summaryrefslogtreecommitdiff
path: root/www
diff options
context:
space:
mode:
authorBenny Baumann <BenBE@geshi.org>2014-12-16 21:03:54 +0100
committerBenny Baumann <BenBE@geshi.org>2014-12-16 21:08:25 +0100
commit0988a0c268653910f78a50e16d34edf14a89dc13 (patch)
tree3c8bcc1e070b4c15825758e16b4a426a58cf1fe0 /www
parentdd6c8d16286f10c22b0fe7e4908825e18db9d703 (diff)
parent5596d4a37845019c6053c184a94689101a7d48a8 (diff)
downloadcacert-devel-0988a0c268653910f78a50e16d34edf14a89dc13.tar.gz
cacert-devel-0988a0c268653910f78a50e16d34edf14a89dc13.tar.xz
cacert-devel-0988a0c268653910f78a50e16d34edf14a89dc13.zip
Merge branch 'release' into bug-1131bug-1131
Conflicts: pages/wot/6.php www/policy/CAcertCommunityAgreement.php The conflict in the CCA document page was introduced due to the rename of the file. This instance can be safely ignored, as bug 1131 introduces a new version superseeding the old document. The instance in pages/wot/6.php is a bit more complicated, but basically results from a change of bug 1137 and the modified paths to the policy documents.
Diffstat (limited to 'www')
-rw-r--r--www/api/ccsr.php24
-rw-r--r--www/api/cemails.php9
-rw-r--r--www/disputes.php74
-rw-r--r--www/gpg.php279
-rw-r--r--www/images/btn_paynowCC_LG.gifbin2432 -> 2410 bytes
-rw-r--r--www/images/btn_subscribeCC_LG.gifbin0 -> 2172 bytes
-rw-r--r--www/index.php184
-rw-r--r--www/keygenIE.js4
-rw-r--r--www/policy/CAcertCommunityAgreement.php2
-rw-r--r--www/sqldump.php22
-rw-r--r--www/stats.php427
-rw-r--r--www/styles/default.css472
-rw-r--r--www/wot.php171
13 files changed, 837 insertions, 831 deletions
diff --git a/www/api/ccsr.php b/www/api/ccsr.php
index 7efdf8d..3bfe55a 100644
--- a/www/api/ccsr.php
+++ b/www/api/ccsr.php
@@ -31,7 +31,7 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($_REQUEST['email'] as $email)
{
$email = mysql_real_escape_string(trim($email));
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0 and `email`='$email'";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0 and `email`='$email'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -42,7 +42,7 @@ require_once '../../includes/lib/check_weak_key.php';
}
if(count($emails) <= 0)
die("404,Wasn't able to match any emails sent against your account");
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
@@ -62,18 +62,20 @@ require_once '../../includes/lib/check_weak_key.php';
$codesign = 1;
$CSR = trim($_REQUEST['optionalCSR']);
-
+
if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
{
die("403, $weakKey");
}
-
+
$incsr = tempnam("/tmp", "ccsrIn");
$checkedcsr = tempnam("/tmp", "ccsrOut");
$fp = fopen($incsr, "w");
fputs($fp, $CSR);
fclose($fp);
- $do = `/usr/bin/openssl req -in $incsr -out $checkedcsr`;
+ $incsr_esc = escapeshellarg($incsr);
+ $checkedcsr_esc = escapeshellarg($checkedcsr);
+ $do = shell_exec("/usr/bin/openssl req -in $incsr_esc -out $checkedcsr_esc");
@unlink($incsr);
if(filesize($checkedcsr) <= 0)
die("404,Invalid or missing CSR");
@@ -82,9 +84,9 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($emails as $id => $email)
$csrsubject .= "/emailAddress=".$email;
- $query = "insert into `emailcerts` set `CN`='".$user['email']."', `keytype`='MS',
- `memid`='".$user['id']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `subject`='$csrsubject', `codesign`='$codesign'";
+ $query = "insert into `emailcerts` set `CN`='".mysql_real_escape_string($user['email'])."', `keytype`='MS',
+ `memid`='".intval($user['id'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
+ `subject`='".mysql_real_escape_string($csrsubject)."', `codesign`='".intval($codesign)."'";
mysql_query($query);
$certid = mysql_insert_id();
$CSRname = generatecertpath("csr","client",$certid);
@@ -93,14 +95,14 @@ require_once '../../includes/lib/check_weak_key.php';
mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='$certid'");
foreach($emails as $emailid => $email)
- mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='$emailid'");
+ mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='".intval($emailid)."'");
- $do = `../../scripts/runclient`;
+ $do = shell_exec("../../scripts/runclient");
sleep(10); // THIS IS BROKEN AND SHOULD BE FIXED
$query = "select * from `emailcerts` where `id`='$certid' and `crt_name` != ''";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
- die("404,Your certificate request has failed. ID: $certid");
+ die("404,Your certificate request has failed. ID: ".intval($certid));
$cert = mysql_fetch_assoc($res);
echo "200,Authentication Ok\n";
readfile("../".$cert['crt_name']);
diff --git a/www/api/cemails.php b/www/api/cemails.php
index 0d067ea..f937069 100644
--- a/www/api/cemails.php
+++ b/www/api/cemails.php
@@ -25,7 +25,7 @@
echo "200,Authentication Ok\n";
$user = mysql_fetch_assoc($res);
$memid = $user['id'];
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
echo "CS=".intval($user['codesign'])."\n";
@@ -40,8 +40,9 @@
if($user['mname'] != "" && $user['suffix'] != "")
echo "NAME=".sanitizeHTML($user['fname'])." ".sanitizeHTML($user['mname'])." ".sanitizeHTML($user['lname'])." ".sanitizeHTML($user['suffix'])."\n";
}
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0";
$res = mysql_query($query);
- while($row = mysql_fetch_assoc($res))
- echo "EMAIL=".$row['email']."\n";
+ while($row = mysql_fetch_assoc($res)) {
+ echo "EMAIL=".sanitizeHTML($row['email'])."\n";
+ }
?>
diff --git a/www/disputes.php b/www/disputes.php
index f195ed5..96c7c75 100644
--- a/www/disputes.php
+++ b/www/disputes.php
@@ -17,6 +17,8 @@
*/ ?>
<?
require_once("../includes/loggedin.php");
+ require_once("../includes/notary.inc.php");
+ require_once("../includes/lib/l10n.php");
loadem("account");
@@ -58,24 +60,13 @@
{
$row = mysql_fetch_assoc($res);
echo $row['email']."<br>\n";
- $query = "select `emailcerts`.`id`
- from `emaillink`,`emailcerts` where
- `emailid`='$emailid' and `emaillink`.`emailcertsid`=`emailcerts`.`id` and
- `revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0
- group by `emailcerts`.`id`";
- $dres = mysql_query($query);
- while($drow = mysql_fetch_assoc($dres))
- mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".intval($drow['id'])."'");
-
- $do = `../scripts/runclient`;
- $query = "update `email` set `deleted`=NOW() where `id`='".intval($emailid)."'";
- mysql_query($query);
+ account_email_delete($row['id']);
}
mysql_query("update `disputeemail` set hash='',action='accept' where `id`='$emailid'");
- $rc = mysql_num_rows(mysql_query("select * from `domains` where `memid`='$oldmemid' and `deleted`=0"));
- $rc = mysql_num_rows(mysql_query("select * from `email` where `memid`='$oldmemid' and `deleted`=0 and `id`!='$emailid'"));
- $res = mysql_query("select * from `users` where `id`='$oldmemid'");
- $user = mysql_fetch_assoc($res);
+ $rc = mysql_num_rows(mysql_query("select * from `domains` where `memid`='$oldmemid' and `deleted`=0"));
+ $rc2 = mysql_num_rows(mysql_query("select * from `email` where `memid`='$oldmemid' and `deleted`=0 and `id`!='$emailid'"));
+ $res = mysql_query("select * from `users` where `id`='$oldmemid'");
+ $user = mysql_fetch_assoc($res);
if($rc == 0 && $rc2 == 0 && $_SESSION['_config']['email'] == $user['email'])
{
mysql_query("update `users` set `deleted`=NOW() where `id`='$oldmemid'");
@@ -160,17 +151,13 @@
showheader(_("Domain Dispute"));
echo "<p>"._("You have opted to accept this dispute and the request will now remove this domain from the existing account, and revoke any current certificates.")."</p>";
echo "<p>"._("The following accounts have been removed:")."<br>\n";
+ //new account_domain_delete($domainid, $memberID)
$query = "select * from `domains` where `id`='$domainid' and deleted=0";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
- echo $_SESSION['_config']['domain']."<br>\n";
- mysql_query("update `domains` set `deleted`=NOW() where `id`='$domainid'");
- $query = "select * from `domlink` where `domid`='$domainid'";
- $res = mysql_query($query);
- while($row = mysql_fetch_assoc($res))
- mysql_query("update `domaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$row['certid']."' and `revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0");
- $do = `../scripts/runserver`;
+ echo $_SESSION['_config']['domain']."<br>\n";
+ account_domain_delete($domainid);
}
mysql_query("update `disputedomain` set hash='',action='accept' where `id`='$domainid'");
showfooter();
@@ -236,6 +223,23 @@
exit;
}
+ //check if email belongs to locked account
+ $res = mysql_query("select 1 from `email`, `users` where `email`.`email`='$email' and `email`.`memid`=`users`.`id` and (`users`.`assurer_blocked`=1 or `users`.`locked`=1)");
+ if(mysql_num_rows($res) > 0)
+ {
+ showheader(_("Email Dispute"));
+ printf(_("Sorry, the email address '%s' cannot be disputed for administrative reasons. To solve this problem please get in contact with %s."), sanitizeHTML($email),"<a href='mailto:support@cacert.org'>support@cacert.org</a>");
+ $duser=$_SESSION['profile']['fname']." ".$_SESSION['profile']['lname'];
+ $body = sprintf("Someone has just attempted to dispute this email '%s', which belongs to a locked account:\n".
+ "Username(ID): %s (%s)\n".
+ "email: %s\n".
+ "IP/Hostname: %s\n", $email, $duser, $_SESSION['profile']['id'], $_SESSION['profile']['email'], $_SERVER['REMOTE_ADDR'].(array_key_exists('REMOTE_HOST',$_SERVER)?"/".$_SERVER['REMOTE_HOST']:""));
+ sendmail("support@cacert.org", "[CAcert.org] failed dispute on locked account", $body, $_SESSION['profile']['email'], "", "", $duser);
+
+ showfooter();
+ exit;
+ }
+
$res = mysql_query("select * from `disputeemail` where `email`='$email' and hash!=''");
if(mysql_num_rows($res) > 0)
{
@@ -284,11 +288,15 @@
`IP`='".$_SERVER['REMOTE_ADDR']."'";
mysql_query($query);
+ $my_translation = L10n::get_translation();
+ L10n::set_recipient_language($oldmemid);
+
$body = sprintf(_("You have been sent this email as the email address '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $email)."\n\n";
$body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=email&emailid=$emailid&hash=$hash\n\n";
$body .= _("Best regards")."\n"._("CAcert.org Support!");
sendmail($email, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "", "", "CAcert Support");
+ L10n::set_translation($my_translation);
showheader(_("Email Dispute"));
printf(_("The email address '%s' has been entered into the dispute system, the email address will now be sent an email which will give the recipent the option of accepting or rejecting the request, if after 2 days we haven't received a valid response for or against we will discard the request."), sanitizeHTML($email));
@@ -308,6 +316,23 @@
exit;
}
+ //check if domain belongs to locked account
+ $res = mysql_query("select 1 from `domains`, `users` where `domains`.`domain`='$domain' and `domains`.`memid`=`users`.`id` and (`users`.`assurer_blocked`=1 or `users`.`locked`=1)");
+ if(mysql_num_rows($res) > 0)
+ {
+ showheader(_("Domain Dispute"));
+ printf(_("Sorry, the domain '%s' cannot be disputed for administrative reasons. To solve this problem please get in contact with %s."), sanitizeHTML($domain),"<a href='mailto:support@cacert.org'>support@cacert.org</a>");
+ $duser=$_SESSION['profile']['fname']." ".$_SESSION['profile']['lname'];
+ $body = sprintf("Someone has just attempted to dispute this domain '%s', which belongs to a locked account:\n".
+ "Username(ID): %s (%s)\n".
+ "email: %s\n".
+ "IP/Hostname: %s\n", $domain, $duser, $_SESSION['profile']['id'], $_SESSION['profile']['email'], $_SERVER['REMOTE_ADDR'].(array_key_exists('REMOTE_HOST',$_SERVER)?"/".$_SERVER['REMOTE_HOST']:""));
+ sendmail("support@cacert.org", "[CAcert.org] failed dispute on locked account", $body, $_SESSION['profile']['email'], "", "", $duser);
+
+ showfooter();
+ exit;
+ }
+
$query = "select * from `disputedomain` where `domain`='$domain' and hash!=''";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
@@ -427,10 +452,13 @@
$query = "insert into `disputedomain` set `domain`='$domain',`memid`='".$_SESSION['profile']['id']."',
`oldmemid`='$oldmemid',`created`=NOW(),`hash`='$hash',`id`='$domainid'";
mysql_query($query);
+ $my_translation = L10n::get_translation();
+ L10n::set_recipient_language($oldmemid);
$body = sprintf(_("You have been sent this email as the domain '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $domain)."\n\n";
$body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=domain&domainid=$domainid&hash=$hash\n\n";
$body .= _("Best regards")."\n"._("CAcert.org Support!");
+ L10n::set_recipient_language($my_translation);
sendmail($authaddy, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "", "", "CAcert Support");
diff --git a/www/gpg.php b/www/gpg.php
index 345b559..cb72475 100644
--- a/www/gpg.php
+++ b/www/gpg.php
@@ -17,6 +17,8 @@
*/ ?>
<?
require_once("../includes/loggedin.php");
+ require_once("../includes/lib/general.php");
+ require_once('../includes/notary.inc.php');
$id = 0; if(array_key_exists('id',$_REQUEST)) $id=intval($_REQUEST['id']);
$oldid = $_REQUEST['oldid'] = array_key_exists('oldid',$_REQUEST) ? intval($_REQUEST['oldid']) : 0;
@@ -52,7 +54,7 @@ if(0)
{
showheader(_("Welcome to CAcert.org"));
echo "The OpenPGP signing system is currently shutdown due to a maintenance. We hope to get it fixed within the next few hours. We are very sorry for the inconvenience.";
-
+
exit(0);
}
}
@@ -61,12 +63,18 @@ if(0)
function verifyName($name)
{
if($name == "") return 0;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']) return 1;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']) return 1;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1;
- return 0;
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname'])) return 1; // John Doe
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname'])) return 1; // John Joseph Doe
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0]." ".$_SESSION['profile']['lname'])) return 1; // John J Doe
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0].". ".$_SESSION['profile']['lname'])) return 1; // John J. Doe
+
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; // John Doe Jr.
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John Joseph Doe Jr.
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0]." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John J Doe Jr.
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0].". ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John J. Doe Jr.
+
+ return 0;
}
function verifyEmail($email)
@@ -82,17 +90,44 @@ function verifyEmail($email)
$state=0;
if($oldid == "0" && $CSR != "")
{
- $debugkey = $gpgkey = clean_gpgcsr($CSR);
+ if(!array_key_exists('CCA',$_REQUEST))
+ {
+ showheader(_("My CAcert.org Account!"));
+ echo _("You did not accept the CAcert Community Agreement (CCA), hit the back button and try again.");
+ showfooter();
+ exit;
+ }
- $tnam = tempnam('/tmp/', '__gpg');
- $fp = fopen($tnam, 'w');
- fwrite($fp, $gpgkey);
- fclose($fp);
- $debugpg = $gpg = trim(`gpg --with-colons --homedir /tmp 2>&1 < $tnam`);
- unlink($tnam);
+ $err = runCommand('mktemp --directory /tmp/cacert_gpg.XXXXXXXXXX',
+ "",
+ $tmpdir);
+ if (!$tmpdir)
+ {
+ $err = true;
+ }
+
+ if (!$err)
+ {
+ $err = runCommand("gpg --with-colons --homedir $tmpdir 2>&1",
+ clean_gpgcsr($CSR),
+ $gpg);
+
+ shell_exec("rm -r $tmpdir");
+ }
+
+ if ($err)
+ {
+ showheader(_("Welcome to CAcert.org"));
+
+ echo "<p style='color:#ff0000'>"._("There was an error parsing your key.")."</p>";
+ unset($_REQUEST['process']);
+ $id = $oldid;
+ unset($oldid);
+ exit();
+ }
$lines = "";
- $gpgarr = explode("\n", $gpg);
+ $gpgarr = explode("\n", trim($gpg));
foreach($gpgarr as $line)
{
#echo "Line[]: $line <br/>\n";
@@ -143,7 +178,7 @@ function verifyEmail($email)
$uidformatwrong=0;
if(sizeof($bits)<10) $uidformatwrong=1;
-
+
if(preg_match("/\@.*\@/",$bits[9]))
{
showheader(_("Welcome to CAcert.org"));
@@ -158,18 +193,18 @@ function verifyEmail($email)
// Name (Comment) <Email>
if(preg_match("/^([^\(\)\[@<>]+) \(([^\(\)@<>]*)\) <([\w=\/%.-]*\@[\w.-]*|[\w.-]*\![\w=\/%.-]*)>/",$bits[9],$matches))
{
- $name=trim(hex2bin($matches[1]));
+ $name=trim(gpg_hex2bin($matches[1]));
$nocomment=0;
- $comm=trim(hex2bin($matches[2]));
- $mail=trim(hex2bin($matches[3]));
+ $comm=trim(gpg_hex2bin($matches[2]));
+ $mail=trim(gpg_hex2bin($matches[3]));
}
// Name <EMail>
elseif(preg_match("/^([^\(\)\[@<>]+) <([\w=\/%.-]*\@[\w.-]*|[\w.-]*\![\w=\/%.-]*)>/",$bits[9],$matches))
{
- $name=trim(hex2bin($matches[1]));
+ $name=trim(gpg_hex2bin($matches[1]));
$nocomment=1;
$comm="";
- $mail=trim(hex2bin($matches[2]));
+ $mail=trim(gpg_hex2bin($matches[2]));
}
// Unrecognized format
else
@@ -251,7 +286,6 @@ function verifyEmail($email)
}
$resulttable.="</table>";
-
if($nok==0)
{
showheader(_("Welcome to CAcert.org"));
@@ -261,7 +295,6 @@ function verifyEmail($email)
unset($_REQUEST['process']);
$id = $oldid;
unset($oldid);
- $do = `echo "$debugkey\n--\n$debugpg\n--" >> /www/tmp/gpg.debug`;
exit();
}
elseif($nerr)
@@ -275,17 +308,27 @@ function verifyEmail($email)
if($oldid == "0" && $CSR != "")
{
+ write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1);
+
+ //set variable for comment
+ if(trim($_REQUEST['description']) == ""){
+ $description= "";
+ }else{
+ $description= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+ }
+
$query = "insert into `gpg` set `memid`='".intval($_SESSION['profile']['id'])."',
`email`='".mysql_real_escape_string($lastvalidemail)."',
`level`='1',
`expires`='".mysql_real_escape_string($expires)."',
`multiple`='".mysql_real_escape_string($multiple)."',
- `keyid`='".mysql_real_escape_string($keyid)."'";
+ `keyid`='".mysql_real_escape_string($keyid)."',
+ `description`='".mysql_real_escape_string($description)."'";
mysql_query($query);
- $id = mysql_insert_id();
+ $insert_id = mysql_insert_id();
- $cwd = '/tmp/gpgspace'.$id;
+ $cwd = '/tmp/gpgspace'.$insert_id;
mkdir($cwd,0755);
$fp = fopen("$cwd/gpg.csr", "w");
@@ -296,7 +339,8 @@ function verifyEmail($email)
system("gpg --homedir $cwd --import $cwd/gpg.csr");
- $debugpg = $gpg = trim(`gpg --homedir $cwd --with-colons --fixed-list-mode --list-keys $keyid 2>&1`);
+ $cmd_keyid = escapeshellarg($keyid);
+ $gpg = trim(shell_exec("gpg --homedir $cwd --with-colons --fixed-list-mode --list-keys $cmd_keyid 2>&1"));
$lines = "";
$gpgarr = explode("\n", $gpg);
foreach($gpgarr as $line)
@@ -319,13 +363,13 @@ function verifyEmail($email)
$pos = strlen($bits[9]);
}
- $name = trim(hex2bin(trim(substr($bits[9], 0, $pos))));
+ $name = trim(gpg_hex2bin(trim(substr($bits[9], 0, $pos))));
$nameok=verifyName($name);
if($nocomment == 0)
{
$pos += 2;
$pos2 = strpos($bits[9], ")");
- $comm = trim(hex2bin(trim(substr($bits[9], $pos, $pos2 - $pos))));
+ $comm = trim(gpg_hex2bin(trim(substr($bits[9], $pos, $pos2 - $pos))));
if($comm != "")
$comment[] = $comm;
$pos = $pos2 + 3;
@@ -334,15 +378,15 @@ function verifyEmail($email)
}
$mail="";
- if (preg_match("/<([\w.-]*\@[\w.-]*)>/", $bits[9],$match)) {
+ if (preg_match("/<([\w.-]*\@[\w.-]*)>/", $bits[9],$match)) {
//echo "Found: ".$match[1];
- $mail = trim(hex2bin($match[1]));
+ $mail = trim(gpg_hex2bin($match[1]));
}
else
{
//echo "Not found!\n";
}
-
+
$emailok=verifyEmail($mail);
$uidid=$bits[7];
@@ -384,95 +428,90 @@ function verifyEmail($email)
}
}
+ if(count($ToBeDeleted)>0)
+ {
+ $descriptorspec = array(
+ 0 => array("pipe", "r"), // stdin is a pipe that the child will read from
+ 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
+ 2 => array("pipe", "w") // stderr is a file to write to
+ );
+ $stderr = fopen('php://stderr', 'w');
+ //echo "Keyid: $keyid\n";
- if(count($ToBeDeleted)>0)
- {
+ $cmd_keyid = escapeshellarg($keyid);
+ $process = proc_open("/usr/bin/gpg --homedir $cwd --no-tty --command-fd 0 --status-fd 1 --logger-fd 2 --edit-key $cmd_keyid", $descriptorspec, $pipes);
+ //echo "Process: $process\n";
+ //fputs($stderr,"Process: $process\n");
+
+ if (is_resource($process)) {
+ //echo("it is a resource\n");
+ // $pipes now looks like this:
+ // 0 => writeable handle connected to child stdin
+ // 1 => readable handle connected to child stdout
+ // Any error output will be appended to /tmp/error-output.txt
+ while (!feof($pipes[1]))
+ {
+ $buffer = fgets($pipes[1], 4096);
+ //echo $buffer;
- $descriptorspec = array(
- 0 => array("pipe", "r"), // stdin is a pipe that the child will read from
- 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
- 2 => array("pipe", "w") // stderr is a file to write to
- );
-
- $stderr = fopen('php://stderr', 'w');
-
-
- //echo "Keyid: $keyid\n";
-
- $process = proc_open("/usr/bin/gpg --homedir $cwd --no-tty --command-fd 0 --status-fd 1 --logger-fd 2 --edit-key $keyid", $descriptorspec, $pipes);
-
- //echo "Process: $process\n";
- //fputs($stderr,"Process: $process\n");
-
- if (is_resource($process)) {
- //echo("it is a resource\n");
- // $pipes now looks like this:
- // 0 => writeable handle connected to child stdin
- // 1 => readable handle connected to child stdout
- // Any error output will be appended to /tmp/error-output.txt
- while (!feof($pipes[1]))
- {
- $buffer = fgets($pipes[1], 4096);
- //echo $buffer;
-
- if($buffer == "[GNUPG:] GET_BOOL keyedit.sign_all.okay\n")
- {
- fputs($pipes[0],"yes\n");
- }
- elseif($buffer == "[GNUPG:] GOT_IT\n")
- {
- }
- elseif(ereg("^\[GNUPG:\] GET_BOOL keyedit\.remove\.uid\.okay\s*",$buffer))
- {
- fputs($pipes[0],"yes\n");
- }
- elseif(ereg("^\[GNUPG:\] GET_LINE keyedit\.prompt\s*",$buffer))
- {
- if(count($ToBeDeleted)>0)
- {
- $delthisuid=array_pop($ToBeDeleted);
- //echo "Deleting an UID $delthisuid\n";
- fputs($pipes[0],"uid ".$delthisuid."\n");
- }
- else
- {
- //echo "Saving\n";
- fputs($pipes[0],$state?"save\n":"deluid\n");
- $state++;
- }
- }
- elseif($buffer == "[GNUPG:] GOOD_PASSPHRASE\n")
- {
- }
- elseif(ereg("^\[GNUPG:\] KEYEXPIRED ",$buffer))
- {
- echo "Key expired!\n";
- exit;
- }
- elseif($buffer == "")
- {
- //echo "Empty!\n";
- }
- else
- {
- echo "ERROR: UNKNOWN $buffer\n";
- }
+ if($buffer == "[GNUPG:] GET_BOOL keyedit.sign_all.okay\n")
+ {
+ fputs($pipes[0],"yes\n");
+ }
+ elseif($buffer == "[GNUPG:] GOT_IT\n")
+ {
+ }
+ elseif(ereg("^\[GNUPG:\] GET_BOOL keyedit\.remove\.uid\.okay\s*",$buffer))
+ {
+ fputs($pipes[0],"yes\n");
+ }
+ elseif(ereg("^\[GNUPG:\] GET_LINE keyedit\.prompt\s*",$buffer))
+ {
+ if(count($ToBeDeleted)>0)
+ {
+ $delthisuid=array_pop($ToBeDeleted);
+ //echo "Deleting an UID $delthisuid\n";
+ fputs($pipes[0],"uid ".$delthisuid."\n");
+ }
+ else
+ {
+ //echo "Saving\n";
+ fputs($pipes[0],$state?"save\n":"deluid\n");
+ $state++;
+ }
+ }
+ elseif($buffer == "[GNUPG:] GOOD_PASSPHRASE\n")
+ {
+ }
+ elseif(ereg("^\[GNUPG:\] KEYEXPIRED ",$buffer))
+ {
+ echo "Key expired!\n";
+ exit;
+ }
+ elseif($buffer == "")
+ {
+ //echo "Empty!\n";
+ }
+ else
+ {
+ echo "ERROR: UNKNOWN $buffer\n";
+ }
}
//echo "Fertig\n";
fclose($pipes[0]);
-
+
//echo stream_get_contents($pipes[1]);
fclose($pipes[1]);
-
+
// It is important that you close any pipes before calling
// proc_close in order to avoid a deadlock
$return_value = proc_close($process);
-
+
//echo "command returned $return_value\n";
}
else
@@ -484,15 +523,16 @@ function verifyEmail($email)
}
- $csrname=generatecertpath("csr","gpg",$id);
- $do=`gpg --homedir $cwd --batch --export-options export-minimal --export $keyid >$csrname`;
+ $csrname=generatecertpath("csr","gpg",$insert_id);
+ $cmd_keyid = escapeshellarg($keyid);
+ $do=shell_exec("gpg --homedir $cwd --batch --export-options export-minimal --export $cmd_keyid >$csrname");
- mysql_query("update `gpg` set `csr`='$csrname' where `id`='$id'");
- waitForResult('gpg', $id);
+ mysql_query("update `gpg` set `csr`='$csrname' where `id`='$insert_id'");
+ waitForResult('gpg', $insert_id);
showheader(_("Welcome to CAcert.org"));
echo $resulttable;
- $query = "select * from `gpg` where `id`='$id' and `crt`!=''";
+ $query = "select * from `gpg` where `id`='$insert_id' and `crt`!=''";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -500,7 +540,7 @@ function verifyEmail($email)
echo _("If this is a re-occuring problem, please send a copy of the key you are trying to signed to support@cacert.org. Thank you.");
} else {
echo "<pre>";
- readfile(generatecertpath("crt","gpg",$id));
+ readfile(generatecertpath("crt","gpg",$insert_id));
echo "</pre>";
}
@@ -508,6 +548,23 @@ function verifyEmail($email)
exit;
}
+ if($oldid == 2 && array_key_exists('change',$_REQUEST) && $_REQUEST['change'] != "")
+ {
+ showheader(_("My CAcert.org Account!"));
+ foreach($_REQUEST as $id => $val)
+ {
+ if(substr($id,0,14)=="check_comment_")
+ {
+ $cid = intval(substr($id,14));
+ $comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
+ mysql_query("update `gpg` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+ }
+ }
+ echo(_("Certificate settings have been changed.")."<br/>\n");
+ showfooter();
+ exit;
+ }
+
$id = intval($id);
showheader(_("Welcome to CAcert.org"));
diff --git a/www/images/btn_paynowCC_LG.gif b/www/images/btn_paynowCC_LG.gif
index f2edb8f..99fda23 100644
--- a/www/images/btn_paynowCC_LG.gif
+++ b/www/images/btn_paynowCC_LG.gif
Binary files differ
diff --git a/www/images/btn_subscribeCC_LG.gif b/www/images/btn_subscribeCC_LG.gif
new file mode 100644
index 0000000..a5cd278
--- /dev/null
+++ b/www/images/btn_subscribeCC_LG.gif
Binary files differ
diff --git a/www/index.php b/www/index.php
index c7cc03e..e6fc06a 100644
--- a/www/index.php
+++ b/www/index.php
@@ -17,7 +17,7 @@
*/
require_once('../includes/lib/l10n.php');
-
+require_once('../includes/notary.inc.php');
$id = 0; if(array_key_exists("id",$_REQUEST)) $id=intval($_REQUEST['id']);
$oldid = 0; if(array_key_exists("oldid",$_REQUEST)) $oldid=intval($_REQUEST['oldid']);
@@ -125,7 +125,7 @@ require_once('../includes/lib/l10n.php');
showfooter();
exit;
}
- }
+ }
}
if($oldid == 5 && $process != "")
@@ -148,18 +148,19 @@ require_once('../includes/lib/l10n.php');
}
}
+ //client login
if($id == 4 && $_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'])
{
include_once("../includes/lib/general.php");
$user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'],
$_SERVER['SSL_CLIENT_I_DN_CN']);
-
+
if($user_id >= 0)
{
$_SESSION['profile'] = mysql_fetch_assoc(mysql_query(
- "select * from `users` where
+ "select * from `users` where
`id`='$user_id' and `deleted`=0 and `locked`=0"));
-
+
if($_SESSION['profile']['id'] != 0)
{
$_SESSION['profile']['loggedin'] = 1;
@@ -171,79 +172,13 @@ require_once('../includes/lib/l10n.php');
}
}
+
if($id == 4 && array_key_exists('profile',$_SESSION) && array_key_exists('loggedin',array($_SESSION['profile'])) && $_SESSION['profile']['loggedin'] == 1)
{
header("location: https://".$_SERVER['HTTP_HOST']."/account.php");
exit;
}
- function getOTP64($otp)
- {
- $lookupChar = "123456789abcdefhkmnprstuvwxyzABCDEFGHKMNPQRSTUVWXYZ=+[]&@#*!-?%:";
-
- for($i = 0; $i < 6; $i++)
- $val[$i] = hexdec(substr($otp, $i * 2, 2));
-
- $tmp1 = $val[0] >> 2;
- $OTP = $lookupChar[$tmp1 & 63];
- $tmp2 = $val[0] - ($tmp1 << 2);
- $tmp1 = $val[1] >> 4;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 63];
- $tmp2 = $val[1] - ($tmp1 << 4);
- $tmp1 = $val[2] >> 6;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 63];
- $tmp2 = $val[2] - ($tmp1 << 6);
- $OTP .= $lookupChar[$tmp2 & 63];
- $tmp1 = $val[3] >> 2;
- $OTP .= $lookupChar[$tmp1 & 63];
- $tmp2 = $val[3] - ($tmp1 << 2);
- $tmp1 = $val[4] >> 4;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 63];
- $tmp2 = $val[4] - ($tmp1 << 4);
- $tmp1 = $val[5] >> 6;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 63];
- $tmp2 = $val[5] - ($tmp1 << 6);
- $OTP .= $lookupChar[$tmp2 & 63];
-
- return $OTP;
- }
-
- function getOTP32($otp)
- {
- $lookupChar = "0123456789abcdefghkmnoprstuvwxyz";
-
- for($i = 0; $i < 7; $i++)
- $val[$i] = hexdec(substr($otp, $i * 2, 2));
-
- $tmp1 = $val[0] >> 3;
- $OTP = $lookupChar[$tmp1 & 31];
- $tmp2 = $val[0] - ($tmp1 << 3);
- $tmp1 = $val[1] >> 6;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 31];
- $tmp2 = ($val[1] - ($tmp1 << 6)) >> 1;
- $OTP .= $lookupChar[$tmp2 & 31];
- $tmp2 = $val[1] - (($val[1] >> 1) << 1);
- $tmp1 = $val[2] >> 4;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 31];
- $tmp2 = $val[2] - ($tmp1 << 4);
- $tmp1 = $val[3] >> 7;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 31];
- $tmp2 = ($val[3] - ($tmp1 << 7)) >> 2;
- $OTP .= $lookupChar[$tmp2 & 31];
- $tmp2 = $val[3] - (($val[3] - ($tmp1 << 7)) >> 2) << 2;
- $tmp1 = $val[4] >> 5;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 31];
- $tmp2 = $val[4] - ($tmp1 << 5);
- $OTP .= $lookupChar[$tmp2 & 31];
- $tmp1 = $val[5] >> 3;
- $OTP .= $lookupChar[$tmp1 & 31];
- $tmp2 = $val[5] - ($tmp1 << 3);
- $tmp1 = $val[6] >> 6;
- $OTP .= $lookupChar[($tmp1 + $tmp2) & 31];
-
- return $OTP;
- }
-
if($oldid == 4)
{
$oldid = 0;
@@ -256,70 +191,24 @@ require_once('../includes/lib/l10n.php');
$query = "select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or
`password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0";
$res = mysql_query($query);
- if(mysql_num_rows($res) <= 0)
- {
- $otpquery = "select * from `users` where `email`='$email' and `otphash`!='' and `verified`=1 and `deleted`=0 and `locked`=0";
- $otpres = mysql_query($otpquery);
- if(mysql_num_rows($otpres) > 0)
- {
- $otp = mysql_fetch_assoc($otpres);
- $otphash = $otp['otphash'];
- $otppin = $otp['otppin'];
- if(strlen($pword) == 6)
- {
- $matchperiod = 18;
- $time = round(gmdate("U") / 10);
- } else {
- $matchperiod = 3;
- $time = round(gmdate("U") / 60);
- }
-
- $query = "delete from `otphashes` where UNIX_TIMESTAMP(`when`) <= UNIX_TIMESTAMP(NOW()) - 600";
- mysql_query($query);
-
- $query = "select * from `otphashes` where `username`='$email' and `otp`='$pword'";
- if(mysql_num_rows(mysql_query($query)) <= 0)
- {
- $query = "insert into `otphashes` set `when`=NOW(), `username`='$email', `otp`='$pword'";
- mysql_query($query);
- for($i = $time - $matchperiod; $i <= $time + $matchperiod * 2; $i++)
- {
- if($otppin > 0)
- $tmpmd5 = md5("$i$otphash$otppin");
- else
- $tmpmd5 = md5("$i$otphash");
-
- if(strlen($pword) == 6)
- $md5 = substr(md5("$i$otphash"), 0, 6);
- else if(strlen($pword) == 8)
- $md5 = getOTP64(md5("$i$otphash"));
- else
- $md5 = getOTP32(md5("$i$otphash"));
-
- if($pword == $md5)
- $res = mysql_query($otpquery);
- }
- }
- }
- }
if(mysql_num_rows($res) > 0)
{
$_SESSION['profile'] = "";
unset($_SESSION['profile']);
$_SESSION['profile'] = mysql_fetch_assoc($res);
- $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
if($_SESSION['profile']['language'] == "")
{
$query = "update `users` set `language`='".L10n::get_translation()."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
} else {
L10n::set_translation($_SESSION['profile']['language']);
L10n::init_gettext();
}
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -331,12 +220,16 @@ require_once('../includes/lib/l10n.php');
$_SESSION['_config']['errmsg'] .= _("For your own security you must enter 5 lost password questions and answers.")."<br>";
$_SESSION['_config']['oldlocation'] = "account.php?id=13";
}
+ if (!isset($_SESSION['_config']['oldlocation'])){
+ $_SESSION['_config']['oldlocation']='';
+ }
if (checkpwlight($pword) < 3)
$_SESSION['_config']['oldlocation'] = "account.php?id=14&force=1";
- if($_SESSION['_config']['oldlocation'] != "")
+ if($_SESSION['_config']['oldlocation'] != ""){
header("location: https://".$_SERVER['HTTP_HOST']."/".$_SESSION['_config']['oldlocation']);
- else
+ }else{
header("location: https://".$_SERVER['HTTP_HOST']."/account.php");
+ }
exit;
}
@@ -351,6 +244,40 @@ require_once('../includes/lib/l10n.php');
}
}
+// check for CCA acceptance prior to login
+if ($oldid == 52 )
+{
+ // Check if the user is already authenticated
+ if (!array_key_exists('profile',$_SESSION)
+ || !array_key_exists('loggedin',$_SESSION['profile'])
+ || $_SESSION['profile']['loggedin'] != 1)
+ {
+ header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4");
+ exit;
+ }
+
+ if (array_key_exists('agree',$_REQUEST) && $_REQUEST['agree'] != "")
+ {
+ write_user_agreement($_SESSION['profile']['id'], "CCA", "Login acception", "", 1);
+ $_SESSION['profile']['ccaagreement']=get_user_agreement_status($_SESSION['profile']['id'],'CCA');
+
+ if (array_key_exists("oldlocation",$_SESSION['_config'])
+ && $_SESSION['_config']['oldlocation']!="")
+ {
+ header("Location: https://{$_SERVER['HTTP_HOST']}/{$_SESSION['_config']['oldlocation']}");
+ exit;
+ } else {
+ header("Location: https://{$_SERVER['HTTP_HOST']}/account.php");
+ exit;
+ }
+ }
+
+ // User didn't agree
+ header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4");
+ exit;
+}
+
+
if($process && $oldid == 1)
{
$id = 2;
@@ -499,7 +426,7 @@ require_once('../includes/lib/l10n.php');
if($checkemail != "OK")
{
$id = 1;
- if (substr($checkemail, 0, 1) == "4")
+ if (substr($checkemail, 0, 1) == "4")
{
$_SESSION['_config']['errmsg'] .= _("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.");
} else {
@@ -545,7 +472,6 @@ require_once('../includes/lib/l10n.php');
`regional`='".$_SESSION['signup']['regional']."',
`radius`='".$_SESSION['signup']['radius']."'";
mysql_query($query);
- include_once("../includes/notary.inc.php");
write_user_agreement($memid, "CCA", "account creation", "", 1);
$body = _("Thanks for signing up with CAcert.org, below is the link you need to open to verify your account. Once your account is verified you will be able to start issuing certificates till your hearts' content!")."\n\n";
@@ -566,9 +492,9 @@ require_once('../includes/lib/l10n.php');
$subject = stripslashes($_REQUEST['subject']);
$message = stripslashes($_REQUEST['message']);
$secrethash = $_REQUEST['secrethash2'];
-
+
//check for spam via honeypot
- if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
+ if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
echo _("Form could not be sent.");
showfooter();
exit;
@@ -641,7 +567,7 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/FAQ/AboutUs';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
if ($id == 19)
{
$protocol = $_SERVER['HTTPS'] ? 'https' : 'http';
@@ -655,7 +581,7 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/Board';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
showheader(_("Welcome to CAcert.org"));
includeit($id);
showfooter();
diff --git a/www/keygenIE.js b/www/keygenIE.js
index be2d184..4c15b23 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -247,6 +247,7 @@ var CAcert_keygen_IE = function () {
privateKey.Algorithm = algorithmOid;
privateKey.Length = bits;
privateKey.KeyUsage = 0xffffff; // XCN_NCRYPT_ALLOW_ALL_USAGES
+ privateKey.ExportPolicy = 0x1; // XCN_NCRYPT_ALLOW_EXPORT_FLAG
var request = factory.CreateObject("X509Enrollment.CX509CertificateRequestPkcs10");
request.InitializeFromPrivateKey(
@@ -545,7 +546,8 @@ var CAcert_keygen_IE = function () {
}
cenroll.GenKeyFlags = bits << 16; // keysize is encoded in the uper 16 bits
- //cenroll.GenKeyFlags = cenroll.GenKeyFlags | 0x1; //CRYPT_EXPORTABLE
+ // Allow exporting the private key
+ cenroll.GenKeyFlags = cenroll.GenKeyFlags | 0x1; //CRYPT_EXPORTABLE
generatingKeyNotice.style.display = "";
diff --git a/www/policy/CAcertCommunityAgreement.php b/www/policy/CAcertCommunityAgreement.php
index 065ad2b..e730593 100644
--- a/www/policy/CAcertCommunityAgreement.php
+++ b/www/policy/CAcertCommunityAgreement.php
@@ -1,4 +1,4 @@
<?php
header('HTTP/1.0 301 Moved Permanently');
header('Location: CAcertCommunityAgreement.html');
-exit(); \ No newline at end of file
+exit();
diff --git a/www/sqldump.php b/www/sqldump.php
index 9476f6f..f30b4d0 100644
--- a/www/sqldump.php
+++ b/www/sqldump.php
@@ -15,24 +15,24 @@
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
- header("content-type: text/plain");
+ header("content-type: text/plain");
?>
# CAcert SQL Dump
-# version 0.0.2
+# version 0.0.3
#
# Generation Time: <?=date('r')?>
#
# Database: `cacert`
#
<?
- $tables = mysql_list_tables('cacert');
- while(list($table_name) = mysql_fetch_array($tables))
- {
- echo "# --------------------------------------------------------\n\n";
- echo "#\n# Table structure for table `$table_name`\n#\n\n";
+ $tables = mysql_query("SHOW TABLES");
+ while(list($table_name) = mysql_fetch_array($tables))
+ {
+ echo "# --------------------------------------------------------\n\n";
+ echo "#\n# Table structure for table `$table_name`\n#\n\n";
- echo "DROP TABLE IF EXISTS `$table_name`;\n";
- $create = mysql_fetch_assoc(mysql_query("SHOW CREATE TABLE `cacert`.`$table_name`"));
- echo $create['Create Table'].";\n\n";
- }
+ echo "DROP TABLE IF EXISTS `$table_name`;\n";
+ $create = mysql_fetch_assoc(mysql_query("SHOW CREATE TABLE `$table_name`"));
+ echo $create['Create Table'].";\n\n";
+ }
?>
diff --git a/www/stats.php b/www/stats.php
index 93f693e..d4d892d 100644
--- a/www/stats.php
+++ b/www/stats.php
@@ -1,268 +1,159 @@
-<? /*
- LibreSSL - CAcert web application
- Copyright (C) 2004-2008 CAcert Inc.
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; version 2 of the License.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/
- define('MAX_CACHE_TTL', 36000);
-
- loadem("index");
- showheader(_("Welcome to CAcert.org"));
-
- function tc($sql)
- {
- $row = mysql_fetch_assoc($sql);
- return($row['count']);
- }
-
- /**
- * writes new data to cache, create cache or update existing cache, set current
- * time stamp
- * @return boolean
- */
- function updateCache($stats) {
- $sql = 'insert into statscache (timestamp, cache) values ("' . time() . '", ' .
- '"' . mysql_real_escape_string(serialize($stats)) . '")';
- mysql_query($sql);
- }
-
- /**
- * get statistics data from current cache, return result of getDataFromLive if no cache file exists
- * @return array
- */
- function getData() {
- $sql = 'select * from statscache order by timestamp desc limit 1';
- $res = mysql_query($sql);
- if ($res && mysql_numrows($res) > 0) {
- $ar = mysql_fetch_assoc($res);
- $stats = unserialize($ar['cache']);
- $stats['timestamp'] = $ar['timestamp'];
- if ($ar['timestamp'] + MAX_CACHE_TTL < time())
- {
- $stats=getDataFromLive();
- updateCache($stats);
- }
- return $stats;
- }
- $stats=getDataFromLive();
- updateCache($stats);
- return $stats;
- }
-
- /**
- * get statistics data from live tables, takes a long time so please try to use the
- * cache
- * @return array
- */
- function getDataFromLive() {
- $stats = array();
- $stats['verified_users'] = number_format(tc(mysql_query("select count(`id`) as `count` from `users` where `verified`=1")));
- $stats['verified_emails'] = number_format(tc(mysql_query("select count(`id`) as `count` from `email` where `hash`='' and `deleted`=0")));
- $stats['verified_domains'] = number_format(tc(mysql_query("select count(`id`) as `count` from `domains` where `hash`='' and `deleted`=0")));
- $certs = tc(mysql_query("select count(`id`) as `count` from `domaincerts`"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `emailcerts`"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `gpg`"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgdomaincerts`"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgemailcerts`"));
- $stats['verified_certificates'] = number_format($certs);
- $certs = tc(mysql_query("select count(`id`) as `count` from `domaincerts` where `revoked`=0 and `expire`>NOW()"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `emailcerts` where `revoked`=0 and `expire`>NOW()"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `gpg` where `expire`<=NOW()"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgdomaincerts` where `revoked`=0 and `expire`>NOW()"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgemailcerts` where `revoked`=0 and `expire`>NOW()"));
- $stats['valid_certificates'] = number_format($certs);
- $stats['assurances_made'] = number_format(tc(mysql_query("select count(`id`) as `count` from `notary`")));
- $stats['users_1to49'] = number_format(mysql_num_rows(mysql_query("select `to` from `notary` group by `to` having sum(`points`) > 0 and sum(`points`) < 50")));
- $stats['users_50to99'] = number_format(mysql_num_rows(mysql_query("select `to` from `notary` group by `to` having sum(`points`) >= 50 and sum(`points`) < 100")));
- $stats['assurer_candidates'] = number_format(tc(mysql_query("select count(*) as `count` from `users` where ".
- "not exists(select 1 from `cats_passed` as `cp`, `cats_variant` as `cv` where `cp`.`user_id`=`users`.`id` and `cp`.`variant_id`=`cv`.`id` and `cv`.`type_id`=1) and ".
- "(select sum(`points`) from `notary` where `to`=`users`.`id`) >= 100")));
- $stats['aussurers_with_test'] = number_format(tc(mysql_query("select count(*) as `count` from `users` where ".
- "exists(select 1 from `cats_passed` as `cp`, `cats_variant` as `cv` where `cp`.`user_id`=`users`.`id` and `cp`.`variant_id`=`cv`.`id` and `cv`.`type_id`=1) and ".
- "(select sum(`points`) from `notary` where `to`=`users`.`id`) >= 100")));
- $stats['points_issued'] = number_format(tc(mysql_query("select sum(`points`) as `count` from `notary`")));
-
- $totalusers=0;
- $totassurers=0;
- $totalcerts=0;
- for($i = 0; $i < 12; $i++) {
- $tmp_arr = array();
- $tmp_arr['date'] = date("Y-m", mktime(0,0,0,date("m") - $i,1,date("Y")));
- $date = date("Y-m", mktime(0,0,0,date("m") - $i,1,date("Y")));
- $totalusers += $users = tc(mysql_query("select count(`id`) as `count` from `users` where `created` like '$date%' and `verified`=1"));
- $totassurers += $assurers = mysql_num_rows(mysql_query("select `to` from `notary` where `when` like '$date%' and `method`!='Administrative Increase' group by `to` having sum(`points`) >= 100"));
- $certs = tc(mysql_query("select count(`id`) as `count` from `domaincerts` where `created` like '$date%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `emailcerts` where `created` like '$date%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `gpg` where `issued` like '$date%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgdomaincerts` where `created` like '$date%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgemailcerts` where `created` like '$date%'"));
- $totalcerts += $certs;
-
- $tmp_arr['new_users'] = number_format($users);
- $tmp_arr['new_assurers'] = number_format($assurers);
- $tmp_arr['new_certificates'] = number_format($certs);
-
- $stats['growth_last_12m'][] = $tmp_arr;
- }
- $stats['growth_last_12m_total'] = array('new_users' => number_format($totalusers),
- 'new_assurers' => number_format($totassurers),
- 'new_certificates' => number_format($totalcerts));
-
- $totalcerts = 0;
- $totalusers = 0;
- $totassurers = 0;
- for($i = date("Y"); $i >= 2002; $i--) {
- $tmp_arr = array();
- $tmp_arr['date'] = $i;
- $totalusers += $users = tc(mysql_query("select count(`id`) as `count` from `users` where `created` like '$i%' and `verified`=1"));
- $totassurers += $assurers = mysql_num_rows(mysql_query("select `to` from `notary` where `when` like '$i%' and `method`!='Administrative Increase' group by `to` having sum(`points`) >= 100"));
- $certs = tc(mysql_query("select count(`id`) as `count` from `domaincerts` where `created` like '$i%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `emailcerts` where `created` like '$i%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `gpg` where `issued` like '$i%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgdomaincerts` where `created` like '$i%'"));
- $certs += tc(mysql_query("select count(`id`) as `count` from `orgemailcerts` where `created` like '$i%'"));
- $totalcerts += $certs;
-
- $tmp_arr['new_users'] = number_format($users);
- $tmp_arr['new_assurers'] = number_format($assurers);
- $tmp_arr['new_certificates'] = number_format($certs);
-
- $stats['growth_last_years'][] = $tmp_arr;
- }
- $stats['growth_last_years_total'] = array('new_users' => number_format($totalusers),
- 'new_assurers' => number_format($totassurers),
- 'new_certificates' => number_format($totalcerts));
-
- return $stats;
- }
-
- $stats = getData();
-?>
-<h1>CAcert.org <?=_("Statistics")?></h1>
-
-<table align="center" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="2" class="title">CAcert.org <?=_("Statistics")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Verified Users")?>:</td>
- <td class="DataTD"><?=$stats['verified_users'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Verified Emails")?>:</td>
- <td class="DataTD"><?=$stats['verified_emails'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Verified Domains")?>:</td>
- <td class="DataTD"><?=$stats['verified_domains'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Certificates Issued")?>:</td>
- <td class="DataTD"><?=$stats['verified_certificates'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Valid Certificates")?>:</td>
- <td class="DataTD"><?=$stats['valid_certificates'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Assurances Made")?>:</td>
- <td class="DataTD"><?=$stats['assurances_made'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Users with 1-49 Points")?>:</td>
- <td class="DataTD"><?=$stats['users_1to49'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Users with 50-99 Points")?>:</td>
- <td class="DataTD"><?=$stats['users_50to99'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Assurer Candidates")?>:</td>
- <td class="DataTD"><?=$stats['assurer_candidates'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Assurers with test")?>:</td>
- <td class="DataTD"><?=$stats['aussurers_with_test'];?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Points Issued")?>:</td>
- <td class="DataTD"><?=$stats['points_issued'];?></td>
- </tr>
-</table>
-<br>
-<table align="center" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="4" class="title">CAcert.org <?=_("Growth in the last 12 months")?></td>
- </tr>
- <tr>
- <td class="DataTD"><b><?=_("Date")?></b>
- <td class="DataTD"><b><?=_("New Users")?></b>
- <td class="DataTD"><b><?=_("New Assurers")?></b>
- <td class="DataTD"><b><?=_("New Certificates")?></b>
- </tr>
-<?
- for($i = 0; $i < 12; $i++) {
-?>
- <tr>
- <td class="DataTD"><?=$stats['growth_last_12m'][$i]['date'];?></td>
- <td class="DataTD"><?=$stats['growth_last_12m'][$i]['new_users'];?></td>
- <td class="DataTD"><?=$stats['growth_last_12m'][$i]['new_assurers'];?></td>
- <td class="DataTD"><?=$stats['growth_last_12m'][$i]['new_certificates'];?></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD">N/A</td>
- <td class="DataTD"><?=$stats['growth_last_12m_total']['new_users'];?></td>
- <td class="DataTD"><?=$stats['growth_last_12m_total']['new_assurers'];?></td>
- <td class="DataTD"><?=$stats['growth_last_12m_total']['new_certificates'];?></td>
- </tr>
-</table>
-<br>
-<table align="center" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="4" class="title">CAcert.org <?=_("Growth by year")?></td>
- </tr>
- <tr>
- <td class="DataTD"><b><?=_("Date")?></b>
- <td class="DataTD"><b><?=_("New Users")?></b>
- <td class="DataTD"><b><?=_("New Assurers")?></b>
- <td class="DataTD"><b><?=_("New Certificates")?></b>
- </tr>
-<?
- for($i = 0; $i < count($stats['growth_last_years']); $i++) {
-?>
- <tr>
- <td class="DataTD"><?=$stats['growth_last_years'][$i]['date'];?></td>
- <td class="DataTD"><?=$stats['growth_last_years'][$i]['new_users'];?></td>
- <td class="DataTD"><?=$stats['growth_last_years'][$i]['new_assurers'];?></td>
- <td class="DataTD"><?=$stats['growth_last_years'][$i]['new_certificates'];?></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD">N/A</td>
- <td class="DataTD"><?=$stats['growth_last_years_total']['new_users'];?></td>
- <td class="DataTD"><?=$stats['growth_last_years_total']['new_assurers'];?></td>
- <td class="DataTD"><?=$stats['growth_last_years_total']['new_certificates'];?></td>
- </tr>
-</table>
-<br>
-<?php
- if (isset($stats['timestamp'])) {
-?>
-<div style="text-align: center;font-size: small;"><?=_("Statistical data from cache, created at ") . date('Y-m-d H:i:s', $stats['timestamp']);?></div>
-<?php
- }
-?>
-<? showfooter(); ?>
-
+<? /*
+ LibreSSL - CAcert web application
+ Copyright (C) 2004-2008 CAcert Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/
+
+ loadem("index");
+ showheader(_("Welcome to CAcert.org"));
+
+ /**
+ * get statistics data from current cache, return result of getDataFromLive if no cache file exists
+ * @return array
+ */
+ function getData() {
+ $sql = 'select * from `statscache` order by `timestamp` desc limit 1';
+ $res = mysql_query($sql);
+ if ($res && mysql_numrows($res) > 0) {
+ $ar = mysql_fetch_assoc($res);
+ $stats = unserialize($ar['cache']);
+ $stats['timestamp'] = $ar['timestamp'];
+ return $stats;
+ }
+
+ return null;
+ }
+
+ $stats = getData();
+ if ($stats === null) {
+ echo '<p>', _("Error while retrieving the statistics!"), '</p>';
+ showfooter();
+ die();
+ }
+?>
+<h1>CAcert.org <?=_("Statistics")?></h1>
+
+<table align="center" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="2" class="title">CAcert.org <?=_("Statistics")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Verified Users")?>:</td>
+ <td class="DataTD"><?=$stats['verified_users'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Verified Emails")?>:</td>
+ <td class="DataTD"><?=$stats['verified_emails'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Verified Domains")?>:</td>
+ <td class="DataTD"><?=$stats['verified_domains'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Certificates Issued")?>:</td>
+ <td class="DataTD"><?=$stats['verified_certificates'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Valid Certificates")?>:</td>
+ <td class="DataTD"><?=$stats['valid_certificates'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Assurances Made")?>:</td>
+ <td class="DataTD"><?=$stats['assurances_made'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Users with 1-49 Points")?>:</td>
+ <td class="DataTD"><?=$stats['users_1to49'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Users with 50-99 Points")?>:</td>
+ <td class="DataTD"><?=$stats['users_50to99'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Assurer Candidates")?>:</td>
+ <td class="DataTD"><?=$stats['assurer_candidates'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Assurers with test")?>:</td>
+ <td class="DataTD"><?=$stats['aussurers_with_test'];?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Points Issued")?>:</td>
+ <td class="DataTD"><?=$stats['points_issued'];?></td>
+ </tr>
+</table>
+<br>
+<table align="center" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="4" class="title">CAcert.org <?=_("Growth in the last 12 months")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><b><?=_("Date")?></b>
+ <td class="DataTD"><b><?=_("New Users")?></b>
+ <td class="DataTD"><b><?=_("New Assurers")?></b>
+ <td class="DataTD"><b><?=_("New Certificates")?></b>
+ </tr>
+<?
+ for($i = 0; $i < 12; $i++) {
+?>
+ <tr>
+ <td class="DataTD"><?=$stats['growth_last_12m'][$i]['date'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_12m'][$i]['new_users'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_12m'][$i]['new_assurers'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_12m'][$i]['new_certificates'];?></td>
+ </tr>
+<? } ?>
+ <tr>
+ <td class="DataTD"><?=_("Total")?></td>
+ <td class="DataTD"><?=$stats['growth_last_12m_total']['new_users'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_12m_total']['new_assurers'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_12m_total']['new_certificates'];?></td>
+ </tr>
+</table>
+<br>
+<table align="center" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="4" class="title">CAcert.org <?=_("Growth by year")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><b><?=_("Date")?></b>
+ <td class="DataTD"><b><?=_("New Users")?></b>
+ <td class="DataTD"><b><?=_("New Assurers")?></b>
+ <td class="DataTD"><b><?=_("New Certificates")?></b>
+ </tr>
+<?
+ for($i = 0; $i < count($stats['growth_last_years']); $i++) {
+?>
+ <tr>
+ <td class="DataTD"><?=$stats['growth_last_years'][$i]['date'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_years'][$i]['new_users'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_years'][$i]['new_assurers'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_years'][$i]['new_certificates'];?></td>
+ </tr>
+<? } ?>
+ <tr>
+ <td class="DataTD"><?=_("Total")?></td>
+ <td class="DataTD"><?=$stats['growth_last_years_total']['new_users'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_years_total']['new_assurers'];?></td>
+ <td class="DataTD"><?=$stats['growth_last_years_total']['new_certificates'];?></td>
+ </tr>
+</table>
+<br>
+
+<div style="text-align: center;font-size: small;"><?
+ printf(_("Last updated: %s"), date('Y-m-d H:i:s', $stats['timestamp']));?>
+</div>
+
+<? showfooter(); ?>
diff --git a/www/styles/default.css b/www/styles/default.css
index f2b3c95..4ddfbba 100644
--- a/www/styles/default.css
+++ b/www/styles/default.css
@@ -6,20 +6,22 @@
/***********************************************/
/* HTML tag styles */
/***********************************************/
-body{
+
+body {
font-family: Arial,sans-serif;
color: #333333;
- line-height: 1.166;
+ line-height: 1.166;
margin: 0px;
padding: 0px;
- background: #cccccc;
-/* url("/siteimages/bg_grad.jpg") fixed; */
+ background: #cccccc;
+/* url("/siteimages/bg_grad.jpg") fixed; */
}
+
/******* hyperlink and anchor tag styles *******/
a:link, a:visited {
- color: #005FA9;
+ color: #005fa9;
text-decoration: none;
}
@@ -27,85 +29,95 @@ a:hover {
text-decoration: underline;
}
+
/************** header tag styles **************/
-h1{
- font: bold 120% Arial,sans-serif;
- color: #334d55;
- margin: 0px;
- padding: 0px;
+h1 {
+ font: bold 120% Arial ,sans-serif;
+ color: #334d55;
+ margin: 0px;
+ padding: 0px;
}
-h2{
- font: bold 114% Arial,sans-serif;
- color: #006699;
- margin: 0px;
- padding: 0px;
+h2 {
+ font: bold 114% Arial ,sans-serif;
+ color: #006699;
+ margin: 0px;
+ padding: 0px;
}
-h3{
- font: bold 100% Arial,sans-serif;
- color: #334d55;
- margin: 0px;
- padding: 0px;
+h3 {
+ font: bold 100% Arial ,sans-serif;
+ color: #334d55;
+ margin: 0px;
+ padding: 0px;
}
-h3.pointer{
- cursor: pointer;
- /* cursor: hand; */
+h3.pointer {
+ cursor: pointer;
+ /* cursor: hand; */
}
-h4{
- font: bold 100% Arial,sans-serif;
- color: #333333;
- margin: 0px;
- padding: 0px;
+h4 {
+ font: bold 100% Arial ,sans-serif;
+ color: #333333;
+ margin: 0px;
+ padding: 0px;
}
-h5{
- font: 100% Arial,sans-serif;
- color: #334d55;
- margin: 0px;
- padding: 0px;
+h5 {
+ font: 100% Arial ,sans-serif;
+ color: #334d55;
+ margin: 0px;
+ padding: 0px;
}
/*************** list tag styles ***************/
ul.menu {
-list-style: none;
-margin :0px 0px 0px 15px;
-padding-left: 5px;
-border-left: 1px dotted #000;
+ list-style: none;
+ margin: 0px 0px 0px 15px;
+ padding-left: 5px;
+ border-left: 1px dotted #000;
}
ul.top {
-list-style: none;
-margin: 0px 0px 0px 15px;
-padding-left: 5px;
-border-left: 0px;
+ list-style: none;
+ margin: 0px 0px 0px 15px;
+ padding-left: 5px;
+ border-left: 0px;
}
ul.no_indent {
-list-style: none;
-padding: 0px;
+ list-style: none;
+ padding: 0px;
+}
+
+.attach_ul {
+ margin-bottom: 0px;
}
+.attach_ul + ul {
+ margin-top: 0px;
+}
+
+
/***********************************************/
/* Layout Divs */
/***********************************************/
-#pagecell1{
- position:absolute;
+
+#pagecell1 {
+ position: absolute;
top: 2%;
left: 2%;
right: 2%;
width: 96%;
background-color: #ffffff;
-
}
#tl {
- position:absolute;
+ position: absolute;
top: -1px;
left: -1px;
margin: 0px;
@@ -114,7 +126,7 @@ padding: 0px;
}
#tr {
- position:absolute;
+ position: absolute;
top: -1px;
right: -1px;
margin: 0px;
@@ -122,43 +134,43 @@ padding: 0px;
z-index: 100;
}
-#masthead{
+#masthead {
position: absolute;
top: 0px;
left: 2%;
right: 2%;
- width:95.6%;
-
+ width: 95.6%;
}
-#pageNav{
+#pageNav {
float: right;
- width:178px;
+ width: 178px;
padding: 0px;
background-color: #F5f7f7;
border-left: 1px solid #cccccc;
font: small Verdana,sans-serif;
}
-#content{
+#content {
padding: 0px 10px 0px 0px;
- margin:0px 178px 0px 0px;
+ margin: 0px 178px 0px 0px;
}
/***********************************************/
/* Component Divs */
/***********************************************/
-#siteName{
+#siteName {
margin: 0px;
padding: 16px 0px 8px 0px;
color: #ffffff;
font-weight: normal;
}
+
/************** utility styles *****************/
-#utility{
+#utility {
font: 75% Verdana,sans-serif;
position: absolute;
top: 16px;
@@ -166,7 +178,7 @@ padding: 0px;
color: #919999;
}
-#utility a{
+#utility a {
color: #ffffff;
}
@@ -174,46 +186,48 @@ padding: 0px;
text-decoration: underline;
}
+
/************** pageName styles ****************/
-#pageName{
+#pageName {
padding: 0px 0px 14px 10px;
margin: 0px;
- border-bottom:1px solid #ccd2d2;
+ border-bottom: 1px solid #ccd2d2;
z-index: 2;
}
-#pageName h2{
+#pageName h2 {
font: bold 175% Arial,sans-serif;
color: #000000;
- margin:0px;
+ margin: 0px;
padding: 0px;
}
+
/*
#pageLogo {
- position: absolute;
- top: 8px;
- left: 10px;
- z-index: 5;
+ position: absolute;
+ top: 8px;
+ left: 10px;
+ z-index: 5;
}
*/
+
/************* globalNav styles ****************/
-#globalNav{
-position: relative;
-width: 100%;
-min-width: 640px;
-height: 32px;
-color: #cccccc;
-padding: 0px;
-margin: 0px;
-background-image: url("siteimages/glbnav_background.gif");
+#globalNav {
+ position: relative;
+ width: 100%;
+ min-width: 640px;
+ height: 32px;
+ color: #cccccc;
+ padding: 0px;
+ margin: 0px;
+ background-image: url("siteimages/glbnav_background.gif");
}
-#globalNav img{
+#globalNav img {
margin-bottom: -4px;
-
}
#gnl {
@@ -228,7 +242,7 @@ background-image: url("siteimages/glbnav_background.gif");
right:0px;
}
-#globalLink{
+#globalLink {
position: absolute;
top: 6px;
height: 22px;
@@ -241,24 +255,27 @@ background-image: url("siteimages/glbnav_background.gif");
a.glink, a.glink:visited {
- font-size: small;
- color: #000000;
+ font-size: small;
+ color: #000000;
font-weight: bold;
margin: 0px;
padding: 2px 5px 4px 5px;
- border-right: 1px solid #8FB8BC;
+ border-right: 1px solid #8fb8bc;
}
a.glink:hover {
- background-image: url("siteimages/glblnav_selected.gif");
+ background-image: url("siteimages/glblnav_selected.gif");
text-decoration: none;
}
-.skipLinks {display: none;}
+.skipLinks {
+ display: none;
+}
+
/************ subglobalNav styles **************/
-.subglobalNav{
+.subglobalNav {
position: absolute;
top: 84px;
left: 0px;
@@ -279,13 +296,15 @@ a.glink:hover {
color: #cccccc;
}
+
/*************** search styles *****************/
/*
#listshow {
z-order: 101;
}
*/
-#search{
+
+#search {
position: absolute;
top: 125px;
right: 0px;
@@ -300,46 +319,46 @@ a.glink:hover {
font-size: 11px;
}
-#search1{
+#search1 {
position: absolute;
top: 85px;
right: 300px;
}
-#search2{
+#search2 {
position: absolute;
top: 100px;
right: 300px;
}
-#search3{
+#search3 {
position: absolute;
top: 85px;
right: 240px;
}
-#search4{
+#search4 {
position: absolute;
top: 100px;
right: 226px;
}
-#googlead{
+#googlead {
position: absolute;
top: 5px;
right: 0px;
z-index: -10;
}
-#search input{
- font-size: 70%;
- margin: 0px 0px 0px 10px;
+#search input {
+ font-size: 70%;
+ margin: 0px 0px 0px 10px;
}
-
+
#search a:link, #search a:visited {
font-size: 80%;
font-weight: bold;
-
+
}
#search a:hover {
@@ -349,40 +368,42 @@ a.glink:hover {
/************* breadCrumb styles ***************/
-#breadCrumb{
+#breadCrumb {
padding: 5px 0px 5px 10px;
font: small Verdana,sans-serif;
- color: #AAAAAA;
+ color: #aaaaaa;
}
-#breadCrumb a{
- color: #AAAAAA;
+#breadCrumb a {
+ color: #aaaaaa;
}
#breadCrumb a:hover {
- color: #005FA9;
+ color: #005fa9;
text-decoration: underline;
}
/************** feature styles *****************/
-.feature{
+.feature {
padding: 0px 0px 10px 10px;
font-size: 80%;
min-height: 200px;
height: 200px;
}
-.feature {height: auto;}
+.feature {
+ height: auto;
+}
-.feature h3{
+.feature h3 {
font: bold 175% Arial,sans-serif;
color: #000000;
padding: 30px 0px 5px 0px;
}
-.feature img{
+.feature img {
float: left;
padding: 0px 10px 0px 0px;
}
@@ -396,19 +417,15 @@ a.glink:hover {
min-height: 450px;
}
-.story h3{
+.story h3 {
font: bold 125% Arial,sans-serif;
color: #000000;
}
-.story p {
- padding: 0px 0px 10px 0px;
-}
-
-.story a.capsule{
+.story a.capsule {
font: bold 1em Arial,sans-serif;
color: #005FA9;
- display:block;
+ display: block;
padding-bottom: 5px;
}
@@ -416,14 +433,14 @@ a.glink:hover {
text-decoration: underline;
}
-td.storyLeft{
+td.storyLeft {
padding-right: 12px;
}
/************** siteInfo styles ****************/
-#siteInfo{
+#siteInfo {
clear: both;
border-top: 1px solid #cccccc;
font-size: small;
@@ -431,15 +448,15 @@ td.storyLeft{
padding: 10px 10px 10px 10px;
}
+
/************ sectionLinks styles **************/
-#sectionLinks{
+#sectionLinks {
margin: 0px;
padding: 0px;
-
}
-#sectionLinks h3{
+#sectionLinks h3 {
padding: 10px 0px 2px 10px;
border-bottom: 1px solid #cccccc;
}
@@ -448,7 +465,7 @@ td.storyLeft{
display: block;
border-top: 1px solid #ffffff;
border-bottom: 1px solid #cccccc;
- background-image: url("siteimages/bg_nav.jpg");
+ background-image: url("siteimages/bg_nav.jpg");
font-weight: bold;
padding: 3px 0px 3px 10px;
color: #21536A;
@@ -465,85 +482,99 @@ td.storyLeft{
/************* relatedLinks styles **************/
-.relatedLinks{
+.relatedLinks {
margin: 0px;
padding: 0px 0px 10px 10px;
border-bottom: 1px solid #cccccc;
}
-.relatedLinks h3{
+.relatedLinks h3 {
padding: 10px 0px 2px 0px;
}
-.relatedLinks a{
- display: block;
+.relatedLinks a {
+ display: block;
}
/**************** advert styles *****************/
-#advert{
+#advert {
padding: 10px;
}
-#advert img{
+#advert img {
display: block;
}
+
/********************* end **********************/
.DataTD input, .DataTD textarea {
- FONT-SIZE: 92%;
+ font-size: 92%;
}
.DataTD select, .DataTD option {
- FONT-SIZE: 92%;
+ font-size: 92%;
}
.DataTD {
- background-color: #E2E2E2;
+ background-color: #e2e2e2;
border-style: inset;
border-width: 1px;
- FONT-SIZE: 8pt;
- COLOR: #000000;
- FONT-FAMILY: Arial, Tahoma, Verdana, Helvetica, sans-serif;
+ font-size: 8pt;
+ color: #000000;
+ font-family: Arial, Tahoma, Verdana, Helvetica, sans-serif;
background: #ffffff;
padding: 1px 5px 1px 5px;
- border: 1px #CFCFCF solid;
- border-left: 1px #CFCFCF dotted;
- border-right: 1px #CFCFCF dotted;
+ border: 1px #cfcfcf solid;
+ border-left: 1px #cfcfcf dotted;
+ border-right: 1px #cfcfcf dotted;
}
.DataTDGrey {
background-color: #EFEDED;
border-style: inset;
border-width: 1px;
- FONT-SIZE: 8pt;
- COLOR: #000000;
- FONT-FAMILY: Arial, Tahoma, Verdana, Helvetica, sans-serif;
+ font-size: 8pt;
+ color: #000000;
+ font-family: Arial, Tahoma, Verdana, Helvetica, sans-serif;
padding: 1px 5px 1px 5px;
border: 1px #CFCFCF solid;
- border-left: 1px #CFCFCF dotted;
- border-right: 1px #CFCFCF dotted;
+ border-left: 1px #cfcfcf dotted;
+ border-right: 1px #cfcfcf dotted;
}
.DataTDNotDotted {
- background-color: #E2E2E2;
+ background-color: #e2e2e2;
border-style: inset;
border-width: 1px;
- FONT-SIZE: 8pt;
- COLOR: #000000;
- FONT-FAMILY: Arial, Tahoma, Verdana, Helvetica, sans-serif;
+ font-size: 8pt;
+ color: #000000;
+ font-family: Arial, Tahoma, Verdana, Helvetica, sans-serif;
background: #ffffff;
padding: 1px 5px 1px 5px;
border: 1px #CFCFCF solid;
- border-left: 1px #CFCFCF solid;
- border-right: 1px #CFCFCF solid;
+ border-left: 1px #cfcfcf solid;
+ border-right: 1px #cfcfcf solid;
}
+.DataTDError {
+ border-style: inset;
+ border-width: 1px;
+ font-size: 8pt;
+ color: #ff0000;
+ font-family: Arial, Tahoma, Verdana, Helvetica, sans-serif;
+
+ background: #ffffff;
+ padding: 1px 5px 1px 5px;
+ border: 1px #cfcfcf solid;
+ border-left: 1px #cfcfcf dotted;
+ border-right: 1px #cfcfcf dotted;
+}
.wrapper {
border-collapse: collapse;
font-family: verdana, sans-serif;
@@ -552,104 +583,147 @@ td.storyLeft{
}
td.greytxt {
- color: #CCCCCC;
+ color: #cccccc;
font-size: smaller;
text-align: right;
vertical-align: bottom;
}
-
+.bold, .primaryemailaddress {
+ font-weight:bold;
+}
+.italic, .deletedemailaddress {
+ font-style:italic;
+}
.title {
- background: #E2E2E2;
- font-weight:BOLD;
+ background: #e2e2e2;
+ font-weight: bold;
padding: 1px 5px 1px 5px;
- border: 1px solid #CFCFCF;
- border-bottom: 3px double #CFCFCF;
+ border: 1px solid #cfcfcf;
+ border-bottom: 3px double #cfcfcf;
border-top: 1px solid #656565;
text-align: center;
}
.errmsg {
- font-weight: BOLD;
+ font-weight: bold;
color: #FF0000;
}
-.ac_menu
-{
- border:1px solid black
+.ac_menu {
+ border: 1px solid black
}
-.ac_normal
-{
- background-color:#ffffff;
- cursor:pointer;
+
+.ac_normal {
+ background-color: #ffffff;
+ cursor: pointer;
}
-.ac_highlight
-{
- background-color:#3366cc;
- color:white;
- cursor:pointer;
+
+.ac_highlight {
+ background-color: #3366cc;
+ color: white;
+ cursor: pointer;
}
-.ac_normal .a
-{
- font-size:13px;
- color:black;
+
+.ac_normal .a {
+ font-size: 13px;
+ color: black;
}
-.ac_highlight .a
-{
- font-size:13px;
+
+.ac_highlight .a {
+ font-size: 13px;
}
-.ac_normal .d
-{
- float:right;
- font-size:10px;
- color:green;
+
+.ac_normal .d {
+ float: right;
+ font-size: 10px;
+ color: green;
}
-.ac_highlight .d
-{
- float:right;
- font-size:10px;
+
+.ac_highlight .d {
+ float: right;
+ font-size: 10px;
}
+
/************** sponsorInfo styles ****************/
div.sponsorinfo {
- clear: both;
- border-top: 1px solid #cccccc;
- font-size: small;
- color: #000000;
- padding: 10px 10px 10px 10px;
+ clear: both;
+ border-top: 1px solid #cccccc;
+ font-size: small;
+ color: #000000;
+ padding: 10px 10px 10px 10px;
}
img.sponsorlogo {
- margin-left: 10px;
- margin-right: 10px;
- border: 0px none;
- vertical-align: middle;
+ margin-left: 10px;
+ margin-right: 10px;
+ border: 0px none;
+ vertical-align: middle;
}
+
/************ Newsbox *************/
-#lnews { /* class for the text "Latest News" */
- font-size: small;
- font-variant: small-caps;
+#lnews { /* class for the text "Latest News" */
+ font-size: small;
+ font-variant: small-caps;
}
div.newsbox {
- border-top: 1px solid #cccccc;
- color: #101010;
- padding: 10px 10px 10px 10px;
+ border-top: 1px solid #cccccc;
+ color: #101010;
+ padding: 10px 10px 10px 10px;
}
+
/************ SQL Performance ***********/
div.footerbar {
- clear: both;
- border-top: 1px solid #cccccc;
- font-size: small;
- color: black;
- padding: 10px 10px 10px 10px;
+ clear: both;
+ border-top: 1px solid #cccccc;
+ font-size: small;
+ color: black;
+ padding: 10px 10px 10px 10px;
}
+
/************ Honeypot ***********/
-.robotic { display: none; }
+.robotic {
+ display: none;
+}
+
+/************ unicode fallbacks ***********/
+
+/* Some embedding of font */
+@font-face {
+ font-family: 'Source Code Pro';
+ src: local('Source Code Pro');
+/* src: url(/res/fonts/SourceCodePro-Medium.ttf); */
+}
+
+@font-face {
+ font-family: 'Last Resort';
+ src: local('LastResort');
+/* src: url(/res/fonts/LastResort.ttf); */
+}
+
+.accountdetail {
+ font-family: 'Source Code Pro', 'Lucida Console', 'Arial Unicode MS', monospace, 'Last Resort';
+ font-size: 1.1em;
+}
+
+.accountdetail.fname {
+}
+
+.accountdetail.mname {
+}
+
+.accountdetail.lname {
+ font-weight: bold;
+}
+
+.accountdetail.suffix {
+}
diff --git a/www/wot.php b/www/wot.php
index 858f81b..35dce1f 100644
--- a/www/wot.php
+++ b/www/wot.php
@@ -18,6 +18,7 @@
<?
require_once("../includes/loggedin.php");
require_once("../includes/lib/l10n.php");
+require_once("../includes/notary.inc.php");
function show_page($target,$message,$error)
@@ -113,9 +114,6 @@ function send_reminder()
$_SESSION['_config']['error'] = _("A reminder notice has been sent.");
}
-
-
-
loadem("account");
if(array_key_exists('date',$_POST) && $_POST['date'] != "")
$_SESSION['_config']['date'] = $_POST['date'];
@@ -127,16 +125,16 @@ function send_reminder()
if($oldid == 12)
$id = $oldid;
-
+
if($oldid == 4)
{
if ($_POST['ttp']!='') {
//This mail does not need to be translated
$body = "Hi TTP adminstrators,\n\n";
$body .= "User ".$_SESSION['profile']['fname']." ".
- $_SESSION['profile']['lname']." with email address '".
- $_SESSION['profile']['email']."' is requesting a TTP assurances for ".
- mysql_escape_string(stripslashes($_POST['country'])).".\n\n";
+ $_SESSION['profile']['lname']." with email address '".
+ $_SESSION['profile']['email']."' is requesting a TTP assurances for ".
+ mysql_escape_string(stripslashes($_POST['country'])).".\n\n";
if ($_POST['ttptopup']=='1') {
$body .= "The user is also requesting TTP TOPUP.\n\n";
}else{
@@ -199,6 +197,17 @@ function send_reminder()
show_page("EnterEmail","",_("User is not yet verified. Please try again in 24 hours!"));
exit;
}
+ if ($_SESSION['profile']['ttpadmin'] != 1) {
+ $_SESSION['assuresomeone']['year'] = intval($_POST['year']);
+ $_SESSION['assuresomeone']['month'] = intval($_POST['month']);
+ $_SESSION['assuresomeone']['day'] = intval($_POST['day']);
+ $dob = sprintf('%04d-%02d-%02d', $_SESSION['assuresomeone']['year'], $_SESSION['assuresomeone']['month'], $_SESSION['assuresomeone']['day']);
+
+ if ( $_SESSION['_config']['notarise']['dob'] != $dob) {
+ show_page("EnterEmail","",_("The data entered is not matching with an account."));
+ exit;
+ }
+ }
}
$query = "select * from `users` where `email`='".mysql_escape_string(stripslashes($_POST['email']))."' and `locked`=1";
$res = mysql_query($query);
@@ -225,8 +234,8 @@ function send_reminder()
exit;
}
- $query = "select * from `notary` where `from`='".$_SESSION['profile']['id']."' and
- `to`='".$_SESSION['_config']['notarise']['id']."'";
+ $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and
+ `to`='".intval($_SESSION['_config']['notarise']['id'])."' and `deleted` = 0";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -237,42 +246,84 @@ function send_reminder()
if($oldid == 6)
{
-$iecho= "c";
+ $iecho= "c";
+ //date checks
+ if(trim($_REQUEST['date']) == '')
+ {
+ show_page("VerifyData","",_("You must enter the date when you met the assuree."));
+ exit;
+ }
+
+ if(!check_date_format(trim($_REQUEST['date'])))
+ {
+ show_page("VerifyData","",_("You must enter the date in this format: YYYY-MM-DD."));
+ exit;
+ }
+
+ if(!check_date_difference(trim($_REQUEST['date'])))
+ {
+ show_page("VerifyData","",_("You must not enter a date in the future."));
+ exit;
+ }
+
+ //proof of identity check and accept arbitration, implements CCA
if(!array_key_exists('assertion',$_POST) || $_POST['assertion'] != 1)
{
show_page("VerifyData","",_("You failed to check all boxes to validate your adherence to the rules and policies of CAcert"));
exit;
}
-/* if(!array_key_exists('rules',$_POST) || $_POST['rules'] != 1)
+ //proof of CCA agreement by assuree after 2010-01-01
+ if((!array_key_exists('CCAAgreed',$_POST) || $_POST['CCAAgreed'] != 1) and (check_date_format(trim($_REQUEST['date']),2010)))
{
show_page("VerifyData","",_("You failed to check all boxes to validate your adherence to the rules and policies of CAcert"));
exit;
}
-*/
- if((!array_key_exists('certify',$_POST) || $_POST['certify'] != 1 ) && $_SESSION['profile']['ttpadmin'] != 1)
+ //assurance done according to rules
+ if(!array_key_exists('rules',$_POST) || $_POST['rules'] != 1)
{
show_page("VerifyData","",_("You failed to check all boxes to validate your adherence to the rules and policies of CAcert"));
exit;
}
- if($_SESSION['profile']['ttpadmin'] != 1 && $_POST['location'] == "")
+ //met assuree in person, not appliciable for TTP / TTP Topup assurances
+ if((!array_key_exists('certify',$_POST) || $_POST['certify'] != 1 ) && $_REQUEST['method'] != "Trusted 3rd Parties")
+ {
+ show_page("VerifyData","",_("You failed to check all boxes to validate your adherence to the rules and policies of CAcert"));
+ exit;
+ }
+
+ //check location, min 3 characters
+ if(!array_key_exists('location',$_POST) || trim($_POST['location']) == "")
{
show_page("VerifyData","",_("You failed to enter a location of your meeting."));
exit;
}
+ if(strlen(trim($_REQUEST['location']))<=2)
+ {
+ show_page("VerifyData","",_("You must enter a location with at least 3 characters eg town and country."));
+ exit;
+ }
+
+ //check for points in range 0-35, for nucleus 35 + 15 temporary
if($_REQUEST['points'] == "" || !is_numeric($_REQUEST['points']))
{
show_page("VerifyData","",_("You must enter the number of points you wish to allocate to this person."));
exit;
}
- $query = "select * from `users` where `id`='".$_SESSION['_config']['notarise']['id']."'";
+ if($_REQUEST['points'] <0 || ($_REQUEST['points']>35))
+ {
+ show_page("VerifyData","",_("The number of points you entered are out of the range given by policy."));
+ exit;
+ }
+
+ $query = "select * from `users` where `id`='".intval($_SESSION['_config']['notarise']['id'])."'";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
- $name = $row['fname']." ".$row['mname']." ".$row['lname']." ".$row['suffix'];
+ $name = sanitizeHTML($row['fname'])." ".sanitizeHTML($row['mname'])." ".sanitizeHTML($row['lname'])." ".sanitizeHTML($row['suffix']);
if($_SESSION['_config']['wothash'] != md5($name."-".$row['dob']) || $_SESSION['_config']['wothash'] != $_REQUEST['pagehash'])
{
show_page("VerifyData","",_("Race condition discovered, user altered details during assurance procedure. PLEASE MAKE SURE THE NEW DETAILS BELOW MATCH THE ID DOCUMENTS."));
@@ -291,7 +342,7 @@ $iecho= "c";
if($newpoints < 0)
$newpoints = $awarded = 0;
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['_config']['notarise']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['_config']['notarise']['id'])."' and `deleted` = 0 group by `to`";
$res = mysql_query($query);
$drow = mysql_fetch_assoc($res);
@@ -304,40 +355,42 @@ $iecho= "c";
if($newpoints < 0)
$newpoints = 0;
- if(mysql_escape_string(stripslashes($_POST['date'])) == "")
+ if(mysql_real_escape_string(stripslashes($_POST['date'])) == "")
$_POST['date'] = date("Y-m-d H:i:s");
- $query = "select * from `notary` where `from`='".$_SESSION['profile']['id']."' AND
- `to`='".$_SESSION['_config']['notarise']['id']."' AND
- `awarded`='$awarded' AND
- `location`='".mysql_escape_string(stripslashes($_POST['location']))."' AND
- `date`='".mysql_escape_string(stripslashes($_POST['date']))."'";
+ $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' AND
+ `to`='".intval($_SESSION['_config']['notarise']['id'])."' AND
+ `awarded`='".intval($awarded)."' AND
+ `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."' AND
+ `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."' AND
+ `deleted`=0";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
- show_page("VerifyEmail","",_("Identical Assurance attempted, will not continue."));
+ show_page("VerifyEmail","",_("Identical Assurance attempted, will not continue."));
exit;
}
}
if($oldid == 6)
{
- $query = "insert into `notary` set `from`='".$_SESSION['profile']['id']."',
- `to`='".$_SESSION['_config']['notarise']['id']."',
- `points`='$newpoints', `awarded`='$awarded',
- `location`='".mysql_escape_string(stripslashes($_POST['location']))."',
- `date`='".mysql_escape_string(stripslashes($_POST['date']))."',
+ $query = "insert into `notary` set `from`='".intval($_SESSION['profile']['id'])."',
+ `to`='".intval($_SESSION['_config']['notarise']['id'])."',
+ `points`='".intval($newpoints)."', `awarded`='".intval($awarded)."',
+ `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."',
+ `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."',
`when`=NOW()";
+ //record active acceptance by Assurer
+ if (check_date_format(trim($_REQUEST['date']),2010)) {
+ write_user_agreement($_SESSION['profile']['id'], "CCA", "assurance", "Assuring", 1, $_SESSION['_config']['notarise']['id']);
+ write_user_agreement($_SESSION['_config']['notarise']['id'], "CCA", "assurance", "Being assured", 0, $_SESSION['profile']['id']);
+ }
if($_SESSION['profile']['ttpadmin'] == 1 && ($_POST['method'] == 'Trusted 3rd Parties' || $_POST['method'] == 'Trusted Third Parties')) {
$query .= ",\n`method`='TTP-Assisted'";
}
mysql_query($query);
fix_assurer_flag($_SESSION['_config']['notarise']['id']);
include_once("../includes/notary.inc.php");
-/*to be activated after CCA accept option is implemented in form
- write_user_agreement($_SESSION['profile']['id'], "CCA", "assurance", "Assuring", 1, $_SESSION['_config']['notarise']['id']);}*/
-/* to be activated after the CCA recording is announced
- write_user_agreement($_SESSION['_config']['notarise']['id'], "CCA", "assurance", "Being assured", 0, $_SESSION['profile']['id']); */
if($_SESSION['profile']['points'] < 150)
{
@@ -346,11 +399,11 @@ $iecho= "c";
$addpoints = 2;
else if($_SESSION['profile']['points'] == 149 && $_SESSION['profile']['points'] >= 100)
$addpoints = 1;
- $query = "insert into `notary` set `from`='".$_SESSION['profile']['id']."',
- `to`='".$_SESSION['profile']['id']."',
- `points`='$addpoints', `awarded`='$addpoints',
- `location`='".mysql_escape_string(stripslashes($_POST['location']))."',
- `date`='".mysql_escape_string(stripslashes($_POST['date']))."',
+ $query = "insert into `notary` set `from`='".intval($_SESSION['profile']['id'])."',
+ `to`='".intval($_SESSION['profile']['id'])."',
+ `points`='".intval($addpoints)."', `awarded`='".intval($addpoints)."',
+ `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."',
+ `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."',
`method`='Administrative Increase',
`when`=NOW()";
mysql_query($query);
@@ -400,35 +453,7 @@ $iecho= "c";
sendmail($_SESSION['profile']['email'], "[CAcert.org] "._("You've Assured Another Member."), $body, "support@cacert.org", "", "", "CAcert Support");
- showheader(_("My CAcert.org Account!"));
- echo "<p>"._("Shortly you and the person you were assuring will receive an email confirmation. There is no action on your behalf required to complete this.")."</p>";
-?><form method="post" action="wot.php">
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="2" class="title"><?=_("Assure Someone")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Email")?>:</td>
- <td class="DataTD"><input type="text" name="email" id="email" value=""></td>
- </tr>
- <tr>
- <td class="DataTD" colspan="2"><input type="submit" name="process" value="<?=_("Next")?>"></td>
- </tr>
-</table>
-<input type="hidden" name="oldid" value="5">
-</form>
-<SCRIPT LANGUAGE="JavaScript">
-//<![CDATA[
- function my_init()
- {
- document.getElementById("email").focus();
- }
-
- window.onload = my_init();
-//]]>
-</script>
-<?
- showfooter();
+ show_page('EnterEmail', _("Shortly you and the person you were assuring will receive an email confirmation. There is no action on your behalf required to complete this."));
exit;
}
@@ -436,7 +461,7 @@ $iecho= "c";
{
csrf_check("chgcontact");
- $info = mysql_escape_string(strip_tags(stripslashes($_POST['contactinfo'])));
+ $info = mysql_real_escape_string(strip_tags(stripslashes($_POST['contactinfo'])));
$listme = intval($_POST['listme']);
if($listme < 0 || $listme > 1)
$listme = 0;
@@ -444,7 +469,7 @@ $iecho= "c";
$_SESSION['profile']['listme'] = $listme;
$_SESSION['profile']['contactinfo'] = $info;
- $query = "update `users` set `listme`='$listme',`contactinfo`='$info' where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `listme`='$listme',`contactinfo`='$info' where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
showheader(_("My CAcert.org Account!"));
@@ -465,9 +490,9 @@ $iecho= "c";
$body = $_REQUEST['message'];
$subject = $_REQUEST['subject'];
$userid = intval($_REQUEST['userid']);
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$userid' and `listme`=1"));
- $points = mysql_num_rows(mysql_query("select sum(`points`) as `total` from `notary`
- where `to`='".$user['id']."' group by `to` HAVING SUM(`points`) > 0"));
+ $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($userid)."' and `listme`=1"));
+ $points = mysql_num_rows(mysql_query("select sum(`points`) as `total` from `notary`
+ where `to`='".intval($user['id'])."' and `deleted` = 0 group by `to` HAVING SUM(`points`) > 0"));
if($points > 0)
{
$my_translation = L10n::get_translation();
@@ -503,7 +528,7 @@ $iecho= "c";
showheader(_("My CAcert.org Account!"));?>
<p>
- <? printf(_("Your email has been sent to %s."), $user['fname']); ?>
+ <? printf(_("Your email has been sent to %s."), sanitizeHTML($user['fname'])); ?>
</p>
<p>[ <a href='javascript:history.go(-2)'><?= _("Go Back") ?></a> ]</p>
<?