summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBenny Baumann <BenBE@geshi.org>2014-06-06 22:58:42 +0200
committerBenny Baumann <BenBE@geshi.org>2014-06-06 22:58:42 +0200
commit4dd6c64ef0556151b0bfa5f2b452d810e44ab3ac (patch)
tree08585b83f9efdc302ca7c725b29f50dba7ff2ae6
parent76b8145a2f68d2f65384e2e51530b207b1a737ea (diff)
parenta4a8075571ad33ac0fd4393b25e0c1e8fc31d7fa (diff)
downloadcacert-devel-4dd6c64ef0556151b0bfa5f2b452d810e44ab3ac.tar.gz
cacert-devel-4dd6c64ef0556151b0bfa5f2b452d810e44ab3ac.tar.xz
cacert-devel-4dd6c64ef0556151b0bfa5f2b452d810e44ab3ac.zip
Merge branch 'bug-1138' into release
-rwxr-xr-xCommModule/client.pl2
-rwxr-xr-xCommModule/usbclient.pl2
-rw-r--r--includes/account.php549
-rw-r--r--includes/general.php42
-rw-r--r--includes/lib/account.php22
-rw-r--r--includes/lib/general.php37
-rw-r--r--includes/loggedin.php34
-rw-r--r--includes/notary.inc.php1341
-rw-r--r--pages/account/12.php29
-rw-r--r--pages/account/13.php23
-rw-r--r--pages/account/16.php2
-rw-r--r--pages/account/18.php9
-rw-r--r--pages/account/21.php4
-rw-r--r--pages/account/22.php10
-rw-r--r--pages/account/43.php1873
-rw-r--r--pages/account/44.php27
-rw-r--r--pages/account/5.php39
-rw-r--r--pages/account/52.php107
-rw-r--r--pages/account/55.php27
-rw-r--r--pages/account/57.php26
-rw-r--r--pages/account/58.php4
-rw-r--r--pages/account/59.php385
-rw-r--r--pages/account/6.php8
-rw-r--r--pages/gpg/2.php19
-rw-r--r--pages/wot/1.php22
-rw-r--r--pages/wot/10.php30
-rw-r--r--pages/wot/15.php2
-rw-r--r--pages/wot/9.php23
-rwxr-xr-xscripts/cron/refresh_stats.php55
-rw-r--r--stamp/common.php6
-rw-r--r--www/api/ccsr.php18
-rw-r--r--www/api/cemails.php9
-rw-r--r--www/index.php24
-rw-r--r--www/stats.php5
-rw-r--r--www/styles/default.css24
-rw-r--r--www/wot.php57
36 files changed, 3287 insertions, 1609 deletions
diff --git a/CommModule/client.pl b/CommModule/client.pl
index bd3eb02..532761e 100755
--- a/CommModule/client.pl
+++ b/CommModule/client.pl
@@ -441,7 +441,7 @@ sub calculateDays($)
{
if($_[0])
{
- my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' group by `to`");
+ my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' and `deleted`=0 group by `to`");
SysLog("Summe: $sum[0]\n") if($debug);
return ($sum[0]>=50)?730:180;
diff --git a/CommModule/usbclient.pl b/CommModule/usbclient.pl
index 3cbe2c3..6cbc111 100755
--- a/CommModule/usbclient.pl
+++ b/CommModule/usbclient.pl
@@ -425,7 +425,7 @@ sub calculateDays($)
{
if($_[0])
{
- my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' group by `to`");
+ my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' and `deleted`=0 group by `to`");
SysLog("Summe: $sum[0]\n") if($debug);
return ($sum[0]>=50)?730:180;
diff --git a/includes/account.php b/includes/account.php
index 447d094..99c65c5 100644
--- a/includes/account.php
+++ b/includes/account.php
@@ -84,6 +84,11 @@ function buildSubjectFromSession() {
$memid = array_key_exists('memid',$_REQUEST) ? intval($_REQUEST['memid']) : 0;
$domid = array_key_exists('domid',$_REQUEST) ? intval($_REQUEST['domid']) : 0;
+ $actionrequest = array_key_exists('action',$_REQUEST) ? $_REQUEST['action'] : "";
+
+ $ticketno = array_key_exists('ticketno',$_REQUEST) ? $_REQUEST['ticketno'] : "";
+ $ticketvalidation = FALSE;
+
if(!$_SESSION['mconn'])
{
@@ -146,7 +151,7 @@ function buildSubjectFromSession() {
exit;
}
$hash = make_hash();
- $query = "insert into `email` set `email`='".$_REQUEST['email']."',`memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'";
+ $query = "insert into `email` set `email`='".$_REQUEST['email']."',`memid`='".intval($_SESSION['profile']['id'])."',`created`=NOW(),`hash`='$hash'";
mysql_query($query);
$emailid = mysql_insert_id();
@@ -166,7 +171,7 @@ function buildSubjectFromSession() {
{
$id = 2;
$emailid = intval($_REQUEST['emailid']);
- $query = "select * from `email` where `id`='$emailid' and `memid`='".$_SESSION['profile']['id']."' and `hash` = '' and `deleted`=0";
+ $query = "select * from `email` where `id`='$emailid' and `memid`='".intval($_SESSION['profile']['id'])."' and `hash` = '' and `deleted`=0";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -186,7 +191,7 @@ function buildSubjectFromSession() {
"support@cacert.org", "", "", "CAcert Support");
$_SESSION['profile']['email'] = $row['email'];
- $query = "update `users` set `email`='".$row['email']."' where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `email`='".mysql_real_escape_string($row['email'])."' where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
showheader(_("My CAcert.org Account!"));
printf(_("Your default email address has been updated to '%s'."), sanitizeHTML($row['email']));
@@ -211,7 +216,7 @@ function buildSubjectFromSession() {
}
$id = intval($id);
$query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and
- `email`!='".$_SESSION['profile']['email']."'";
+ `email`!='".mysql_real_escape_string($_SESSION['profile']['email'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -293,11 +298,8 @@ function buildSubjectFromSession() {
$_REQUEST['keytype'] = "MS";
$csr = clean_csr($_REQUEST['optionalCSR']);
}
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
}
if($oldid == 4)
@@ -321,7 +323,7 @@ function buildSubjectFromSession() {
if(is_array($_SESSION['_config']['addid']))
foreach($_SESSION['_config']['addid'] as $id)
{
- $res = mysql_query("select * from `email` where `memid`='".$_SESSION['profile']['id']."' and `id`='".intval($id)."'");
+ $res = mysql_query("select * from `email` where `memid`='".intval($_SESSION['profile']['id'])."' and `id`='".intval($id)."'");
if(mysql_num_rows($res) > 0)
{
$row = mysql_fetch_assoc($res);
@@ -340,7 +342,7 @@ function buildSubjectFromSession() {
showfooter();
exit;
}
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'"));
+ $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
if($_SESSION['_config']['SSO'] == 1)
$emails .= "$count.emailAddress = ".$user['uniqueID']."\n";
@@ -384,7 +386,7 @@ function buildSubjectFromSession() {
`codesign`='".intval($_SESSION['_config']['codesign'])."',
`disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
`rootcert`='".intval($_SESSION['_config']['rootcert'])."',
- `description`='".$_SESSION['_config']['description']."'";
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
if(is_array($addys))
@@ -482,13 +484,13 @@ function buildSubjectFromSession() {
$query = "insert into emailcerts set
`CN`='$defaultemail',
`keytype`='".sanitizeHTML($_REQUEST['keytype'])."',
- `memid`='".$_SESSION['profile']['id']."',
+ `memid`='".intval($_SESSION['profile']['id'])."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
`subject`='".mysql_real_escape_string($csrsubject)."',
- `codesign`='".$_SESSION['_config']['codesign']."',
+ `codesign`='".intval($_SESSION['_config']['codesign'])."',
`disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `description`='".$_SESSION['_config']['description']."'";
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
if(is_array($addys))
@@ -653,7 +655,7 @@ function buildSubjectFromSession() {
$hash = make_hash();
$query = "insert into `domains` set `domain`='".mysql_real_escape_string($_SESSION['_config']['domain'])."',
- `memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'";
+ `memid`='".intval($_SESSION['profile']['id'])."',`created`=NOW(),`hash`='$hash'";
mysql_query($query);
$domainid = mysql_insert_id();
@@ -681,7 +683,7 @@ function buildSubjectFromSession() {
foreach($_REQUEST['delid'] as $id)
{
$id = intval($id);
- $query = "select * from `domains` where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ $query = "select * from `domains` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -726,11 +728,7 @@ function buildSubjectFromSession() {
exit;
}
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
$_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id10CSR");
$fp = fopen($_SESSION['_config']['tmpfname'], "w");
@@ -809,14 +807,14 @@ function buildSubjectFromSession() {
`domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."',
`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
- `description`='".$_SESSION['_config']['description']."'";
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
} elseif(array_key_exists('0',$_SESSION['_config']['altid']) && $_SESSION['_config']['altid']['0'] > 0) {
$query = "insert into `domaincerts` set
`CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
`domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."',
`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
- `description`='".$_SESSION['_config']['description']."'";
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
} else {
showheader(_("My CAcert.org Account!"));
echo _("Domain not verified.");
@@ -870,7 +868,7 @@ function buildSubjectFromSession() {
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
- `domains`.`memid`='".$_SESSION['profile']['id']."'";
+ `domains`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -963,7 +961,7 @@ function buildSubjectFromSession() {
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
- `domains`.`memid`='".$_SESSION['profile']['id']."'";
+ `domains`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -998,7 +996,7 @@ function buildSubjectFromSession() {
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
- `domains`.`memid`='".$_SESSION['profile']['id']."'";
+ `domains`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1049,7 +1047,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
- where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1123,7 +1121,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
- where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1155,7 +1153,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts`
- where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1187,14 +1185,14 @@ function buildSubjectFromSession() {
{
$cid = intval(substr($id,5));
$dis=(array_key_exists('disablelogin_'.$cid,$_REQUEST) && $_REQUEST['disablelogin_'.$cid]=="1")?"0":"1";
- mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+ mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$cid' and `memid`='".intval($_SESSION['profile']['id'])."'");
}
if(substr($id,0,14)=="check_comment_")
{
$cid = intval(substr($id,14));
if(!empty($_REQUEST['check_comment_'.$cid])) {
$comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
- mysql_query("update `emailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+ mysql_query("update `emailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".intval($_SESSION['profile']['id'])."'");
}
}
}
@@ -1268,7 +1266,7 @@ function buildSubjectFromSession() {
if($oldid == 13 && $process != "")
{
- $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$ddres = mysql_query($ddquery);
$ddrow = mysql_fetch_assoc($ddres);
$_SESSION['profile']['points'] = $ddrow['total'];
@@ -1308,7 +1306,7 @@ function buildSubjectFromSession() {
`lname`='".$_SESSION['_config']['user']['lname']."',
`suffix`='".$_SESSION['_config']['user']['suffix']."',
`dob`='".$_SESSION['_config']['user']['year']."-".$_SESSION['_config']['user']['month']."-".$_SESSION['_config']['user']['day']."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
}
if ($showdetails!="") {
@@ -1322,25 +1320,25 @@ function buildSubjectFromSession() {
`A3`='".$_SESSION['_config']['user']['A3']."',
`A4`='".$_SESSION['_config']['user']['A4']."',
`A5`='".$_SESSION['_config']['user']['A5']."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
}
//!!!Should be rewritten
- $_SESSION['_config']['user']['otphash'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otphash']))));
- $_SESSION['_config']['user']['otppin'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otppin']))));
+ $_SESSION['_config']['user']['otphash'] = trim(stripslashes(strip_tags($_REQUEST['otphash'])));
+ $_SESSION['_config']['user']['otppin'] = trim(stripslashes(strip_tags($_REQUEST['otppin'])));
if($_SESSION['_config']['user']['otphash'] != "" && $_SESSION['_config']['user']['otppin'] != "")
{
- $query = "update `users` set `otphash`='".$_SESSION['_config']['user']['otphash']."',
- `otppin`='".$_SESSION['_config']['user']['otppin']."' where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `otphash`='".mysql_real_escape_string($_SESSION['_config']['user']['otphash'])."',
+ `otppin`='".mysql_real_escape_string($_SESSION['_config']['user']['otppin'])."' where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
}
$_SESSION['_config']['user']['set'] = 0;
- $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'"));
+ $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
$_SESSION['profile']['loggedin'] = 1;
- $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$ddres = mysql_query($ddquery);
$ddrow = mysql_fetch_assoc($ddres);
$_SESSION['profile']['points'] = $ddrow['total'];
@@ -1374,7 +1372,7 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['hostname'] != $_SESSION['_config']['securehostname'])
{
- $match = mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."' and
+ $match = mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."' and
(`password`=old_password('".$_SESSION['_config']['user']['oldpass']."') or
`password`=sha1('".$_SESSION['_config']['user']['oldpass']."'))");
$rc = mysql_num_rows($match);
@@ -1396,7 +1394,7 @@ function buildSubjectFromSession() {
echo _("You failed to correctly enter your current Pass Phrase.");
} else {
mysql_query("update `users` set `password`=sha1('".$_SESSION['_config']['user']['pword1']."')
- where `id`='".$_SESSION['profile']['id']."'");
+ where `id`='".intval($_SESSION['profile']['id'])."'");
echo '<h3>', _("Pass Phrase Changed Successfully"), '</h3>', "\n";
echo _("Your Pass Phrase has been updated and your primary email account has been notified of the change.");
$body = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n\n";
@@ -1438,14 +1436,9 @@ function buildSubjectFromSession() {
$_SESSION['_config']['emails'][] = $val;
}
$_SESSION['_config']['name'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['name'])));
- $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU'])));
-
+ $_SESSION['_config']['OU'] = stripslashes(trim($_REQUEST['OU']));
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
}
if($oldid == 16 && (intval(count($_SESSION['_config']['emails'])) + 0) <= 0)
@@ -1474,11 +1467,7 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
$_SESSION['_config']['rootcert'] = 1;
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
if(@count($_SESSION['_config']['emails']) > 0)
$id = 17;
@@ -1514,7 +1503,7 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['name'] != "")
$emails .= "commonName = ".$_SESSION['_config']['name']."\n";
if($_SESSION['_config']['OU'])
- $emails .= "organizationalUnitName = ".$_SESSION['_config']['OU']."\n";
+ $emails .= "organizationalUnitName = ".mysql_real_escape_string($_SESSION['_config']['OU'])."\n";
if($org['O'])
$emails .= "organizationName = ".$org['O']."\n";
if($org['L'])
@@ -1539,13 +1528,13 @@ function buildSubjectFromSession() {
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
- `ou`='".$_SESSION['_config']['OU']."',
+ `ou`='".mysql_real_escape_string($_SESSION['_config']['OU'])."',
`keytype`='NS',
- `orgid`='".$org['orgid']."',
+ `orgid`='".intval($org['orgid'])."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `codesign`='".$_SESSION['_config']['codesign']."',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `description`='".$_SESSION['_config']['description']."'";
+ `codesign`='".intval($_SESSION['_config']['codesign'])."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
@@ -1633,14 +1622,14 @@ function buildSubjectFromSession() {
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
- `ou`='".$_SESSION['_config']['OU']."',
+ `ou`='".mysql_real_escape_string($_SESSION['_config']['OU'])."',
`keytype`='" . sanitizeHTML($_REQUEST['keytype']) . "',
- `orgid`='".$org['orgid']."',
+ `orgid`='".intval($org['orgid'])."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `subject`='$csrsubject',
- `codesign`='".$_SESSION['_config']['codesign']."',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `description`='".$_SESSION['_config']['description']."'";
+ `subject`='".mysql_real_escape_string($csrsubject)."',
+ `codesign`='".intval($_SESSION['_config']['codesign'])."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
@@ -1682,7 +1671,7 @@ function buildSubjectFromSession() {
echo "Renewing certificate #$id ...\n<br/>";
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org`
- where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
+ where `orgemailcerts`.`id`='$id' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orgemailcerts`.`orgid`";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -1755,7 +1744,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org`
- where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
+ where `orgemailcerts`.`id`='".intval($id)."' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orgemailcerts`.`orgid`";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -1788,7 +1777,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `orgemailcerts`, `org`
- where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
+ where `orgemailcerts`.`id`='".intval($id)."' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orgemailcerts`.`orgid`";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -1858,11 +1847,7 @@ function buildSubjectFromSession() {
exit;
}
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
$_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id20CSR");
$fp = fopen($_SESSION['_config']['tmpfname'], "w");
@@ -1883,16 +1868,16 @@ function buildSubjectFromSession() {
getalt2();
$query = "select * from `orginfo`,`org`,`orgdomains` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`org`.`orgid`=`orgdomains`.`orgid` and
- `orgdomains`.`domain`='".$_SESSION['_config']['0.CN']."'";
+ `orgdomains`.`domain`='".mysql_real_escape_string($_SESSION['_config']['0.CN'])."'";
$_SESSION['_config']['CNorg'] = mysql_fetch_assoc(mysql_query($query));
$query = "select * from `orginfo`,`org`,`orgdomains` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`org`.`orgid`=`orgdomains`.`orgid` and
- `orgdomains`.`domain`='".$_SESSION['_config']['0.subjectAltName']."'";
+ `orgdomains`.`domain`='".mysql_real_escape_string($_SESSION['_config']['0.subjectAltName'])."'";
$_SESSION['_config']['SANorg'] = mysql_fetch_assoc(mysql_query($query));
//echo "<pre>"; print_r($_SESSION['_config']); die;
@@ -1942,14 +1927,14 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rowid']['0'] > 0)
{
$query = "select * from `org`,`orginfo` where
- `orginfo`.`id`='".$_SESSION['_config']['rowid']['0']."' and
+ `orginfo`.`id`='".intval($_SESSION['_config']['rowid']['0'])."' and
`orginfo`.`id`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
} else {
$query = "select * from `org`,`orginfo` where
- `orginfo`.`id`='".$_SESSION['_config']['altid']['0']."' and
+ `orginfo`.`id`='".intval($_SESSION['_config']['altid']['0'])."' and
`orginfo`.`id`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
}
$org = mysql_fetch_assoc(mysql_query($query));
$csrsubject = "";
@@ -1977,22 +1962,22 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rowid']['0'] > 0)
{
$query = "insert into `orgdomaincerts` set
- `CN`='".$_SESSION['_config']['rows']['0']."',
- `orgid`='".$org['id']."',
+ `CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."',
+ `orgid`='".intval($org['id'])."',
`created`=NOW(),
- `subject`='$csrsubject',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `type`='$type',
- `description`='".$_SESSION['_config']['description']."'";
+ `subject`='".mysql_real_escape_string($csrsubject)."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `type`='".$type."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
} else {
$query = "insert into `orgdomaincerts` set
- `CN`='".$_SESSION['_config']['altrows']['0']."',
- `orgid`='".$org['id']."',
+ `CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
+ `orgid`='".intval($org['id'])."',
`created`=NOW(),
- `subject`='$csrsubject',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `type`='$type',
- `description`='".$_SESSION['_config']['description']."'";
+ `subject`='".mysql_real_escape_string($csrsubject)."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `type`='".$type."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
}
mysql_query($query);
$CSRid = mysql_insert_id();
@@ -2003,10 +1988,10 @@ function buildSubjectFromSession() {
mysql_query("update `orgdomaincerts` set `CSR_name`='$CSRname' where `id`='$CSRid'");
if(is_array($_SESSION['_config']['rowid']))
foreach($_SESSION['_config']['rowid'] as $id)
- mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'");
+ mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($id)."', `orgcertid`='$CSRid'");
if(is_array($_SESSION['_config']['altid']))
foreach($_SESSION['_config']['altid'] as $id)
- mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'");
+ mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($id)."', `orgcertid`='$CSRid'");
waitForResult("orgdomaincerts", $CSRid,$oldid);
$query = "select * from `orgdomaincerts` where `id`='$CSRid' and `crt_name` != ''";
$res = mysql_query($query);
@@ -2037,7 +2022,7 @@ function buildSubjectFromSession() {
`orgdomaincerts`,`org`
where `orgdomaincerts`.`id`='$id' and
`orgdomaincerts`.`orgid`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -2116,7 +2101,7 @@ function buildSubjectFromSession() {
`orgdomaincerts`,`org`
where `orgdomaincerts`.`id`='$id' and
`orgdomaincerts`.`orgid`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -2151,7 +2136,7 @@ function buildSubjectFromSession() {
`orgdomaincerts`,`org`
where `orgdomaincerts`.`id`='$id' and
`orgdomaincerts`.`orgid`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -2267,7 +2252,7 @@ function buildSubjectFromSession() {
`ST`='".$_SESSION['_config']['ST']."',
`C`='".$_SESSION['_config']['C']."',
`comments`='".$_SESSION['_config']['comments']."'
- where `id`='".$_SESSION['_config']['orgid']."'");
+ where `id`='".intval($_SESSION['_config']['orgid'])."'");
showheader(_("My CAcert.org Account!"));
printf(_("'%s' has just been successfully updated in the database."), sanitizeHTML($_SESSION['_config']['O']));
showfooter();
@@ -2451,7 +2436,7 @@ function buildSubjectFromSession() {
else
$masteracc = $_SESSION['_config']['masteracc'] = 0;
$_REQUEST['email'] = $_SESSION['_config']['email'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['email'])));
- $OU = $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU'])));
+ $_SESSION['_config']['OU'] = stripslashes(trim($_REQUEST['OU']));
$comments = $_SESSION['_config']['comments'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['comments'])));
$res = mysql_query("select * from `users` where `email`='".$_REQUEST['email']."' and `deleted`=0");
if(mysql_num_rows($res) <= 0)
@@ -2473,7 +2458,7 @@ function buildSubjectFromSession() {
set `memid`='".intval($row['id'])."',
`orgid`='".intval($_SESSION['_config']['orgid'])."',
`masteracc`='$masteracc',
- `OU`='$OU',
+ `OU`='".mysql_real_escape_string($_SESSION['_config']['OU'])."',
`comments`='$comments'");
}
}
@@ -2482,7 +2467,7 @@ function buildSubjectFromSession() {
if(($oldid == 34 || $id == 34) && $_SESSION['profile']['orgadmin'] != 1)
{
$orgid = intval($_SESSION['_config']['orgid']);
- $res = mysql_query("select * from `org` where `orgid`='$orgid' and `memid`='".$_SESSION['profile']['id']."' and `masteracc`='1'");
+ $res = mysql_query("select * from `org` where `orgid`='$orgid' and `memid`='".intval($_SESSION['profile']['id'])."' and `masteracc`='1'");
if(mysql_num_rows($res) <= 0)
$id = 32;
}
@@ -2541,7 +2526,7 @@ function buildSubjectFromSession() {
{
if($key == $lang)
{
- mysql_query("update `users` set `language`='$lang' where `id`='".$_SESSION['profile']['id']."'");
+ mysql_query("update `users` set `language`='$lang' where `id`='".intval($_SESSION['profile']['id'])."'");
$_SESSION['profile']['language'] = $lang;
showheader(_("My CAcert.org Account!"));
echo _("Your language setting has been updated.");
@@ -2696,10 +2681,27 @@ function buildSubjectFromSession() {
$oldid=0;
}
- if($oldid == 43 && $_REQUEST['action'] == "updatedob")
+ //check if ticket number was entered
+ if ( $id == 43 || $oldid == 43 || $id == 44 || $oldid == 44 ) {
+ if ($ticketno != "" ) {
+ $ticketno = trim($_REQUEST['ticketno']);
+ $ticketvalidation = valid_ticket_number($ticketno);
+ }
+
+ $_SESSION['ticketno'] = $ticketno;
+ }
+
+ if($oldid == 43 && $actionrequest == "updatedob" && $ticketvalidation == TRUE)
{
$id = 43;
$oldid=0;
+ $userid = intval($_REQUEST['userid']);
+ if (!write_se_log($userid, $_SESSION['profile']['id'],'SE Name/DOB Change',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$fname = mysql_real_escape_string($_REQUEST['fname']);
$mname = mysql_real_escape_string($_REQUEST['mname']);
$lname = mysql_real_escape_string($_REQUEST['lname']);
@@ -2707,21 +2709,29 @@ function buildSubjectFromSession() {
$day = intval($_REQUEST['day']);
$month = intval($_REQUEST['month']);
$year = intval($_REQUEST['year']);
- $userid = intval($_REQUEST['userid']);
- $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'";
- $details = mysql_fetch_assoc(mysql_query($query));
- $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}',
- `new-lname`='$lname',`new-dob`='$year-$month-$day',`uid`='$userid',`adminid`='".$_SESSION['profile']['id']."'";
- mysql_query($query);
$query = "update `users` set `fname`='$fname',`mname`='$mname',`lname`='$lname',`suffix`='$suffix',`dob`='$year-$month-$day' where `id`='$userid'";
mysql_query($query);
+ }elseif($oldid == 43 && $actionrequest == "updatedob" && $ticketvalidation == FALSE){
+ $id = 43;
+ $oldid=0;
+ $_SESSION['ticketmsg']='No action (name/dob change) taken. Ticket number is missing!';
}
- if($oldid == 43 && $_REQUEST['action'] == 'revokecert')
+ if($oldid == 43 && $actionrequest == 'revokecert' && $ticketvalidation == TRUE)
{
$userid = intval($_REQUEST['userid']);
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE Revoke all certificates',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
revoke_all_private_cert($userid);
$id=43;
+ }elseif($oldid == 43 && $actionrequest == "revokecert" && $ticketvalidation == FALSE){
+ $id = 43;
+ $oldid=0;
+ $_SESSION['ticketmsg']='No certificates revokes. Ticket number is missing!';
}
if($oldid == 48 && $_REQUEST['domain'] == "")
@@ -2738,8 +2748,7 @@ function buildSubjectFromSession() {
if($id == 44)
{
- if($_REQUEST['userid'] != "")
- $_REQUEST['userid'] = intval($_REQUEST['userid']);
+ $_REQUEST['userid'] = intval($_REQUEST['userid']);
$row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
if($row['email'] == "")
$id = 42;
@@ -2747,13 +2756,19 @@ function buildSubjectFromSession() {
$_REQUEST['email'] = $row['email'];
}
- if($oldid == 44)
+ if($oldid == 44 && $ticketvalidation == TRUE)
{
showheader(_("My CAcert.org Account!"));
if(intval($_REQUEST['userid']) <= 0)
{
echo _("No such user found.");
} else {
+ if (!write_se_log(intval($_REQUEST['userid']), $_SESSION['profile']['id'],'SE reset password',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
mysql_query("update `users` set `password`=sha1('".mysql_real_escape_string(stripslashes($_REQUEST['newpass']))."') where `id`='".intval($_REQUEST['userid'])."'");
$row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
printf(_("The password for %s has been updated successfully in the system."), sanitizeHTML($row['email']));
@@ -2771,8 +2786,11 @@ function buildSubjectFromSession() {
showfooter();
exit;
+ }elseif($oldid == 44 && $ticketvalidation == FALSE){
+ $_SESSION['ticketmsg']='No password reset taken. Ticket number is missing!';
}
+
if($process != "" && $oldid == 45)
{
$CSR = clean_csr($CSR);
@@ -2839,10 +2857,10 @@ function buildSubjectFromSession() {
$CSRid = mysql_insert_id();
foreach($_SESSION['_config']['rowid'] as $dom)
- mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
+ mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='".intval($dom)."'");
if(is_array($_SESSION['_config']['altid']))
foreach($_SESSION['_config']['altid'] as $dom)
- mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
+ mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='".intval($dom)."'");
$CSRname=generatecertpath("csr","server",$CSRid);
$fp = fopen($CSRname, "w");
@@ -2865,150 +2883,279 @@ function buildSubjectFromSession() {
}
}
- if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0)
+ /* presently not needed
+ if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0 && $ticketvalidation==TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['tverify']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change tverify status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['tverify'];
mysql_query("update `users` set `tverify`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0 && $ticketvalidation==FALSE){
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
+ */
- if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0)
+ if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admsetassuret');
$memid = $_REQUEST['userid'] = intval($_REQUEST['assurer']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change assurer status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['assurer'];
mysql_query("update `users` set `assurer`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['assurer']);
+ $_SESSION['ticketmsg']='No action (Change assurer status) taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0)
+ if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change assurer blocked status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['assurer_blocked'];
mysql_query("update `users` set `assurer_blocked`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0)
+ if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admactlock');
$memid = $_REQUEST['userid'] = intval($_REQUEST['locked']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change locked status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['locked'];
mysql_query("update `users` set `locked`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['locked']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0)
+ if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admcodesign');
$memid = $_REQUEST['userid'] = intval($_REQUEST['codesign']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change codesign status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['codesign'];
mysql_query("update `users` set `codesign`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['codesign']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0)
+ if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admorgadmin');
$memid = $_REQUEST['userid'] = intval($_REQUEST['orgadmin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change org assuer status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['orgadmin'];
mysql_query("update `users` set `orgadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['orgadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0)
+ if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admttpadmin');
$memid = $_REQUEST['userid'] = intval($_REQUEST['ttpadmin']);
+ if(!write_se_log($memid, $_SESSION['profile']['id'],'SE Change ttp admin status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['ttpadmin'];
mysql_query("update `users` set `ttpadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['ttpadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0)
+ if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['adadmin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change advertising admin status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = $row['adadmin'] + 1;
if($ver > 2)
$ver = 0;
mysql_query("update `users` set `adadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['adadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0)
+ if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['locadmin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change location admin status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['locadmin'];
mysql_query("update `users` set `locadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['locadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0)
+ if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admsetadmin');
$memid = $_REQUEST['userid'] = intval($_REQUEST['admin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change SE status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['admin'];
mysql_query("update `users` set `admin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['admin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0)
+ if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['general']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change general status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['general'];
mysql_query("update `alerts` set `general`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['general']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0)
+ if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['country']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change country status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['country'];
mysql_query("update `alerts` set `country`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['country']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0)
+ if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['regional']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change regional status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['regional'];
mysql_query("update `alerts` set `regional`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['regional']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0)
+ if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['radius']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change radius status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['radius'];
mysql_query("update `alerts` set `radius`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0 && $ticketvalidation == false){
+ $_REQUEST['userid'] = intval($_REQUEST['radius']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
if($id == 50)
{
- if(array_key_exists('userid',$_REQUEST) && $_REQUEST['userid'] != "")
+ if(array_key_exists('userid',$_REQUEST) && $_REQUEST['userid'] !== "") {
$_REQUEST['userid'] = intval($_REQUEST['userid']);
+ }
$row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
- if($row['email'] == "")
+ if($row['email'] == "") {
$id = 42;
- else
+ } else {
$_REQUEST['email'] = $row['email'];
+ }
}
if($oldid == 50)
@@ -3023,151 +3170,69 @@ function buildSubjectFromSession() {
if (trim($_REQUEST['arbitrationno'])==""){
showheader(_("My CAcert.org Account!"));
echo _("You did not enter an arbitration number entry.");
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
if ( 1 !== preg_match('/^[a-z]\d{8}\.\d+\.\d+$/i',trim($_REQUEST['arbitrationno'])) ) {
showheader(_("My CAcert.org Account!"));
printf(_("'%s' is not a valid arbitration number entry."), sanitizeHTML(trim($_REQUEST['arbitrationno'])));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
if (check_email_exists(trim($_REQUEST['arbitrationno']).'@cacert.org')) {
showheader(_("My CAcert.org Account!"));
printf(_("The email address '%s' is already in a different account. Can't continue."), sanitizeHTML($_REQUEST['arbitrationno'].'@cacert.org'));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
- }
- if (check_client_cert_running($_REQUEST['userid'],1) ||
- check_server_cert_running($_REQUEST['userid'],1) ||
- check_gpg_cert_running($_REQUEST['userid'],1)) {
+ }
+ if (check_client_cert_running(intval($_REQUEST['userid']),1) ||
+ check_server_cert_running(intval($_REQUEST['userid']),1) ||
+ check_gpg_cert_running(intval($_REQUEST['userid']),1)) {
showheader(_("My CAcert.org Account!"));
printf(_("The CCA retention time for at least one certificate is not over. Can't continue."));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
- if (check_is_orgadmin($_REQUEST['userid'],1)) {
+ if (check_is_orgadmin(intval($_REQUEST['userid']),1)) {
showheader(_("My CAcert.org Account!"));
printf(_("The user is listed as Organisation Administrator. Can't continue."));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
+ showfooter();
+ exit;
+ }
+ if (!write_se_log(intval($_REQUEST['userid']), $_SESSION['profile']['id'], 'SE Account delete', trim($_REQUEST['arbitrationno']))) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
- account_delete($_REQUEST['userid'], trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']);
+ account_delete(intval($_REQUEST['userid']), trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']);
}
- if(($id == 51 || $id == 52 || $oldid == 52) && $_SESSION['profile']['tverify'] <= 0)
+ if(($id == 51 || $id == 52 || $oldid == 52))
{
showheader(_("My CAcert.org Account!"));
- echo _("You don't have access to this area.");
+ echo _("You don't have access to this area.\nThe Tverify programme is terminated as of 16th November 2010" );
showfooter();
exit;
}
- if($oldid == 52)
- {
- $uid = intval($_REQUEST['uid']);
- $query = "select * from `tverify` where `id`='$uid' and `modified`=0";
- $rc = mysql_num_rows(mysql_query($query));
- if($rc <= 0)
- {
- showheader(_("My CAcert.org Account!"));
- echo _("Unable to find a valid tverify request for this ID.");
- showfooter();
- exit;
- }
- }
-
- if($oldid == 52)
- {
- $query = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".$_SESSION['profile']['id']."'";
- $rc = mysql_num_rows(mysql_query($query));
- if($rc > 0)
+ if($id == 59){
+ if (!($oldid == 43 && $_SESSION['profile']['admin'] == 1) &&
+ !($oldid == 13 && intval($_REQUEST['userid']) == $_SESSION['profile']['id']))
{
showheader(_("My CAcert.org Account!"));
- echo _("You have already voted on this request.");
+ echo _("You do not have access to this page.");
showfooter();
exit;
}
}
- if($oldid == 52 && ($_REQUEST['agree'] != "" || $_REQUEST['disagree'] != ""))
- {
- $vote = -1;
- if($_REQUEST['agree'] != "")
- $vote = 1;
-
- $query = "insert into `tverify-vote` set
- `tverify`='$uid',
- `memid`='".$_SESSION['profile']['id']."',
- `when`=NOW(), `vote`='$vote',
- `comment`='".mysql_real_escape_string($_REQUEST['comment'])."'";
- mysql_query($query);
-
- $rc = mysql_num_rows(mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='1'"));
- if($rc >= 8)
- {
- mysql_query("update `tverify` set `modified`=NOW() where `id`='$uid'");
- $tverify = mysql_fetch_assoc(mysql_query("select * from `tverify` where `id`='$uid'"));
- $memid = $tverify['memid'];
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$memid'"));
- $tmp = mysql_fetch_assoc(mysql_query("select sum(`points`) as `points` from `notary` where `to`='$memid'"));
-
- $points = 0;
- if($tverify['URL'] != "" && $tverify['photoid'] != "")
- $points = 150 - intval($tmp['points']);
- if($tverify['URL'] != "" && $tverify['photoid'] == "")
- $points = 90 - intval($tmp['points']);
- if($tverify['URL'] == "" && $tverify['photoid'] == "")
- $points = 50 - intval($tmp['points']);
-
- if($points < 0)
- $points = 0;
-
- if($points > 0)
- {
- mysql_query("insert into `notary` set `from`='0', `to`='$memid', `points`='$points',
- `method`='Thawte Points Transfer', `when`=NOW()");
- fix_assurer_flag($memid);
- }
- $totalpoints = intval($tmp['points']) + $points;
-
- $body = _("Your request to have points transfered was successful. You were issued $points points as a result, and you now have $totalpoints in total")."\n\n"._("The following comments were made by reviewers")."\n\n";
- $res = mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='1'");
- while($row = mysql_fetch_assoc($res))
- $body .= $row['comment']."\n";
- $body .= "\n";
-
- $body .= _("Best regards")."\n";
- $body .= _("CAcert Support Team");
- sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");
- }
-
- $rc = mysql_num_rows(mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='-1'"));
- if($rc >= 4)
- {
- mysql_query("update `tverify` set `modified`=NOW() where `id`='$uid'");
- $tverify = mysql_fetch_assoc(mysql_query("select * from `tverify` where `id`='$uid'"));
- $memid = $tverify['memid'];
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$memid'"));
-
- $body = _("Unfortunately your request for a points increase has been denied, below is the comments from people that reviewed your request as to why they rejected your application.")."\n\n";
- $res = mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='-1'");
- while($row = mysql_fetch_assoc($res))
- $body .= $row['comment']."\n";
- $body .= "\n";
-
- $body .= _("You are welcome to try submitting another request at any time in the future, please make sure you take the reviewer comments into consideration or you risk having your application rejected again.")."\n\n";
-
- $body .= _("Best regards")."\n";
- $body .= _("CAcert Support Team");
- sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");
- }
-
- showheader(_("My CAcert.org Account!"));
- echo _("Your vote has been accepted.");
- showfooter();
- exit;
- }
if(intval($cert) > 0)
$_SESSION['_config']['cert'] = intval($cert);
diff --git a/includes/general.php b/includes/general.php
index f36ccdf..854aab4 100644
--- a/includes/general.php
+++ b/includes/general.php
@@ -57,7 +57,7 @@
exit;
}
- if(array_key_exists('HTTP_HOST',$_SERVER) &&
+ if(array_key_exists('HTTP_HOST',$_SERVER) &&
($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] ||
$_SERVER['HTTP_HOST'] == $_SESSION['_config']['tverify']))
{
@@ -77,12 +77,12 @@
L10n::detect_language();
L10n::init_gettext();
- if(array_key_exists('profile',$_SESSION) && is_array($_SESSION['profile']) && array_key_exists('id',$_SESSION['profile']) && $_SESSION['profile']['id'] > 0)
+ if(array_key_exists('profile',$_SESSION) && is_array($_SESSION['profile']) && array_key_exists('id',$_SESSION['profile']) && $_SESSION['profile']['id'] > 0)
{
- $locked = mysql_fetch_assoc(mysql_query("select `locked` from `users` where `id`='".$_SESSION['profile']['id']."'"));
+ $locked = mysql_fetch_assoc(mysql_query("select `locked` from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
if($locked['locked'] == 0)
{
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -169,19 +169,19 @@
$points++;
//echo "Points due to length and charset: $points<br/>";
-
+
// check for historical password proposal
if ($pwd === "Fr3d Sm|7h") {
return 0;
}
-
+
return $points;
}
function checkpw($pwd, $email, $fname, $mname, $lname, $suffix)
{
$points = checkpwlight($pwd);
-
+
if(@strstr(strtolower($pwd), strtolower($email)))
$points--;
@@ -232,7 +232,7 @@
{
$bits = explode(": ", $_SESSION['_config']['subject'], 2);
$bits = str_replace(", ", "|", str_replace("/", "|", array_key_exists('1',$bits)?$bits['1']:""));
- $bits = explode("|", $bits);
+ $bits = explode("|", $bits);
$_SESSION['_config']['cnc'] = $_SESSION['_config']['subaltc'] = 0;
$_SESSION['_config']['OU'] = "";
@@ -287,7 +287,7 @@
$dom = $bits[$i];
$_SESSION['_config']['row'] = "";
$dom = mysql_real_escape_string($dom);
- $query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
+ $query = "select * from domains where `memid`='".intval($_SESSION['profile']['id'])."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -339,7 +339,7 @@
$dom = $bits[$i];
$_SESSION['_config']['altrow'] = "";
$dom = mysql_real_escape_string($dom);
- $query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
+ $query = "select * from domains where `memid`='".intval($_SESSION['profile']['id'])."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -378,7 +378,7 @@
$_SESSION['_config']['row'] = "";
$dom = mysql_real_escape_string($dom);
$query = "select *, `orginfo`.`id` as `id` from `orginfo`,`orgdomains`,`org` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`orgdomains`.`orgid`=`orginfo`.`id` and
`orgdomains`.`domain`='$dom'";
@@ -426,7 +426,7 @@
$_SESSION['_config']['altrow'] = "";
$dom = mysql_real_escape_string($dom);
$query = "select * from `orginfo`,`orgdomains`,`org` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`orgdomains`.`orgid`=`orginfo`.`id` and
`orgdomains`.`domain`='$dom'";
@@ -458,7 +458,7 @@
$dom = $bits[$i];
$dom = mysql_real_escape_string($dom);
$query = "select * from `org`,`orgdomains`,`orginfo`
- where `org`.`memid`='".$_SESSION['profile']['id']."'
+ where `org`.`memid`='".intval($_SESSION['profile']['id'])."'
and `orgdomains`.`orgid`=`org`.`orgid`
and `orginfo`.`id`=`org`.`orgid`
and `orgdomains`.`domain`='$dom'";
@@ -477,12 +477,12 @@
if($id <= 0)
$id = $_SESSION['profile']['id'];
- $query = "select sum(`points`) as `points` from `notary` where `to`='$id' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='$id' and `deleted` = 0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
$dob = date("Y-m-d", mktime(0,0,0,date("m"),date("d"),date("Y")-18));
- $query = "select * from `users` where `id`='".$_SESSION['profile']['id']."' and `dob` < '$dob'";
+ $query = "select * from `users` where `id`='".intval($_SESSION['profile']['id'])."' and `dob` < '$dob'";
if(mysql_num_rows(mysql_query($query)) < 1)
{
if($points >= 100)
@@ -557,7 +557,7 @@
$fp = @fsockopen($domain,25,$errno,$errstr,5);
if($fp)
{
-
+
$line = fgets($fp, 4096);
while(substr($line, 0, 4) == "220-")
$line = fgets($fp, 4096);
@@ -581,7 +581,7 @@
$line = mysql_real_escape_string(trim(strip_tags($line)));
$query = "insert into `pinglog` set `when`=NOW(), `email`='$myemail', `result`='$line'";
- if(is_array($_SESSION['profile'])) $query.=", `uid`='".$_SESSION['profile']['id']."'";
+ if(is_array($_SESSION['profile'])) $query.=", `uid`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
if(substr($line, 0, 3) != "250")
@@ -591,7 +591,7 @@
}
}
}
- $query = "insert into `pinglog` set `when`=NOW(), `uid`='".$_SESSION['profile']['id']."',
+ $query = "insert into `pinglog` set `when`=NOW(), `uid`='".intval($_SESSION['profile']['id'])."',
`email`='$myemail', `result`='Failed to make a connection to the mail server'";
mysql_query($query);
return _("Failed to make a connection to the mail server");
@@ -662,7 +662,7 @@
return $ticket;
}
- function sanitizeHTML($input)
+ function sanitizeHTML($input)
{
return htmlentities(strip_tags($input), ENT_QUOTES);
//In case of problems, please use the following line again:
@@ -732,7 +732,7 @@
$text=preg_replace("/[^\w-.@]/","",$text);
return($text);
}
-
+
// returns text message to be shown to the user given the result of is_no_assurer
function no_assurer_text($Status)
@@ -775,7 +775,7 @@
$name="../$type/$kind/".intval($id/1000)."/$kind-".intval($id).".$type";
if (!is_dir("../csr")) { mkdir("../csr",0777); }
if (!is_dir("../crt")) { mkdir("../crt",0777); }
-
+
if (!is_dir("../csr/$kind")) { mkdir("../csr/$kind",0777); }
if (!is_dir("../crt/$kind")) { mkdir("../crt/$kind",0777); }
if (!is_dir("../csr/$kind/".intval($id/1000))) { mkdir("../csr/$kind/".intval($id/1000)); }
diff --git a/includes/lib/account.php b/includes/lib/account.php
index e311668..4c4d5ac 100644
--- a/includes/lib/account.php
+++ b/includes/lib/account.php
@@ -19,10 +19,10 @@
/**
* Function to recalculate the cached Assurer status
- *
+ *
* @param int $userID
* if the user ID is not given the flag will be recalculated for all users
- *
+ *
* @return bool
* false if there was an error on fixing the flag. This does NOT return the
* new value of the flag
@@ -30,7 +30,7 @@
function fix_assurer_flag($userID = NULL)
{
// Update Assurer-Flag on users table if 100 points and CATS passed.
- //
+ //
// We may have some performance issues here if no userID is given
// there are ~150k assurances and ~220k users currently
// but the exists-clause on cats_passed should be a good filter
@@ -46,20 +46,21 @@ function fix_assurer_flag($userID = NULL)
WHERE `cp`.`variant_id` = `cv`.`id`
AND `cv`.`type_id` = 1
AND `cp`.`user_id` = `u`.`id`
- )
+ )
AND (
SELECT SUM(`points`) FROM `notary` AS `n`
WHERE `n`.`to` = `u`.`id`
AND (`n`.`expire` > now()
- OR `n`.`expire` IS NULL)
+ OR `n`.`expire` IS NULL)
+ AND `n`.`deleted` = 0
) >= 100';
-
+
$query = mysql_query($sql);
if (!$query) {
return false;
}
// Challenge has been passed and non-expired points >= 100
-
+
// Reset flag if requirements are not met
//
// Also a bit performance critical but assurer flag is only set on
@@ -86,13 +87,14 @@ function fix_assurer_flag($userID = NULL)
`n`.`expire` > now()
OR `n`.`expire` IS NULL
)
+ AND `n`.`deleted` = 0
) < 100
)';
-
+
$query = mysql_query($sql);
if (!$query) {
return false;
}
-
+
return true;
-} \ No newline at end of file
+}
diff --git a/includes/lib/general.php b/includes/lib/general.php
index 85b132d..127c6b7 100644
--- a/includes/lib/general.php
+++ b/includes/lib/general.php
@@ -18,10 +18,10 @@
/**
* Checks if the user may log in and retrieve the user id
- *
+ *
* Usually called with $_SERVER['SSL_CLIENT_M_SERIAL'] and
* $_SERVER['SSL_CLIENT_I_DN_CN']
- *
+ *
* @param $serial string
* usually $_SERVER['SSL_CLIENT_M_SERIAL']
* @param $issuer_cn string
@@ -43,7 +43,7 @@ function get_user_id_from_cert($serial, $issuer_cn)
$row = mysql_fetch_assoc($res);
return intval($row['memid']);
}
-
+
return -1;
}
@@ -71,7 +71,7 @@ function failWithId($errormessage) {
/**
* Runs a command on the shell and return it's exit code and output
- *
+ *
* @param string $command
* The command to run. Make sure that you escapeshellarg() any non-constant
* parts as this is executed on a shell!
@@ -85,7 +85,7 @@ function failWithId($errormessage) {
* @param string|bool $errors
* The output the command wrote to STDERR (this is passed as reference),
* if true (default) the output will be written to the real STDERR
- *
+ *
* @return int|bool
* The exit code of the command, true if the execution of the command
* failed (true because then
@@ -93,38 +93,38 @@ function failWithId($errormessage) {
*/
function runCommand($command, $input = "", &$output = null, &$errors = true) {
$descriptorspec = array();
-
+
if ($input !== true) {
$descriptorspec[0] = array("pipe", "r"); // STDIN for child
}
-
+
if ($output !== true) {
$descriptorspec[1] = array("pipe", "w"); // STDOUT for child
}
-
+
if ($errors !== true) {
$descriptorspec[2] = array("pipe", "w"); // STDERR for child
}
-
+
$proc = proc_open($command, $descriptorspec, $pipes);
-
+
if (is_resource($proc))
{
if ($input !== true) {
fwrite($pipes[0], $input);
fclose($pipes[0]);
}
-
+
if ($output !== true) {
$output = stream_get_contents($pipes[1]);
}
-
+
if ($errors !== true) {
$errors = stream_get_contents($pipes[2]);
}
-
+
return proc_close($proc);
-
+
} else {
return true;
}
@@ -145,19 +145,18 @@ function runCommand($command, $input = "", &$output = null, &$errors = true) {
{
$Result |= 5;
}
-
- $query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now()');
+
+ $query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now() and `deleted` = 0');
$row = mysql_fetch_assoc($query);
if ($row['points'] < 100) {
$Result |= 3;
}
-
+
$query = mysql_query('SELECT `assurer_blocked` FROM `users` WHERE `id` = \''.(int)intval($userID).'\'');
$row = mysql_fetch_assoc($query);
if ($row['assurer_blocked'] > 0) {
$Result |= 9;
}
-
+
return $Result;
}
- \ No newline at end of file
diff --git a/includes/loggedin.php b/includes/loggedin.php
index 4f9b8e8..70c9674 100644
--- a/includes/loggedin.php
+++ b/includes/loggedin.php
@@ -38,18 +38,18 @@
if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
continue;
if(is_int($key) || is_string($key))
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
- $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$uid'"));
+ $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($uid)."'"));
if($_SESSION['profile']['locked'] == 0)
$_SESSION['profile']['loggedin'] = 1;
else
unset($_SESSION['profile']);
}
-
+
if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && ($_SESSION['profile']['id'] == 0 || $_SESSION['profile']['loggedin'] == 0))
{
$user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'],
@@ -64,13 +64,13 @@
if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
continue;
if(is_int($key) || is_string($key))
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
$_SESSION['profile'] = mysql_fetch_assoc(mysql_query(
- "select * from `users` where `id`='".$user_id."'"));
+ "select * from `users` where `id`='".intval($user_id)."'"));
if($_SESSION['profile']['locked'] == 0)
$_SESSION['profile']['loggedin'] = 1;
else
@@ -82,9 +82,9 @@
{
if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
continue;
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
$_SESSION['_config']['oldlocation'] = '';
@@ -113,7 +113,7 @@
if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && $_SESSION['profile']['id'] > 0 && $_SESSION['profile']['loggedin'] > 0)
{
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -121,7 +121,7 @@
if($_SESSION['profile']['language'] == "")
{
$query = "update `users` set `language`='".L10n::get_translation()."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
} else {
L10n::set_translation($_SESSION['profile']['language']);
@@ -136,9 +136,9 @@
$_SESSION['profile'] = "";
foreach($_SESSION as $key => $value)
{
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
header("location: https://".$normalhost."/index.php");
diff --git a/includes/notary.inc.php b/includes/notary.inc.php
index b34b2f4..b568ccb 100644
--- a/includes/notary.inc.php
+++ b/includes/notary.inc.php
@@ -16,6 +16,9 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
+define('NULL_DATETIME', '0000-00-00 00:00:00');
+define('THAWTE_REVOCATION_DATETIME', '2010-11-16 00:00:00');
+
function query_init ($query)
{
return mysql_query($query);
@@ -35,7 +38,7 @@
function get_number_of_assurances ($userid)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting' AND `from`='".intval($userid)."' ");
+ WHERE `method` = 'Face to Face Meeting' AND `from`='".intval($userid)."' and `deleted` = 0");
$row = query_getnextrow($res);
return intval($row['list']);
@@ -44,7 +47,7 @@
function get_number_of_ttpassurances ($userid)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE (`method`='Trusted Third Parties' or `method`='TTP-Assisted') AND `to`='".intval($userid)."' ");
+ WHERE (`method`='Trusted Third Parties' or `method`='TTP-Assisted') AND `to`='".intval($userid)."' and `deleted` = 0");
$row = query_getnextrow($res);
return intval($row['list']);
@@ -53,7 +56,7 @@
function get_number_of_assurees ($userid)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting' AND `to`='".intval($userid)."' ");
+ WHERE `method` = 'Face to Face Meeting' AND `to`='".intval($userid)."' and `deleted` = 0");
$row = query_getnextrow($res);
return intval($row['list']);
@@ -62,7 +65,7 @@
function get_top_assurer_position ($no_of_assurances)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting'
+ WHERE `method` = 'Face to Face Meeting' and `deleted` = 0
GROUP BY `from` HAVING count(*) > '".intval($no_of_assurances)."'");
return intval(query_get_number_of_rows($res)+1);
}
@@ -70,32 +73,52 @@
function get_top_assuree_position ($no_of_assurees)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting'
+ WHERE `method` = 'Face to Face Meeting' and `deleted` = 0
GROUP BY `to` HAVING count(*) > '".intval($no_of_assurees)."'");
return intval(query_get_number_of_rows($res)+1);
}
- function get_given_assurances ($userid)
+ /**
+ * Get the list of assurances given by the user
+ * @param int $userid - id of the assurer
+ * @param int $log - if set to 1 also includes deleted assurances
+ * @return resource - a MySQL result set
+ */
+ function get_given_assurances($userid, $log=0)
{
- $res = query_init ("select * from `notary` where `from`='".intval($userid)."' and `from` != `to` order by `id` asc");
+ $deleted='';
+ if ($log == 0) {
+ $deleted = ' and `deleted` = 0 ';
+ }
+ $res = query_init("select * from `notary` where `from`='".intval($userid)."' and `from` != `to` $deleted order by `id` asc");
return $res;
}
- function get_received_assurances ($userid)
+ /**
+ * Get the list of assurances received by the user
+ * @param int $userid - id of the assuree
+ * @param int $log - if set to 1 also includes deleted assurances
+ * @return resource - a MySQL result set
+ */
+ function get_received_assurances($userid, $log=0)
{
- $res = query_init ("select * from `notary` where `to`='".intval($userid)."' and `from` != `to` order by `id` asc ");
+ $deleted='';
+ if ($log == 0) {
+ $deleted = ' and `deleted` = 0 ';
+ }
+ $res = query_init("select * from `notary` where `to`='".intval($userid)."' and `from` != `to` $deleted order by `id` asc ");
return $res;
}
function get_given_assurances_summary ($userid)
{
- $res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' group by points,awarded,method");
+ $res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' and `deleted` = 0 group by points,awarded,method");
return $res;
}
function get_received_assurances_summary ($userid)
{
- $res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' group by points,awarded,method");
+ $res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' and `deleted` = 0 group by points,awarded,method");
return $res;
}
@@ -113,69 +136,177 @@
return mysql_num_rows($res);
}
- function calc_experience ($row,&$points,&$experience,&$sum_experience,&$revoked)
+
+ /**
+ * Calculate awarded points (corrects some issues like out of range points
+ * or points that were issued by means that have been deprecated)
+ *
+ * @param array $row - associative array containing the data from the
+ * `notary` table
+ * @return int - the awarded points for this assurance
+ */
+ function calc_awarded($row)
+ {
+ // Back in the old days there was no `awarded` column => is now zero,
+ // there the `points` column contained that data
+ $points = max(intval($row['awarded']), intval($row['points']));
+
+ // Set negative points to zero, yes there are such things in the database
+ $points = max($points, 0);
+
+ switch ($row['method'])
+ {
+ // These programmes have been revoked
+ case 'Thawte Points Transfer': // revoke all Thawte-points (as per arbitration)
+ case 'CT Magazine - Germany': // revoke c't (only one test-entry)
+ case 'Temporary Increase': // revoke 'temporary increase' (Current usage breaks audit aspects, needs to be reimplemented)
+ $points = 0;
+ break;
+
+ case 'Administrative Increase': // ignore AI with 2 points or less (historical for experiance points, now other calculation)
+ if ($points <= 2) // maybe limit to 35/50 pts in the future?
+ $points = 0;
+ break;
+
+ // TTP assurances, limit to 35
+ case 'TTP-Assisted':
+ $points = min($points, 35);
+ break;
+
+ // TTP TOPUP, limit to 30
+ case 'TOPUP':
+ $points = min($points, 30);
+
+ // All these should be preserved for the time being
+ case 'Unknown': // to be revoked in the future? limit to max 50 pts?
+ case 'Trusted Third Parties': // to be revoked in the future? limit to max 35 pts?
+ case '': // to be revoked in the future? limit to max 50 pts?
+ case 'Face to Face Meeting': // normal assurances (and superassurances?), limit to 35/50 pts in the future?
+ break;
+
+ default: // should never happen ... ;-)
+ $points = 0;
+ }
+
+ return $points;
+ }
+
+
+ /**
+ * Calculate the experience points from a given Assurance
+ * @param array $row - [inout] associative array containing the data from
+ * the `notary` table, the keys 'experience' and 'calc_awarded' will be
+ * added
+ * @param int $sum_points - [inout] the sum of already counted assurance
+ * points the assurer issued
+ * @param int $sum_experience - [inout] the sum of already counted
+ * experience points that were awarded to the assurer
+ */
+ function calc_experience(&$row, &$sum_points, &$sum_experience)
{
- $apoints = max($row['points'], $row['awarded']);
- $points += $apoints;
- $experience = "&nbsp;";
- $revoked = false; # to be coded later (after DB-upgrade)
+ $row['calc_awarded'] = calc_awarded($row);
+
+ // Don't count revoked assurances even if we are displaying them
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $row['experience'] = 0;
+ return;
+ }
+
+ $experience = 0;
if ($row['method'] == "Face to Face Meeting")
{
- $sum_experience = $sum_experience +2;
- $experience = "2";
+ $experience = 2;
}
- return $apoints;
+ $sum_experience += $experience;
+ $row['experience'] = $experience;
+
+ $sum_points += $row['calc_awarded'];
}
- function calc_assurances ($row,&$points,&$experience,&$sumexperience,&$awarded,&$revoked)
+ /**
+ * Calculate the points received from a received Assurance
+ * @param array $row - [inout] associative array containing the data from
+ * the `notary` table, the keys 'experience' and 'calc_awarded' will be
+ * added
+ * @param int $sum_points - [inout] the sum of already counted assurance
+ * points the assuree received
+ * @param int $sum_experience - [inout] the sum of already counted
+ * experience points that were awarded to the assurer
+ */
+ function calc_assurances(&$row, &$sum_points, &$sum_experience)
{
- $awarded = calc_points($row);
- $revoked = false;
+ $row['calc_awarded'] = calc_awarded($row);
+ $experience = 0;
- if ($awarded > 100)
+ // High point values mean that some of them are experience points
+ if ($row['calc_awarded'] > 100)
{
- $experience = $awarded - 100; // needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100)
- $awarded = 100;
+ $experience = $row['calc_awarded'] - 100; // needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100)
+ $row['calc_awarded'] = 100;
}
- else
- $experience = 0;
switch ($row['method'])
{
case 'Thawte Points Transfer':
case 'CT Magazine - Germany':
case 'Temporary Increase': // Current usage of 'Temporary Increase' may break audit aspects, needs to be reimplemented
- $awarded=sprintf("<strong style='color: red'>%s</strong>",_("Revoked"));
- $experience=0;
- $revoked=true;
+ $experience = 0;
+ $row['deleted'] = THAWTE_REVOCATION_DATETIME;
break;
- default:
- $points += $awarded;
}
- $sumexperience = $sumexperience + $experience;
- }
+ // Don't count revoked assurances even if we are displaying them
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $row['experience'] = 0;
+ return;
+ }
+
+ $sum_experience += $experience;
+ $row['experience'] = $experience;
+ $sum_points += $row['calc_awarded'];
+ }
- function show_user_link ($name,$userid)
+ /**
+ * Generate a link to the support engineer page for the user with the name
+ * of the user as link text
+ * @param array $user - associative array containing the data from the
+ * `user` table
+ * @return string
+ */
+ function show_user_link($user)
{
- $name = trim($name);
+ $name = trim($user['fname'].' '.$user['lname']);
+ $userid = intval($user['id']);
+
if($name == "")
{
- if ($userid == 0)
+ if ($userid == 0) {
$name = _("System");
- else
+ } else {
$name = _("Deleted account");
+ }
}
else
- $name = "<a href='wot.php?id=9&amp;userid=".intval($userid)."'>".sanitizeHTML($name)."</a>";
+ {
+ $name = "<a href='wot.php?id=9&amp;userid=".$userid."'>".sanitizeHTML($name)."</a>";
+ }
+
return $name;
}
- function show_email_link ($email,$userid)
+ /**
+ * Generate a link to the support engineer page for the user with the email
+ * address as link text
+ * @param array $user - associative array containing the data from the
+ * `user` table
+ * @return string
+ */
+ function show_email_link($user)
{
- $email = trim($email);
- if($email != "")
- $email = "<a href='account.php?id=43&amp;userid=".intval($userid)."'>".sanitizeHTML($email)."</a>";
+ $email = trim($user['email']);
+ if($email != "") {
+ $email = "<a href='account.php?id=43&amp;userid=".intval($user['id'])."'>".sanitizeHTML($email)."</a>";
+ }
return $email;
}
@@ -215,35 +346,41 @@
<?
}
- function output_assurances_header($title,$support)
+ /**
+ * Render header for the assurance table (same for given/received)
+ * @param string $title - The title for the table
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_assurances_header($title, $support, $log)
{
+ if ($support == 1) {
+ $log = 1;
+ }
+
+ $colspan = 7;
+ if ($support == 1) {
+ $colspan += 2;
+ }
+ if ($log == 1) {
+ $colspan += 1;
+ }
?>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
-<?
- if ($support == "1")
- {
-?>
- <td colspan="10" class="title"><?=$title?></td>
-<?
- } else {
-?>
- <td colspan="7" class="title"><?=$title?></td>
-<?
- }
-?>
+ <td colspan="<?=$colspan?>" class="title"><?=$title?></td>
</tr>
<tr>
<td class="DataTD"><strong><?=_("ID")?></strong></td>
<td class="DataTD"><strong><?=_("Date")?></strong></td>
<?
- if ($support == "1")
- {
+ if ($support == 1)
+ {
?>
<td class="DataTD"><strong><?=_("When")?></strong></td>
<td class="DataTD"><strong><?=_("Email")?></strong></td>
<?
- }
+ }
?>
<td class="DataTD"><strong><?=_("Who")?></strong></td>
<td class="DataTD"><strong><?=_("Points")?></strong></td>
@@ -251,43 +388,88 @@
<td class="DataTD"><strong><?=_("Method")?></strong></td>
<td class="DataTD"><strong><?=_("Experience Points")?></strong></td>
<?
- if ($support == "1")
- {
+ if ($log == 1)
+ {
?>
- <td class="DataTD"><strong><?=_("Revoke")?></strong></td>
+ <td class="DataTD"><strong><?=_("Revoked")?></strong></td>
<?
- }
+ }
?>
</tr>
<?
}
- function output_assurances_footer($points_txt,$points,$experience_txt,$sumexperience,$support)
+ /**
+ * Render footer for the assurance table (same for given/received)
+ * @param string $points_txt - Description for sum of assurance points
+ * @param int $sumpoints - sum of assurance points
+ * @param string $experience_txt - Description for sum of experience points
+ * @param int $sumexperience - sum of experience points
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_assurances_footer(
+ $points_txt,
+ $sumpoints,
+ $experience_txt,
+ $sumexperience,
+ $support,
+ $log)
{
?>
<tr>
- <td<?=($support == "1")?' colspan="5"':' colspan="3"'?> class="DataTD"><strong><?=$points_txt?>:</strong></td>
- <td class="DataTD"><?=$points?></td>
+ <td colspan="<?=($support == 1) ? 5 : 3 ?>" class="DataTD"><strong><?=$points_txt?>:</strong></td>
+ <td class="DataTD"><?=intval($sumpoints)?></td>
<td class="DataTD">&nbsp;</td>
<td class="DataTD"><strong><?=$experience_txt?>:</strong></td>
- <td class="DataTD"><?=$sumexperience?></td>
+ <td class="DataTD"><?=intval($sumexperience)?></td>
<?
- if ($support == "1")
- {
+ if ($log == 1)
+ {
?>
<td class="DataTD">&nbsp;</td>
<?
- }
+ }
?>
-
</tr>
</table>
<br/>
<?
}
- function output_assurances_row($assuranceid,$date,$when,$email,$name,$awarded,$points,$location,$method,$experience,$userid,$support,$revoked)
+ /**
+ * Render an assurance for a view
+ * @param array $assurance - associative array containing the data from the `notary` table
+ * @param int $userid - Id of the user whichs given/received assurances are displayed
+ * @param array $other_user - associative array containing the other users data from the `users` table
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - ticket number currently set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_assurances_row(
+ $assurance,
+ $userid,
+ $other_user,
+ $support,
+ $ticketno,
+ $log)
{
+ $assuranceid = intval($assurance['id']);
+ $date = $assurance['date'];
+ $when = $assurance['when'];
+ $awarded = intval($assurance['calc_awarded']);
+ $points = intval($assurance['points']);
+ $location = $assurance['location'];
+ $method = $assurance['method'] ? _($assurance['method']) : '';
+ $experience = intval($assurance['experience']);
+ $revoked = $assurance['deleted'] !== NULL_DATETIME;
+
+ $email = show_email_link($other_user);
+ $name = show_user_link($other_user);
+
+ if ($support == 1) {
+ $log = 1;
+ }
$tdstyle="";
$emopen="";
@@ -295,7 +477,7 @@
if ($awarded == $points)
{
- if ($awarded == "0")
+ if ($awarded == 0)
{
if ($when < "2006-09-01")
{
@@ -310,7 +492,7 @@
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$assuranceid?><?=$emclose?></td>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$date?><?=$emclose?></td>
<?
- if ($support == "1")
+ if ($support == 1)
{
?>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$when?><?=$emclose?></td>
@@ -319,26 +501,30 @@
}
?>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$name?><?=$emclose?></td>
- <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$awarded?><?=$emclose?></td>
+ <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$revoked ? sprintf("<strong style='color: red'>%s</strong>",_("Revoked")) : $awarded?><?=$emclose?></td>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$location?><?=$emclose?></td>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$method?><?=$emclose?></td>
- <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?><?=$emclose?></td>
+ <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?$experience:'&nbsp;'?><?=$emclose?></td>
<?
- if ($support == "1")
+ if ($log == 1)
{
if ($revoked == true)
{
?>
- <td class="DataTD" <?=$tdstyle?>>&nbsp;</td>
+ <td class="DataTD" <?=$tdstyle?>><?=$assurance['deleted']?></td>
+<?
+ } elseif ($support == 1) {
+?>
+ <td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&amp;userid=<?=intval($userid)?>&amp;assurance=<?=intval($assuranceid)?>&amp;csrf=<?=make_csrf('admdelassurance')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$assuranceid)?>');"><?=_("Revoke")?></a><?=$emclose?></td>
<?
} else {
?>
- <td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&amp;userid=<?=intval($userid)?>&amp;assurance=<?=intval($assuranceid)?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$assuranceid)?>');"><?=_("Revoke")?></a><?=$emclose?></td>
+ <td class="DataTD" <?=$tdstyle?>>&nbsp;</td>
<?
}
}
?>
- </tr>
+ </tr>
<?
}
@@ -381,35 +567,61 @@
// ************* output given assurances ******************
- function output_given_assurances_content($userid,&$points,&$sum_experience,$support)
+ /**
+ * Helper function to render assurances given by the user
+ * @param int $userid
+ * @param int& $sum_points - [out] sum of given points
+ * @param int& $sum_experience - [out] sum of experience points gained
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_given_assurances_content(
+ $userid,
+ &$sum_points,
+ &$sum_experience,
+ $support,
+ $ticketno,
+ $log)
{
- $points = 0;
+ $sum_points = 0;
$sumexperience = 0;
- $res = get_given_assurances(intval($userid));
+ $res = get_given_assurances(intval($userid), $log);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = get_user (intval($row['to']));
- $apoints = calc_experience ($row,$points,$experience,$sum_experience,$revoked);
- $name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['to']));
- $email = show_email_link ($fromuser['email'],intval($row['to']));
- output_assurances_row (intval($row['id']),$row['date'],$row['when'],$email,$name,$apoints,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience,$userid,$support,$revoked);
+ $assuree = get_user(intval($row['to']));
+ calc_experience($row, $sum_points, $sum_experience);
+ output_assurances_row($row, $userid, $assuree, $support, $ticketno, $log);
}
}
// ************* output received assurances ******************
- function output_received_assurances_content($userid,&$points,&$sum_experience,$support)
+ /**
+ * Helper function to render assurances received by the user
+ * @param int $userid
+ * @param int& $sum_points - [out] sum of received points
+ * @param int& $sum_experience - [out] sum of experience points the assurers gained
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_received_assurances_content(
+ $userid,
+ &$sum_points,
+ &$sum_experience,
+ $support,
+ $ticketno,
+ $log)
{
- $points = 0;
+ $sum_points = 0;
$sumexperience = 0;
- $res = get_received_assurances(intval($userid));
+ $res = get_received_assurances(intval($userid), $log);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = get_user (intval($row['from']));
- calc_assurances ($row,$points,$experience,$sum_experience,$awarded,$revoked);
- $name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['from']));
- $email = show_email_link ($fromuser['email'],intval($row['from']));
- output_assurances_row (intval($row['id']),$row['date'],$row['when'],$email,$name,$awarded,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience,$userid,$support,$revoked);
+ $fromuser = get_user(intval($row['from']));
+ calc_assurances($row, $sum_points, $sum_experience);
+ output_assurances_row($row, $userid, $fromuser, $support, $ticketno, $log);
}
}
@@ -422,41 +634,6 @@
return intval(query_get_number_of_rows($res));
}
- function calc_points($row)
- {
- $awarded = intval($row['awarded']);
- if ($awarded == "")
- $awarded = 0;
- if (intval($row['points']) < $awarded)
- $points = $awarded; // if 'sum of added points' > 100, awarded shows correct value
- else
- $points = intval($row['points']); // on very old assurances, awarded is '0' instead of correct value
- switch ($row['method'])
- {
- case 'Thawte Points Transfer': // revoke all Thawte-points (as per arbitration)
- case 'CT Magazine - Germany': // revoke c't (only one test-entry)
- case 'Temporary Increase': // revoke 'temporary increase' (Current usage breaks audit aspects, needs to be reimplemented)
- $points = 0;
- break;
- case 'Administrative Increase': // ignore AI with 2 points or less (historical for experiance points, now other calculation)
- if ($points <= 2) // maybe limit to 35/50 pts in the future?
- $points = 0;
- break;
- case 'Unknown': // to be revoked in the future? limit to max 50 pts?
- case 'Trusted Third Parties': // to be revoked in the future? limit to max 35 pts?
- case 'TTP-Assisted': // TTP assurances, limit to 35
- case 'TOPUP': // TOPUP to be delevoped in the future, limit to 30
- case '': // to be revoked in the future? limit to max 50 pts?
- case 'Face to Face Meeting': // normal assurances, limit to 35/50 pts in the future?
- break;
- default: // should never happen ... ;-)
- $points = 0;
- }
- if ($points < 0) // ignore negative points (bug needs to be fixed)
- $points = 0;
- return $points;
- }
-
function max_points($userid)
{
return output_summary_content ($userid,0);
@@ -486,7 +663,7 @@
$res = get_received_assurances_summary($userid);
while($row = mysql_fetch_assoc($res))
{
- $points = calc_points ($row);
+ $points = calc_awarded($row);
if ($points > $max_points) // limit to 100 points, above is experience (needs to be fixed)
{
@@ -591,18 +768,66 @@
return $issue_points;
}
- function output_given_assurances($userid,$support=0)
+ /**
+ * Render assurances given by the user
+ * @param int $userid
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_given_assurances($userid, $support=0, $ticketno='', $log=0)
{
- output_assurances_header(_("Assurance Points You Issued"),$support);
- output_given_assurances_content($userid,$points,$sum_experience,$support);
- output_assurances_footer(_("Total Points Issued"),$points,_("Total Experience Points"),$sum_experience,$support);
+ output_assurances_header(
+ _("Assurance Points You Issued"),
+ $support,
+ $log);
+
+ output_given_assurances_content(
+ $userid,
+ $sum_points,
+ $sum_experience,
+ $support,
+ $ticketno,
+ $log);
+
+ output_assurances_footer(
+ _("Total Points Issued"),
+ $sum_points,
+ _("Total Experience Points"),
+ $sum_experience,
+ $support,
+ $log);
}
- function output_received_assurances($userid,$support=0)
+ /**
+ * Render assurances received by the user
+ * @param int $userid
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_received_assurances($userid, $support=0, $ticketno='', $log=0)
{
- output_assurances_header(_("Your Assurance Points"),$support);
- output_received_assurances_content($userid,$points,$sum_experience,$support);
- output_assurances_footer(_("Total Assurance Points"),$points,_("Total Experience Points"),$sum_experience,$support);
+ output_assurances_header(
+ _("Assurance Points You Received"),
+ $support,
+ $log);
+
+ output_received_assurances_content(
+ $userid,
+ $sum_points,
+ $sum_experience,
+ $support,
+ $ticketno,
+ $log);
+
+ output_assurances_footer(
+ _("Total Points Received"),
+ $sum_points,
+ _("Total Experience Points"),
+ $sum_experience,
+ $support,
+ $log);
}
function output_summary($userid)
@@ -658,18 +883,31 @@
}
/**
- * get_first_user_agreement()
- * returns the first user_agreement entry of the requested type depending on thes status of active of a given user
- * @param mixed $memid
- * @param integer $active, 0 - passive, 1 -active
- * @param string $type
- * @return
+ * Get the first user_agreement entry of the requested type
+ * @param int $memid
+ * @param string $type - the type of user agreement, by default all
+ * agreements are listed
+ * @param int $active - whether to get active or passive agreements:
+ * 0 := passive
+ * 1 := active
+ * null := both
+ * @return array(string=>mixed) - an associative array containing
+ * 'document', 'date', 'method', 'comment', 'active'
*/
- function get_first_user_agreement($memid, $active=1, $type="CCA"){
- //returns an array (`document`,`date`,`method`, `comment`,`active`)
+ function get_first_user_agreement($memid, $type=null, $active=null){
+ $filter = '';
+ if (!is_null($type)) {
+ $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'";
+ }
+
+ if (!is_null($active)) {
+ $filter .= " AND u.`active` = ".intval($active);
+ }
+
$query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u
- WHERE u.`document` = '" . mysql_real_escape_string($type) . "' AND u.`memid`=" . intval($memid) . " AND u.`active`=" . intval($active) .
- " ORDER BY u.`date` Limit 1;";
+ WHERE u.`memid`=".intval($memid)."
+ $filter
+ ORDER BY u.`date` LIMIT 1";
$res = mysql_query($query);
if(mysql_num_rows($res) >0){
$rec = mysql_fetch_assoc($res);
@@ -680,15 +918,31 @@
}
/**
- * get_last_user_agreement()
- * returns the last user_agreement entry of a given type and of a given user
- * @param mixed $memid
- * @param string $type
- * @return
+ * Get the last user_agreement entry of the requested type
+ * @param int $memid
+ * @param string $type - the type of user agreement, by default all
+ * agreements are listed
+ * @param int $active - whether to get active or passive agreements:
+ * 0 := passive,
+ * 1 := active,
+ * null := both
+ * @return array(string=>mixed) - an associative array containing
+ * 'document', 'date', 'method', 'comment', 'active'
*/
- function get_last_user_agreement($memid, $type="CCA"){
- //returns an array (`document`,`date`,`method`, `comment`,`active`)
- $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM user_agreements u WHERE u.`document` = '" . mysql_real_escape_string($type) . "' AND (u.`memid`=" . intval($memid) . " ) order by `date` desc limit 1 " ;
+ function get_last_user_agreement($memid, $type=null, $active=null){
+ $filter = '';
+ if (!is_null($type)) {
+ $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'";
+ }
+
+ if (!is_null($active)) {
+ $filter .= " AND u.`active` = ".intval($active);
+ }
+
+ $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u
+ WHERE u.`memid`=".intval($memid)."
+ $filter
+ ORDER BY u.`date` DESC LIMIT 1";
$res = mysql_query($query);
if(mysql_num_rows($res) >0){
$rec = mysql_fetch_assoc($res);
@@ -698,6 +952,34 @@
return $rec;
}
+/**
+ * Get the all user_agreement entries of the requested type
+ * @param int $memid
+ * @param string $type - the type of user agreement, by default all
+ * agreements are listed
+ * @param int $active - whether to get an active or passive agreements:
+ * 0 := passive,
+ * 1 := active,
+ * null := both
+ * @return resource - a mysql result set containing all agreements
+ */
+function get_user_agreements($memid, $type=null, $active=null){
+ $filter = '';
+ if (!is_null($type)) {
+ $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'";
+ }
+
+ if (!is_null($active)) {
+ $filter .= " AND u.`active` = ".intval($active);
+ }
+
+ $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u
+ WHERE u.`memid`=".intval($memid)."
+ $filter
+ ORDER BY u.`date`";
+ return mysql_query($query);
+}
+
/**
* delete_user_agreement()
* deletes all entries for a given type from user_agreement of a given user, if type is not given all
@@ -706,7 +988,6 @@
* @return
*/
function delete_user_agreement($memid, $type=false){
- //deletes all entries to an user for the given type of user agreements
if ($type === false) {
$filter = '';
} else {
@@ -909,11 +1190,6 @@
}
//change personal information to arbitration number and DOB=1900-01-01
- $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'";
- $details = mysql_fetch_assoc(mysql_query($query));
- $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}',
- `new-lname`='$arbno',`new-dob`='1900-01-01',`uid`='$id',`adminid`='".$adminid."'";
- mysql_query($query);
$query = "update `users` set `fname`='".$arbno."',
`mname`='".$arbno."',
`lname`='".$arbno."',
@@ -1125,3 +1401,740 @@
function check_date_difference($date, $diff=1){
return (strtotime($date)<=time()+$diff*86400);
}
+
+/**
+ * Write some information to the adminlog
+ *
+ * @param int $uid - id of the user account
+ * @param int $adminid - id of the admin
+ * @param string $type - the operation that was performed on the user account
+ * @param string $info - the ticket / arbitration number or other information
+ * @return bool - true := success, false := error
+ */
+function write_se_log($uid, $adminid, $type, $info){
+ //records all support engineer actions changing a user account
+ $uid = intval($uid);
+ $adminid = intval($adminid);
+ $type = mysql_real_escape_string($type);
+ $info = mysql_real_escape_string($info);
+ $query="insert into `adminlog` (`when`, `uid`, `adminid`,`type`,`information`) values
+ (Now(), $uid, $adminid, '$type', '$info')";
+ return mysql_query($query);
+}
+
+/**
+ * Check if the entered information is a valid ticket or arbitration number
+ * @param string $ticketno
+ * @return bool
+ */
+function valid_ticket_number($ticketno){
+ //a arbitration case
+ //d dispute action
+ //s support case
+ //m board motion
+ $pattern='/[adsmADSM]\d{8}\.\d+/';
+ if (preg_match($pattern, $ticketno)) {
+ return true;
+ }
+ return false;
+}
+
+// function for handling account/43.php
+/**
+ * Get all data of an account given by the id from the `users` table
+ * @param int $userid - account id
+ * @param int $deleted - states if deleted data should be visible , default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_user_data($userid, $deleted=0){
+ $userid = intval($userid);
+ $filter='';
+ if (0==$deleted) {
+ $filter .=' and `users`.`deleted`=0';
+ }
+ $query = "select * from `users` where `users`.`id`='$userid' ".$filter;
+ return mysql_query($query);
+}
+
+/**
+ * Get the alert settings for a user
+ * @param int $userid for the requested account
+ * @return array - associative array
+ */
+function get_alerts($userid){
+ return mysql_fetch_assoc(mysql_query("select * from `alerts` where `memid`='".intval($userid)."'"));
+}
+
+/**
+ * Get all email addresses linked to the account
+ * @param int $userid
+ * @param string $exclude - if given the email address will be excluded
+ * @param int $deleted - states if deleted data should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_email_addresses($userid, $exclude, $deleted=0){
+ //should be entered in account/2.php
+ $userid = intval($userid);
+ $filter='';
+ if (0==$deleted) {
+ $filter .= ' and `deleted`=0';
+ }
+ if ($exclude) {
+ $filter .= " and `email`!='".mysql_real_escape_string($exclude)."'";
+ }
+ $query = "select * from `email` where `memid`='".$userid."' and `hash`='' ".$filter." order by `created`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all domains linked to the account
+ * @param int $userid
+ * @param int $deleted - states if deleted data should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_domains($userid, $deleted=0){
+ //should be entered in account/9.php
+ $userid = intval($userid);
+ $filter='';
+ if (0==$deleted) {
+ $filter .= ' and `deleted`=0';
+ }
+ $query = "select * from `domains` where `memid`='".$userid."' and `hash`=''".$filter." order by `created`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all training results for the account
+ * @param int $userid
+ * @return resource - a mysql result set
+ */
+function get_training_results($userid){
+ //should be entered in account/55.php
+ $userid = intval($userid);
+ $query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ".
+ " FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ".
+ " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".$userid."'".
+ " ORDER BY `CP`.`pass_date`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all SE log entries for the account
+ * @param int $userid
+ * @return resource - a mysql result set
+ */
+function get_se_log($userid){
+ $userid = intval($userid);
+ $query = "SELECT `adminlog`.`when`, `adminlog`.`type`, `adminlog`.`information`, `users`.`fname`, `users`.`lname`
+ FROM `adminlog`, `users`
+ WHERE `adminlog`.`adminid` = `users`.`id` and `adminlog`.`uid`=".$userid."
+ ORDER BY `adminlog`.`when`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all client certificates linked to the account
+ * @param int $userid
+ * @param int $viewall - states if expired certs should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_client_certs($userid, $viewall=0){
+ //add to account/5.php
+ $userid = intval($userid);
+ $query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`,
+ UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
+ UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`,
+ `emailcerts`.`expire`,
+ `emailcerts`.`revoked` as `revoke`,
+ UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`,
+ `emailcerts`.`id`,
+ `emailcerts`.`CN`,
+ `emailcerts`.`serial`,
+ `emailcerts`.`disablelogin`,
+ `emailcerts`.`description`
+ from `emailcerts`
+ where `emailcerts`.`memid`='".$userid."'";
+ if($viewall == 0)
+ {
+ $query .= " AND `emailcerts`.`revoked`=0 AND `emailcerts`.`renewed`=0";
+ $query .= " HAVING `timeleft` > 0";
+ }
+ $query .= " ORDER BY `emailcerts`.`modified` desc";
+ return mysql_query($query);
+}
+
+/**
+ * Get all server certs linked to the account
+ * @param int $userid
+ * @param int $viewall - states if expired certs should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_server_certs($userid, $viewall=0){
+ //add to account/12.php
+ $userid = intval($userid);
+ $query = "select UNIX_TIMESTAMP(`domaincerts`.`created`) as `created`,
+ UNIX_TIMESTAMP(`domaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
+ UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired`,
+ `domaincerts`.`expire`,
+ `domaincerts`.`revoked` as `revoke`,
+ UNIX_TIMESTAMP(`revoked`) as `revoked`,
+ `domaincerts`.`CN`,
+ `domaincerts`.`serial`,
+ `domaincerts`.`id`,
+ `domaincerts`.`description`
+ from `domaincerts`,`domains`
+ where `domains`.`memid`='".$userid."' and `domaincerts`.`domid`=`domains`.`id`";
+ if($viewall == 0)
+ {
+ $query .= " AND `domaincerts`.`revoked`=0 AND `domaincerts`.`renewed`=0";
+ $query .= " HAVING `timeleft` > 0";
+ }
+ $query .= " ORDER BY `domaincerts`.`modified` desc";
+ return mysql_query($query);
+}
+
+/**
+ * Get all gpg certs linked to the account
+ * @param int $userid
+ * @param int $viewall - states if expired certs should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_gpg_certs($userid, $viewall=0){
+ //add to gpg/2.php
+ $userid = intval($userid);
+ $query = $query = "select UNIX_TIMESTAMP(`issued`) as `issued`,
+ UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() as `timeleft`,
+ UNIX_TIMESTAMP(`expire`) as `expired`,
+ `expire`, `id`, `level`, `email`, `keyid`, `description`
+ from `gpg` where `memid`='".$userid."'";
+ if ($viewall == 0) {
+ $query .= " HAVING `timeleft` > 0";
+ }
+ $query .= " ORDER BY `issued` desc";
+ return mysql_query($query);
+}
+
+
+
+/**
+ * Show the table header to the email table for the admin log
+ */
+function output_log_email_header(){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Email, primary bold") ?></td>
+ <td class="DataTD bold"><?= _("Created") ?></td>
+ <td class="DataTD bold"><?= _("Deleted") ?></td>
+ </tr>
+
+ <?
+}
+/**
+ * Show all email data for the admin log
+ * @param array $row - associative array containing the column data
+ * @param string $primary - if given the primary address is highlighted
+ */
+function output_log_email($row, $primary){
+ $style = '';
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $style = ' deletedemailaddress';
+ } elseif ($primary == $row['email']) {
+ $style = ' primaryemailaddress';
+ }
+ ?>
+ <tr>
+ <td class="DataTD<?=$style?>"><?=$row['email']?></td>
+ <td class="DataTD<?=$style?>"><?=$row['created']?></td>
+ <td class="DataTD<?=$style?>"><?=$row['deleted']?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the domains table for the admin log
+ */
+function output_log_domains_header(){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Domain") ?></td>
+ <td class="DataTD bold"><?= _("Created") ?></td>
+ <td class="DataTD bold"><?= _("Deleted") ?></td>
+ </tr>
+
+ <?
+}
+
+/**
+ * Show the domain data for the admin log
+ * @param array $row - associative array containing the column data
+ */
+function output_log_domains($row){
+ $italic='';
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $italic=' italic';
+ }
+ ?>
+ <tr>
+ <td class="DataTD<?=$italic?>"><?=$row['domain']?></td>
+ <td class="DataTD<?=$italic?>"><?=$row['created']?></td>
+ <td class="DataTD<?=$italic?>"><?=$row['deleted']?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the user agreement table for the admin log
+ */
+function output_log_agreement_header(){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Agreement") ?></td>
+ <td class="DataTD bold"><?= _("Date") ?></td>
+ <td class="DataTD bold"><?= _("Method") ?></td>
+ <td class="DataTD bold"><?= _("Active ") ?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the agreement data for the admin log
+ * @param array $row - associative array containing the column data
+ */
+function output_log_agreement($row){
+ ?>
+ <tr>
+ <td class="DataTD" ><?=$row['document']?></td>
+ <td class="DataTD" ><?=$row['date']?></td>
+ <td class="DataTD" ><?=$row['method']?></td>
+ <td class="DataTD"><?= ($row['active']==0)? _('passive'):_('active')?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the training table
+ */
+function output_log_training_header(){
+ //should be entered in account/55.php
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Agreement") ?></td>
+ <td class="DataTD bold"><?= _("Test") ?></td>
+ <td class="DataTD bold"><?= _("Variant") ?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the training data
+ * @param array $row - associative array containing the column data
+ */
+function output_log_training($row){
+ //should be entered in account/55.php
+ ?>
+ <tr>
+ <td class="DataTD"><?=$row['pass_date']?></td>
+ <td class="DataTD"><?=$row['type_text']?></td>
+ <td class="DataTD"><?=$row['test_text']?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the SE log table for the admin log
+ * @param int $support - if support = 1 more information is visible
+ */
+function output_log_se_header($support=0){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Date") ?></td>
+ <td class="DataTD bold"><?= _("Type") ?></td>
+ <?
+ if (1 == $support) {
+ ?>
+ <td class="DataTD bold"><?= _("Information") ?></td>
+ <td class="DataTD bold"><?= _("Admin") ?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the SE log data for the admin log
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 more information is visible
+ */
+function output_log_se($row, $support=0){
+ //should be entered in account/55.php
+ ?>
+ <tr>
+ <td class="DataTD"><?=$row['when']?></td>
+ <td class="DataTD"><?=$row['type']?></td>
+ <?
+ if (1 == $support) {
+ ?>
+ <td class="DataTD"><?=$row['information']?></td>
+ <td class="DataTD"><?=$row['fname'].' '.$row['lname']?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Shows the table header to the client cert table
+ * @param int $support - if support = 1 some columns ar not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_client_cert_header($support=0, $readonly=true){
+ //should be added to account/5.php
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
+ <?
+ }
+ ?>
+ <td class="DataTD"><?=_("Status")?></td>
+ <td class="DataTD"><?=_("Email Address")?></td>
+ <td class="DataTD"><?=_("SerialNumber")?></td>
+ <td class="DataTD"><?=_("Revoked")?></td>
+ <td class="DataTD"><?=_("Expires")?></td>
+ <td class="DataTD"><?=_("Login")?></td>
+ <?
+ if (1 != $support) {
+ ?>
+ <td colspan="2" class="DataTD"><?=_("Comment *")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the client cert data
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 some columns are not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_client_cert($row, $support=0, $readonly=true){
+ //should be entered in account/5.php
+ $verified="";
+ if ($row['timeleft'] > 0) {
+ $verified = _("Valid");
+ } else {
+ $verified = _("Expired");
+ }
+
+ if ($row['expired'] == 0) {
+ $verified = _("Pending");
+ }
+
+ if ($row['revoked'] == 0) {
+ $row['revoke'] = _("Not Revoked");
+ } else {
+ $verified = _("Revoked");
+ }
+
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>">
+ </td>
+ <?
+
+ } elseif ($verified === _("Revoked")) {
+ ?>
+ <td class="DataTD">&nbsp;</td>
+ <?
+
+ } else {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>">
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ <td class="DataTD"><?=$verified?></td>
+ <?
+
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : htmlspecialchars($row['CN']))?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="account.php?id=6&amp;cert=<?=intval($row['id'])?>">
+ <?=(trim($row['CN'])=="" ? _("empty") : htmlspecialchars($row['CN']))?>
+ </a>
+ </td>
+ <?
+ }
+
+ ?>
+ <td class="DataTD"><?=$row['serial']?></td>
+ <td class="DataTD"><?=$row['revoke']?></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <td class="DataTD">
+ <input type="checkbox" name="disablelogin_<?=intval($row['id'])?>" value="1" <?=$row['disablelogin']?"":"checked='checked'"?> <?=$readonly?'disabled="disabled"':''?>/>
+ <input type="hidden" name="cert_<?=intval($row['id'])?>" value="1" />
+ </td>
+ <?
+
+ if (1 != $support) {
+ ?>
+ <td class="DataTD">
+ <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" />
+ </td>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" />
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the server cert table
+ * @param int $support - if support = 1 some columns ar not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_server_certs_header($support=0, $readonly=true){
+ //should be entered in account/12.php
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
+ <?
+ }
+ ?>
+ <td class="DataTD"><?=_("Status")?></td>
+ <td class="DataTD"><?=_("CommonName")?></td>
+ <td class="DataTD"><?=_("SerialNumber")?></td>
+ <td class="DataTD"><?=_("Revoked")?></td>
+ <td class="DataTD"><?=_("Expires")?></td>
+ <?
+ if (1 != $support) {
+ ?>
+ <td colspan="2" class="DataTD"><?=_("Comment *")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the server cert data
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 some columns are not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_server_certs($row, $support=0, $readonly=true){
+ //should be entered in account/12.php
+ $verified="";
+ if ($row['timeleft'] > 0) {
+ $verified = _("Valid");
+ } else {
+ $verified = _("Expired");
+ }
+
+ if ($row['expired'] == 0) {
+ $verified = _("Pending");
+ }
+
+ if ($row['revoked'] == 0) {
+ $row['revoke'] = _("Not Revoked");
+ } else {
+ $verified = _("Revoked");
+ }
+
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"/>
+ </td>
+ <?
+ } elseif($verified === _("Revoked")) {
+ ?>
+ <td class="DataTD">&nbsp;</td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"/>
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ <td class="DataTD"><?=$verified?></td>
+ <?
+
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD"><?=htmlspecialchars($row['CN'])?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="account.php?id=15&amp;cert=<?=intval($row['id'])?>">
+ <?=htmlspecialchars($row['CN'])?>
+ </a>
+ </td>
+ <?
+ }
+
+ ?>
+ <td class="DataTD"><?=$row['serial']?></td>
+ <td class="DataTD"><?=$row['revoke']?></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <?
+
+ if (1 != $support) {
+ ?>
+ <td class="DataTD">
+ <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" />
+ </td>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" />
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the gpg cert table
+ * @param int $support - if support = 1 some columns ar not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_gpg_certs_header($support=0, $readonly=true){
+ // $readonly is currently ignored but kept for consistency
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Status")?></td>
+ <td class="DataTD"><?=_("Email Address")?></td>
+ <td class="DataTD"><?=_("Expires")?></td>
+ <td class="DataTD"><?=_("Key ID")?></td>
+ <?
+ if (1 != $support) {
+ ?>
+ <td colspan="2" class="DataTD"><?=_("Comment *")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the gpg cert data
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 some columns are not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_gpg_certs($row, $support=0, $readonly=true){
+ //should be entered in account/55.php
+ $verified="";
+ if ($row['timeleft'] > 0) {
+ $verified = _("Valid");
+ } else {
+ $verified = _("Expired");
+ }
+
+ if ($row['expired'] == 0) {
+ $verified = _("Pending");
+ }
+
+ ?>
+ <tr>
+ <td class="DataTD"><?=$verified?></td>
+ <?
+
+ if($verified == _("Pending")) {
+ ?>
+ <td class="DataTD"><?=htmlspecialchars($row['email'])?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>">
+ <?=htmlspecialchars($row['email'])?>
+ </a>
+ </td>
+ <?
+ }
+
+ ?>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <?
+
+ if($verified == _("Pending")) {
+ ?>
+ <td class="DataTD"><?=htmlspecialchars($row['keyid'])?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>">
+ <?=htmlspecialchars($row['keyid'])?>
+ </a>
+ </td>
+ <?
+ }
+
+ if (1 != $support) {
+ ?>
+ <td class="DataTD">
+ <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" />
+ </td>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" />
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ </tr>
+ <?
+}
diff --git a/pages/account/12.php b/pages/account/12.php
index 9058a07..f4428aa 100644
--- a/pages/account/12.php
+++ b/pages/account/12.php
@@ -19,7 +19,7 @@
<form method="post" action="account.php">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
- <td colspan="8" class="title"><?=_("Domain Certificates")?> - <a href="account.php?id=12&amp;viewall=<?=!$viewall?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
+ <td colspan="8" class="title"><?=_("Domain Certificates")?> - <a href="account.php?id=12&amp;viewall=<?=intval(!$viewall)?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
</tr>
<tr>
<td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
@@ -34,17 +34,20 @@
$query = "select UNIX_TIMESTAMP(`domaincerts`.`created`) as `created`,
UNIX_TIMESTAMP(`domaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired`,
- `domaincerts`.`expire` as `expires`, `revoked` as `revoke`,
- UNIX_TIMESTAMP(`revoked`) as `revoked`, `CN`, `domaincerts`.`serial`, `domaincerts`.`id` as `id`,
+ `domaincerts`.`expire`,
+ `domaincerts`.`revoked` as `revoke`,
+ UNIX_TIMESTAMP(`revoked`) as `revoked`,
+ if (`domaincerts`.`expire`=0,CURRENT_TIMESTAMP(),`domaincerts`.`modified`) as `modified`,
+ `CN`, `domaincerts`.`serial`, `domaincerts`.`id` as `id`,
`domaincerts`.`description`
from `domaincerts`,`domains`
where `memid`='".intval($_SESSION['profile']['id'])."' and `domaincerts`.`domid`=`domains`.`id` ";
if($viewall != 1)
{
$query .= "AND `revoked`=0 AND `renewed`=0 ";
- $query .= "HAVING `timeleft` > 0 ";
+ $query .= "HAVING `timeleft` > 0 or `expire` = 0 ";
}
- $query .= "ORDER BY `domaincerts`.`modified` desc";
+ $query .= "ORDER BY `modified` desc";
//echo $query."<br>\n";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -69,24 +72,24 @@
?>
<tr>
<? if($verified != _("Pending") && $verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=$row['id']?>"/></td>
+ <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"/></td>
<? } else if($verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=$row['id']?>"/></td>
+ <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"/></td>
<? } else { ?>
<td class="DataTD">&nbsp;</td>
<? } ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="account.php?id=15&amp;cert=<?=$row['id']?>"><?=$row['CN']?></a></td>
+ <td class="DataTD"><a href="account.php?id=15&amp;cert=<?=intval($row['id'])?>"><?=htmlspecialchars($row['CN'])?></a></td>
<td class="DataTD"><?=$row['serial']?></td>
<td class="DataTD"><?=$row['revoke']?></td>
- <td class="DataTD"><?=$row['expires']?></td>
- <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
- <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
+ <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td>
</tr>
<? } ?>
<tr>
<td class="DataTD" colspan="8">
- <a href="account.php?id=12&amp;viewall=<?=!$viewall?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
+ <a href="account.php?id=12&amp;viewall=<?=intval(!$viewall)?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
</td>
</tr>
<tr>
@@ -104,6 +107,6 @@
<td class="DataTD" colspan="8"><?=_("From here you can delete pending requests, or revoke valid certificates.")?></td>
</tr>
</table>
-<input type="hidden" name="oldid" value="<?=$id?>"/>
+<input type="hidden" name="oldid" value="<?=intval($id)?>"/>
<input type="hidden" name="csrf" value="<?=make_csrf('srvcerchange')?>"/>
</form>
diff --git a/pages/account/13.php b/pages/account/13.php
index 08f325d..080e277 100644
--- a/pages/account/13.php
+++ b/pages/account/13.php
@@ -52,22 +52,22 @@
<? if($_SESSION['profile']['points'] == 0) { ?>
<tr>
<td class="DataTD" width="125"><?=_("First Name")?>: </td>
- <td class="DataTD" width="125"><input type="text" name="fname" value="<?=$user['fname']?>"></td>
+ <td class="DataTD" width="125"><input type="text" name="fname" value="<?=sanitizeHTML($user['fname'])?>"></td>
</tr>
<tr>
<td class="DataTD" valign="top"><?=_("Middle Name(s)")?><br>
(<?=_("optional")?>)
</td>
- <td class="DataTD"><input type="text" name="mname" value="<?=$user['mname']?>"></td>
+ <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($user['mname'])?>"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Last Name")?>: </td>
- <td class="DataTD"><input type="text" name="lname" value="<?=$user['lname']?>"></td>
+ <td class="DataTD"><input type="text" name="lname" value="<?=sanitizeHTML($user['lname'])?>"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Suffix")?><br>
(<?=_("optional")?>)</td>
- <td class="DataTD"><input type="text" name="suffix" value="<?=$user['suffix']?>"></td>
+ <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($user['suffix'])?>"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Date of Birth")?><br>
@@ -100,22 +100,22 @@
<? } else { ?>
<tr>
<td class="DataTD" width="125"><?=_("First Name")?>: </td>
- <td class="DataTD" width="125"><?=$user['fname']?></td>
+ <td class="DataTD" width="125"><?=sanitizeHTML($user['fname'])?></td>
</tr>
<tr>
<td class="DataTD" valign="top"><?=_("Middle Name(s)")?><br>
(<?=_("optional")?>)
</td>
- <td class="DataTD"><?=$user['mname']?></td>
+ <td class="DataTD"><?=sanitizeHTML($user['mname'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Last Name")?>: </td>
- <td class="DataTD"><?=$user['lname']?></td>
+ <td class="DataTD"><?=sanitizeHTML($user['lname'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Suffix")?><br>
(<?=_("optional")?>)</td>
- <td class="DataTD"><?=$user['suffix']?></td>
+ <td class="DataTD"><?=sanitizeHTML($user['suffix'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Date of Birth")?><br>
@@ -124,7 +124,10 @@
</tr>
<? } ?>
<tr>
- <td colspan="2" class="title"><a href="account.php?id=13&amp;showdetails=<?=!$showdetails?>"><?=_("View secret question & answers and OTP phrases")?></a></td>
+ <td colspan="2" class="title"><a href="account.php?id=59&amp;oldid=13&amp;userid=<?=intval($_SESSION['profile']['id'])?>"><?=_('Show account history')?></a></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="title"><a href="account.php?id=13&amp;showdetails=<?=intval(!$showdetails)?>"><?=_("View secret question & answers and OTP phrases")?></a></td>
</tr>
<? if($showdetails){ ?>
<tr>
@@ -167,5 +170,5 @@
</tr>
</table>
<input type="hidden" name="csrf" value="<?=make_csrf('perschange')?>" />
-<input type="hidden" name="oldid" value="<?=$id?>">
+<input type="hidden" name="oldid" value="<?=intval($id)?>">
</form>
diff --git a/pages/account/16.php b/pages/account/16.php
index 564463e..db8a8f5 100644
--- a/pages/account/16.php
+++ b/pages/account/16.php
@@ -42,7 +42,7 @@
</tr>
<tr>
<td class="DataTD"><?=_("Department")?>:</td>
- <td class="DataTD"><input type="text" name="OU" value="<?=array_key_exists('OU',$_SESSION['_config'])?($_SESSION['_config']['OU']):''?>"/></td>
+ <td class="DataTD"><input type="text" name="OU" value="<?=array_key_exists('OU',$_SESSION['_config'])?(sanitizeHTML($_SESSION['_config']['OU'])):''?>"/></td>
</tr>
<tr>
<td class="DataTD" colspan="2" align="left">
diff --git a/pages/account/18.php b/pages/account/18.php
index 9ab13b2..ca0a3c8 100644
--- a/pages/account/18.php
+++ b/pages/account/18.php
@@ -79,6 +79,7 @@ $status = array_key_exists('status',$_SESSION['_config']) ? intval($_SESSION['_c
UNIX_TIMESTAMP(`oemail`.`expire`) as `expired`,
`oemail`.`expire` as `expires`, `oemail`.`revoked` as `revoke`,
UNIX_TIMESTAMP(`oemail`.`revoked`) as `revoked`,
+ if (`oemail`.`expire`=0,CURRENT_TIMESTAMP(),`oemail`.`modified`) as `modified`,
`oemail`.`CN`, `oemail`.`serial`, `oemail`.`id`,
`oemail`.`description`, `oemail`.`ou`, `orginfo`.`O`
from `orgemailcerts` as `oemail`, `org`, `orginfo`
@@ -92,17 +93,17 @@ $status = array_key_exists('status',$_SESSION['_config']) ? intval($_SESSION['_c
if(0==$status)
{
$query .= "AND `oemail`.`revoked`=0 AND `oemail`.`renewed`=0 ";
- $query .= "HAVING `timeleft` > 0 AND `revoked`=0 ";
+ $query .= "HAVING `timeleft` > 0 AND `revoked`=0 or `expires` = 0 ";
}
switch ($sorting){
case 0:
- $query .= "ORDER BY `orginfo`.`O`, `oemail`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `modified` desc";
break;
case 1:
- $query .= "ORDER BY `orginfo`.`O`, `oemail`.`ou`, `oemail`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `oemail`.`ou`, `modified` desc";
break;
case 2:
- $query .= "ORDER BY `orginfo`.`O`, `oemail`.`CN`, `oemail`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `oemail`.`CN`, `modified` desc";
break;
}
$res = mysql_query($query);
diff --git a/pages/account/21.php b/pages/account/21.php
index 75827fb..c5832b9 100644
--- a/pages/account/21.php
+++ b/pages/account/21.php
@@ -41,7 +41,7 @@ if (is_array($_SESSION['_config']['altrows'])) {
}
echo _("Organisation"), ": {$org['O']}<br>\n";
-echo _("Org. Unit"), ": {$_SESSION['_config']['OU']}<br>\n";
+echo _("Org. Unit"), ": ", sanitizeHTML($_SESSION['_config']['OU']), "<br>\n";
echo _("Location"), ": {$org['L']}<br>\n";
echo _("State/Province"), ": {$org['ST']}<br>\n";
echo _("Country"), ": {$org['C']}<br>\n";
@@ -52,7 +52,7 @@ echo _("Country"), ": {$org['C']}<br>\n";
<input type="submit" name="process" value="<?=_("Submit")?>">
<input type="hidden" name="oldid" value="<?=$id?>">
</p>
-
+
<?
if ($_SESSION['profile']['admin'] == 1) {
?>
diff --git a/pages/account/22.php b/pages/account/22.php
index 0413da0..7b7db2d 100644
--- a/pages/account/22.php
+++ b/pages/account/22.php
@@ -78,7 +78,9 @@ $status = array_key_exists('dstatus',$_SESSION['_config']) ? intval($_SESSION['_
UNIX_TIMESTAMP(`orgdomaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`orgdomaincerts`.`expire`) as `expired`,
`orgdomaincerts`.`expire` as `expires`, `revoked` as `revoke`,
- UNIX_TIMESTAMP(`revoked`) as `revoked`, `CN`,
+ UNIX_TIMESTAMP(`orgdomaincerts`.`revoked`) as `revoked`,
+ if (`orgdomaincerts`.`expire`=0,CURRENT_TIMESTAMP(),`orgdomaincerts`.`modified`) as `modified`,
+ `CN`,
`orgdomaincerts`.`serial`,
`orgdomaincerts`.`id` as `id`,
`orgdomaincerts`.`description`, `orginfo`.`O`
@@ -94,14 +96,14 @@ $status = array_key_exists('dstatus',$_SESSION['_config']) ? intval($_SESSION['_
if(0==$status)
{
$query .= "AND `revoked`=0 AND `renewed`=0 ";
- $query .= "HAVING `timeleft` > 0 ";
+ $query .= "HAVING `timeleft` > 0 or `expires` = 0 ";
}
switch ($sorting){
case 0:
- $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `modified` desc";
break;
case 1:
- $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`CN`, `orgdomaincerts`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`CN`, `modified` desc";
break;
}
diff --git a/pages/account/43.php b/pages/account/43.php
index 53b24d3..c889ce3 100644
--- a/pages/account/43.php
+++ b/pages/account/43.php
@@ -14,30 +14,30 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?
+*/
+
include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
+$ticketno='';
+$ticketvalidation=FALSE;
- if(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0)
- {
- $assurance = mysql_escape_string(intval($_REQUEST['assurance']));
- $row = 0;
- $res = mysql_query("select `to` from `notary` where `id`='$assurance'");
- if ($res) {
- $row = mysql_fetch_assoc($res);
- }
- mysql_query("delete from `notary` where `id`='$assurance'");
- if ($row) {
- fix_assurer_flag($row['to']);
- }
- }
+if (isset($_SESSION['ticketno'])) {
+ $ticketno = $_SESSION['ticketno'];
+ $ticketvalidation = valid_ticket_number($ticketno);
+}
+if (isset($_SESSION['ticketmsg'])) {
+ $ticketmsg = $_SESSION['ticketmsg'];
+} else {
+ $ticketmsg = '';
+}
- if(intval(array_key_exists('userid',$_REQUEST)?$_REQUEST['userid']:0) <= 0)
- {
+
+// search for an account by email search, if more than one is found display list to choose
+if(intval(array_key_exists('userid',$_REQUEST)?$_REQUEST['userid']:0) <= 0)
+{
$_REQUEST['userid'] = 0;
- $emailsearch = $email = mysql_escape_string(stripslashes($_REQUEST['email']));
+ $emailsearch = $email = mysql_real_escape_string(stripslashes($_REQUEST['email']));
//Disabled to speed up the queries
//if(!strstr($email, "%"))
@@ -45,877 +45,1036 @@ include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
// bug-975 ted+uli changes --- begin
if(preg_match("/^[0-9]+$/", $email)) {
- // $email consists of digits only ==> search for IDs
- // Be defensive here (outer join) if primary mail is not listed in email table
- $query = "select `users`.`id` as `id`, `email`.`email` as `email`
- from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
- where (`email`.`id`='$email' or `users`.`id`='$email')
- and `users`.`deleted`=0
- group by `users`.`id` limit 100";
+ // $email consists of digits only ==> search for IDs
+ // Be defensive here (outer join) if primary mail is not listed in email table
+ $query = "select `users`.`id` as `id`, `email`.`email` as `email`
+ from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
+ where (`email`.`id`='$email' or `users`.`id`='$email')
+ and `users`.`deleted`=0
+ group by `users`.`id` limit 100";
} else {
- // $email contains non-digits ==> search for mail addresses
- // Be defensive here (outer join) if primary mail is not listed in email table
- $query = "select `users`.`id` as `id`, `email`.`email` as `email`
- from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
- where (`email`.`email` like '$emailsearch'
- or `users`.`email` like '$emailsearch')
- and `users`.`deleted`=0
- group by `users`.`id` limit 100";
+ // $email contains non-digits ==> search for mail addresses
+ // Be defensive here (outer join) if primary mail is not listed in email table
+ $query = "select `users`.`id` as `id`, `email`.`email` as `email`
+ from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
+ where (`email`.`email` like '$emailsearch'
+ or `users`.`email` like '$emailsearch')
+ and `users`.`deleted`=0
+ group by `users`.`id` limit 100";
}
// bug-975 ted+uli changes --- end
$res = mysql_query($query);
- if(mysql_num_rows($res) > 1) { ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Select Specific Account Details")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("User ID")?></td>
- <td class="DataTD"><?=_("Email")?></td>
- </tr>
-<?
- while($row = mysql_fetch_assoc($res))
- { ?>
- <tr>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=intval($row['id'])?></a></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
- </tr>
-<? } if(mysql_num_rows($res) >= 100) { ?>
- <tr>
- <td class="DataTD" colspan="2"><?=_("Only the first 100 rows are displayed.")?></td>
- </tr>
-<? } else { ?>
- <tr>
- <td class="DataTD" colspan="2"><? printf(_("%s rows displayed."), mysql_num_rows($res)); ?></td>
- </tr>
-<? } ?>
-</table><br><br>
-<? } elseif(mysql_num_rows($res) == 1) {
- $row = mysql_fetch_assoc($res);
- $_REQUEST['userid'] = $row['id'];
- } else {
- printf(_("No users found matching %s"), sanitizeHTML($email));
- }
- }
-
- if(intval($_REQUEST['userid']) > 0)
- {
- $userid = intval($_REQUEST['userid']);
- $query = "select * from `users` where `users`.`id`='$userid' and `users`.`deleted`=0";
- $res = mysql_query($query);
- if(mysql_num_rows($res) <= 0)
- {
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
- } else {
- $row = mysql_fetch_assoc($res);
- $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($row['id'])."'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $alerts = mysql_fetch_assoc(mysql_query("select * from `alerts` where `memid`='".intval($row['id'])."'"));
+ if(mysql_num_rows($res) > 1) {
?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><? printf(_("%s's Account Details"), sanitizeHTML($row['email'])); ?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Email")?>:</td>
- <td class="DataTD"><?=sanitizeHTML($row['email'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("First Name")?>:</td>
- <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to modify this DOB and/or last name?")?>')) return false;">
- <input type="hidden" name="csrf" value="<?=make_csrf('admchangepers')?>" />
- <input type="text" name="fname" value="<?=sanitizeHTML($row['fname'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Middle Name")?>:</td>
- <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($row['mname'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Last Name")?>:</td>
- <td class="DataTD"> <input type="hidden" name="oldid" value="43">
- <input type="hidden" name="action" value="updatedob">
- <input type="hidden" name="userid" value="<?=intval($userid)?>">
- <input type="text" name="lname" value="<?=sanitizeHTML($row['lname'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Suffix")?>:</td>
- <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($row['suffix'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Date of Birth")?>:</td>
- <td class="DataTD">
-<?
- $year = intval(substr($row['dob'], 0, 4));
- $month = intval(substr($row['dob'], 5, 2));
- $day = intval(substr($row['dob'], 8, 2));
- ?><nobr><select name="day">
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Select Specific Account Details")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("User ID")?></td>
+ <td class="DataTD"><?=_("Email")?></td>
+ </tr>
<?
- for($i = 1; $i <= 31; $i++)
+ while($row = mysql_fetch_assoc($res))
{
- echo "<option";
- if($day == $i)
- echo " selected='selected'";
- echo ">$i</option>";
- }
?>
- </select>
- <select name="month">
+ <tr>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=intval($row['id'])?></a></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
+ </tr>
<?
- for($i = 1; $i <= 12; $i++)
- {
- echo "<option value='$i'";
- if($month == $i)
- echo " selected='selected'";
- echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))."</option>";
}
+
+ if(mysql_num_rows($res) >= 100) {
?>
- </select>
- <input type="text" name="year" value="<?=$year?>" size="4">
- <input type="submit" value="Go"></form></nobr></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("CCA accepted")?>:</td>
- <td class="DataTD"><a href="account.php?id=57&amp;userid=<?=intval($row['id'])?>"><?=intval(get_user_agreement_status($row['id'])) ? _("Yes") : _("No") ?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Trainings")?>:</td>
- <td class="DataTD"><a href="account.php?id=55&amp;userid=<?=intval($row['id'])?>">show</a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Is Assurer")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;assurer=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admsetassuret')?>"><?=$row['assurer']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Blocked Assurer")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;assurer_blocked=<?=intval($row['id'])?>"><?=$row['assurer_blocked']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Account Locking")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;locked=<?=$row['id']?>&amp;csrf=<?=make_csrf('admactlock')?>"><?=$row['locked']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Code Signing")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;codesign=<?=$row['id']?>&amp;csrf=<?=make_csrf('admcodesign')?>"><?=$row['codesign']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Org Assurer")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;orgadmin=<?=$row['id']?>&amp;csrf=<?=make_csrf('admorgadmin')?>"><?=$row['orgadmin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("TTP Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;ttpadmin=<?=$row['id']?>&amp;csrf=<?=make_csrf('admttpadmin')?>"><?=$row['ttpadmin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Location Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;locadmin=<?=$row['id']?>"><?=$row['locadmin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;admin=<?=$row['id']?>&amp;csrf=<?=make_csrf('admsetadmin')?>"><?=$row['admin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Ad Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;adadmin=<?=$row['id']?>"><?=$row['adadmin']?></a> (0 = none, 1 = submit, 2 = approve)</td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Tverify Account")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;tverify=<?=$row['id']?>"><?=$row['tverify']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("General Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;general=<?=$row['id']?>"><?=$alerts['general']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Country Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;country=<?=$row['id']?>"><?=$alerts['country']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Regional Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;regional=<?=$row['id']?>"><?=$alerts['regional']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Within 200km Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;radius=<?=$row['id']?>"><?=$alerts['radius']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Change Password")?>:</td>
- <td class="DataTD"><a href="account.php?id=44&amp;userid=<?=$row['id']?>"><?=_("Change Password")?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Delete Account")?>:</td>
- <td class="DataTD"><a href="account.php?id=50&amp;userid=<?=$row['id']?>&amp;csrf=<?=make_csrf('admdelaccount')?>"><?=_("Delete Account")?></a></td>
- </tr>
+ <tr>
+ <td class="DataTD" colspan="2"><?=_("Only the first 100 rows are displayed.")?></td>
+ </tr>
<?
- // This is intensionally a $_GET for audit purposes. DO NOT CHANGE!!!
- if(array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes") {
+ } else {
?>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q1:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q1'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A1:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A1'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q2:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q2'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A2:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A2'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q3:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q3'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A3:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A3'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q4:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q4'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A4:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A4'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q5:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q5'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A5:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A5'])?></td>
- </tr>
-<? } else { ?>
- <tr>
- <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;showlostpw=yes"><?=_("Show Lost Password Details")?></a></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD"><?=_("Assurance Points")?>:</td>
- <td class="DataTD"><?=intval($drow['points'])?></td>
- </tr>
-</table>
-<br><?
- $query = "select * from `email` where `memid`='".intval($row['id'])."' and `deleted`=0 and `hash`=''
- and `email`!='".mysql_escape_string($row['email'])."'";
- $dres = mysql_query($query);
- if(mysql_num_rows($dres) > 0) { ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Alternate Verified Email Addresses")?></td>
- </tr><?
- $rc = mysql_num_rows($dres);
- while($drow = mysql_fetch_assoc($dres))
- { ?>
- <tr>
- <td class="DataTD"><?=_("Secondary Emails")?>:</td>
- <td class="DataTD"><?=sanitizeHTML($drow['email'])?></td>
- </tr>
-<? } ?>
-</table>
-<br><? } ?>
+ <tr>
+ <td class="DataTD" colspan="2"><? printf(_("%s rows displayed."), mysql_num_rows($res)); ?></td>
+ </tr>
<?
- $query = "select * from `domains` where `memid`='".intval($row['id'])."' and `deleted`=0 and `hash`=''";
- $dres = mysql_query($query);
- if(mysql_num_rows($dres) > 0) { ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Verified Domains")?></td>
- </tr><?
- $rc = mysql_num_rows($dres);
- while($drow = mysql_fetch_assoc($dres))
- { ?>
- <tr>
- <td class="DataTD"><?=_("Domain")?>:</td>
- <td class="DataTD"><?=sanitizeHTML($drow['domain'])?></td>
- </tr>
-<? } ?>
-</table>
-<br>
-<? } ?>
-<? // Begin - Debug infos ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="2" class="title"><?=_("Account State")?></td>
- </tr>
-
-<?
- // --- bug-975 begin ---
- // potential db inconsistency like in a20110804.1
- // Admin console -> don't list user account
- // User login -> impossible
- // Assurer, assure someone -> user displayed
- /* regular user account search with regular settings
-
- --- Admin Console find user query
- $query = "select `users`.`id` as `id`, `email`.`email` as `email` from `users`,`email`
- where `users`.`id`=`email`.`memid` and
- (`email`.`email` like '$emailsearch' or `email`.`id`='$email' or `users`.`id`='$email') and
- `email`.`hash`='' and `email`.`deleted`=0 and `users`.`deleted`=0
- group by `users`.`id` limit 100";
- => requirements
- 1. email.hash = ''
- 2. email.deleted = 0
- 3. users.deleted = 0
- 4. email.email = primary-email (???) or'd
- not covered by admin console find user routine, but may block users login
- 5. users.verified = 0|1
- further "special settings"
- 6. users.locked (setting displayed in display form)
- 7. users.assurer_blocked (setting displayed in display form)
-
- --- User login user query
- select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or
- `password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0
- => requirements
- 1. users.verified = 1
- 2. users.deleted = 0
- 3. users.locked = 0
- 4. users.email = primary-email
-
- --- Assurer, assure someone find user query
- select * from `users` where `email`='".mysql_escape_string(stripslashes($_POST['email']))."'
- and `deleted`=0
- => requirements
- 1. users.deleted = 0
- 2. users.email = primary-email
- Admin User Assurer
- bit Console Login assure someone
-
- 1. email.hash = '' Yes No No
- 2. email.deleted = 0 Yes No No
- 3. users.deleted = 0 Yes Yes Yes
- 4. users.verified = 1 No Yes No
- 5. users.locked = 0 No Yes No
- 6. users.email = prim-email No Yes Yes
- 7. email.email = prim-email Yes No No
-
- full usable account needs all 7 requirements fulfilled
- so if one setting isn't set/cleared there is an inconsistency either way
- if eg email.email is not avail, admin console cannot open user info
- but user can login and assurer can display user info
- if user verified is not set to 1, admin console displays user record
- but user cannot login, but assurer can search for the user and the data displays
-
- consistency check:
- 1. search primary-email in users.email
- 2. search primary-email in email.email
- 3. userid = email.memid
- 4. check settings from table 1. - 5.
-
- */
-
- $inconsistency = 0;
- $inconsistencydisp = "";
- $inccause = "";
- // current userid intval($row['id'])
- $query = "select `email` as `uemail`, `deleted` as `udeleted`, `verified`, `locked`
- from `users` where `id`='".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $uemail = $drow['uemail'];
- $udeleted = $drow['udeleted'];
- $uverified = $drow['verified'];
- $ulocked = $drow['locked'];
-
- $query = "select `hash`, `email` as `eemail` from `email`
- where `memid`='".intval($row['id'])."' and
- `email` ='".$uemail."' and
- `deleted` = 0";
- $dres = mysql_query($query);
- if ($drow = mysql_fetch_assoc($dres)) {
- $drow['edeleted'] = 0;
- } else {
- // try if there are deleted entries
- $query = "select `hash`, `deleted` as `edeleted`, `email` as `eemail` from `email`
- where `memid`='".intval($row['id'])."' and
- `email` ='".$uemail."'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- }
-
- if ($drow) {
- $eemail = $drow['eemail'];
- $edeleted = $drow['edeleted'];
- $ehash = $drow['hash'];
- if ($udeleted!=0) {
- $inconsistency += 1;
- $inccause .= (empty($inccause)?"":"<br>")._("Users record set to deleted");
- }
- if ($uverified!=1) {
- $inconsistency += 2;
- $inccause .= (empty($inccause)?"":"<br>")._("Users record verified not set");
- }
- if ($ulocked!=0) {
- $inconsistency += 4;
- $inccause .= (empty($inccause)?"":"<br>")._("Users record locked set");
- }
- if ($edeleted!=0) {
- $inconsistency += 8;
- $inccause .= (empty($inccause)?"":"<br>")._("Email record set deleted");
- }
- if ($ehash!='') {
- $inconsistency += 16;
- $inccause .= (empty($inccause)?"":"<br>")._("Email record hash not unset");
- }
- } else {
- $inconsistency = 32;
- $inccause = _("Prim. email, Email record doesn't exist");
- }
- if ($inconsistency>0) {
- // $inconsistencydisp = _("Yes");
-?>
- <tr>
- <td class="DataTD"><?=_("Account inconsistency")?>:</td>
- <td class="DataTD"><?=$inccause?><br>code: <?=$inconsistency?></td>
- </tr>
- <tr>
- <td colspan="2" class="DataTD" style="max-width: 75ex">
- <?=_("Account inconsistency can cause problems in daily account ".
- "operations and needs to be fixed manually through arbitration/critical ".
- "team.")?>
- </td>
- </tr>
-<? }
-
- // --- bug-975 end ---
+ }
?>
-</table>
-<br>
+ </table><br><br>
<?
- // End - Debug infos
-?>
+ } elseif(mysql_num_rows($res) == 1) {
+ $row = mysql_fetch_assoc($res);
+ $_REQUEST['userid'] = $row['id'];
+ } else {
+ printf(_("No users found matching %s"), sanitizeHTML($email));
+ }
+}
+
+// display user information for given user id
+if(intval($_REQUEST['userid']) > 0) {
+ $userid = intval($_REQUEST['userid']);
+ $res =get_user_data($userid);
+ if(mysql_num_rows($res) <= 0) {
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
+ } else {
+ $row = mysql_fetch_assoc($res);
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($row['id'])."' and `deleted` = 0";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $alerts =get_alerts(intval($row['id']));
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="6" class="title"><?=_("Certificates")?></td>
- </tr>
-
- <tr>
- <td class="DataTD"><?=_("Cert Type")?>:</td>
- <td class="DataTD"><?=_("Total")?></td>
- <td class="DataTD"><?=_("Valid")?></td>
- <td class="DataTD"><?=_("Expired")?></td>
- <td class="DataTD"><?=_("Revoked")?></td>
- <td class="DataTD"><?=_("Latest Expire")?></td>
- </tr>
-<!-- server certificates -->
- <tr>
- <td class="DataTD"><?=_("Server")?>:</td>
- <?
- $query = "select COUNT(*) as `total`,
- MAX(`domaincerts`.`expire`) as `maxexpire`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."'
- and `revoked` = '0000-00-00 00:00:00'
- and `expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."'
- and `expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."'
- and `revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- client certificates -->
- <tr>
- <td class="DataTD"><?=_("Client")?>:</td>
- <?
- $query = "select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."'
- and `revoked` = '0000-00-00 00:00:00'
- and `expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."'
- and `expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."'
- and `revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- gpg certificates -->
- <tr>
- <td class="DataTD"><?=_("GPG")?>:</td>
- <?
- $query = "select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
- from `gpg`
- where `memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `gpg`
- where `memid` = '".intval($row['id'])."'
- and `expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `gpg`
- where `memid` = '".intval($row['id'])."'
- and `expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- org server certificates -->
- <tr>
- <td class="DataTD"><a href="account.php?id=58&amp;userid=<?=intval($row['id'])?>"><?=_("Org Server")?></a>:</td>
- <?
- $query = "select COUNT(*) as `total`,
- MAX(`orgcerts`.`expire`) as `maxexpire`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
- and `orgcerts`.`expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- org client certificates -->
- <tr>
- <td class="DataTD"><?=_("Org Client")?>:</td>
- <?
- $query = "select COUNT(*) as `total`,
- MAX(`orgcerts`.`expire`) as `maxexpire`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
- and `orgcerts`.`expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
- <tr>
- <td colspan="6" class="title">
- <form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to revoke all private certificates?")?>')) return false;">
- <input type="hidden" name="action" value="revokecert">
- <input type="hidden" name="oldid" value="43">
- <input type="hidden" name="userid" value="<?=intval($userid)?>">
- <input type="submit" value="<?=_('revoke certificates')?>">
- </form>
- </td>
- </tr>
-</table>
-<br>
-
-
-<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredto"><?=_("Show Assurances the user got")?></a>
- (<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredto15"><?=_("New calculation")?></a>)
-<br />
-<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredby"><?=_("Show Assurances the user gave")?></a>
- (<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredby15"><?=_("New calculation")?></a>)
-<br />
+//display account data
-<?
-// if(array_key_exists('assuredto',$_GET) && $_GET['assuredto'] == "yes") {
+//deletes an assurance
+ if(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0 && $ticketvalidation == true)
+ {
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE assurance revoke', $ticketno)) {
+ $ticketmsg=_("Writing to the admin log failed. Can't continue.");
+ } else {
+ $assurance = intval($_REQUEST['assurance']);
+ $trow = 0;
+ $res = mysql_query("select `to` from `notary` where `id`='".intval($assurance)."' and `deleted` = 0");
+ if ($res) {
+ $trow = mysql_fetch_assoc($res);
+ if ($trow) {
+ mysql_query("update `notary` set `deleted`=NOW() where `id`='".intval($assurance)."'");
+ fix_assurer_flag($trow['to']);
+ }
+ }
+ }
+ } elseif(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0 && $ticketvalidation == FALSE) {
+ $ticketmsg=_('No assurance revoked. Ticket number is missing!');
+ }
-function showassuredto()
-{
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="8" class="title"><?=_("Assurance Points")?></td>
- </tr>
- <tr>
- <td class="DataTD"><b><?=_("ID")?></b></td>
- <td class="DataTD"><b><?=_("Date")?></b></td>
- <td class="DataTD"><b><?=_("Who")?></b></td>
- <td class="DataTD"><b><?=_("Email")?></b></td>
- <td class="DataTD"><b><?=_("Points")?></b></td>
- <td class="DataTD"><b><?=_("Location")?></b></td>
- <td class="DataTD"><b><?=_("Method")?></b></td>
- <td class="DataTD"><b><?=_("Revoke")?></b></td>
- </tr>
-<?
- $query = "select * from `notary` where `to`='".intval($_GET['userid'])."'";
- $dres = mysql_query($query);
- $points = 0;
- while($drow = mysql_fetch_assoc($dres))
- {
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['from'])."'"));
- $points += $drow['points'];
+//Ticket number
?>
- <tr>
- <td class="DataTD"><?=$drow['id']?></td>
- <td class="DataTD"><?=sanitizeHTML($drow['date'])?></td>
- <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['fname'])." ".sanitizeHTML($fromuser['lname'])?></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
- <td class="DataTD"><?=intval($drow['points'])?></td>
- <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td>
- <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>&amp;assurance=<?=intval($drow['id'])?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$drow['id'])?>');"><?=_("Revoke")?></a></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
- <td class="DataTD"><?=$points?></td>
- <td class="DataTD" colspan="3">&nbsp;</td>
- </tr>
-</table>
-<? } ?>
+<form method="post" action="account.php?id=43&userid=<?=intval($_REQUEST['userid'])?>">
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="2" class="title"><?=_('Ticket handling') ?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_('Ticket no')?>:</td>
+ <td class="DataTD"><input type="text" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="DataTDError"><?=$ticketmsg?></td><?php $_SESSION['ticketmsg']='' ?>
+ </tr>
+ <tr>
+ <td colspan="2" ><input type="submit" value="<?=_('Set ticket number') ?>"></td>
+ </tr>
+ </table>
+</form>
+<br/>
+
+
+<!-- display data table -->
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><? printf(_("%s's Account Details"), sanitizeHTML($row['email'])); ?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Email")?>:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['email'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("First Name")?>:</td>
+ <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to modify this DOB and/or last name?")?>')) return false;">
+ <input type="hidden" name="csrf" value="<?=make_csrf('admchangepers')?>" />
+ <input type="text" name="fname" value="<?=sanitizeHTML($row['fname'])?>">
+ </td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Middle Name")?>:</td>
+ <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($row['mname'])?>"></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Last Name")?>:</td>
+ <td class="DataTD"> <input type="hidden" name="oldid" value="43">
+ <input type="hidden" name="action" value="updatedob">
+ <input type="hidden" name="userid" value="<?=intval($userid)?>">
+ <input type="text" name="lname" value="<?=sanitizeHTML($row['lname'])?>">
+ </td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Suffix")?>:</td>
+ <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($row['suffix'])?>"></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Date of Birth")?>:</td>
+ <td class="DataTD">
+ <?
+ $year = intval(substr($row['dob'], 0, 4));
+ $month = intval(substr($row['dob'], 5, 2));
+ $day = intval(substr($row['dob'], 8, 2));
+ ?>
+ <nobr>
+ <select name="day">
+ <?
+ for($i = 1; $i <= 31; $i++) {
+ echo "<option";
+ if($day == $i) {
+ echo " selected='selected'";
+ }
+ echo ">$i</option>";
+ }
+ ?>
+ </select>
+ <select name="month">
+ <?
+ for($i = 1; $i <= 12; $i++) {
+ echo "<option value='$i'";
+ if($month == $i)
+ echo " selected='selected'";
+ echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))."</option>";
+ }
+ ?>
+ </select>
+ <input type="text" name="year" value="<?=$year?>" size="4">
+ <input type="submit" value="Go">
+ <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/>
+ </form>
+ </nobr>
+ </td>
+ </tr>
+
+ <? // list of flags ?>
+ <tr>
+ <td class="DataTD"><?=_("CCA accepted")?>:</td>
+ <td class="DataTD"><a href="account.php?id=57&amp;userid=<?=intval($row['id'])?>"><?=intval(get_user_agreement_status($row['id'], 'CCA')) ? _("Yes") : _("No") ?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Trainings")?>:</td>
+ <td class="DataTD"><a href="account.php?id=55&amp;userid=<?=intval($row['id'])?>">show</a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Is Assurer")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;assurer=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admsetassuret')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['assurer'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Blocked Assurer")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;assurer_blocked=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['assurer_blocked'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Account Locking")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;locked=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admactlock')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['locked'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Code Signing")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;codesign=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admcodesign')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['codesign'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Org Assurer")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;orgadmin=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admorgadmin')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['orgadmin'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("TTP Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;ttpadmin=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admttpadmin')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['ttpadmin'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Location Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;locadmin=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['locadmin']?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;admin=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admsetadmin')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['admin'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Ad Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;adadmin=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['adadmin'])?></a> (0 = none, 1 = submit, 2 = approve)</td>
+ </tr>
+ <!-- presently not needed
+ <tr>
+ <td class="DataTD"><?=_("Tverify Account")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;tverify=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['tverify'])?></a></td>
+ </tr>
+ -->
+ <tr>
+ <td class="DataTD"><?=_("General Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;general=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['general'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Country Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;country=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['country'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Regional Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;regional=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['regional'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Within 200km Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;radius=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['radius'])?></a></td>
+ </tr>
+ <? //change password, view secret questions and delete account section ?>
+ <tr>
+ <td class="DataTD"><?=_("Change Password")?>:</td>
+ <td class="DataTD"><a href="account.php?id=44&amp;userid=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Change Password")?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Delete Account")?>:</td>
+ <td class="DataTD"><a href="account.php?id=50&amp;userid=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admdelaccount')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Delete Account")?></a></td>
+ </tr>
+ <?
+ // This is intensionally a $_GET for audit purposes. DO NOT CHANGE!!!
+ if(array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes" && $ticketvalidation==true) {
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE view lost password information', $ticketno)) {
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><?=_("Writing to the admin log failed. Can't continue.")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;showlostpw=yes&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td>
+ </tr>
+ <?
+ } else {
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q1:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q1'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A1:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A1'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q2:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q2'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A2:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A2'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q3:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q3'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A3:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A3'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q4:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q4'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A4:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A4'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q5:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q5'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A5:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A5'])?></td>
+ </tr>
+ <?
+ }
+ } elseif (array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes" && $ticketvalidation==false) {
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><?=_('No access granted. Ticket number is missing')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;showlostpw=yes&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td>
+ </tr>
+ <?
+ } else {
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;showlostpw=yes&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td>
+ </tr>
+ <? }
+
+ // list assurance points
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Assurance Points")?>:</td>
+ <td class="DataTD"><?=intval($drow['points'])?></td>
+ </tr>
+ <?
+ // show account history
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=59&amp;oldid=43&amp;userid=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_('Show account history')?></a></td>
+ </tr>
+ </table>
+ <br/>
+ <?
+ //list secondary email addresses
+ $dres = get_email_addresses(intval($row['id']),$row['email']);
+ if(mysql_num_rows($dres) > 0) {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Alternate Verified Email Addresses")?></td>
+ </tr>
+ <?
+ while($drow = mysql_fetch_assoc($dres)) {
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Secondary Emails")?>:</td>
+ <td class="DataTD"><?=sanitizeHTML($drow['email'])?></td>
+ </tr>
+ <?
+ }
+ ?>
+ </table>
+ <br/>
+ <?
+ }
+
+ // list of domains
+ $dres=get_domains(intval($row['id']));
+ if(mysql_num_rows($dres) > 0) {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Verified Domains")?></td>
+ </tr>
+ <?
+ while($drow = mysql_fetch_assoc($dres)) {
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Domain")?>:</td>
+ <td class="DataTD"><?=sanitizeHTML($drow['domain'])?></td>
+ </tr>
+ <?
+ }
+ ?>
+ </table>
+ <br/>
+ <?
+ }
+ ?>
+ <? // Begin - Debug infos ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="2" class="title"><?=_("Account State")?></td>
+ </tr>
+
+ <?
+ // --- bug-975 begin ---
+ // potential db inconsistency like in a20110804.1
+ // Admin console -> don't list user account
+ // User login -> impossible
+ // Assurer, assure someone -> user displayed
+ /* regular user account search with regular settings
+
+ --- Admin Console find user query
+ $query = "select `users`.`id` as `id`, `email`.`email` as `email` from `users`,`email`
+ where `users`.`id`=`email`.`memid` and
+ (`email`.`email` like '$emailsearch' or `email`.`id`='$email' or `users`.`id`='$email') and
+ `email`.`hash`='' and `email`.`deleted`=0 and `users`.`deleted`=0
+ group by `users`.`id` limit 100";
+ => requirements
+ 1. email.hash = ''
+ 2. email.deleted = 0
+ 3. users.deleted = 0
+ 4. email.email = primary-email (???) or'd
+ not covered by admin console find user routine, but may block users login
+ 5. users.verified = 0|1
+ further "special settings"
+ 6. users.locked (setting displayed in display form)
+ 7. users.assurer_blocked (setting displayed in display form)
+
+ --- User login user query
+ select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or
+ `password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0
+ => requirements
+ 1. users.verified = 1
+ 2. users.deleted = 0
+ 3. users.locked = 0
+ 4. users.email = primary-email
+
+ --- Assurer, assure someone find user query
+ select * from `users` where `email`='".mysql_real_escape_string(stripslashes($_POST['email']))."'
+ and `deleted`=0
+ => requirements
+ 1. users.deleted = 0
+ 2. users.email = primary-email
+
+ Admin User Assurer
+ bit Console Login assure someone
+
+ 1. email.hash = '' Yes No No
+ 2. email.deleted = 0 Yes No No
+ 3. users.deleted = 0 Yes Yes Yes
+ 4. users.verified = 1 No Yes No
+ 5. users.locked = 0 No Yes No
+ 6. users.email = prim-email No Yes Yes
+ 7. email.email = prim-email Yes No No
+
+ full usable account needs all 7 requirements fulfilled
+ so if one setting isn't set/cleared there is an inconsistency either way
+ if eg email.email is not avail, admin console cannot open user info
+ but user can login and assurer can display user info
+ if user verified is not set to 1, admin console displays user record
+ but user cannot login, but assurer can search for the user and the data displays
+
+ consistency check:
+ 1. search primary-email in users.email
+ 2. search primary-email in email.email
+ 3. userid = email.memid
+ 4. check settings from table 1. - 5.
+
+ */
+
+ $inconsistency = 0;
+ $inconsistencydisp = "";
+ $inccause = "";
+
+ // current userid intval($row['id'])
+ $query = "select `email` as `uemail`, `deleted` as `udeleted`, `verified`, `locked`
+ from `users` where `id`='".intval($row['id'])."' ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $uemail = $drow['uemail'];
+ $udeleted = $drow['udeleted'];
+ $uverified = $drow['verified'];
+ $ulocked = $drow['locked'];
+
+ $query = "select `hash`, `email` as `eemail` from `email`
+ where `memid`='".intval($row['id'])."' and
+ `email` ='".$uemail."' and
+ `deleted` = 0";
+ $dres = mysql_query($query);
+ if ($drow = mysql_fetch_assoc($dres)) {
+ $drow['edeleted'] = 0;
+ } else {
+ // try if there are deleted entries
+ $query = "select `hash`, `deleted` as `edeleted`, `email` as `eemail` from `email`
+ where `memid`='".intval($row['id'])."' and
+ `email` ='".$uemail."'";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ }
+
+ if ($drow) {
+ $eemail = $drow['eemail'];
+ $edeleted = $drow['edeleted'];
+ $ehash = $drow['hash'];
+ if ($udeleted!=0) {
+ $inconsistency += 1;
+ $inccause .= (empty($inccause)?"":"<br>")._("Users record set to deleted");
+ }
+ if ($uverified!=1) {
+ $inconsistency += 2;
+ $inccause .= (empty($inccause)?"":"<br>")._("Users record verified not set");
+ }
+ if ($ulocked!=0) {
+ $inconsistency += 4;
+ $inccause .= (empty($inccause)?"":"<br>")._("Users record locked set");
+ }
+ if ($edeleted!=0) {
+ $inconsistency += 8;
+ $inccause .= (empty($inccause)?"":"<br>")._("Email record set deleted");
+ }
+ if ($ehash!='') {
+ $inconsistency += 16;
+ $inccause .= (empty($inccause)?"":"<br>")._("Email record hash not unset");
+ }
+ } else {
+ $inconsistency = 32;
+ $inccause = _("Prim. email, Email record doesn't exist");
+ }
+ if ($inconsistency>0) {
+ // $inconsistencydisp = _("Yes");
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Account inconsistency")?>:</td>
+ <td class="DataTD"><?=$inccause?><br>code: <?=intval($inconsistency)?></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="DataTD" style="max-width: 75ex;">
+ <?=_("Account inconsistency can cause problems in daily account operations and needs to be fixed manually through arbitration/critical team.")?>
+ </td>
+ </tr>
+ <?
+ }
+
+ // --- bug-975 end ---
+ ?>
+ </table>
+ <br />
+ <?
+ // End - Debug infos
+
+ // certificate overview
+ ?>
+
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="6" class="title"><?=_("Certificates")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Cert Type")?>:</td>
+ <td class="DataTD"><?=_("Total")?></td>
+ <td class="DataTD"><?=_("Valid")?></td>
+ <td class="DataTD"><?=_("Expired")?></td>
+ <td class="DataTD"><?=_("Revoked")?></td>
+ <td class="DataTD"><?=_("Latest Expire")?></td>
+ </tr>
+ <!-- server certificates -->
+ <tr>
+ <td class="DataTD"><?=_("Server")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`,
+ MAX(`domaincerts`.`expire`) as `maxexpire`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ and `revoked` = '0000-00-00 00:00:00'
+ and `expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ and `expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ and `revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- client certificates -->
+ <tr>
+ <td class="DataTD"><?=_("Client")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ and `revoked` = '0000-00-00 00:00:00'
+ and `expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ and `expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ and `revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- gpg certificates -->
+ <tr>
+ <td class="DataTD"><?=_("GPG")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
+ from `gpg`
+ where `memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `gpg`
+ where `memid` = '".intval($row['id'])."'
+ and `expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `gpg`
+ where `memid` = '".intval($row['id'])."'
+ and `expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- org server certificates -->
+ <tr>
+ <td class="DataTD"><a href="account.php?id=58&amp;userid=<?=intval($row['id'])?>"><?=_("Org Server")?></a>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`,
+ MAX(`orgcerts`.`expire`) as `maxexpire`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
+ and `orgcerts`.`expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- org client certificates -->
+ <tr>
+ <td class="DataTD"><?=_("Org Client")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`,
+ MAX(`orgcerts`.`expire`) as `maxexpire`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
+ and `orgcerts`.`expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <tr>
+ <td colspan="6" class="title">
+ <form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to revoke all private certificates?")?>')) return false;">
+ <input type="hidden" name="action" value="revokecert">
+ <input type="hidden" name="oldid" value="43">
+ <input type="hidden" name="userid" value="<?=intval($userid)?>">
+ <input type="submit" value="<?=_('revoke certificates')?>">
+ <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/>
+ </form>
+ </td>
+ </tr>
+ </table>
+ <br />
+ <? // list assurances ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td class="DataTD">
+ <a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredto&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user got")?></a>
+ (<a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredto15&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>)
+ </td>
+ </tr>
+ <tr>
+ <td class="DataTD">
+ <a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredby&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user gave")?></a>
+ (<a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredby15&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>)
+ </td>
+ </tr>
+ </table>
+ <?
+ // if(array_key_exists('assuredto',$_GET) && $_GET['assuredto'] == "yes") {
+
+
+ function showassuredto($ticketno)
+ {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="8" class="title"><?=_("Assurance Points")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><b><?=_("ID")?></b></td>
+ <td class="DataTD"><b><?=_("Date")?></b></td>
+ <td class="DataTD"><b><?=_("Who")?></b></td>
+ <td class="DataTD"><b><?=_("Email")?></b></td>
+ <td class="DataTD"><b><?=_("Points")?></b></td>
+ <td class="DataTD"><b><?=_("Location")?></b></td>
+ <td class="DataTD"><b><?=_("Method")?></b></td>
+ <td class="DataTD"><b><?=_("Revoke")?></b></td>
+ </tr>
+ <?
+ $query = "select * from `notary` where `to`='".intval($_GET['userid'])."' and `deleted` = 0";
+ $dres = mysql_query($query);
+ $points = 0;
+ while($drow = mysql_fetch_assoc($dres)) {
+ $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['from'])."'"));
+ $points += $drow['points'];
+ ?>
+ <tr>
+ <td class="DataTD"><?=$drow['id']?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['date'])?></td>
+ <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['fname'])." ".sanitizeHTML($fromuser['lname'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
+ <td class="DataTD"><?=intval($drow['points'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>&amp;assurance=<?=intval($drow['id'])?>&amp;csrf=<?=make_csrf('admdelassurance')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),intval($drow['id']))?>');"><?=_("Revoke")?></a></td>
+ </tr>
+ <?
+ }
+ ?>
+ <tr>
+ <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
+ <td class="DataTD"><?=intval($points)?></td>
+ <td class="DataTD" colspan="3">&nbsp;</td>
+ </tr>
+ </table>
+ <?
+ }
+
+ function showassuredby($ticketno)
+ {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="8" class="title"><?=_("Assurance Points The User Issued")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><b><?=_("ID")?></b></td>
+ <td class="DataTD"><b><?=_("Date")?></b></td>
+ <td class="DataTD"><b><?=_("Who")?></b></td>
+ <td class="DataTD"><b><?=_("Email")?></b></td>
+ <td class="DataTD"><b><?=_("Points")?></b></td>
+ <td class="DataTD"><b><?=_("Location")?></b></td>
+ <td class="DataTD"><b><?=_("Method")?></b></td>
+ <td class="DataTD"><b><?=_("Revoke")?></b></td>
+ </tr>
+ <?
+ $query = "select * from `notary` where `from`='".intval($_GET['userid'])."' and `deleted` = 0";
+ $dres = mysql_query($query);
+ $points = 0;
+ while($drow = mysql_fetch_assoc($dres)) {
+ $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['to'])."'"));
+ $points += intval($drow['points']);
+ ?>
+ <tr>
+ <td class="DataTD"><?=intval($drow['id'])?></td>
+ <td class="DataTD"><?=$drow['date']?></td>
+ <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['fname']." ".$fromuser['lname'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
+ <td class="DataTD"><?=intval($drow['points'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['from'])?>&assurance=<?=intval($drow['id'])?>&amp;csrf=<?=make_csrf('admdelassurance')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),intval($drow['id']))?>');"><?=_("Revoke")?></a></td>
+ </tr>
+ <?
+ }
+ ?>
+ <tr>
+ <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
+ <td class="DataTD"><?=intval($points)?></td>
+ <td class="DataTD" colspan="3">&nbsp;</td>
+ </tr>
+ </table>
+ <?} ?>
+<br/><br/>
<?
-function showassuredby()
-{
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="8" class="title"><?=_("Assurance Points The User Issued")?></td>
- </tr>
- <tr>
- <td class="DataTD"><b><?=_("ID")?></b></td>
- <td class="DataTD"><b><?=_("Date")?></b></td>
- <td class="DataTD"><b><?=_("Who")?></b></td>
- <td class="DataTD"><b><?=_("Email")?></b></td>
- <td class="DataTD"><b><?=_("Points")?></b></td>
- <td class="DataTD"><b><?=_("Location")?></b></td>
- <td class="DataTD"><b><?=_("Method")?></b></td>
- <td class="DataTD"><b><?=_("Revoke")?></b></td>
- </tr>
-<?
- $query = "select * from `notary` where `from`='".intval($_GET['userid'])."'";
- $dres = mysql_query($query);
- $points = 0;
- while($drow = mysql_fetch_assoc($dres))
- {
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$drow['to']."'"));
- $points += $drow['points'];
-?>
- <tr>
- <td class="DataTD"><?=$drow['id']?></td>
- <td class="DataTD"><?=$drow['date']?></td>
- <td class="DataTD"><a href="wot.php?id=9&userid=<?=$drow['to']?>"><?=$fromuser['fname']." ".$fromuser['lname']?></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
- <td class="DataTD"><?=$drow['points']?></td>
- <td class="DataTD"><?=$drow['location']?></td>
- <td class="DataTD"><?=$drow['method']?></td>
- <td class="DataTD"><a href="account.php?id=43&userid=<?=$drow['from']?>&assurance=<?=$drow['id']?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$drow['id'])?>');"><?=_("Revoke")?></a></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
- <td class="DataTD"><?=$points?></td>
- <td class="DataTD" colspan="3">&nbsp;</td>
- </tr>
-</table>
-<? } ?>
-<br><br>
-<? } }
+} }
if(isset($_GET['shownotary'])) {
switch($_GET['shownotary']) {
case 'assuredto':
- showassuredto();
+ showassuredto($ticketno);
break;
case 'assuredby':
- showassuredby();
+ showassuredby($ticketno);
break;
case 'assuredto15':
- output_received_assurances(intval($_GET['userid']),1);
+ output_received_assurances(intval($_GET['userid']),1,$ticketno);
break;
case 'assuredby15':
- output_given_assurances(intval($_GET['userid']),1);
+ output_given_assurances(intval($_GET['userid']),1, $ticketno);
break;
}
}
diff --git a/pages/account/44.php b/pages/account/44.php
index fd34612..718f0e0 100644
--- a/pages/account/44.php
+++ b/pages/account/44.php
@@ -14,8 +14,28 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<? if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") { ?><div color="orange">ERROR: <?=$_SESSION['_config']['error']?></div><? unset($_SESSION['_config']['error']); } ?>
+*/
+
+if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") {
+ ?>
+ <div style="color: orange;">ERROR: <?=$_SESSION['_config']['error']?></div>
+ <?
+ unset($_SESSION['_config']['error']);
+}
+
+$ticketno = "";
+if (array_key_exists('ticketno', $_SESSION)) {
+ $ticketno = $_SESSION['ticketno'];
+}
+
+if (!valid_ticket_number($ticketno)) {
+ printf(_("I'm sorry, you did not enter a ticket number! %s You cannot reset the password."), '<br/>');
+ echo '<br/><a href="account.php?id=43&amp;userid='.intval($_REQUEST['userid']).'">'._('Back to previous page.').'</a>';
+ showfooter();
+ exit;
+ }
+?>
+
<form method="post" action="account.php">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
@@ -34,5 +54,6 @@
</tr>
</table>
<input type="hidden" name="userid" value="<?=intval($_REQUEST['userid'])?>">
-<input type="hidden" name="oldid" value="<?=$id?>">
+<input type="hidden" name="oldid" value="<?=intval($id)?>">
+<input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/>
</form>
diff --git a/pages/account/5.php b/pages/account/5.php
index 934ca0c..efed0ab 100644
--- a/pages/account/5.php
+++ b/pages/account/5.php
@@ -19,7 +19,7 @@
<form method="post" action="account.php">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
- <td colspan="10" class="title"><?=_("Client Certificates")?> - <a href="account.php?id=5&amp;viewall=<?=!$viewall?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
+ <td colspan="10" class="title"><?=_("Client Certificates")?> - <a href="account.php?id=5&amp;viewall=<?=intval(!$viewall)?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
</tr>
<tr>
<td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
@@ -34,23 +34,24 @@
$query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`,
- `emailcerts`.`expire` as `expires`,
+ `emailcerts`.`expire`,
`emailcerts`.`revoked` as `revoke`,
UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`,
+ if (`emailcerts`.`expire`=0,CURRENT_TIMESTAMP(),`emailcerts`.`modified`) as `modified` ,
`emailcerts`.`id`,
`emailcerts`.`CN`,
`emailcerts`.`serial`,
`emailcerts`.`disablelogin` as `disablelogin`,
`emailcerts`.`description`
from `emailcerts`
- where `emailcerts`.`memid`='".$_SESSION['profile']['id']."'
+ where `emailcerts`.`memid`='".intval($_SESSION['profile']['id'])."'
";
if($viewall != 1)
$query .= " AND `revoked`=0 AND `renewed`=0 ";
$query .= " GROUP BY `emailcerts`.`id` ";
if($viewall != 1)
- $query .= " HAVING `timeleft` > 0 ";
- $query .= " ORDER BY `emailcerts`.`modified` desc";
+ $query .= " HAVING `timeleft` > 0 or `expire` = 0 ";
+ $query .= " ORDER BY `modified` desc";
// echo $query."<br>\n";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -75,32 +76,32 @@
?>
<tr>
<? if($verified != _("Pending") && $verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=$row['id']?>"></td>
+ <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"></td>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="account.php?id=6&amp;cert=<?=$row['id']?>"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></a></td>
+ <td class="DataTD"><a href="account.php?id=6&amp;cert=<?=intval($row['id'])?>"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></a></td>
<? } else if($verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=$row['id']?>"></td>
+ <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"></td>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td>
<? } else { ?>
<td class="DataTD">&nbsp;</td>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td>
<? } ?>
- <td class="DataTD"><?=$row['serial']?></td>
- <td class="DataTD"><?=$row['revoke']?></td>
- <td class="DataTD"><?=$row['expires']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['serial'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['revoke'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['expire'])?></td>
<td class="DataTD">
- <input type="checkbox" name="disablelogin_<?=$row['id']?>" value="1" <?=$row['disablelogin']?"":'checked="checked"'?>/>
- <input type="hidden" name="cert_<?=$row['id']?>" value="1" />
+ <input type="checkbox" name="disablelogin_<?=intval($row['id'])?>" value="1" <?=$row['disablelogin']?"":'checked="checked"'?>/>
+ <input type="hidden" name="cert_<?=intval($row['id'])?>" value="1" />
</td>
- <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
- <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td>
+ <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
+ <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td>
</tr>
<? } ?>
<tr>
<td class="DataTD" colspan="9">
- <a href="account.php?id=5&amp;viewall=<?=!$viewall?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
+ <a href="account.php?id=5&amp;viewall=<?=intval(!$viewall)?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
</td>
</tr>
@@ -119,7 +120,7 @@
</tr>
<? } ?>
</table>
-<input type="hidden" name="oldid" value="<?=$id?>" />
+<input type="hidden" name="oldid" value="<?=intval($id)?>" />
<input type="hidden" name="csrf" value="<?=make_csrf('clicerchange')?>" />
</form>
<p><?=_("From here you can delete pending requests, or revoke valid certificates.")?></p>
diff --git a/pages/account/52.php b/pages/account/52.php
index 77a3bae..6c00c26 100644
--- a/pages/account/52.php
+++ b/pages/account/52.php
@@ -14,45 +14,51 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<? if($_SESSION['profile']['tverify'] <= 0) { echo _("You don't have access to this area."); } else { ?>
-<?
+*/
+
+if($_SESSION['profile']['tverify'] <= 0) {
+ echo _("You don't have access to this area.");
+} else {
$uid = intval($_GET['uid']);
- $query = "select * from `tverify` where `id`='$uid' and `modified`=0";
+ $query = "select * from `tverify` where `id`='".intval($uid)."' and `modified`=0";
$res = mysql_query($query);
- if(mysql_num_rows($res) > 0)
- {
+ if(mysql_num_rows($res) > 0) {
$row = mysql_fetch_assoc($res);
$memid = intval($row['memid']);
- $query2 = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".intval($_SESSION['profile']['id'])."'";
- $rc2 = mysql_num_rows(mysql_query($query2));
- if($rc2 > 0)
- {
+ $query2 = "select * from `tverify-vote` where `tverify`='".intval($uid)."' and `memid`='".intval($_SESSION['profile']['id'])."'";
+ $rc2 = mysql_num_rows(mysql_query($query2));
+ if($rc2 > 0) {
showheader(_("My CAcert.org Account!"));
echo _("You have already voted on this request.");
showfooter();
exit;
}
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid'";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `deleted` = 0";
$notary = mysql_fetch_assoc(mysql_query($query));
- $query = "select * from `users` where `id`='$memid'";
+ $query = "select * from `users` where `id`='".intval($memid)."'";
$user = mysql_fetch_assoc(mysql_query($query));
$tobe = 50 - $notary['points'];
- if($row['URL'] != '' && $row['photoid'] != '')
+ if($row['URL'] != '' && $row['photoid'] != '') {
$tobe = 150 - $notary['points'];
- else if($row['URL'] != '')
+ } else if($row['URL'] != '') {
$tobe = 90 - $notary['points'];
- if(intval($tobe) <= 0)
+ }
+ if(intval($tobe) <= 0) {
$tobe = 0;
+ }
?>
<?=_("Request Details")?>:<br>
-<?=_("Name on file")?>: <?=$user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix']?><br>
-<?=_("Primary email address")?>: <?=$user['email']." (".$user['id'].")"?><br>
-<?=_("Certificate Subject")?>: <?=$row['CN']?><br>
-<? if($row['URL'] != '') { ?><?=_("Notary URL")?>: <a href="<?=$row['URL']?>"><?=$row['URL']?></a><br><? } ?>
-<? if($row['photoid'] != '') { ?><?=_("Photo ID URL")?>: <a href="/account.php?id=51&amp;photoid=<?=intval($row['id'])?>"><?=_("Here")?></a><br><? } ?>
+<?=_("Name on file")?>: <?=sanitizeHTML($user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix'])?><br>
+<?=_("Primary email address")?>: <?=sanitizeHTML($user['email'])." (".intval($user['id']).")"?><br>
+<?=_("Certificate Subject")?>: <?=sanitizeHTML($row['CN'])?><br>
+<? if($row['URL'] != '') { ?>
+<?=_("Notary URL")?>: <a href="<?=$row['URL']?>"><?=$row['URL']?></a><br>
+<? } ?>
+<? if($row['photoid'] != '') { ?>
+<?=_("Photo ID URL")?>: <a href="/account.php?id=51&amp;photoid=<?=intval($row['id'])?>"><?=_("Here")?></a><br>
+<? } ?>
<?=_("Current Points")?>: <?=intval($notary['points'])?><br>
<?=_("Potential Points")?>: <?=intval($tobe)?><br>
<?=_("Date of Birth")?>: <?=$user['dob']?> (YYYY-MM-DD)<br>
@@ -63,40 +69,37 @@
<input type="submit" name="agree" value="<?=_("I agree with this Application")?>">
<input type="submit" name="disagree" value="<?=_("I don't agree with this Application")?>">
<input type="hidden" name="oldid" value="<?=intval($_GET['id'])?>">
-<input type="hidden" name="uid" value="<?=$uid?>">
+<input type="hidden" name="uid" value="<?=intval($uid)?>">
</form>
-<? } else {
- $query = "select * from `tverify` where `id`='$uid' and `modified`=1";
- $res = mysql_query($query);
- if(mysql_num_rows($res) > 0)
- {
- echo _("This UID has already been voted on.")."<br/>";
+<?
} else {
- if($uid) echo _("Unable to locate a valid request for that UID.")."<br/>";
- }
-
- // Search for open requests:
- $query = "select * from `tverify` where `modified`=0";
- $res = mysql_query($query);
- if(mysql_num_rows($res) > 0)
- {
- echo "<br/>"._("The following requests are still open:")."<br/><ul>";
- while($row = mysql_fetch_assoc($res))
- {
- $uid=intval($row['id']);
- $query3 = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".intval($_SESSION['profile']['id'])."'";
- $rc3 = mysql_num_rows(mysql_query($query3));
- if($rc3 <= 0)
- {
- echo "<li><a href='account.php?id=52&amp;uid=".intval($row['id'])."'>".intval($row['id'])."</a></li>\n";
+ $query = "select * from `tverify` where `id`='".intval($uid)."' and `modified`=1";
+ $res = mysql_query($query);
+ if(mysql_num_rows($res) > 0) {
+ echo _("This UID has already been voted on.")."<br/>";
+ } else {
+ if($uid) echo _("Unable to locate a valid request for that UID.")."<br/>";
+ }
+
+ // Search for open requests:
+ $query = "select * from `tverify` where `modified`=0";
+ $res = mysql_query($query);
+ if(mysql_num_rows($res) > 0) {
+ echo "<br/>"._("The following requests are still open:")."<br/><ul>";
+ while($row = mysql_fetch_assoc($res)) {
+ $uid=intval($row['id']);
+ $query3 = "select * from `tverify-vote` where `tverify`='".intval($uid)."' and `memid`='".intval($_SESSION['profile']['id'])."'";
+ $rc3 = mysql_num_rows(mysql_query($query3));
+ if($rc3 <= 0)
+ {
+ echo "<li><a href='account.php?id=52&amp;uid=".intval($row['id'])."'>".intval($row['id'])."</a></li>\n";
+ }
}
- }
- echo "</ul>\n<br>\n";
- }
- else
- {
- echo "<br/>"._("There are no pending requests where you haven't voted yet.");
+ echo "</ul>\n<br>\n";
+ } else {
+ echo "<br/>"._("There are no pending requests where you haven't voted yet.");
+ }
}
+}
-
- } } ?>
+?>
diff --git a/pages/account/55.php b/pages/account/55.php
index ec401a0..6793a71 100644
--- a/pages/account/55.php
+++ b/pages/account/55.php
@@ -23,7 +23,7 @@
<tr>
<td colspan="5" class="title"><?=_("Your passed Tests")?></td>
</tr>
- <tr>
+ <tr>
<td class="DataTD"><?=_("The list of tests you did pass at").' <a href="https://cats.cacert.org/">https://cats.cacert.org/</a>'?></td>
</tr>
</table>
@@ -34,7 +34,7 @@
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
} else {
$row = mysql_fetch_assoc($res);
}
@@ -58,11 +58,11 @@
<?
$query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ".
" FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ".
- " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".(int)$user_id."'".
+ " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".intval($user_id)."'".
" ORDER BY `CP`.`pass_date`";
-
+
$res = mysql_query($query);
-
+
$HaveTest=0;
while($row = mysql_fetch_array($res, MYSQL_NUM))
{
@@ -71,23 +71,24 @@
}
?>
<tr>
- <td class="DataTD"><?=$row[0]?></td>
- <td class="DataTD"><?=$row[1]?></td>
- <td class="DataTD"><?=$row[2]?></td>
+ <td class="DataTD"><?=sanitizeHTML($row[0])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row[1])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row[2])?></td>
</tr>
-<? }
+<? }
?>
</table>
<br>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
+ <tr>
<?
if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) {
?>
- <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=$user_id ?>">back</a></td></tr>
-<? } else {
+ <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($user_id)?>">back</a></td></tr>
+<?
+ } else {
$query = 'SELECT `u`.id, `u`.`assurer`, SUM(`points`) FROM `users` AS `u`, `notary` AS `n` '.
- ' WHERE `u`.`id` = \''.(int)intval($_SESSION['profile']['id']).'\' AND `n`.`to` = `u`.`id` AND `expire` < now() '.
+ ' WHERE `u`.`id` = \''.(int)intval($_SESSION['profile']['id']).'\' AND `n`.`to` = `u`.`id` AND `expire` < now() and and `n`.`deleted` = 0'.
' GROUP BY `u`.id, `u`.`assurer`';
$res = mysql_query($query);
if (!$res) {
diff --git a/pages/account/57.php b/pages/account/57.php
index 0356eeb..9db7ccf 100644
--- a/pages/account/57.php
+++ b/pages/account/57.php
@@ -28,7 +28,7 @@
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
} else {
$row = mysql_fetch_assoc($res);
?>
@@ -48,12 +48,12 @@
<td class="DataTD"><b><?=_('Type')?></b></td>
</tr>
<?
- $data=get_first_user_agreement($user_id,1);
+ $data=get_first_user_agreement($user_id, 'CCA', 1);
if (!isset($data['active'])){
$type='';
- }else{
+ }else{
$type=_('active');
- }
+ }
?>
<tr>
<td class="DataTD"><?=_('First active CCA')?></td>
@@ -62,7 +62,7 @@
<td class="DataTD"><?=$type?></td>
</tr>
<?
- $data=get_first_user_agreement($user_id,0);
+ $data=get_first_user_agreement($user_id, 'CCA', 0);
if (!isset($data['active'])){
$type="";
}else{
@@ -76,14 +76,14 @@
<td class="DataTD"><?=$type?></td>
</tr>
<?
- $data=get_last_user_agreement($user_id);
+ $data=get_last_user_agreement($user_id, 'CCA');
if (!isset($data['active'])){
- $type="";
- }elseif($data['active']==1){
- $type=_('active');
- }else{
- $type=_('passive');
- }
+ $type="";
+ }elseif($data['active']==1){
+ $type=_('active');
+ }else{
+ $type=_('passive');
+ }
?>
<tr>
<td class="DataTD"><?=_('Last CCA')?></td>
@@ -98,7 +98,7 @@
<?
if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) {
?>
- <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=$user_id ?>">back</a></td></tr>
+ <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($user_id)?>">back</a></td></tr>
<? }
?> </table>
<?
diff --git a/pages/account/58.php b/pages/account/58.php
index 1f6b1a0..af26b70 100644
--- a/pages/account/58.php
+++ b/pages/account/58.php
@@ -23,7 +23,7 @@ if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST)
$query = "select `users`.`fname`, `users`.`mname`, `users`.`lname` from `users` where `id`='$user_id' and `users`.`deleted`=0";
$res = mysql_query($query);
if(mysql_num_rows($res) != 1){
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
} else {
if ($row = mysql_fetch_assoc($res)){
$username=sanitizeHTML($row['fname']).' '.sanitizeHTML($row['mname']).' '.sanitizeHTML($row['lname']);
@@ -54,7 +54,7 @@ if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST)
}
?></table>
<? }else{
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
}
}
}
diff --git a/pages/account/59.php b/pages/account/59.php
new file mode 100644
index 0000000..1c73ae5
--- /dev/null
+++ b/pages/account/59.php
@@ -0,0 +1,385 @@
+<?/*
+ LibreSSL - CAcert web application
+ Copyright (C) 2004-2008 CAcert Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/
+include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
+
+
+$userid = intval($_REQUEST['userid']);
+
+$res = get_user_data($userid);
+if (mysql_num_rows($res) <= 0)
+{
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
+ exit;
+}
+
+$user = mysql_fetch_assoc($res);
+
+$fname = $user['fname'];
+$mname = $user['mname'];
+$lname = $user['lname'];
+$suffix = $user['suffix'];
+$dob = $user['dob'];
+$username = $fname." ".$mname." ".$lname." ".$suffix;
+$email = $user['email'];
+$alerts =get_alerts($userid);
+
+$ticketno = "";
+if (array_key_exists('ticketno', $_SESSION)) {
+ $ticketno = $_SESSION['ticketno'];
+}
+
+$oldid = 0;
+if (array_key_exists('oldid', $_REQUEST)) {
+ $oldid = intval($_REQUEST['oldid']);
+}
+
+// Support Engineer access restrictions
+$support=0;
+if ($userid != $_SESSION['profile']['id']) {
+ // Check if support engineer
+ if (array_key_exists('admin', $_SESSION['profile']) &&
+ $_SESSION['profile']['admin'] != 0)
+ {
+ $support=$_SESSION['profile']['admin'];
+
+ } else {
+ echo _("You do not have access to this page.");
+ showfooter();
+ exit;
+ }
+
+ if (!valid_ticket_number($ticketno)) {
+ printf(_("I'm sorry, you did not enter a ticket number! %s Support is not allowed to view the account history without a ticket number."), '<br/>');
+ echo '<br/><a href="account.php?id=43&amp;userid='.intval($userid).'">'. _('Back to previous page.') .'</a>';
+ showfooter();
+ exit;
+ }
+
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE View account history', $ticketno)) {
+ echo _("Writing to the admin log failed. Can't continue.");
+ echo '<br/><a href="account.php?id=43&amp;userid='.intval($userid).'">'. _('Back to previous page.') .'</a>';
+ showfooter();
+ exit;
+ }
+}
+
+// Account details
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="2" class="title"><?printf(_('Account history of %s'),$username)?></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="title"><?=_('User actions')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_('User name')?></td>
+ <td class="DataTD"><?=sanitizeHTML($username)?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_('Date of Birth')?></td>
+ <td class="DataTD"><?=sanitizeHTML($dob)?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Is Assurer")?>:</td>
+ <td class="DataTD"><?= ($user['assurer']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Blocked Assurer")?>:</td>
+ <td class="DataTD"><?= ($user['assurer_blocked']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Account Locking")?>:</td>
+ <td class="DataTD"><?= ($user['locked']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Code Signing")?>:</td>
+ <td class="DataTD"><?= ($user['codesign']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Org Assurer")?>:</td>
+ <td class="DataTD"><?= ($user['orgadmin']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("TTP Admin")?>:</td>
+ <td class="DataTD"><?= $user['ttpadmin']._(' - 0 = none, 1 = TTP Admin, 2 = TTP TOPUP admin')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Location Admin")?>:</td>
+ <td class="DataTD"><?= ($user['locadmin']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Admin")?>:</td>
+ <td class="DataTD"><?= ($user['admin']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Ad Admin")?>:</td>
+ <td class="DataTD"><?= $user['adadmin']._(' - 0 = none, 1 = submit, 2 = approve')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("General Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['general']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Country Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['country']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Regional Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['regional']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Within 200km Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['radius']==0)? _('No'):_('Yes')?></td>
+ </tr>
+</table>
+<br/>
+<?
+
+// Email addresses
+$dres = get_email_addresses($userid,'',1);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="3" class="title"><?=_('Email addresses')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_email_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_email($drow,$email);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="3" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+<?
+
+// Domains
+$dres = get_domains($userid, 1);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="3" class="title"><?=_('Domains')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_domains_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_domains($drow);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="3" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// Trainings
+$dres = get_training_results($userid);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="3" class="title"><?=_('Trainings')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_training_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_training($drow);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="3" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// User Agreements
+$dres = get_user_agreements($userid);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="4" class="title"><?=_('User agreements')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_agreement_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_agreement($drow);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="4" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// Client Certificates
+$dres = get_client_certs($userid, 1);
+$colspan=8;
+if (1 == $support) {
+ $colspan=6;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('Client certificates')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_client_cert_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_client_cert($drow,$support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// Server Certificates
+$dres = get_server_certs($userid,1);
+$colspan = 7;
+if (1 == $support) {
+ $colspan = 5;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('Server certificates')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_server_certs_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_server_certs($drow,$support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// GPG Certificates
+$dres = get_gpg_certs($userid,1);
+$colspan = 6;
+if (1 == $support) {
+ $colspan = 4;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('GPG/PGP certificates')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_gpg_certs_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_gpg_certs($drow, $support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}?>
+</table>
+<br/>
+
+<?
+
+output_given_assurances($userid, $support, $ticketno, 1);
+?><br/><?
+
+output_received_assurances($userid, $support, $ticketno, 1);
+?><br/><?
+
+$dres = get_se_log($userid);
+$colspan = 2;
+if (1 == $support) {
+ $colspan = 4;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('Admin log')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_se_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_se($drow,$support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+<tr>
+ <td colspan="<?=$colspan?>" >
+ <a href="account.php?id=<?=$oldid?intval($oldid):($support?43:13)?>&amp;userid=<?=intval($userid)?>"><?= _('Back to previous page.')?></a>
+ </td>
+</tr>
+
+</table>
diff --git a/pages/account/6.php b/pages/account/6.php
index 8455499..305fccb 100644
--- a/pages/account/6.php
+++ b/pages/account/6.php
@@ -25,7 +25,7 @@ if(array_key_exists('cert',$_REQUEST)) {
$query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`,
- `emailcerts`.`expire` as `expires`,
+ `emailcerts`.`expire`,
`emailcerts`.`revoked` as `revoke`,
UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`,
`emailcerts`.`id`,
@@ -137,11 +137,11 @@ if (array_key_exists('format', $_REQUEST)) {
</tr>
<tr>
<td class="DataTD"><?=_("Email Address")?></td>
- <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td>
</tr>
<tr>
<td class="DataTD"><?=_("SerialNumber")?></td>
- <td class="DataTD"><?=$row['serial']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['serial'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Revoked")?></td>
@@ -149,7 +149,7 @@ if (array_key_exists('format', $_REQUEST)) {
</tr>
<tr>
<td class="DataTD"><?=_("Expires")?></td>
- <td class="DataTD"><?=$row['expires']?></td>
+ <td class="DataTD"><?=$row['expire']?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Login")?></td>
diff --git a/pages/gpg/2.php b/pages/gpg/2.php
index cc8a872..84e11d2 100644
--- a/pages/gpg/2.php
+++ b/pages/gpg/2.php
@@ -30,7 +30,7 @@
$query = "select UNIX_TIMESTAMP(`issued`) as `issued`,
UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`expire`) as `expired`,
- `expire` as `expires`, `id`, `level`,
+ `expire`, `id`, `level`,
`email`,`keyid`,`description` from `gpg` where `memid`='".intval($_SESSION['profile']['id'])."'
ORDER BY `issued` desc";
$res = mysql_query($query);
@@ -43,6 +43,7 @@
<? } else {
while($row = mysql_fetch_assoc($res))
{
+ $verified = '';
if($row['timeleft'] > 0)
$verified = _("Valid");
if($row['timeleft'] < 0)
@@ -53,18 +54,18 @@
<tr>
<? if($verified == _("Valid")) { ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=$row['id']?>"><?=$row['email']?></a></td>
+ <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
<? } else if($verified == _("Pending")) { ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><?=$row['email']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['email'])?></td>
<? } else { ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=$row['id']?>"><?=$row['email']?></a></td>
+ <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
<? } ?>
- <td class="DataTD"><?=$row['expires']?></td>
- <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=$row['id']?>"><?=$row['keyid']?></a></td>
- <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
- <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['keyid'])?></a></td>
+ <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
+ <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td>
</tr>
<? } ?>
<? } ?>
@@ -77,5 +78,5 @@
<td class="DataTD" colspan="6"><input type="submit" name="change" value="<?=_("Change settings")?>" /> </td>
</tr>
</table>
-<input type="hidden" name="oldid" value="<?=$id?>" />
+<input type="hidden" name="oldid" value="<?=intval($id)?>" />
</form>
diff --git a/pages/wot/1.php b/pages/wot/1.php
index a45b5df..9047f27 100644
--- a/pages/wot/1.php
+++ b/pages/wot/1.php
@@ -14,9 +14,9 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?
- $res=mysql_fetch_assoc(mysql_query("select sum(acount) as summe from countries"));
+*/
+
+ $res=mysql_fetch_assoc(mysql_query("select sum(acount) as summe from countries"));
$total1 =$res['summe'];
$locid=array_key_exists('locid',$_REQUEST)?intval($_REQUEST['locid']):0;
@@ -91,7 +91,7 @@
{
$query = "select *, `users`.`id` as `id` from `users`,`notary` where `listme`='1' and
`ccid`='".$ccid."' and `regid`='".$regid."' and
- `locid`='".$locid."' and `users`.`id`=`notary`.`to`
+ `locid`='".$locid."' and `users`.`id`=`notary`.`to` and `notary`.`deleted`=0
group by `notary`.`to` HAVING SUM(`points`) >= 100 order by `points` desc";
$list = mysql_query($query);
if(mysql_num_rows($list) > 0)
@@ -104,19 +104,19 @@
<td class="title"><?=_("Contact Details")?></td>
<td class="title"><?=_("Email Assurer")?></td>
<td class="title"><?=_("Assurer Challenge")?></td>
-
</tr>
-<? while($row = mysql_fetch_assoc($list)) { ?>
+
+<? while($row = mysql_fetch_assoc($list)) { ?>
<tr>
- <td class="DataTD" width="100"><nobr><?=$row['fname']?> <?=substr($row['lname'], 0, 1)?></nobr></td>
+ <td class="DataTD" width="100"><nobr><?=sanitizeHTML($row['fname'])?> <?=substr($row['lname'], 0, 1)?>.</nobr></td>
<td class="DataTD"><?=maxpoints($row['id'])?></td>
- <td class="DataTD"><?=$row['contactinfo']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['contactinfo'])?></td>
<td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($row['id'])?>"><?=_("Email Me")?></a></td>
<td class="DataTD"><?=$row['assurer']?_("Yes"):("<font color=\"#ff0000\">"._("Not yet!")."</font>")?></td>
-
</tr>
-<? }
- }
+<?
+ }
+ }
?>
</table>
<br>
diff --git a/pages/wot/10.php b/pages/wot/10.php
index bc76a86..b5e146c 100644
--- a/pages/wot/10.php
+++ b/pages/wot/10.php
@@ -24,7 +24,7 @@
<td colspan="5" class="title"><?=_("Assurer Ranking")?></td>
</tr>
<tr>
-<?
+<?// the rank calculation is not adjusted to the new deletion method
$query = "SELECT `users`. *, count(*) AS `list` FROM `users`, `notary`
WHERE `users`.`id` = `notary`.`from` AND `notary`.`from` != `notary`.`to`
AND `from`='".intval($_SESSION['profile']['id'])."' GROUP BY `notary`.`from`";
@@ -36,8 +36,8 @@
WHERE `users`.`id` = `notary`.`from` AND `notary`.`from` != `notary`.`to`
GROUP BY `notary`.`from` HAVING count(*) > '$rc' ORDER BY `notary`.`when` DESC";
*/
- $query = "SELECT count(*) AS `list` FROM `users`
- inner join `notary` on `users`.`id` = `notary`.`from`
+ $query = "SELECT count(*) AS `list` FROM `users`
+ inner join `notary` on `users`.`id` = `notary`.`from`
GROUP BY `notary`.`from` HAVING count(*) > '$rc'";
$rank = mysql_num_rows(mysql_query($query)) + 1;
@@ -64,18 +64,18 @@
<td class="DataTD"><b><?=_("Method")?></b></td>
</tr>
<?
- $query = "select * from `notary` where `to`='".intval($_SESSION['profile']['id'])."'";
+ $query = "select `id`, `date`, `from`, `points`, `location`, `method` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0";
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($row['from'])."'"));
+ $fromuser = mysql_fetch_assoc(mysql_query("select `fname`, `lname` from `users` where `id`='".intval($row['from'])."'"));
?>
<tr>
- <td class="DataTD"><?=$row['id']?></td>
+ <td class="DataTD"><?=intval($row['id'])?></td>
<td class="DataTD"><?=$row['date']?></td>
- <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($row['from'])?>"><?=$fromuser['fname']." ".$fromuser['lname']?></td>
- <td class="DataTD"><?=$row['points']?></td>
- <td class="DataTD"><?=$row['location']?></td>
+ <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($row['from'])?>"><?=sanitizeHTML(trim($fromuser['fname']." ".$fromuser['lname']))?></td>
+ <td class="DataTD"><?=intval($row['points'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['location'])?></td>
<td class="DataTD"><?=_(sprintf("%s", $row['method']))?></td>
</tr>
<?
@@ -114,30 +114,30 @@ if ($thawte)
</tr>
<?
$points = 0;
- $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and `to`!='".intval($_SESSION['profile']['id'])."'";
+ $query = "select `id`, `date`, `points`, `to`, `location`, `method` from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and `to`!='".intval($_SESSION['profile']['id'])."' and `deleted`=0" ;
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($row['to'])."'"));
- $points += $row['points'];
+ $fromuser = mysql_fetch_assoc(mysql_query("select `fname`, `lname` from `users` where `id`='".intval($row['to'])."'"));
+ $points += intval($row['points']);
$name = trim($fromuser['fname']." ".$fromuser['lname']);
if($name == "")
$name = _("Deleted before Verification");
else
- $name = "<a href='wot.php?id=9&amp;userid=".intval($row['to'])."'>$name</a>";
+ $name = "<a href='wot.php?id=9&amp;userid=".intval($row['to'])."'>".sanitizeHTML($name)."</a>";
?>
<tr>
<td class="DataTD"><?=intval($row['id'])?></td>
<td class="DataTD"><?=$row['date']?></td>
<td class="DataTD"><?=$name?></td>
<td class="DataTD"><?=intval($row['points'])?></td>
- <td class="DataTD"><?=$row['location']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['location'])?></td>
<td class="DataTD"><?=$row['method']==""?"":_(sprintf("%s", $row['method']))?></td>
</tr>
<? } ?>
<tr>
<td class="DataTD" colspan="3"><b><?=_("Total Points Issued")?>:</b></td>
- <td class="DataTD"><?=$points?></td>
+ <td class="DataTD"><?=intval($points)?></td>
<td class="DataTD" colspan="2">&nbsp;</td>
</tr>
</table>
diff --git a/pages/wot/15.php b/pages/wot/15.php
index cca2702..c1f3e0f 100644
--- a/pages/wot/15.php
+++ b/pages/wot/15.php
@@ -14,7 +14,7 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/
+*/
require_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
diff --git a/pages/wot/9.php b/pages/wot/9.php
index bfa7a98..a8b9413 100644
--- a/pages/wot/9.php
+++ b/pages/wot/9.php
@@ -15,9 +15,9 @@
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
-
+
require_once($_SESSION['_config']['filepath'].'/includes/lib/l10n.php');
-
+
$res = mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."' and `listme`='1'");
if(mysql_num_rows($res) <= 0)
@@ -28,9 +28,8 @@
$user = mysql_fetch_array($res);
$userlang = $user['language'];
$points = mysql_num_rows(mysql_query("select sum(`points`) as `total` from `notary`
- where `to`='".$user['id']."' group by `to` HAVING SUM(`points`) > 0"));
- if($points <= 0)
- {
+ where `to`='".intval($user['id'])."' and `deleted`=0 group by `to` HAVING SUM(`points`) > 0"));
+ if($points <= 0) {
echo _("Sorry, I was unable to locate that user.");
} else {
@@ -38,31 +37,31 @@
?>
<? if($_SESSION['_config']['error'] != "") { ?><font color="#ff0000" size="+1">ERROR: <?=$_SESSION['_config']['error']?></font><? unset($_SESSION['_config']['error']); } ?>
<form method="post" action="wot.php">
-<input type="hidden" name="userid" value="<?=$user['id']?>">
+<input type="hidden" name="userid" value="<?=intval($user['id'])?>">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
<td colspan="2" class="title"><?=_("Contact Assurer")?></td>
</tr>
<tr>
<td class="DataTD"><?=_("To")?>:</td>
- <td class="DataTD" align="left"><?=$user['fname']?> <?=substr($user['lname'], 0, 1)?></td>
+ <td class="DataTD" align="left"><?=sanitizeHTML(trim($user['fname'].' '.substr($user['lname'], 0, 1)))?></td>
</tr>
<? if($userlang != "") { ?>
<tr>
<td class="DataTD"><?=_("Language")?>:</td>
- <td class="DataTD" align="left"><? printf(_("%s prefers to be contacted in %s"), $user['fname'], L10n::$translations[$userlang]) ?></td>
+ <td class="DataTD" align="left"><? printf(_("%s prefers to be contacted in %s"), sanitizeHTML($user['fname']), L10n::$translations[$userlang]) ?></td>
</tr>
<? } ?>
<?
- $query = "select * from `addlang` where `userid`='".$user['id']."'";
+ $query = "select * from `addlang` where `userid`='".intval($user['id'])."'";
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
- $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='${row['lang']}'"));
+ $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='".mysql_real_escape_string($row['lang'])."'"));
?>
<tr>
<td class="DataTD"><?=_("Additional Language")?>:</td>
- <td class="DataTD" align="left"><? printf(_("%s will also accept email in %s - %s"), $user['fname'], $lang['lang'], $lang['country']) ?></td>
+ <td class="DataTD" align="left"><? printf(_("%s will also accept email in %s - %s"), sanitizeHTML($user['fname']), sanitizeHTML($lang['lang']), sanitizeHTML($lang['country'])) ?></td>
</tr>
<? } ?>
<tr>
@@ -79,7 +78,7 @@
</table>
<input type="hidden" name="pageid" value="<?=$_SESSION['_config']['pagehash']?>">
<input type="hidden" name="userid" value="<?=intval($_REQUEST['userid'])?>">
-<input type="hidden" name="oldid" value="<?=$id?>">
+<input type="hidden" name="oldid" value="<?=intval($id)?>">
</form>
<p>[ <a href='javascript:history.go(-1)'><?=_("Go Back")?></a> ]</p>
<? } } ?>
diff --git a/scripts/cron/refresh_stats.php b/scripts/cron/refresh_stats.php
index 2a3d2b5..3b446ba 100755
--- a/scripts/cron/refresh_stats.php
+++ b/scripts/cron/refresh_stats.php
@@ -23,7 +23,7 @@ require_once(dirname(__FILE__).'/../../includes/mysql.php');
/**
* Wrapper around mysql_query() to provide some error handling. Prints an error
* message and dies if query fails
- *
+ *
* @param string $sql
* the SQL statement to execute
* @return resource|boolean
@@ -35,7 +35,7 @@ function sql_query($sql) {
fwrite(STDERR, "MySQL query failed:\n\"$sql\"\n".mysql_error());
die(1);
}
-
+
return $res;
}
@@ -54,7 +54,7 @@ function updateCache($stats) {
$sql = "insert into `statscache` (`timestamp`, `cache`) values
('$timestamp', '".mysql_real_escape_string(serialize($stats))."')";
sql_query($sql);
-
+
// Make sure the new statistic was inserted successfully
$res = sql_query(
"select 1 from `statscache` where `timestamp` = '$timestamp'");
@@ -62,7 +62,7 @@ function updateCache($stats) {
fwrite(STDERR, "Error on inserting the new statistic");
return false;
}
-
+
sql_query("delete from `statscache` where `timestamp` != '$timestamp'");
return true;
}
@@ -74,22 +74,22 @@ function updateCache($stats) {
*/
function getDataFromLive() {
echo "Calculating current statistics\n";
-
+
$stats = array();
$stats['verified_users'] = number_format(tc(
"select count(*) as `count` from `users`
where `verified` = 1
and `deleted` = 0
and `locked` = 0"));
-
+
$stats['verified_emails'] = number_format(tc(
"select count(*) as `count` from `email`
where `hash` = '' and `deleted` = 0"));
-
+
$stats['verified_domains'] = number_format(tc(
"select count(*) as `count` from `domains`
where `hash` = '' and `deleted` = 0"));
-
+
$certs = tc("select count(*) as `count` from `domaincerts`
where `expire` != 0");
$certs += tc("select count(*) as `count` from `emailcerts`
@@ -101,7 +101,7 @@ function getDataFromLive() {
$certs += tc("select count(*) as `count` from `orgemailcerts`
where `expire` != 0");
$stats['verified_certificates'] = number_format($certs);
-
+
$certs = tc("select count(*) as `count` from `domaincerts`
where `revoked` = 0 and `expire` > NOW()");
$certs += tc("select count(*) as `count` from `emailcerts`
@@ -113,11 +113,12 @@ function getDataFromLive() {
$certs += tc("select count(*) as `count` from `orgemailcerts`
where `revoked` = 0 and `expire` > NOW()");
$stats['valid_certificates'] = number_format($certs);
-
+
$stats['assurances_made'] = number_format(tc(
"select count(*) as `count` from `notary`
- where `method` = '' or `method` = 'Face to Face Meeting'"));
-
+ where (`method` = '' or `method` = 'Face to Face Meeting')
+ and `deleted` = 0"));
+
$stats['users_1to49'] = number_format(tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -125,7 +126,7 @@ function getDataFromLive() {
group by `to`
having sum(`points`) > 0 and sum(`points`) < 50
) as `low_points`"));
-
+
$stats['users_50to99'] = number_format(tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -133,7 +134,7 @@ function getDataFromLive() {
group by `to`
having sum(`points`) >= 50 and sum(`points`) < 100
) as `high_points`"));
-
+
$stats['assurer_candidates'] = number_format(tc(
"select count(*) as `count` from `users`
where (
@@ -148,7 +149,7 @@ function getDataFromLive() {
and `cv`.`type_id`=1
)"
));
-
+
$stats['aussurers_with_test'] = number_format(tc(
"select count(*) as `count` from `users`
where (
@@ -163,7 +164,7 @@ function getDataFromLive() {
and `cv`.`type_id`=1
)"
));
-
+
$stats['points_issued'] = number_format(tc(
"select sum(greatest(`points`, `awarded`)) as `count` from `notary`
where `deleted` = 0
@@ -177,16 +178,16 @@ function getDataFromLive() {
$next_month_ts = mktime(0, 0, 0, date("m") - $i + 1, 1, date("Y"));
$first = date("Y-m-d", $first_ts);
$next_month = date("Y-m-d", $next_month_ts);
-
+
echo "Calculating statistics for month $first\n";
-
+
$totalusers += $users = tc(
- "select count(*) as `count` from `users`
+ "select count(*) as `count` from `users`
where `created` >= '$first' and `created` < '$next_month'
and `verified` = 1
and `deleted` = 0
and `locked` = 0");
-
+
$totassurers += $assurers = tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -195,7 +196,7 @@ function getDataFromLive() {
and `deleted` = 0
group by `to` having sum(`points`) >= 100
) as `assurer_candidates`");
-
+
$certs = tc(
"select count(*) as `count` from `domaincerts`
where `created` >= '$first' and `created` < '$next_month'
@@ -240,16 +241,16 @@ function getDataFromLive() {
$next_year_ts = mktime(0, 0, 0, 1, 1, $i + 1);
$first = date("Y-m-d", $first_ts);
$next_year = date("Y-m-d", $next_year_ts);
-
+
echo "Calculating statistics for year $i\n";
-
+
$totalusers += $users = tc(
- "select count(*) as `count` from `users`
+ "select count(*) as `count` from `users`
where `created` >= '$first' and `created` < '$next_year'
and `verified` = 1
and `deleted` = 0
and `locked` = 0");
-
+
$totassurers += $assurers = tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -258,7 +259,7 @@ function getDataFromLive() {
and `deleted` = 0
group by `to` having sum(`points`) >= 100
) as `assurer_candidates`");
-
+
$certs = tc(
"select count(*) as `count` from `domaincerts`
where `created` >= '$first' and `created` < '$next_year'
@@ -286,7 +287,7 @@ function getDataFromLive() {
$tmp_arr['new_users'] = number_format($users);
$tmp_arr['new_assurers'] = number_format($assurers);
$tmp_arr['new_certificates'] = number_format($certs);
-
+
$stats['growth_last_years'][] = $tmp_arr;
}
$stats['growth_last_years_total'] = array(
diff --git a/stamp/common.php b/stamp/common.php
index ff814dd..d99a23a 100644
--- a/stamp/common.php
+++ b/stamp/common.php
@@ -41,9 +41,9 @@
if($row['certid'] > 0)
{
if($row['org'] == 0)
- $query = "select * from `domaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0";
+ $query = "select * from `domaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0";
else
- $query = "select * from `orgdomaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0";
+ $query = "select * from `orgdomaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0";
if($_REQUEST['debug'] == 1)
echo $query."<br>\n";
$res = mysql_query($query);
@@ -117,7 +117,7 @@
if($org == 0)
{
$query = "SELECT *, sum(`points`) AS `total` FROM `users`, `notary` WHERE `users`.`id` = '$cert[memid]' AND
- `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' GROUP BY `notary`.`to`";
+ `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' and `notary`.`deleted`=0 GROUP BY `notary`.`to`";
$user = mysql_fetch_assoc(mysql_query($query));
} else {
$query = "select * from `orginfo` where `id`='$cert[orgid]'";
diff --git a/www/api/ccsr.php b/www/api/ccsr.php
index 403882f..b223168 100644
--- a/www/api/ccsr.php
+++ b/www/api/ccsr.php
@@ -31,7 +31,7 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($_REQUEST['email'] as $email)
{
$email = mysql_real_escape_string(trim($email));
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0 and `email`='$email'";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0 and `email`='$email'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -42,7 +42,7 @@ require_once '../../includes/lib/check_weak_key.php';
}
if(count($emails) <= 0)
die("404,Wasn't able to match any emails sent against your account");
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
@@ -62,12 +62,12 @@ require_once '../../includes/lib/check_weak_key.php';
$codesign = 1;
$CSR = trim($_REQUEST['optionalCSR']);
-
+
if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
{
die("403, $weakKey");
}
-
+
$incsr = tempnam("/tmp", "ccsrIn");
$checkedcsr = tempnam("/tmp", "ccsrOut");
$fp = fopen($incsr, "w");
@@ -84,9 +84,9 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($emails as $id => $email)
$csrsubject .= "/emailAddress=".$email;
- $query = "insert into `emailcerts` set `CN`='".$user['email']."', `keytype`='MS',
- `memid`='".$user['id']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `subject`='$csrsubject', `codesign`='$codesign'";
+ $query = "insert into `emailcerts` set `CN`='".mysql_real_escape_string($user['email'])."', `keytype`='MS',
+ `memid`='".intval($user['id'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
+ `subject`='".mysql_real_escape_string($csrsubject)."', `codesign`='".intval($codesign)."'";
mysql_query($query);
$certid = mysql_insert_id();
$CSRname = generatecertpath("csr","client",$certid);
@@ -95,14 +95,14 @@ require_once '../../includes/lib/check_weak_key.php';
mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='$certid'");
foreach($emails as $emailid => $email)
- mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='$emailid'");
+ mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='".intval($emailid)."'");
$do = `../../scripts/runclient`;
sleep(10); // THIS IS BROKEN AND SHOULD BE FIXED
$query = "select * from `emailcerts` where `id`='$certid' and `crt_name` != ''";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
- die("404,Your certificate request has failed. ID: $certid");
+ die("404,Your certificate request has failed. ID: ".intval($certid));
$cert = mysql_fetch_assoc($res);
echo "200,Authentication Ok\n";
readfile("../".$cert['crt_name']);
diff --git a/www/api/cemails.php b/www/api/cemails.php
index 0d067ea..f937069 100644
--- a/www/api/cemails.php
+++ b/www/api/cemails.php
@@ -25,7 +25,7 @@
echo "200,Authentication Ok\n";
$user = mysql_fetch_assoc($res);
$memid = $user['id'];
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
echo "CS=".intval($user['codesign'])."\n";
@@ -40,8 +40,9 @@
if($user['mname'] != "" && $user['suffix'] != "")
echo "NAME=".sanitizeHTML($user['fname'])." ".sanitizeHTML($user['mname'])." ".sanitizeHTML($user['lname'])." ".sanitizeHTML($user['suffix'])."\n";
}
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0";
$res = mysql_query($query);
- while($row = mysql_fetch_assoc($res))
- echo "EMAIL=".$row['email']."\n";
+ while($row = mysql_fetch_assoc($res)) {
+ echo "EMAIL=".sanitizeHTML($row['email'])."\n";
+ }
?>
diff --git a/www/index.php b/www/index.php
index c7cc03e..40a8e86 100644
--- a/www/index.php
+++ b/www/index.php
@@ -125,7 +125,7 @@ require_once('../includes/lib/l10n.php');
showfooter();
exit;
}
- }
+ }
}
if($oldid == 5 && $process != "")
@@ -153,13 +153,13 @@ require_once('../includes/lib/l10n.php');
include_once("../includes/lib/general.php");
$user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'],
$_SERVER['SSL_CLIENT_I_DN_CN']);
-
+
if($user_id >= 0)
{
$_SESSION['profile'] = mysql_fetch_assoc(mysql_query(
- "select * from `users` where
+ "select * from `users` where
`id`='$user_id' and `deleted`=0 and `locked`=0"));
-
+
if($_SESSION['profile']['id'] != 0)
{
$_SESSION['profile']['loggedin'] = 1;
@@ -307,19 +307,19 @@ require_once('../includes/lib/l10n.php');
$_SESSION['profile'] = "";
unset($_SESSION['profile']);
$_SESSION['profile'] = mysql_fetch_assoc($res);
- $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
if($_SESSION['profile']['language'] == "")
{
$query = "update `users` set `language`='".L10n::get_translation()."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
} else {
L10n::set_translation($_SESSION['profile']['language']);
L10n::init_gettext();
}
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -499,7 +499,7 @@ require_once('../includes/lib/l10n.php');
if($checkemail != "OK")
{
$id = 1;
- if (substr($checkemail, 0, 1) == "4")
+ if (substr($checkemail, 0, 1) == "4")
{
$_SESSION['_config']['errmsg'] .= _("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.");
} else {
@@ -566,9 +566,9 @@ require_once('../includes/lib/l10n.php');
$subject = stripslashes($_REQUEST['subject']);
$message = stripslashes($_REQUEST['message']);
$secrethash = $_REQUEST['secrethash2'];
-
+
//check for spam via honeypot
- if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
+ if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
echo _("Form could not be sent.");
showfooter();
exit;
@@ -641,7 +641,7 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/FAQ/AboutUs';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
if ($id == 19)
{
$protocol = $_SERVER['HTTPS'] ? 'https' : 'http';
@@ -655,7 +655,7 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/Board';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
showheader(_("Welcome to CAcert.org"));
includeit($id);
showfooter();
diff --git a/www/stats.php b/www/stats.php
index 1599e17..d4d892d 100644
--- a/www/stats.php
+++ b/www/stats.php
@@ -32,7 +32,7 @@
$stats['timestamp'] = $ar['timestamp'];
return $stats;
}
-
+
return null;
}
@@ -40,7 +40,7 @@
if ($stats === null) {
echo '<p>', _("Error while retrieving the statistics!"), '</p>';
showfooter();
- die();
+ die();
}
?>
<h1>CAcert.org <?=_("Statistics")?></h1>
@@ -157,4 +157,3 @@
</div>
<? showfooter(); ?>
-
diff --git a/www/styles/default.css b/www/styles/default.css
index 4d4db6a..a7ba2a8 100644
--- a/www/styles/default.css
+++ b/www/styles/default.css
@@ -14,7 +14,7 @@ body {
margin: 0px;
padding: 0px;
background: #cccccc;
-/* url("/siteimages/bg_grad.jpg") fixed; */
+/* url("/siteimages/bg_grad.jpg") fixed; */
}
@@ -219,7 +219,7 @@ ul.no_indent {
}
#globalNav img {
- margin-bottom: -4px;
+ margin-bottom: -4px;
}
#gnl {
@@ -558,6 +558,19 @@ td.storyLeft {
border-right: 1px #cfcfcf solid;
}
+.DataTDError {
+ border-style: inset;
+ border-width: 1px;
+ font-size: 8pt;
+ color: #ff0000;
+ font-family: Arial, Tahoma, Verdana, Helvetica, sans-serif;
+
+ background: #ffffff;
+ padding: 1px 5px 1px 5px;
+ border: 1px #cfcfcf solid;
+ border-left: 1px #cfcfcf dotted;
+ border-right: 1px #cfcfcf dotted;
+}
.wrapper {
border-collapse: collapse;
font-family: verdana, sans-serif;
@@ -571,7 +584,12 @@ td.greytxt {
text-align: right;
vertical-align: bottom;
}
-
+.bold, .primaryemailaddress {
+ font-weight:bold;
+}
+.italic, .deletedemailaddress {
+ font-style:italic;
+}
.title {
background: #e2e2e2;
font-weight: bold;
diff --git a/www/wot.php b/www/wot.php
index 7200517..faa8339 100644
--- a/www/wot.php
+++ b/www/wot.php
@@ -133,9 +133,9 @@ function send_reminder()
//This mail does not need to be translated
$body = "Hi TTP adminstrators,\n\n";
$body .= "User ".$_SESSION['profile']['fname']." ".
- $_SESSION['profile']['lname']." with email address '".
- $_SESSION['profile']['email']."' is requesting a TTP assurances for ".
- mysql_escape_string(stripslashes($_POST['country'])).".\n\n";
+ $_SESSION['profile']['lname']." with email address '".
+ $_SESSION['profile']['email']."' is requesting a TTP assurances for ".
+ mysql_escape_string(stripslashes($_POST['country'])).".\n\n";
if ($_POST['ttptopup']=='1') {
$body .= "The user is also requesting TTP TOPUP.\n\n";
}else{
@@ -224,8 +224,8 @@ function send_reminder()
exit;
}
- $query = "select * from `notary` where `from`='".$_SESSION['profile']['id']."' and
- `to`='".$_SESSION['_config']['notarise']['id']."'";
+ $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and
+ `to`='".intval($_SESSION['_config']['notarise']['id'])."' and `deleted` = 0";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -310,7 +310,7 @@ $iecho= "c";
exit;
}
- $query = "select * from `users` where `id`='".$_SESSION['_config']['notarise']['id']."'";
+ $query = "select * from `users` where `id`='".intval($_SESSION['_config']['notarise']['id'])."'";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$name = $row['fname']." ".$row['mname']." ".$row['lname']." ".$row['suffix'];
@@ -332,7 +332,7 @@ $iecho= "c";
if($newpoints < 0)
$newpoints = $awarded = 0;
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['_config']['notarise']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['_config']['notarise']['id'])."' and `deleted` = 0 group by `to`";
$res = mysql_query($query);
$drow = mysql_fetch_assoc($res);
@@ -345,14 +345,15 @@ $iecho= "c";
if($newpoints < 0)
$newpoints = 0;
- if(mysql_escape_string(stripslashes($_POST['date'])) == "")
+ if(mysql_real_escape_string(stripslashes($_POST['date'])) == "")
$_POST['date'] = date("Y-m-d H:i:s");
- $query = "select * from `notary` where `from`='".$_SESSION['profile']['id']."' AND
- `to`='".$_SESSION['_config']['notarise']['id']."' AND
- `awarded`='$awarded' AND
- `location`='".mysql_escape_string(stripslashes($_POST['location']))."' AND
- `date`='".mysql_escape_string(stripslashes($_POST['date']))."'";
+ $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' AND
+ `to`='".intval($_SESSION['_config']['notarise']['id'])."' AND
+ `awarded`='".intval($awarded)."' AND
+ `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."' AND
+ `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."' AND
+ `deleted`=0";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -363,11 +364,11 @@ $iecho= "c";
if($oldid == 6)
{
- $query = "insert into `notary` set `from`='".$_SESSION['profile']['id']."',
- `to`='".$_SESSION['_config']['notarise']['id']."',
- `points`='$newpoints', `awarded`='$awarded',
- `location`='".mysql_escape_string(stripslashes($_POST['location']))."',
- `date`='".mysql_escape_string(stripslashes($_POST['date']))."',
+ $query = "insert into `notary` set `from`='".intval($_SESSION['profile']['id'])."',
+ `to`='".intval($_SESSION['_config']['notarise']['id'])."',
+ `points`='".intval($newpoints)."', `awarded`='".intval($awarded)."',
+ `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."',
+ `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."',
`when`=NOW()";
//record active acceptance by Assurer
if (check_date_format(trim($_REQUEST['date']),2010)) {
@@ -388,11 +389,11 @@ $iecho= "c";
$addpoints = 2;
else if($_SESSION['profile']['points'] == 149 && $_SESSION['profile']['points'] >= 100)
$addpoints = 1;
- $query = "insert into `notary` set `from`='".$_SESSION['profile']['id']."',
- `to`='".$_SESSION['profile']['id']."',
- `points`='$addpoints', `awarded`='$addpoints',
- `location`='".mysql_escape_string(stripslashes($_POST['location']))."',
- `date`='".mysql_escape_string(stripslashes($_POST['date']))."',
+ $query = "insert into `notary` set `from`='".intval($_SESSION['profile']['id'])."',
+ `to`='".intval($_SESSION['profile']['id'])."',
+ `points`='".intval($addpoints)."', `awarded`='".intval($addpoints)."',
+ `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."',
+ `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."',
`method`='Administrative Increase',
`when`=NOW()";
mysql_query($query);
@@ -478,7 +479,7 @@ $iecho= "c";
{
csrf_check("chgcontact");
- $info = mysql_escape_string(strip_tags(stripslashes($_POST['contactinfo'])));
+ $info = mysql_real_escape_string(strip_tags(stripslashes($_POST['contactinfo'])));
$listme = intval($_POST['listme']);
if($listme < 0 || $listme > 1)
$listme = 0;
@@ -486,7 +487,7 @@ $iecho= "c";
$_SESSION['profile']['listme'] = $listme;
$_SESSION['profile']['contactinfo'] = $info;
- $query = "update `users` set `listme`='$listme',`contactinfo`='$info' where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `listme`='$listme',`contactinfo`='$info' where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
showheader(_("My CAcert.org Account!"));
@@ -507,9 +508,9 @@ $iecho= "c";
$body = $_REQUEST['message'];
$subject = $_REQUEST['subject'];
$userid = intval($_REQUEST['userid']);
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$userid' and `listme`=1"));
+ $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($userid)."' and `listme`=1"));
$points = mysql_num_rows(mysql_query("select sum(`points`) as `total` from `notary`
- where `to`='".$user['id']."' group by `to` HAVING SUM(`points`) > 0"));
+ where `to`='".intval($user['id'])."' and `deleted` = 0 group by `to` HAVING SUM(`points`) > 0"));
if($points > 0)
{
$my_translation = L10n::get_translation();
@@ -545,7 +546,7 @@ $iecho= "c";
showheader(_("My CAcert.org Account!"));?>
<p>
- <? printf(_("Your email has been sent to %s."), $user['fname']); ?>
+ <? printf(_("Your email has been sent to %s."), sanitizeHTML($user['fname'])); ?>
</p>
<p>[ <a href='javascript:history.go(-2)'><?= _("Go Back") ?></a> ]</p>
<?