBB2 session handling.
* Adsense agent scans the page to find relevant words
* and appears as an anonymous user, forcing the expire
* of the session.
*/
$is_adsense = isset($_SERVER['HTTP_USER_AGENT']) && strstr($_SERVER['HTTP_USER_AGENT'], 'Google');
if (!UserUtil::isLoggedIn() && $userdata['user_id'] != ANONYMOUS && !$is_adsense) {
// PN user not logged in so this session should not be logged in.
session_end($userdata['session_id'], $userdata['user_id']);
unset($sessiondata['userid']);
if (!($userdata = session_begin(ANONYMOUS, $user_ip, $thispage_id, FALSE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
init_userprefs($userdata);
return $userdata;
}
if (UserUtil::isLoggedIn() && $userdata['user_id'] != UserUtil::getVar('uid')) {
// PN user not logged in so this session should not be logged in.
session_end($userdata['session_id'], $userdata['user_id']);
if (!($userdata = session_begin(UserUtil::getVar('uid'), $user_ip, $thispage_id, FALSE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
}
// End PNphpBB2 Module
//
// Do not check IP assuming equivalence, if IPv4 we'll check only first 24
// bits ... I've been told (by vHiker) this should alleviate problems with
// load balanced et al proxies while retaining some reliance on IP security.
//
$ip_check_s = substr($userdata['session_ip'], 0, 6);
$ip_check_u = substr($user_ip, 0, 6);
if ($ip_check_s == $ip_check_u) {
$SID = $sessionmethod == SESSION_METHOD_GET || defined('IN_ADMIN') ? 'sid=' . $session_id : '';
//
// Only update session DB a minute or so after last update
//
if ($current_time - $userdata['session_time'] > 60) {
// A little trick to reset session_admin on session re-usage
// Begin PNphpBB2 Module
// $update_admin = (!defined('IN_ADMIN') && $current_time - $userdata['session_time'] > ($board_config['session_length']+60)) ? ', session_admin = 0' : '';
// End PNphpBB2 Module
$sql = "UPDATE " . SESSIONS_TABLE . " \n SET session_time = {$current_time}, session_page = {$thispage_id}{$update_admin}\n WHERE session_id = '" . $userdata['session_id'] . "'";
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
if ($userdata['user_id'] != ANONYMOUS) {
$sql = "UPDATE " . USERS_TABLE . " \n SET user_session_time = {$current_time}, user_session_page = {$thispage_id}\n WHERE user_id = " . $userdata['user_id'];
if (!$db->sql_query($sql)) {
message_die(CRITICAL_ERROR, 'Error updating sessions table', '', __LINE__, __FILE__, $sql);
}
}
session_clean($userdata['session_id']);
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);
}
// Add the session_key to the userdata array if it is set
if (isset($sessiondata['autologinid']) && $sessiondata['autologinid'] != '') {
$userdata['session_key'] = $sessiondata['autologinid'];
}
return $userdata;
}
}
}
//
// If we reach here then no (valid) session exists. So we'll create a new one,
// using the cookie user_id if available to pull basic user prefs.
//
$user_id = isset($sessiondata['userid']) ? intval($sessiondata['userid']) : ANONYMOUS;
if (!($userdata = session_begin($user_id, $user_ip, $thispage_id, TRUE))) {
message_die(CRITICAL_ERROR, 'Error creating user session', '', __LINE__, __FILE__, $sql);
}
return $userdata;
}
