summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--CommModule/.gitignore19
-rwxr-xr-xCommModule/client.pl12
-rwxr-xr-xCommModule/serial.conf32
-rwxr-xr-xCommModule/usbclient.pl2
-rw-r--r--README17
-rw-r--r--README.md19
-rw-r--r--config/ttp.ini6
-rw-r--r--crt/DIR1
-rw-r--r--csr/DIR1
-rw-r--r--includes/account.php738
-rw-r--r--includes/account_stuff.php110
-rw-r--r--includes/general.php59
-rw-r--r--includes/general_stuff.php12
-rw-r--r--includes/lib/account.php72
-rw-r--r--includes/lib/check_weak_key.php95
-rw-r--r--includes/lib/general.php41
-rw-r--r--includes/lib/l10n.php21
-rw-r--r--includes/loggedin.php79
-rw-r--r--includes/notary.inc.php1574
-rw-r--r--locale/Makefile2
-rw-r--r--pages/account/10.php65
-rw-r--r--pages/account/12.php29
-rw-r--r--pages/account/13.php30
-rw-r--r--pages/account/15.php2
-rw-r--r--pages/account/16.php102
-rw-r--r--pages/account/18.php9
-rw-r--r--pages/account/19.php2
-rw-r--r--pages/account/20.php61
-rw-r--r--pages/account/21.php4
-rw-r--r--pages/account/22.php10
-rw-r--r--pages/account/23.php2
-rw-r--r--pages/account/24.php62
-rw-r--r--pages/account/27.php50
-rw-r--r--pages/account/3.php131
-rw-r--r--pages/account/41.php2
-rw-r--r--pages/account/43.php1873
-rw-r--r--pages/account/44.php27
-rw-r--r--pages/account/49.php13
-rw-r--r--pages/account/5.php39
-rw-r--r--pages/account/52.php107
-rw-r--r--pages/account/53.php2
-rw-r--r--pages/account/54.php2
-rw-r--r--pages/account/55.php234
-rw-r--r--pages/account/56.php82
-rw-r--r--pages/account/57.php48
-rw-r--r--pages/account/58.php4
-rw-r--r--pages/account/59.php385
-rw-r--r--pages/account/6.php16
-rw-r--r--pages/gpg/2.php19
-rw-r--r--pages/index/0.php6
-rw-r--r--pages/index/1.php70
-rw-r--r--pages/index/10.php2
-rw-r--r--pages/index/16.php2
-rw-r--r--pages/index/3.php4
-rw-r--r--pages/index/52.php32
-rw-r--r--pages/index/feed.rss47
-rw-r--r--pages/wot/1.php22
-rw-r--r--pages/wot/10.php30
-rw-r--r--pages/wot/12.php6
-rw-r--r--pages/wot/13.php6
-rw-r--r--pages/wot/15.php2
-rw-r--r--pages/wot/16.php143
-rw-r--r--pages/wot/4.php15
-rw-r--r--pages/wot/5.php47
-rw-r--r--pages/wot/6.php26
-rw-r--r--pages/wot/9.php34
-rwxr-xr-xscripts/cron/refresh_stats.php55
-rwxr-xr-xscripts/cron/warning.php6
-rwxr-xr-xscripts/db_migrations/version5.sh249
-rw-r--r--scripts/gpgfillmissingemail.php4
-rwxr-xr-xscripts/scanforexponents.php5
-rwxr-xr-xscripts/send_heartbleed.php248
-rw-r--r--stamp/common.php6
-rw-r--r--tverify/index.php10
-rw-r--r--www/.gitignore5
-rw-r--r--www/.htaccess2
-rw-r--r--www/alert_hash_collision.php8
-rw-r--r--www/api/ccsr.php24
-rw-r--r--www/api/cemails.php13
-rw-r--r--www/api/edu.php2
l---------www/cacert1-class3-revoke.crl1
l---------www/cacert1-revoke.crl1
-rw-r--r--www/cap.html.php4
-rw-r--r--www/cap.php6
-rw-r--r--www/capnew.php52
-rw-r--r--www/cats/cats_import.php6
-rw-r--r--www/certs/cacert.asc55
-rw-r--r--www/certs/class3.crt81
-rw-r--r--www/certs/class3.derbin1885 -> 1926 bytes
-rw-r--r--www/certs/class3.txt227
-rw-r--r--www/certs/root.crt80
-rw-r--r--www/certs/root.derbin1857 -> 1963 bytes
-rw-r--r--www/certs/root.txt241
-rw-r--r--www/coap.html.php14
-rw-r--r--www/coapnew.php64
-rw-r--r--www/disputes.php28
-rw-r--r--www/gpg.php38
-rw-r--r--www/images/cacert4.pngbin6421 -> 17565 bytes
-rw-r--r--www/index.php139
-rw-r--r--www/policy/AssurancePolicy.html750
-rw-r--r--www/policy/AssurancePolicy.php727
-rw-r--r--www/policy/CAcertCommunityAgreement.html531
-rw-r--r--www/policy/CAcertCommunityAgreement.php516
-rw-r--r--www/policy/CertificationPracticeStatement.html4543
-rw-r--r--www/policy/CertificationPracticeStatement.php4091
-rw-r--r--www/policy/DisputeResolutionPolicy.html678
-rw-r--r--www/policy/DisputeResolutionPolicy.php798
-rw-r--r--www/policy/NRPDisclaimerAndLicence.html19
-rw-r--r--www/policy/NRPDisclaimerAndLicence.php18
-rw-r--r--www/policy/OrganisationAssurancePolicy.html412
-rw-r--r--www/policy/OrganisationAssurancePolicy.php406
-rw-r--r--www/policy/PolicyOnJuniorAssurersMembers.html202
-rw-r--r--www/policy/PolicyOnPolicy.html347
-rw-r--r--www/policy/PolicyOnPolicy.php291
-rw-r--r--www/policy/PrivacyPolicy.html79
-rw-r--r--www/policy/PrivacyPolicy.php4
-rw-r--r--www/policy/RootDistributionLicense.html126
-rw-r--r--www/policy/RootDistributionLicense.php130
-rw-r--r--www/policy/images/cacert-draft.png (renamed from www/policy/cacert-draft.png)bin4796 -> 4796 bytes
-rw-r--r--www/policy/images/cacert-policy.pngbin0 -> 5030 bytes
-rw-r--r--www/policy/images/valid-html401-blue.pngbin0 -> 1669 bytes
-rw-r--r--www/policy/images/valid-html50-blue.pngbin0 -> 1438 bytes
-rw-r--r--www/policy/images/valid-xhtml11-blue.pngbin0 -> 2037 bytes
-rw-r--r--www/policy/index.php16
-rw-r--r--www/robots.txt3
-rw-r--r--www/stats.php5
-rw-r--r--www/styles/default.css74
-rw-r--r--www/verify.php4
-rw-r--r--www/wot.php162
129 files changed, 13636 insertions, 9788 deletions
diff --git a/CommModule/.gitignore b/CommModule/.gitignore
new file mode 100644
index 0000000..40a9309
--- /dev/null
+++ b/CommModule/.gitignore
@@ -0,0 +1,19 @@
+# Ignore autogenerated serial conf file
+/serial.conf
+/serialserver.conf
+
+# Ignore *-active files
+/client.pl-active
+/server.pl-active
+
+# Ignore log files
+/logfile20??-??-??.txt
+/nohup.out
+/oldlogs/
+
+# Ignore working files generated by the signer
+/currentcrls/
+/delta?.diff
+/revoke-root?.crl
+/timesync.sh
+/work/
diff --git a/CommModule/client.pl b/CommModule/client.pl
index bc8919d..5aac7ee 100755
--- a/CommModule/client.pl
+++ b/CommModule/client.pl
@@ -40,8 +40,8 @@ my $paranoid=1;
my $debug=0;
-#my $serialport="/dev/ttyS0";
-my $serialport="/dev/ttyUSB0";
+my $serialport="/dev/ttyS1";
+#my $serialport="/dev/ttyUSB0";
my $gpgbin="/usr/bin/gpg";
@@ -441,12 +441,12 @@ sub calculateDays($)
{
if($_[0])
{
- my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' group by `to`");
+ my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' and `deleted`=0 group by `to`");
SysLog("Summe: $sum[0]\n") if($debug);
- return ($sum[0]>=50)?730:180;
+ return ($sum[0]>=50)?30:3;
}
- return 180;
+ return 3;
}
sub X509extractSAN($)
@@ -832,7 +832,7 @@ sub HandleCerts($$)
SysLog "SAN: --$SAN--\n" if($debug);
SysLog "memid: $row{'memid'}\n" if($debug);
- my $days=$org?($server?(365*2):365):calculateDays($row{"memid"});
+ my $days=$org?($server?(30):7):calculateDays($row{"memid"});
my $md_id = 0;
$md_id = 1 if( $row{'md'} eq "md5");
diff --git a/CommModule/serial.conf b/CommModule/serial.conf
deleted file mode 100755
index bd9980c..0000000
--- a/CommModule/serial.conf
+++ /dev/null
@@ -1,32 +0,0 @@
-Device::SerialPort_Configuration_File -- DO NOT EDIT --
-/dev/ttyUSB0
-
-C_CFLAG,7346
-C_IFLAG,0
-C_ISPEED,4098
-C_LFLAG,2608
-C_OFLAG,4
-C_OSPEED,4098
-C_VERASE,127
-C_VQUIT,28
-C_VSUSP,26
-C_VINTR,3
-C_VSTOP,19
-C_VSTART,17
-C_VKILL,21
-C_VMIN,0
-C_VEOF,4
-C_VEOL,0
-C_VTIME,0
-CFG_1,none
-RCONST,0
-CFG_2,none
-HNAME,localhost
-ALIAS,/dev/ttyUSB0
-CFG_3,none
-U_MSG,0
-DATYPE,raw
-E_MSG,0
-HADDR,0
-RTOT,0
-DVTYPE,none
diff --git a/CommModule/usbclient.pl b/CommModule/usbclient.pl
index 3cbe2c3..6cbc111 100755
--- a/CommModule/usbclient.pl
+++ b/CommModule/usbclient.pl
@@ -425,7 +425,7 @@ sub calculateDays($)
{
if($_[0])
{
- my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' group by `to`");
+ my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' and `deleted`=0 group by `to`");
SysLog("Summe: $sum[0]\n") if($debug);
return ($sum[0]>=50)?730:180;
diff --git a/README b/README
deleted file mode 100644
index 7f2ca78..0000000
--- a/README
+++ /dev/null
@@ -1,17 +0,0 @@
-LibreSSL Documentation
-
-(c) 2005-2008 by CAcert Inc.
-License: GNU-GPLv2
-
-System Requirements:
-Linux/POSIX
-PHP
-GetText
-UFPDF - PDF generation library from http://acko.net/node/56
-OpenSSL - X.509 toolkit from http://www.openssl.org/
-openssl-vulnkey including blacklists for all common key sizes
-GnuPG - OpenPGP toolkit from http://www.gnupg.org/
-whois - whois client from http://www.linux.it/~md/software/
-XEnroll - Enrollment Active-X control for IE5/6 from Microsoft (search for xenroll.cab)
-CommModule - CAcert Communication Module
-
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..39c9d68
--- /dev/null
+++ b/README.md
@@ -0,0 +1,19 @@
+LibreSSL Documentation
+======================
+
+(c) 2005-2013 by CAcert Inc.
+License: GNU-GPLv2
+
+## System Requirements:
+
+ * Linux/POSIX
+ * PHP 5.3
+ * GetText PECL module for PHP
+ * UFPDF - PDF generation library from http://acko.net/node/56
+ * OpenSSL - X.509 toolkit from http://www.openssl.org/
+ * openssl-vulnkey including blacklists for all common key sizes
+ * GnuPG - OpenPGP toolkit from http://www.gnupg.org/
+ * whois - whois client from http://www.linux.it/~md/software/
+ * XEnroll - Enrollment Active-X control for IE5/6 from Microsoft (search for xenroll.cab)
+ * CommModule - CAcert Communication Module
+
diff --git a/config/ttp.ini b/config/ttp.ini
new file mode 100644
index 0000000..d0a0913
--- /dev/null
+++ b/config/ttp.ini
@@ -0,0 +1,6 @@
+; list of countries and the TTP CAP form to be used
+[ttp_country]
+Australia=ttp
+Puerto Rico=ttp
+US Virgin Island=ttp
+USA =ttp \ No newline at end of file
diff --git a/crt/DIR b/crt/DIR
new file mode 100644
index 0000000..87975fb
--- /dev/null
+++ b/crt/DIR
@@ -0,0 +1 @@
+# This directory has to be writeable by the web server
diff --git a/csr/DIR b/csr/DIR
new file mode 100644
index 0000000..87975fb
--- /dev/null
+++ b/csr/DIR
@@ -0,0 +1 @@
+# This directory has to be writeable by the web server
diff --git a/includes/account.php b/includes/account.php
index 7c3748d..6061d16 100644
--- a/includes/account.php
+++ b/includes/account.php
@@ -84,6 +84,11 @@ function buildSubjectFromSession() {
$memid = array_key_exists('memid',$_REQUEST) ? intval($_REQUEST['memid']) : 0;
$domid = array_key_exists('domid',$_REQUEST) ? intval($_REQUEST['domid']) : 0;
+ $actionrequest = array_key_exists('action',$_REQUEST) ? $_REQUEST['action'] : "";
+
+ $ticketno = array_key_exists('ticketno',$_REQUEST) ? $_REQUEST['ticketno'] : "";
+ $ticketvalidation = FALSE;
+
if(!$_SESSION['mconn'])
{
@@ -146,7 +151,7 @@ function buildSubjectFromSession() {
exit;
}
$hash = make_hash();
- $query = "insert into `email` set `email`='".$_REQUEST['email']."',`memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'";
+ $query = "insert into `email` set `email`='".$_REQUEST['email']."',`memid`='".intval($_SESSION['profile']['id'])."',`created`=NOW(),`hash`='$hash'";
mysql_query($query);
$emailid = mysql_insert_id();
@@ -166,7 +171,7 @@ function buildSubjectFromSession() {
{
$id = 2;
$emailid = intval($_REQUEST['emailid']);
- $query = "select * from `email` where `id`='$emailid' and `memid`='".$_SESSION['profile']['id']."' and `hash` = '' and `deleted`=0";
+ $query = "select * from `email` where `id`='$emailid' and `memid`='".intval($_SESSION['profile']['id'])."' and `hash` = '' and `deleted`=0";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -186,7 +191,7 @@ function buildSubjectFromSession() {
"support@cacert.org", "", "", "CAcert Support");
$_SESSION['profile']['email'] = $row['email'];
- $query = "update `users` set `email`='".$row['email']."' where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `email`='".mysql_real_escape_string($row['email'])."' where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
showheader(_("My CAcert.org Account!"));
printf(_("Your default email address has been updated to '%s'."), sanitizeHTML($row['email']));
@@ -211,7 +216,7 @@ function buildSubjectFromSession() {
}
$id = intval($id);
$query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and
- `email`!='".$_SESSION['profile']['email']."'";
+ `email`!='".mysql_real_escape_string($_SESSION['profile']['email'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -284,6 +289,9 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
$_SESSION['_config']['rootcert'] = 1;
}
+
+ $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']);
+
$csr = "";
if(trim($_REQUEST['optionalCSR']) == "")
{
@@ -293,11 +301,8 @@ function buildSubjectFromSession() {
$_REQUEST['keytype'] = "MS";
$csr = clean_csr($_REQUEST['optionalCSR']);
}
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
}
if($oldid == 4)
@@ -321,7 +326,7 @@ function buildSubjectFromSession() {
if(is_array($_SESSION['_config']['addid']))
foreach($_SESSION['_config']['addid'] as $id)
{
- $res = mysql_query("select * from `email` where `memid`='".$_SESSION['profile']['id']."' and `id`='".intval($id)."'");
+ $res = mysql_query("select * from `email` where `memid`='".intval($_SESSION['profile']['id'])."' and `id`='".intval($id)."'");
if(mysql_num_rows($res) > 0)
{
$row = mysql_fetch_assoc($res);
@@ -340,7 +345,7 @@ function buildSubjectFromSession() {
showfooter();
exit;
}
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'"));
+ $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
if($_SESSION['_config']['SSO'] == 1)
$emails .= "$count.emailAddress = ".$user['uniqueID']."\n";
@@ -384,7 +389,8 @@ function buildSubjectFromSession() {
`codesign`='".intval($_SESSION['_config']['codesign'])."',
`disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
`rootcert`='".intval($_SESSION['_config']['rootcert'])."',
- `description`='".$_SESSION['_config']['description']."'";
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
if(is_array($addys))
@@ -395,7 +401,8 @@ function buildSubjectFromSession() {
fputs($fp, $emails);
fclose($fp);
$challenge=$_SESSION['spkac_hash'];
- $res=`openssl spkac -verify -in $CSRname`;
+ $CSRname_esc = escapeshellarg($CSRname);
+ $res=shell_exec("openssl spkac -verify -in $CSRname_esc");
if(!strstr($res,"Challenge String: ".$challenge))
{
$id = $oldid;
@@ -457,7 +464,9 @@ function buildSubjectFromSession() {
$csrsubject .= "/emailAddress = ".$user['uniqueID'];
$tmpname = tempnam("/tmp", "id4csr");
- $do = `/usr/bin/openssl req -in $tmpfname -out $tmpname`; // -subj "$csr"`;
+ $tmpfname_esc = escapeshellarg($tmpfname);
+ $tmpname_esc = escapeshellarg($tmpname);
+ $do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc"); // -subj "$csr";
@unlink($tmpfname);
$csr = "";
$fp = fopen($tmpname, "r");
@@ -479,13 +488,14 @@ function buildSubjectFromSession() {
$query = "insert into emailcerts set
`CN`='$defaultemail',
`keytype`='".sanitizeHTML($_REQUEST['keytype'])."',
- `memid`='".$_SESSION['profile']['id']."',
+ `memid`='".intval($_SESSION['profile']['id'])."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
`subject`='".mysql_real_escape_string($csrsubject)."',
- `codesign`='".$_SESSION['_config']['codesign']."',
+ `codesign`='".intval($_SESSION['_config']['codesign'])."',
`disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `description`='".$_SESSION['_config']['description']."'";
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
if(is_array($addys))
@@ -560,7 +570,7 @@ function buildSubjectFromSession() {
$addy = array();
$adds = array();
if(strtolower(substr($newdom, -4, 3)) != ".jp")
- $adds = explode("\n", trim(`/usr/bin/whois $newdom|grep "@"`));
+ $adds = explode("\n", trim(shell_exec("/usr/bin/whois $newdom|grep \"@\"")));
if(substr($newdomain, -4) == ".org" || substr($newdomain, -5) == ".info")
{
if(is_array($adds))
@@ -650,7 +660,7 @@ function buildSubjectFromSession() {
$hash = make_hash();
$query = "insert into `domains` set `domain`='".mysql_real_escape_string($_SESSION['_config']['domain'])."',
- `memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'";
+ `memid`='".intval($_SESSION['profile']['id'])."',`created`=NOW(),`hash`='$hash'";
mysql_query($query);
$domainid = mysql_insert_id();
@@ -678,7 +688,7 @@ function buildSubjectFromSession() {
foreach($_REQUEST['delid'] as $id)
{
$id = intval($id);
- $query = "select * from `domains` where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ $query = "select * from `domains` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -723,19 +733,15 @@ function buildSubjectFromSession() {
exit;
}
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
$_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id10CSR");
$fp = fopen($_SESSION['_config']['tmpfname'], "w");
fputs($fp, $CSR);
fclose($fp);
- $CSR = $_SESSION['_config']['tmpfname'];
- $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $CSR = escapeshellarg($_SESSION['_config']['tmpfname']);
+ $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -762,6 +768,8 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
$_SESSION['_config']['rootcert'] = 1;
}
+
+ $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']);
}
if($process != "" && $oldid == 11)
@@ -806,14 +814,16 @@ function buildSubjectFromSession() {
`domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."',
`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
- `description`='".$_SESSION['_config']['description']."'";
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
} elseif(array_key_exists('0',$_SESSION['_config']['altid']) && $_SESSION['_config']['altid']['0'] > 0) {
$query = "insert into `domaincerts` set
`CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
`domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."',
`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
- `description`='".$_SESSION['_config']['description']."'";
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
} else {
showheader(_("My CAcert.org Account!"));
echo _("Domain not verified.");
@@ -867,7 +877,7 @@ function buildSubjectFromSession() {
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
- `domains`.`memid`='".$_SESSION['profile']['id']."'";
+ `domains`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -886,22 +896,24 @@ function buildSubjectFromSession() {
mysql_query("update `domaincerts` set `renewed`='1' where `id`='$id'");
$query = "insert into `domaincerts` set
- `domid`='".$row['domid']."',
+ `domid`='".intval($row['domid'])."',
`CN`='".mysql_real_escape_string($row['CN'])."',
`subject`='".mysql_real_escape_string($row['subject'])."',".
//`csr_name`='".$row['csr_name']."', // RACE CONDITION
- "`created`='".$row['created']."',
+ "`created`='".mysql_real_escape_string($row['created'])."',
`modified`=NOW(),
- `rootcert`='".$row['rootcert']."',
- `type`='".$row['type']."',
- `pkhash`='".$row['pkhash']."',
- `description`='".$row['description']."'";
+ `rootcert`='".intval($row['rootcert'])."',
+ `type`='".intval($row['type'])."',
+ `pkhash`='".mysql_real_escape_string($row['pkhash'])."',
+ `description`='".mysql_real_escape_string($row['description'])."',
+ `md`='".HashAlgorithms::clean($row['md'])."'";
mysql_query($query);
$newid = mysql_insert_id();
$newfile=generatecertpath("csr","server",$newid);
copy($row['csr_name'], $newfile);
- $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in "$newfile"|tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in "$newfile"|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $newfile_esc = escapeshellarg($newfile);
+ $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -930,7 +942,8 @@ function buildSubjectFromSession() {
printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
} else {
$drow = mysql_fetch_assoc($res);
- $cert = `/usr/bin/openssl x509 -in $drow[crt_name]`;
+ $crt_name = escapeshellarg($drow['crt_name']);
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crt_name");
echo "<pre>\n$cert\n</pre>\n";
}
}
@@ -958,7 +971,7 @@ function buildSubjectFromSession() {
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
- `domains`.`memid`='".$_SESSION['profile']['id']."'";
+ `domains`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -972,8 +985,12 @@ function buildSubjectFromSession() {
continue;
}
mysql_query("update `domaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
- printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
+ printf(_("Certificate for '%s' with the serial no '%s' has been revoked.").'<br/>', htmlspecialchars($row['CN']), htmlspecialchars($row['serial']));
}
+
+ // TRANSLATORS: Please don't translate "Certificate Revocation List (CRL)", it's a technical term
+ echo '<br/>'._('All listed certificates will be added to the Certificate Revocation List (CRL) soon.').'<br/>';
+
}
else
{
@@ -989,7 +1006,7 @@ function buildSubjectFromSession() {
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
- `domains`.`memid`='".$_SESSION['profile']['id']."'";
+ `domains`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1040,7 +1057,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
- where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1059,17 +1076,18 @@ function buildSubjectFromSession() {
mysql_query("update `emailcerts` set `renewed`='1' where `id`='$id'");
$query = "insert into emailcerts set
- `memid`='".$row['memid']."',
+ `memid`='".intval($row['memid'])."',
`CN`='".mysql_real_escape_string($row['CN'])."',
`subject`='".mysql_real_escape_string($row['subject'])."',
- `keytype`='".$row['keytype']."',
- `csr_name`='".$row['csr_name']."',
- `created`='".$row['created']."',
+ `keytype`='".mysql_real_escape_string($row['keytype'])."',
+ `csr_name`='".mysql_real_escape_string($row['csr_name'])."',
+ `created`='".mysql_real_escape_string($row['created'])."',
`modified`=NOW(),
- `disablelogin`='".$row['disablelogin']."',
- `codesign`='".$row['codesign']."',
- `rootcert`='".$row['rootcert']."',
- `description`='".$row['description']."'";
+ `disablelogin`='".intval($row['disablelogin'])."',
+ `codesign`='".intval($row['codesign'])."',
+ `rootcert`='".intval($row['rootcert'])."',
+ `description`='".mysql_real_escape_string($row['description'])."',
+ `md`='".HashAlgorithms::clean($row['md'])."'";
mysql_query($query);
$newid = mysql_insert_id();
$newfile=generatecertpath("csr","client",$newid);
@@ -1114,7 +1132,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
- where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1128,8 +1146,11 @@ function buildSubjectFromSession() {
continue;
}
mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
- printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
+ printf(_("Certificate for '%s' with the serial no '%s' has been revoked.").'<br/>', htmlspecialchars($row['CN']), htmlspecialchars($row['serial']));
}
+
+ // TRANSLATORS: Please don't translate "Certificate Revocation List (CRL)", it's a technical term
+ echo '<br/>'._('All listed certificates will be added to the Certificate Revocation List (CRL) soon.').'<br/>';
}
else
{
@@ -1143,7 +1164,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts`
- where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
+ where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -1175,14 +1196,14 @@ function buildSubjectFromSession() {
{
$cid = intval(substr($id,5));
$dis=(array_key_exists('disablelogin_'.$cid,$_REQUEST) && $_REQUEST['disablelogin_'.$cid]=="1")?"0":"1";
- mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+ mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$cid' and `memid`='".intval($_SESSION['profile']['id'])."'");
}
if(substr($id,0,14)=="check_comment_")
{
$cid = intval(substr($id,14));
if(!empty($_REQUEST['check_comment_'.$cid])) {
$comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid])));
- mysql_query("update `emailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'");
+ mysql_query("update `emailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".intval($_SESSION['profile']['id'])."'");
}
}
}
@@ -1191,6 +1212,23 @@ function buildSubjectFromSession() {
exit;
}
+ if($oldid == 6 && $_REQUEST['certid'] != "")
+ {
+ if(trim($_REQUEST['description']) != ""){
+ $description= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
+ }else{
+ $description= "";
+ }
+
+ if(trim($_REQUEST['disablelogin']) == "1"){
+ $disablelogin = 1;
+ }else{
+ $disablelogin = 0;
+ }
+
+ mysql_query("update `emailcerts` set `disablelogin`='$disablelogin', `description`='$description' where `id`='".$_REQUEST['certid']."' and `memid`='".$_SESSION['profile']['id']."'");
+ }
+
if($oldid == 13 && $process != "" && $showdetails!="")
{
csrf_check("perschange");
@@ -1256,7 +1294,7 @@ function buildSubjectFromSession() {
if($oldid == 13 && $process != "")
{
- $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$ddres = mysql_query($ddquery);
$ddrow = mysql_fetch_assoc($ddres);
$_SESSION['profile']['points'] = $ddrow['total'];
@@ -1296,7 +1334,7 @@ function buildSubjectFromSession() {
`lname`='".$_SESSION['_config']['user']['lname']."',
`suffix`='".$_SESSION['_config']['user']['suffix']."',
`dob`='".$_SESSION['_config']['user']['year']."-".$_SESSION['_config']['user']['month']."-".$_SESSION['_config']['user']['day']."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
}
if ($showdetails!="") {
@@ -1310,25 +1348,25 @@ function buildSubjectFromSession() {
`A3`='".$_SESSION['_config']['user']['A3']."',
`A4`='".$_SESSION['_config']['user']['A4']."',
`A5`='".$_SESSION['_config']['user']['A5']."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
}
//!!!Should be rewritten
- $_SESSION['_config']['user']['otphash'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otphash']))));
- $_SESSION['_config']['user']['otppin'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otppin']))));
+ $_SESSION['_config']['user']['otphash'] = trim(stripslashes(strip_tags($_REQUEST['otphash'])));
+ $_SESSION['_config']['user']['otppin'] = trim(stripslashes(strip_tags($_REQUEST['otppin'])));
if($_SESSION['_config']['user']['otphash'] != "" && $_SESSION['_config']['user']['otppin'] != "")
{
- $query = "update `users` set `otphash`='".$_SESSION['_config']['user']['otphash']."',
- `otppin`='".$_SESSION['_config']['user']['otppin']."' where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `otphash`='".mysql_real_escape_string($_SESSION['_config']['user']['otphash'])."',
+ `otppin`='".mysql_real_escape_string($_SESSION['_config']['user']['otppin'])."' where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
}
$_SESSION['_config']['user']['set'] = 0;
- $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'"));
+ $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
$_SESSION['profile']['loggedin'] = 1;
- $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$ddres = mysql_query($ddquery);
$ddrow = mysql_fetch_assoc($ddres);
$_SESSION['profile']['points'] = $ddrow['total'];
@@ -1362,7 +1400,7 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['hostname'] != $_SESSION['_config']['securehostname'])
{
- $match = mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."' and
+ $match = mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."' and
(`password`=old_password('".$_SESSION['_config']['user']['oldpass']."') or
`password`=sha1('".$_SESSION['_config']['user']['oldpass']."'))");
$rc = mysql_num_rows($match);
@@ -1384,7 +1422,7 @@ function buildSubjectFromSession() {
echo _("You failed to correctly enter your current Pass Phrase.");
} else {
mysql_query("update `users` set `password`=sha1('".$_SESSION['_config']['user']['pword1']."')
- where `id`='".$_SESSION['profile']['id']."'");
+ where `id`='".intval($_SESSION['profile']['id'])."'");
echo '<h3>', _("Pass Phrase Changed Successfully"), '</h3>', "\n";
echo _("Your Pass Phrase has been updated and your primary email account has been notified of the change.");
$body = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n\n";
@@ -1426,14 +1464,9 @@ function buildSubjectFromSession() {
$_SESSION['_config']['emails'][] = $val;
}
$_SESSION['_config']['name'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['name'])));
- $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU'])));
+ $_SESSION['_config']['OU'] = stripslashes(trim($_REQUEST['OU']));
-
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
}
if($oldid == 16 && (intval(count($_SESSION['_config']['emails'])) + 0) <= 0)
@@ -1462,11 +1495,9 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
$_SESSION['_config']['rootcert'] = 1;
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']);
+
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
if(@count($_SESSION['_config']['emails']) > 0)
$id = 17;
@@ -1502,7 +1533,7 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['name'] != "")
$emails .= "commonName = ".$_SESSION['_config']['name']."\n";
if($_SESSION['_config']['OU'])
- $emails .= "organizationalUnitName = ".$_SESSION['_config']['OU']."\n";
+ $emails .= "organizationalUnitName = ".mysql_real_escape_string($_SESSION['_config']['OU'])."\n";
if($org['O'])
$emails .= "organizationName = ".$org['O']."\n";
if($org['L'])
@@ -1527,13 +1558,14 @@ function buildSubjectFromSession() {
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
- `ou`='".$_SESSION['_config']['OU']."',
+ `ou`='".mysql_real_escape_string($_SESSION['_config']['OU'])."',
`keytype`='NS',
- `orgid`='".$org['orgid']."',
+ `orgid`='".intval($org['orgid'])."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `codesign`='".$_SESSION['_config']['codesign']."',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `description`='".$_SESSION['_config']['description']."'";
+ `codesign`='".intval($_SESSION['_config']['codesign'])."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
@@ -1545,7 +1577,8 @@ function buildSubjectFromSession() {
fputs($fp, $emails);
fclose($fp);
$challenge=$_SESSION['spkac_hash'];
- $res=`openssl spkac -verify -in $CSRname`;
+ $CSRname_esc = escapeshellarg($CSRname);
+ $res=shell_exec("openssl spkac -verify -in $CSRname_esc");
if(!strstr($res,"Challenge String: ".$challenge))
{
$id = $oldid;
@@ -1597,7 +1630,9 @@ function buildSubjectFromSession() {
$csrsubject .= "/countryName=".$org['C'];
$tmpname = tempnam("/tmp", "id17csr");
- $do = `/usr/bin/openssl req -in $tmpfname -out $tmpname`;
+ $tmpfname_esc = escapeshellarg($tmpfname);
+ $tmpname_esc = escapeshellarg($tmpname);
+ $do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc");
@unlink($tmpfname);
$csr = "";
$fp = fopen($tmpname, "r");
@@ -1618,14 +1653,15 @@ function buildSubjectFromSession() {
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
- `ou`='".$_SESSION['_config']['OU']."',
+ `ou`='".mysql_real_escape_string($_SESSION['_config']['OU'])."',
`keytype`='" . sanitizeHTML($_REQUEST['keytype']) . "',
- `orgid`='".$org['orgid']."',
+ `orgid`='".intval($org['orgid'])."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `subject`='$csrsubject',
- `codesign`='".$_SESSION['_config']['codesign']."',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `description`='".$_SESSION['_config']['description']."'";
+ `subject`='".mysql_real_escape_string($csrsubject)."',
+ `codesign`='".intval($_SESSION['_config']['codesign'])."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
mysql_query($query);
$emailid = mysql_insert_id();
@@ -1667,7 +1703,7 @@ function buildSubjectFromSession() {
echo "Renewing certificate #$id ...\n<br/>";
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org`
- where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
+ where `orgemailcerts`.`id`='$id' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orgemailcerts`.`orgid`";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -1692,17 +1728,18 @@ function buildSubjectFromSession() {
continue;
}
$query = "insert into `orgemailcerts` set
- `orgid`='".$row['orgid']."',
- `CN`='".$row['CN']."',
- `ou`='".$row['ou']."',
- `subject`='".$row['subject']."',
- `keytype`='".$row['keytype']."',
- `csr_name`='".$row['csr_name']."',
- `created`='".$row['created']."',
+ `orgid`='".intval($row['orgid'])."',
+ `CN`='".mysql_real_escape_string($row['CN'])."',
+ `ou`='".mysql_real_escape_string($row['ou'])."',
+ `subject`='".mysql_real_escape_string($row['subject'])."',
+ `keytype`='".mysql_real_escape_string($row['keytype'])."',
+ `csr_name`='".mysql_real_escape_string($row['csr_name'])."',
+ `created`='".mysql_real_escape_string($row['created'])."',
`modified`=NOW(),
- `codesign`='".$row['codesign']."',
- `rootcert`='".$row['rootcert']."',
- `description`='".$row['description']."'";
+ `codesign`='".intval($row['codesign'])."',
+ `rootcert`='".intval($row['rootcert'])."',
+ `description`='".mysql_real_escape_string($row['description'])."',
+ `md`='".HashAlgorithms::clean($row['md'])."'";
mysql_query($query);
$newid = mysql_insert_id();
$newfile=generatecertpath("csr","orgclient",$newid);
@@ -1740,7 +1777,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org`
- where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
+ where `orgemailcerts`.`id`='".intval($id)."' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orgemailcerts`.`orgid`";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -1755,8 +1792,11 @@ function buildSubjectFromSession() {
continue;
}
mysql_query("update `orgemailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
- printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
+ printf(_("Certificate for '%s' with the serial no '%s' has been revoked.").'<br/>', htmlspecialchars($row['CN']), htmlspecialchars($row['serial']));
}
+
+ // TRANSLATORS: Please don't translate "Certificate Revocation List (CRL)", it's a technical term
+ echo '<br/>'._('All listed certificates will be added to the Certificate Revocation List (CRL) soon.').'<br/>';
}
else
{
@@ -1770,7 +1810,7 @@ function buildSubjectFromSession() {
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `orgemailcerts`, `org`
- where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
+ where `orgemailcerts`.`id`='".intval($id)."' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orgemailcerts`.`orgid`";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -1840,19 +1880,15 @@ function buildSubjectFromSession() {
exit;
}
- if(trim($_REQUEST['description']) != ""){
- $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
- }else{
- $_SESSION['_config']['description']= "";
- }
+ $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description']));
$_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id20CSR");
$fp = fopen($_SESSION['_config']['tmpfname'], "w");
fputs($fp, $CSR);
fclose($fp);
- $CSR = $_SESSION['_config']['tmpfname'];
- $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ $CSR = escapeshellarg($_SESSION['_config']['tmpfname']);
+ $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\""));
+ $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:")));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -1865,16 +1901,16 @@ function buildSubjectFromSession() {
getalt2();
$query = "select * from `orginfo`,`org`,`orgdomains` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`org`.`orgid`=`orgdomains`.`orgid` and
- `orgdomains`.`domain`='".$_SESSION['_config']['0.CN']."'";
+ `orgdomains`.`domain`='".mysql_real_escape_string($_SESSION['_config']['0.CN'])."'";
$_SESSION['_config']['CNorg'] = mysql_fetch_assoc(mysql_query($query));
$query = "select * from `orginfo`,`org`,`orgdomains` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`org`.`orgid`=`orgdomains`.`orgid` and
- `orgdomains`.`domain`='".$_SESSION['_config']['0.subjectAltName']."'";
+ `orgdomains`.`domain`='".mysql_real_escape_string($_SESSION['_config']['0.subjectAltName'])."'";
$_SESSION['_config']['SANorg'] = mysql_fetch_assoc(mysql_query($query));
//echo "<pre>"; print_r($_SESSION['_config']); die;
@@ -1890,6 +1926,8 @@ function buildSubjectFromSession() {
$_SESSION['_config']['rootcert'] = intval($_REQUEST['rootcert']);
if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
$_SESSION['_config']['rootcert'] = 1;
+
+ $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']);
}
if($process != "" && $oldid == 21)
@@ -1924,14 +1962,14 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rowid']['0'] > 0)
{
$query = "select * from `org`,`orginfo` where
- `orginfo`.`id`='".$_SESSION['_config']['rowid']['0']."' and
+ `orginfo`.`id`='".intval($_SESSION['_config']['rowid']['0'])."' and
`orginfo`.`id`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
} else {
$query = "select * from `org`,`orginfo` where
- `orginfo`.`id`='".$_SESSION['_config']['altid']['0']."' and
+ `orginfo`.`id`='".intval($_SESSION['_config']['altid']['0'])."' and
`orginfo`.`id`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
}
$org = mysql_fetch_assoc(mysql_query($query));
$csrsubject = "";
@@ -1959,22 +1997,24 @@ function buildSubjectFromSession() {
if($_SESSION['_config']['rowid']['0'] > 0)
{
$query = "insert into `orgdomaincerts` set
- `CN`='".$_SESSION['_config']['rows']['0']."',
- `orgid`='".$org['id']."',
+ `CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."',
+ `orgid`='".intval($org['id'])."',
`created`=NOW(),
- `subject`='$csrsubject',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `type`='$type',
- `description`='".$_SESSION['_config']['description']."'";
+ `subject`='".mysql_real_escape_string($csrsubject)."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `type`='".$type."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
} else {
$query = "insert into `orgdomaincerts` set
- `CN`='".$_SESSION['_config']['altrows']['0']."',
- `orgid`='".$org['id']."',
+ `CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
+ `orgid`='".intval($org['id'])."',
`created`=NOW(),
- `subject`='$csrsubject',
- `rootcert`='".$_SESSION['_config']['rootcert']."',
- `type`='$type',
- `description`='".$_SESSION['_config']['description']."'";
+ `subject`='".mysql_real_escape_string($csrsubject)."',
+ `rootcert`='".intval($_SESSION['_config']['rootcert'])."',
+ `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."',
+ `type`='".$type."',
+ `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'";
}
mysql_query($query);
$CSRid = mysql_insert_id();
@@ -1985,10 +2025,10 @@ function buildSubjectFromSession() {
mysql_query("update `orgdomaincerts` set `CSR_name`='$CSRname' where `id`='$CSRid'");
if(is_array($_SESSION['_config']['rowid']))
foreach($_SESSION['_config']['rowid'] as $id)
- mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'");
+ mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($id)."', `orgcertid`='$CSRid'");
if(is_array($_SESSION['_config']['altid']))
foreach($_SESSION['_config']['altid'] as $id)
- mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'");
+ mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($id)."', `orgcertid`='$CSRid'");
waitForResult("orgdomaincerts", $CSRid,$oldid);
$query = "select * from `orgdomaincerts` where `id`='$CSRid' and `crt_name` != ''";
$res = mysql_query($query);
@@ -2019,7 +2059,7 @@ function buildSubjectFromSession() {
`orgdomaincerts`,`org`
where `orgdomaincerts`.`id`='$id' and
`orgdomaincerts`.`orgid`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -2043,15 +2083,16 @@ function buildSubjectFromSession() {
continue;
}
$query = "insert into `orgdomaincerts` set
- `orgid`='".$row['orgid']."',
- `CN`='".$row['CN']."',
- `csr_name`='".$row['csr_name']."',
- `created`='".$row['created']."',
+ `orgid`='".intval($row['orgid'])."',
+ `CN`='".mysql_real_escape_string($row['CN'])."',
+ `csr_name`='".mysql_real_escape_string($row['csr_name'])."',
+ `created`='".mysql_real_escape_string($row['created'])."',
`modified`=NOW(),
- `subject`='".$row['subject']."',
- `type`='".$row['type']."',
- `rootcert`='".$row['rootcert']."',
- `description`='".$row['description']."'";
+ `subject`='".mysql_real_escape_string($row['subject'])."',
+ `type`='".intval($row['type'])."',
+ `rootcert`='".intval($row['rootcert'])."',
+ `description`='".mysql_real_escape_string($row['description'])."',
+ `md`='".HashAlgorithms::clean($row['md'])."'";
mysql_query($query);
$newid = mysql_insert_id();
//echo "NewID: $newid<br/>\n";
@@ -2061,7 +2102,7 @@ function buildSubjectFromSession() {
echo _("Renewing").": ".$row['CN']."<br>\n";
$res = mysql_query("select * from `orgdomlink` where `orgcertid`='".$row['id']."'");
while($r2 = mysql_fetch_assoc($res))
- mysql_query("insert into `orgdomlink` set `orgdomid`='".$r2['id']."', `orgcertid`='$newid'");
+ mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($r2['orgdomid'])."', `orgcertid`='$newid'");
waitForResult("orgdomaincerts", $newid,$oldid,0);
$query = "select * from `orgdomaincerts` where `id`='$newid' and `crt_name` != ''";
$res = mysql_query($query);
@@ -2070,7 +2111,8 @@ function buildSubjectFromSession() {
printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions.")." newid: $newid", "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
} else {
$drow = mysql_fetch_assoc($res);
- $cert = `/usr/bin/openssl x509 -in $drow[crt_name]`;
+ $crtname = escapeshellarg($drow['crt_name']);
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname");
echo "<pre>\n$cert\n</pre>\n";
}
}
@@ -2097,7 +2139,7 @@ function buildSubjectFromSession() {
`orgdomaincerts`,`org`
where `orgdomaincerts`.`id`='$id' and
`orgdomaincerts`.`orgid`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -2111,8 +2153,11 @@ function buildSubjectFromSession() {
continue;
}
mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
- printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
+ printf(_("Certificate for '%s' with the serial no '%s' has been revoked.").'<br/>', htmlspecialchars($row['CN']), htmlspecialchars($row['serial']));
}
+
+ // TRANSLATORS: Please don't translate "Certificate Revocation List (CRL)", it's a technical term
+ echo '<br/>'._('All listed certificates will be added to the Certificate Revocation List (CRL) soon.').'<br/>';
}
else
{
@@ -2129,7 +2174,7 @@ function buildSubjectFromSession() {
`orgdomaincerts`,`org`
where `orgdomaincerts`.`id`='$id' and
`orgdomaincerts`.`orgid`=`org`.`orgid` and
- `org`.`memid`='".$_SESSION['profile']['id']."'";
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."'";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
@@ -2215,7 +2260,7 @@ function buildSubjectFromSession() {
`contact`='".$_SESSION['_config']['contact']."',
`L`='".$_SESSION['_config']['L']."',
`ST`='".$_SESSION['_config']['ST']."',
- `C`='".$_SESSION['_config']['C']."',
+ `C`='".strtoupper($_SESSION['_config']['C'])."',
`comments`='".$_SESSION['_config']['comments']."'");
showheader(_("My CAcert.org Account!"));
printf(_("'%s' has just been successfully added as an organisation to the database."), sanitizeHTML($_SESSION['_config']['O']));
@@ -2243,9 +2288,9 @@ function buildSubjectFromSession() {
`contact`='".$_SESSION['_config']['contact']."',
`L`='".$_SESSION['_config']['L']."',
`ST`='".$_SESSION['_config']['ST']."',
- `C`='".$_SESSION['_config']['C']."',
+ `C`='".strtoupper($_SESSION['_config']['C'])."',
`comments`='".$_SESSION['_config']['comments']."'
- where `id`='".$_SESSION['_config']['orgid']."'");
+ where `id`='".intval($_SESSION['_config']['orgid'])."'");
showheader(_("My CAcert.org Account!"));
printf(_("'%s' has just been successfully updated in the database."), sanitizeHTML($_SESSION['_config']['O']));
showfooter();
@@ -2425,11 +2470,11 @@ function buildSubjectFromSession() {
{
csrf_check('orgadmadd');
if($_SESSION['profile']['orgadmin'] == 1)
- $masteracc = $_SESSION['_config'][masteracc] = intval($_REQUEST['masteracc']);
+ $masteracc = $_SESSION['_config']['masteracc'] = intval($_REQUEST['masteracc']);
else
- $masteracc = $_SESSION['_config'][masteracc] = 0;
+ $masteracc = $_SESSION['_config']['masteracc'] = 0;
$_REQUEST['email'] = $_SESSION['_config']['email'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['email'])));
- $OU = $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU'])));
+ $_SESSION['_config']['OU'] = stripslashes(trim($_REQUEST['OU']));
$comments = $_SESSION['_config']['comments'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['comments'])));
$res = mysql_query("select * from `users` where `email`='".$_REQUEST['email']."' and `deleted`=0");
if(mysql_num_rows($res) <= 0)
@@ -2451,7 +2496,7 @@ function buildSubjectFromSession() {
set `memid`='".intval($row['id'])."',
`orgid`='".intval($_SESSION['_config']['orgid'])."',
`masteracc`='$masteracc',
- `OU`='$OU',
+ `OU`='".mysql_real_escape_string($_SESSION['_config']['OU'])."',
`comments`='$comments'");
}
}
@@ -2460,7 +2505,7 @@ function buildSubjectFromSession() {
if(($oldid == 34 || $id == 34) && $_SESSION['profile']['orgadmin'] != 1)
{
$orgid = intval($_SESSION['_config']['orgid']);
- $res = mysql_query("select * from `org` where `orgid`='$orgid' and `memid`='".$_SESSION['profile']['id']."' and `masteracc`='1'");
+ $res = mysql_query("select * from `org` where `orgid`='$orgid' and `memid`='".intval($_SESSION['profile']['id'])."' and `masteracc`='1'");
if(mysql_num_rows($res) <= 0)
$id = 32;
}
@@ -2519,7 +2564,7 @@ function buildSubjectFromSession() {
{
if($key == $lang)
{
- mysql_query("update `users` set `language`='$lang' where `id`='".$_SESSION['profile']['id']."'");
+ mysql_query("update `users` set `language`='$lang' where `id`='".intval($_SESSION['profile']['id'])."'");
$_SESSION['profile']['language'] = $lang;
showheader(_("My CAcert.org Account!"));
echo _("Your language setting has been updated.");
@@ -2674,10 +2719,27 @@ function buildSubjectFromSession() {
$oldid=0;
}
- if($oldid == 43 && $_REQUEST['action'] == "updatedob")
+ //check if ticket number was entered
+ if ( $id == 43 || $oldid == 43 || $id == 44 || $oldid == 44 ) {
+ if ($ticketno != "" ) {
+ $ticketno = trim($_REQUEST['ticketno']);
+ $ticketvalidation = valid_ticket_number($ticketno);
+ }
+
+ $_SESSION['ticketno'] = $ticketno;
+ }
+
+ if($oldid == 43 && $actionrequest == "updatedob" && $ticketvalidation == TRUE)
{
$id = 43;
$oldid=0;
+ $userid = intval($_REQUEST['userid']);
+ if (!write_se_log($userid, $_SESSION['profile']['id'],'SE Name/DOB Change',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$fname = mysql_real_escape_string($_REQUEST['fname']);
$mname = mysql_real_escape_string($_REQUEST['mname']);
$lname = mysql_real_escape_string($_REQUEST['lname']);
@@ -2685,21 +2747,29 @@ function buildSubjectFromSession() {
$day = intval($_REQUEST['day']);
$month = intval($_REQUEST['month']);
$year = intval($_REQUEST['year']);
- $userid = intval($_REQUEST['userid']);
- $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'";
- $details = mysql_fetch_assoc(mysql_query($query));
- $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}',
- `new-lname`='$lname',`new-dob`='$year-$month-$day',`uid`='$userid',`adminid`='".$_SESSION['profile']['id']."'";
- mysql_query($query);
$query = "update `users` set `fname`='$fname',`mname`='$mname',`lname`='$lname',`suffix`='$suffix',`dob`='$year-$month-$day' where `id`='$userid'";
mysql_query($query);
+ }elseif($oldid == 43 && $actionrequest == "updatedob" && $ticketvalidation == FALSE){
+ $id = 43;
+ $oldid=0;
+ $_SESSION['ticketmsg']='No action (name/dob change) taken. Ticket number is missing!';
}
- if($oldid == 43 && $_REQUEST['action'] == 'revokecert')
+ if($oldid == 43 && $actionrequest == 'revokecert' && $ticketvalidation == TRUE)
{
$userid = intval($_REQUEST['userid']);
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE Revoke all certificates',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
revoke_all_private_cert($userid);
$id=43;
+ }elseif($oldid == 43 && $actionrequest == "revokecert" && $ticketvalidation == FALSE){
+ $id = 43;
+ $oldid=0;
+ $_SESSION['ticketmsg']='No certificates revokes. Ticket number is missing!';
}
if($oldid == 48 && $_REQUEST['domain'] == "")
@@ -2716,8 +2786,7 @@ function buildSubjectFromSession() {
if($id == 44)
{
- if($_REQUEST['userid'] != "")
- $_REQUEST['userid'] = intval($_REQUEST['userid']);
+ $_REQUEST['userid'] = intval($_REQUEST['userid']);
$row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
if($row['email'] == "")
$id = 42;
@@ -2725,18 +2794,25 @@ function buildSubjectFromSession() {
$_REQUEST['email'] = $row['email'];
}
- if($oldid == 44)
+ if($oldid == 44 && $ticketvalidation == TRUE)
{
showheader(_("My CAcert.org Account!"));
if(intval($_REQUEST['userid']) <= 0)
{
echo _("No such user found.");
} else {
+ if (!write_se_log(intval($_REQUEST['userid']), $_SESSION['profile']['id'],'SE reset password',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
mysql_query("update `users` set `password`=sha1('".mysql_real_escape_string(stripslashes($_REQUEST['newpass']))."') where `id`='".intval($_REQUEST['userid'])."'");
$row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
printf(_("The password for %s has been updated successfully in the system."), sanitizeHTML($row['email']));
-
+ $my_translation = L10n::get_translation();
+ L10n::set_recipient_language(intval($_REQUEST['userid']));
$body = sprintf(_("Hi %s,"),$row['fname'])."\n\n";
$body .= _("You are receiving this email because a CAcert administrator ".
"has changed the password on your account.")."\n\n";
@@ -2745,18 +2821,24 @@ function buildSubjectFromSession() {
sendmail($row['email'], "[CAcert.org] "._("Password Update Notification"), $body,
"support@cacert.org", "", "", "CAcert Support");
+ L10n::set_translation($my_translation);
}
showfooter();
exit;
+ }elseif($oldid == 44 && $ticketvalidation == FALSE){
+ $_SESSION['ticketmsg']='No password reset taken. Ticket number is missing!';
}
+
if($process != "" && $oldid == 45)
{
$CSR = clean_csr($CSR);
$_SESSION['_config']['CSR'] = $CSR;
- $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\"", $CSR, $CSRSubjects);
+ runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:", $CSR, $CSRAlts);
+ $_SESSION['_config']['subject'] = trim($CSRSubjects);
+ $bits = explode(",", trim($CSRAlts));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -2780,8 +2862,11 @@ function buildSubjectFromSession() {
if($process != "" && $oldid == 46)
{
$CSR = clean_csr($_SESSION['_config']['CSR']);
- $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
- $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
+ runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\"", $CSR, $CSRSubjects);
+ runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:", $CSR, $CSRAlts);
+
+ $_SESSION['_config']['subject'] = trim($CSRSubjects);
+ $bits = explode(",", trim($CSRAlts));
foreach($bits as $val)
{
$_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
@@ -2817,10 +2902,10 @@ function buildSubjectFromSession() {
$CSRid = mysql_insert_id();
foreach($_SESSION['_config']['rowid'] as $dom)
- mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
+ mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='".intval($dom)."'");
if(is_array($_SESSION['_config']['altid']))
foreach($_SESSION['_config']['altid'] as $dom)
- mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
+ mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='".intval($dom)."'");
$CSRname=generatecertpath("csr","server",$CSRid);
$fp = fopen($CSRname, "w");
@@ -2843,150 +2928,279 @@ function buildSubjectFromSession() {
}
}
- if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0)
+ /* presently not needed
+ if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0 && $ticketvalidation==TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['tverify']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change tverify status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['tverify'];
mysql_query("update `users` set `tverify`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0 && $ticketvalidation==FALSE){
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
+ */
- if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0)
+ if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admsetassuret');
$memid = $_REQUEST['userid'] = intval($_REQUEST['assurer']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change assurer status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['assurer'];
mysql_query("update `users` set `assurer`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['assurer']);
+ $_SESSION['ticketmsg']='No action (Change assurer status) taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0)
+ if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change assurer blocked status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['assurer_blocked'];
mysql_query("update `users` set `assurer_blocked`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0)
+ if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admactlock');
$memid = $_REQUEST['userid'] = intval($_REQUEST['locked']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change locked status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['locked'];
mysql_query("update `users` set `locked`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['locked']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0)
+ if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admcodesign');
$memid = $_REQUEST['userid'] = intval($_REQUEST['codesign']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change codesign status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['codesign'];
mysql_query("update `users` set `codesign`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['codesign']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0)
+ if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admorgadmin');
$memid = $_REQUEST['userid'] = intval($_REQUEST['orgadmin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change org assuer status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['orgadmin'];
mysql_query("update `users` set `orgadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['orgadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0)
+ if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admttpadmin');
$memid = $_REQUEST['userid'] = intval($_REQUEST['ttpadmin']);
+ if(!write_se_log($memid, $_SESSION['profile']['id'],'SE Change ttp admin status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['ttpadmin'];
mysql_query("update `users` set `ttpadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['ttpadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0)
+ if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['adadmin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change advertising admin status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = $row['adadmin'] + 1;
if($ver > 2)
$ver = 0;
mysql_query("update `users` set `adadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['adadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0)
+ if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['locadmin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change location admin status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['locadmin'];
mysql_query("update `users` set `locadmin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['locadmin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0)
+ if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0 && $ticketvalidation == TRUE)
{
csrf_check('admsetadmin');
$memid = $_REQUEST['userid'] = intval($_REQUEST['admin']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change SE status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['admin'];
mysql_query("update `users` set `admin`='$ver' where `id`='$memid'");
+ }elseif($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['admin']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0)
+ if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['general']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change general status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['general'];
mysql_query("update `alerts` set `general`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['general']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0)
+ if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['country']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change country status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['country'];
mysql_query("update `alerts` set `country`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['country']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0)
+ if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['regional']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change regional status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['regional'];
mysql_query("update `alerts` set `regional`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0 && $ticketvalidation == FALSE){
+ $_REQUEST['userid'] = intval($_REQUEST['regional']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
- if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0)
+ if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0 && $ticketvalidation == TRUE)
{
$memid = $_REQUEST['userid'] = intval($_REQUEST['radius']);
+ if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change radius status',$ticketno)) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ showfooter();
+ exit;
+ }
$query = "select * from `alerts` where `memid`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
$ver = !$row['radius'];
mysql_query("update `alerts` set `radius`='$ver' where `memid`='$memid'");
+ }elseif($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0 && $ticketvalidation == false){
+ $_REQUEST['userid'] = intval($_REQUEST['radius']);
+ $_SESSION['ticketmsg']='No action taken. Ticket number is missing!';
}
if($id == 50)
{
- if(array_key_exists('userid',$_REQUEST) && $_REQUEST['userid'] != "")
+ if(array_key_exists('userid',$_REQUEST) && $_REQUEST['userid'] !== "") {
$_REQUEST['userid'] = intval($_REQUEST['userid']);
+ }
$row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
- if($row['email'] == "")
+ if($row['email'] == "") {
$id = 42;
- else
+ } else {
$_REQUEST['email'] = $row['email'];
+ }
}
if($oldid == 50)
@@ -3001,151 +3215,69 @@ function buildSubjectFromSession() {
if (trim($_REQUEST['arbitrationno'])==""){
showheader(_("My CAcert.org Account!"));
echo _("You did not enter an arbitration number entry.");
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
if ( 1 !== preg_match('/^[a-z]\d{8}\.\d+\.\d+$/i',trim($_REQUEST['arbitrationno'])) ) {
showheader(_("My CAcert.org Account!"));
printf(_("'%s' is not a valid arbitration number entry."), sanitizeHTML(trim($_REQUEST['arbitrationno'])));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
if (check_email_exists(trim($_REQUEST['arbitrationno']).'@cacert.org')) {
showheader(_("My CAcert.org Account!"));
printf(_("The email address '%s' is already in a different account. Can't continue."), sanitizeHTML($_REQUEST['arbitrationno'].'@cacert.org'));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
- }
- if (check_client_cert_running($_REQUEST['userid'],1) ||
- check_server_cert_running($_REQUEST['userid'],1) ||
- check_gpg_cert_running($_REQUEST['userid'],1)) {
+ }
+ if (check_client_cert_running(intval($_REQUEST['userid']),1) ||
+ check_server_cert_running(intval($_REQUEST['userid']),1) ||
+ check_gpg_cert_running(intval($_REQUEST['userid']),1)) {
showheader(_("My CAcert.org Account!"));
printf(_("The CCA retention time for at least one certificate is not over. Can't continue."));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
- if (check_is_orgadmin($_REQUEST['userid'],1)) {
+ if (check_is_orgadmin(intval($_REQUEST['userid']),1)) {
showheader(_("My CAcert.org Account!"));
printf(_("The user is listed as Organisation Administrator. Can't continue."));
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
+ showfooter();
+ exit;
+ }
+ if (!write_se_log(intval($_REQUEST['userid']), $_SESSION['profile']['id'], 'SE Account delete', trim($_REQUEST['arbitrationno']))) {
+ showheader(_("Something went wrong"));
+ echo _("Writing to the admin log failed. Can't continue.");
+ printf('<br/><a href="account.php?id=43&amp;userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>');
showfooter();
exit;
}
- account_delete($_REQUEST['userid'], trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']);
+ account_delete(intval($_REQUEST['userid']), trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']);
}
- if(($id == 51 || $id == 52 || $oldid == 52) && $_SESSION['profile']['tverify'] <= 0)
+ if(($id == 51 || $id == 52 || $oldid == 52))
{
showheader(_("My CAcert.org Account!"));
- echo _("You don't have access to this area.");
+ echo _("You don't have access to this area.\nThe Tverify programme is terminated as of 16th November 2010" );
showfooter();
exit;
}
- if($oldid == 52)
- {
- $uid = intval($_REQUEST['uid']);
- $query = "select * from `tverify` where `id`='$uid' and `modified`=0";
- $rc = mysql_num_rows(mysql_query($query));
- if($rc <= 0)
+ if($id == 59){
+ if (!($oldid == 43 && $_SESSION['profile']['admin'] == 1) &&
+ !($oldid == 13 && intval($_REQUEST['userid']) == $_SESSION['profile']['id']))
{
showheader(_("My CAcert.org Account!"));
- echo _("Unable to find a valid tverify request for this ID.");
+ echo _("You do not have access to this page.");
showfooter();
exit;
}
}
- if($oldid == 52)
- {
- $query = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".$_SESSION['profile']['id']."'";
- $rc = mysql_num_rows(mysql_query($query));
- if($rc > 0)
- {
- showheader(_("My CAcert.org Account!"));
- echo _("You have already voted on this request.");
- showfooter();
- exit;
- }
- }
-
- if($oldid == 52 && ($_REQUEST['agree'] != "" || $_REQUEST['disagree'] != ""))
- {
- $vote = -1;
- if($_REQUEST['agree'] != "")
- $vote = 1;
-
- $query = "insert into `tverify-vote` set
- `tverify`='$uid',
- `memid`='".$_SESSION['profile']['id']."',
- `when`=NOW(), `vote`='$vote',
- `comment`='".mysql_real_escape_string($_REQUEST['comment'])."'";
- mysql_query($query);
-
- $rc = mysql_num_rows(mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='1'"));
- if($rc >= 8)
- {
- mysql_query("update `tverify` set `modified`=NOW() where `id`='$uid'");
- $tverify = mysql_fetch_assoc(mysql_query("select * from `tverify` where `id`='$uid'"));
- $memid = $tverify['memid'];
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$memid'"));
- $tmp = mysql_fetch_assoc(mysql_query("select sum(`points`) as `points` from `notary` where `to`='$memid'"));
-
- $points = 0;
- if($tverify['URL'] != "" && $tverify['photoid'] != "")
- $points = 150 - intval($tmp['points']);
- if($tverify['URL'] != "" && $tverify['photoid'] == "")
- $points = 90 - intval($tmp['points']);
- if($tverify['URL'] == "" && $tverify['photoid'] == "")
- $points = 50 - intval($tmp['points']);
-
- if($points < 0)
- $points = 0;
-
- if($points > 0)
- {
- mysql_query("insert into `notary` set `from`='0', `to`='$memid', `points`='$points',
- `method`='Thawte Points Transfer', `when`=NOW()");
- fix_assurer_flag($memid);
- }
- $totalpoints = intval($tmp['points']) + $points;
-
- $body = _("Your request to have points transfered was successful. You were issued $points points as a result, and you now have $totalpoints in total")."\n\n"._("The following comments were made by reviewers")."\n\n";
- $res = mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='1'");
- while($row = mysql_fetch_assoc($res))
- $body .= $row['comment']."\n";
- $body .= "\n";
-
- $body .= _("Best regards")."\n";
- $body .= _("CAcert Support Team");
- sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");
- }
-
- $rc = mysql_num_rows(mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='-1'"));
- if($rc >= 4)
- {
- mysql_query("update `tverify` set `modified`=NOW() where `id`='$uid'");
- $tverify = mysql_fetch_assoc(mysql_query("select * from `tverify` where `id`='$uid'"));
- $memid = $tverify['memid'];
- $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$memid'"));
-
- $body = _("Unfortunately your request for a points increase has been denied, below is the comments from people that reviewed your request as to why they rejected your application.")."\n\n";
- $res = mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='-1'");
- while($row = mysql_fetch_assoc($res))
- $body .= $row['comment']."\n";
- $body .= "\n";
-
- $body .= _("You are welcome to try submitting another request at any time in the future, please make sure you take the reviewer comments into consideration or you risk having your application rejected again.")."\n\n";
-
- $body .= _("Best regards")."\n";
- $body .= _("CAcert Support Team");
- sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");
- }
-
- showheader(_("My CAcert.org Account!"));
- echo _("Your vote has been accepted.");
- showfooter();
- exit;
- }
if(intval($cert) > 0)
$_SESSION['_config']['cert'] = intval($cert);
diff --git a/includes/account_stuff.php b/includes/account_stuff.php
index dbebf6a..e2f60f6 100644
--- a/includes/account_stuff.php
+++ b/includes/account_stuff.php
@@ -22,6 +22,7 @@
function showheader($title = "CAcert.org", $title2 = "")
{
global $id, $PHP_SELF;
+ $PHP_SELF = &$_SERVER['PHP_SELF'];
$expand="";
$tmpid = $id;
if($PHP_SELF == "/wot.php")
@@ -35,46 +36,51 @@
switch($tmpid)
{
- case 1:
- case 2: $expand = " explode('emailacc');"; break;
- case 3:
- case 4:
- case 5:
- case 6: $expand = " explode('clicerts');"; break;
- case 7:
- case 8:
- case 9: $expand = " explode('domains');"; break;
- case 10:
- case 11:
- case 12:
- case 15: $expand = " explode('servercert');"; break;
- case 13:
- case 14:
- case 36:
- case 41:
+ case 1: // Add email address
+ case 2: $expand = " explode('emailacc');"; break; // View email addresses
+ case 3: // Add Client certificate
+ case 4: // Confirm Client Certificate Request
+ case 5: // View Client Certificates
+ case 6: $expand = " explode('clicerts');"; break; // Client Certificate page
+ case 7: // Add new domain
+ case 8: // Confirm Domain page
+ case 9: $expand = " explode('domains');"; break; // View Domains
+ case 10: // Add Server Certifiacte
+ case 11: // Confirm Server Certificate Rewust
+ case 12: // View Server Cerificate
+ case 15: $expand = " explode('servercert');"; break; // Server Certificate page
+ case 13: // ViewEdit
+ case 14: // Change password
+ case 36: // My Alert settings
+ case 41: // Language Settings
+ case 55: // Trainings
+ case 59: // Account History
case 507:
- case 508:
- case 513: $expand = " explode('mydetails');"; break;
- case 16:
- case 17:
- case 18:
- case 19: $expand = " explode('clientorg');"; break;
- case 20:
- case 21:
- case 22:
- case 23: $expand = " explode('serverorg');"; break;
- case 24:
- case 25:
- case 26:
- case 27:
- case 28:
- case 29:
- case 30:
+ case 508: // My Listing
+ case 510: // Old points calculation
+ case 515: // New points calculation
+ case 513: $expand = " explode('mydetails');"; break; // My Location
+ case 16: // Add Org Client Cert
+ case 17: // Confirm Org Client Certificate Request
+ case 18: // View Org Client Certificate
+ case 19: $expand = " explode('clientorg');"; break; // Org Cleint Cert page
+ case 20: // Add Org Server Cert
+ case 21: // Conform Org Server Cert Request
+ case 22: // View Org Server Certs
+ case 23: $expand = " explode('serverorg');"; break; // Org Server Certificate page
+ case 24: // Add new Organisation
+ case 25: // View Organisation List
+ case 26: // View Organisation Domains
+ case 27: // Edit Org Account
+ case 28: // View Add Org Domain
+ case 29: // Edit Org Domain
+ case 30: // Delete Org Domain
case 31:
- case 32:
- case 33:
- case 34:
- case 35: $expand = " explode('orgadmin');"; break;
+ case 32: // View Org Admin
+ case 33: // Add Org Admin
+ case 34: // Delete Org Admin
+ case 60: // View Organisation Account History
+ case 35: $expand = " explode('orgadmin');"; break; // View Org Admin Organisation List
case 42:
case 43:
case 44:
@@ -86,20 +92,19 @@
case 50:
case 54:
case 53: $expand = " explode('sysadmin');"; break;
- case 500:
+ case 500: // CAcert Web of Trust
case 501:
- case 502:
- case 503:
- case 504:
- case 505:
+ case 502: // Become an Assurer
+ case 503: // CAcert Web of Trust Roles
+ case 504: // TTP
+ case 505: // Assurer Some one
case 506:
case 509:
- case 510:
case 511:
- case 512: $expand = " explode('WoT');"; break;
+ case 512: $expand = " explode('WoT');"; break; // Find Assurer
case 1000:
case 1001:
- case 1002:
+ case 1002: // View GPG key
case 1003:
case 1004:
case 1005:
@@ -108,9 +113,9 @@
case 1008:
case 1009:
case 1010: $expand = " explode('gpg');"; break;
- case 1500:
- case 1501:
- case 1502:
+ case 1500: // Dipute
+ case 1501: // Dispute Email Request
+ case 1502: // ViewEdit
case 1503:
case 1504:
case 1505:
@@ -137,7 +142,6 @@
<title><?=$title?></title>
<? if(array_key_exists('header',$_SESSION) && $_SESSION['_config']['header'] != "") { ?><?=$_SESSION['_config']['header']?><? } ?>
<link rel="stylesheet" href="/styles/default.css" type="text/css" />
-<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<script language="JavaScript" type="text/javascript">
function explode(e) {
if (document.getElementById(e).style.display == 'none') {
@@ -172,9 +176,11 @@ function hideall() {
</div>
<div class="relatedLinks">
<h3 class="pointer" onclick="explode('mydetails')">+ <?=_("My Details")?></h3>
- <ul class="menu" id="mydetails"><li><a href="account.php?id=13"><?=_("View/Edit")?></a></li><li><a href="account.php?id=14"><?=_("Change Password")?></a></li><li><a href="account.php?id=41"><?=_("Default Language")?></a></li><li><a href="wot.php?id=8"><?=_("My Listing")?></a></li><li><a href="wot.php?id=13"><?=_("My Location")?></a></li><li><a href="account.php?id=36"><?=_("My Alert Settings")?></a></li><li><a href="wot.php?id=10"><?=_("My Points")?></a></li><?
+ <ul class="menu" id="mydetails"><li><a href="account.php?id=13"><?=_("View/Edit")?></a></li><li><a href="account.php?id=14"><?=_("Change Password")?></a></li><li><a href="account.php?id=41"><?=_("Default Language")?></a></li><li><a href="wot.php?id=8"><?=_("My Listing")?></a></li><li><a href="wot.php?id=13"><?=_("My Location")?></a></li><li><a href="account.php?id=36"><?=_("My Alert Settings")?></a></li><li><a href="account.php?id=55"><?=_("My Trainings")?></a></li><li><a href="wot.php?id=10"><?=_("My Points")?></a></li><?
+/* to delete
if($_SESSION['profile']['id'] == 1 || $_SESSION['profile']['id'] == 5897)
echo "<li><a href='sqldump.php'>SQL Dump</a></li>";
+*/
?></ul>
</div>
<div class="relatedLinks">
@@ -217,7 +223,7 @@ function hideall() {
<? } ?>
<div class="relatedLinks">
<h3 class="pointer" onclick="explode('WoT')">+ <?=_("CAcert Web of Trust")?></h3>
- <ul class="menu" id="WoT"><li><a href="wot.php?id=0"><?=_("About")?></a></li><li><a href="wot.php?id=12"><?=_("Find an Assurer")?></a></li><li><a href="wot.php?id=3"><?=_("Rules")?></a></li><li><? if($_SESSION['profile']['assurer'] != 1) { ?><a href="wot.php?id=2"><?=_("Becoming an Assurer")?></a><? } else { ?><a href="wot.php?id=5"><?=_("Assure Someone")?></a><? } ?></li><li><a href="wot.php?id=4"><?=_("Trusted ThirdParties")?></a></li><? if($_SESSION['profile']['points'] >= 500) { ?><li><a href="wot.php?id=11"><div style="white-space:nowrap"><?=_("Organisation Assurance")?></div></a></li><? } ?><li><a href="account.php?id=55"><?=_("Training")?></a></li></ul>
+ <ul class="menu" id="WoT"><li><a href="wot.php?id=0"><?=_("About")?></a></li><li><a href="wot.php?id=12"><?=_("Find an Assurer")?></a></li><li><a href="wot.php?id=3"><?=_("Rules")?></a></li><li><? if($_SESSION['profile']['assurer'] != 1) { ?><a href="wot.php?id=2"><?=_("Becoming an Assurer")?></a><? } else { ?><a href="wot.php?id=5"><?=_("Assure Someone")?></a><? } ?></li><li><a href="wot.php?id=4"><?=_("Trusted ThirdParties")?></a></li><? if($_SESSION['profile']['points'] >= 500) { ?><li><a href="wot.php?id=11"><div style="white-space:nowrap"><?=_("Organisation Assurance")?></div></a></li><? } ?></ul>
</div>
<div class="relatedLinks">
<h3 class="pointer" onclick="explode('WoTForms')">+ <?=_("CAP Forms")?></h3><?
diff --git a/includes/general.php b/includes/general.php
index d89c0e6..8846f4b 100644
--- a/includes/general.php
+++ b/includes/general.php
@@ -28,6 +28,12 @@
// if($_SESSION['profile']['id'] > 0)
// session_regenerate_id();
+ //cf. http://stackoverflow.com/a/14532168
+ if(!defined('ENT_HTML401')) define('ENT_HTML401', 0);
+ if(!defined('ENT_XML1')) define('ENT_XML1', 16);
+ if(!defined('ENT_XHTML')) define('ENT_XHTML', 32);
+ if(!defined('ENT_HTML5')) define('ENT_HTML5', (32|16));
+
$pageLoadTime_Start = microtime(true);
$junk = array(_("Face to Face Meeting"), _("Trusted Third Parties"), _("Thawte Points Transfer"), _("Administrative Increase"),
@@ -57,7 +63,7 @@
exit;
}
- if(array_key_exists('HTTP_HOST',$_SERVER) &&
+ if(array_key_exists('HTTP_HOST',$_SERVER) &&
($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] ||
$_SERVER['HTTP_HOST'] == $_SESSION['_config']['tverify']))
{
@@ -77,12 +83,12 @@
L10n::detect_language();
L10n::init_gettext();
- if(array_key_exists('profile',$_SESSION) && is_array($_SESSION['profile']) && array_key_exists('id',$_SESSION['profile']) && $_SESSION['profile']['id'] > 0)
+ if(array_key_exists('profile',$_SESSION) && is_array($_SESSION['profile']) && array_key_exists('id',$_SESSION['profile']) && $_SESSION['profile']['id'] > 0)
{
- $locked = mysql_fetch_assoc(mysql_query("select `locked` from `users` where `id`='".$_SESSION['profile']['id']."'"));
+ $locked = mysql_fetch_assoc(mysql_query("select `locked` from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
if($locked['locked'] == 0)
{
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -169,19 +175,19 @@
$points++;
//echo "Points due to length and charset: $points<br/>";
-
+
// check for historical password proposal
if ($pwd === "Fr3d Sm|7h") {
return 0;
}
-
+
return $points;
}
function checkpw($pwd, $email, $fname, $mname, $lname, $suffix)
{
$points = checkpwlight($pwd);
-
+
if(@strstr(strtolower($pwd), strtolower($email)))
$points--;
@@ -219,7 +225,7 @@
//echo "Points due to name matches: $points<br/>";
$shellpwd = escapeshellarg($pwd);
- $do = `grep $shellpwd /usr/share/dict/american-english`;
+ $do = shell_exec("grep -F -- $shellpwd /usr/share/dict/american-english");
if($do)
$points--;
@@ -232,7 +238,7 @@
{
$bits = explode(": ", $_SESSION['_config']['subject'], 2);
$bits = str_replace(", ", "|", str_replace("/", "|", array_key_exists('1',$bits)?$bits['1']:""));
- $bits = explode("|", $bits);
+ $bits = explode("|", $bits);
$_SESSION['_config']['cnc'] = $_SESSION['_config']['subaltc'] = 0;
$_SESSION['_config']['OU'] = "";
@@ -287,7 +293,7 @@
$dom = $bits[$i];
$_SESSION['_config']['row'] = "";
$dom = mysql_real_escape_string($dom);
- $query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
+ $query = "select * from domains where `memid`='".intval($_SESSION['profile']['id'])."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -339,7 +345,7 @@
$dom = $bits[$i];
$_SESSION['_config']['altrow'] = "";
$dom = mysql_real_escape_string($dom);
- $query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
+ $query = "select * from domains where `memid`='".intval($_SESSION['profile']['id'])."' and `domain` like '$dom' and `deleted`=0 and `hash`=''";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -378,7 +384,7 @@
$_SESSION['_config']['row'] = "";
$dom = mysql_real_escape_string($dom);
$query = "select *, `orginfo`.`id` as `id` from `orginfo`,`orgdomains`,`org` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`orgdomains`.`orgid`=`orginfo`.`id` and
`orgdomains`.`domain`='$dom'";
@@ -426,7 +432,7 @@
$_SESSION['_config']['altrow'] = "";
$dom = mysql_real_escape_string($dom);
$query = "select * from `orginfo`,`orgdomains`,`org` where
- `org`.`memid`='".$_SESSION['profile']['id']."' and
+ `org`.`memid`='".intval($_SESSION['profile']['id'])."' and
`org`.`orgid`=`orginfo`.`id` and
`orgdomains`.`orgid`=`orginfo`.`id` and
`orgdomains`.`domain`='$dom'";
@@ -458,7 +464,7 @@
$dom = $bits[$i];
$dom = mysql_real_escape_string($dom);
$query = "select * from `org`,`orgdomains`,`orginfo`
- where `org`.`memid`='".$_SESSION['profile']['id']."'
+ where `org`.`memid`='".intval($_SESSION['profile']['id'])."'
and `orgdomains`.`orgid`=`org`.`orgid`
and `orginfo`.`id`=`org`.`orgid`
and `orgdomains`.`domain`='$dom'";
@@ -477,12 +483,12 @@
if($id <= 0)
$id = $_SESSION['profile']['id'];
- $query = "select sum(`points`) as `points` from `notary` where `to`='$id' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='$id' and `deleted` = 0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
$dob = date("Y-m-d", mktime(0,0,0,date("m"),date("d"),date("Y")-18));
- $query = "select * from `users` where `id`='".$_SESSION['profile']['id']."' and `dob` < '$dob'";
+ $query = "select * from `users` where `id`='".intval($_SESSION['profile']['id'])."' and `dob` < '$dob'";
if(mysql_num_rows(mysql_query($query)) < 1)
{
if($points >= 100)
@@ -506,7 +512,7 @@
return(0);
}
- function hex2bin($data)
+ function gpg_hex2bin($data)
{
while(strstr($data, "\\x"))
{
@@ -527,7 +533,8 @@
$fp = fopen($tmpfname, "w");
fputs($fp, $message);
fclose($fp);
- $do = `/usr/bin/gpg --homedir /home/gpg --clearsign "$tmpfname"|/usr/sbin/sendmail "$to"`;
+ $to_esc = escapeshellarg($to);
+ $do = shell_exec("/usr/bin/gpg --homedir /home/gpg --clearsign \"$tmpfname\"|/usr/sbin/sendmail ".$to_esc);
@unlink($tmpfname);
}
@@ -538,9 +545,9 @@
{
list($username,$domain)=explode('@',$email,2);
$dom = escapeshellarg($domain);
- $line = trim(`dig +short MX $dom 2>&1`);
+ $line = trim(shell_exec("dig +short MX $dom 2>&1"));
#echo $email."-$dom-$line-\n";
-#echo `dig +short mx heise.de 2>&1`."-<br>\n";
+#echo shell_exec("dig +short mx heise.de 2>&1")."-<br>\n";
$list = explode("\n", $line);
foreach($list as $row) {
@@ -557,7 +564,7 @@
$fp = @fsockopen($domain,25,$errno,$errstr,5);
if($fp)
{
-
+
$line = fgets($fp, 4096);
while(substr($line, 0, 4) == "220-")
$line = fgets($fp, 4096);
@@ -581,7 +588,7 @@
$line = mysql_real_escape_string(trim(strip_tags($line)));
$query = "insert into `pinglog` set `when`=NOW(), `email`='$myemail', `result`='$line'";
- if(is_array($_SESSION['profile'])) $query.=", `uid`='".$_SESSION['profile']['id']."'";
+ if(isset($_SESSION['profile']) && is_array($_SESSION['profile']) && isset($_SESSION['profile']['id'])) $query.=", `uid`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
if(substr($line, 0, 3) != "250")
@@ -591,7 +598,7 @@
}
}
}
- $query = "insert into `pinglog` set `when`=NOW(), `uid`='".$_SESSION['profile']['id']."',
+ $query = "insert into `pinglog` set `when`=NOW(), `uid`='".intval($_SESSION['profile']['id'])."',
`email`='$myemail', `result`='Failed to make a connection to the mail server'";
mysql_query($query);
return _("Failed to make a connection to the mail server");
@@ -662,7 +669,7 @@
return $ticket;
}
- function sanitizeHTML($input)
+ function sanitizeHTML($input)
{
return htmlentities(strip_tags($input), ENT_QUOTES);
//In case of problems, please use the following line again:
@@ -732,7 +739,7 @@
$text=preg_replace("/[^\w-.@]/","",$text);
return($text);
}
-
+
// returns text message to be shown to the user given the result of is_no_assurer
function no_assurer_text($Status)
@@ -775,7 +782,7 @@
$name="../$type/$kind/".intval($id/1000)."/$kind-".intval($id).".$type";
if (!is_dir("../csr")) { mkdir("../csr",0777); }
if (!is_dir("../crt")) { mkdir("../crt",0777); }
-
+
if (!is_dir("../csr/$kind")) { mkdir("../csr/$kind",0777); }
if (!is_dir("../crt/$kind")) { mkdir("../crt/$kind",0777); }
if (!is_dir("../csr/$kind/".intval($id/1000))) { mkdir("../csr/$kind/".intval($id/1000)); }
diff --git a/includes/general_stuff.php b/includes/general_stuff.php
index 4c1bd30..10c4e0a 100644
--- a/includes/general_stuff.php
+++ b/includes/general_stuff.php
@@ -38,7 +38,7 @@ google_color_text = "000000";
google_color_border = "FFFFFF";
//-->
</script>
-<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script><? } else {
+<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script><? } else {
?><h2><?=_("Free digital certificates!")?></h2><? } ?></div>
</div>
<div id="pageNav">
@@ -47,15 +47,15 @@ google_color_border = "FFFFFF";
<? if(array_key_exists('mconn',$_SESSION) && $_SESSION['mconn']) { ?>
<a href="https://<?=$_SESSION['_config']['normalhostname']?>/index.php?id=1"><?=_("Join")?></a>
<? } ?>
- <a href="/policy/CAcertCommunityAgreement.php"><?=_("Community Agreement")?></a>
+ <a href="/policy/CAcertCommunityAgreement.html"><?=_("Community Agreement")?></a>
<a href="/index.php?id=3"><?=_("Root Certificate")?></a>
</div>
<? if(array_key_exists('mconn',$_SESSION) && $_SESSION['mconn']) { ?>
<div class="relatedLinks">
<h3 class="pointer"><?=_("My Account")?></h3>
- <a href="https://<?=$_SESSION['_config']['normalhostname']?>/index.php?id=4"><?=_("Password Login")?></a>
+ <a href="https://<?=$_SESSION['_config']['normalhostname']?>/index.php?id=4"><?=_("Password Login")?></a>
<a href="https://<?=$_SESSION['_config']['normalhostname']?>/index.php?id=5"><?=_("Lost Password")?></a>
- <a href="https://<?=$_SESSION['_config']['normalhostname']?>/index.php?id=4&amp;noauto=1"><?=_("Net Cafe Login")?></a>
+ <a href="https://<?=$_SESSION['_config']['normalhostname']?>/index.php?id=4&amp;noauto=1"><?=_("Net Cafe Login")?></a>
<a href="https://<?=$_SESSION['_config']['securehostname']?>/index.php?id=4"><?=_("Certificate Login")?></a>
</div>
<? } ?>
@@ -137,8 +137,8 @@ if(!function_exists("showfooter"))
<a href="/policy/PrivacyPolicy.html"><?=_("Privacy Policy")?></a> |
<a href="/index.php?id=51"><?=_("Mission Statement")?></a> | <a href="/index.php?id=11"><?=_("Contact Us")?></a> |
&copy;2002-<?=date("Y")?> <?=_("by CAcert")?></div>
-</div>
-</body>
+</div>
+</body>
</html><?
}
}
diff --git a/includes/lib/account.php b/includes/lib/account.php
index e311668..dd8afd3 100644
--- a/includes/lib/account.php
+++ b/includes/lib/account.php
@@ -19,10 +19,10 @@
/**
* Function to recalculate the cached Assurer status
- *
+ *
* @param int $userID
* if the user ID is not given the flag will be recalculated for all users
- *
+ *
* @return bool
* false if there was an error on fixing the flag. This does NOT return the
* new value of the flag
@@ -30,7 +30,7 @@
function fix_assurer_flag($userID = NULL)
{
// Update Assurer-Flag on users table if 100 points and CATS passed.
- //
+ //
// We may have some performance issues here if no userID is given
// there are ~150k assurances and ~220k users currently
// but the exists-clause on cats_passed should be a good filter
@@ -46,20 +46,21 @@ function fix_assurer_flag($userID = NULL)
WHERE `cp`.`variant_id` = `cv`.`id`
AND `cv`.`type_id` = 1
AND `cp`.`user_id` = `u`.`id`
- )
+ )
AND (
SELECT SUM(`points`) FROM `notary` AS `n`
WHERE `n`.`to` = `u`.`id`
AND (`n`.`expire` > now()
- OR `n`.`expire` IS NULL)
+ OR `n`.`expire` IS NULL)
+ AND `n`.`deleted` = 0
) >= 100';
-
+
$query = mysql_query($sql);
if (!$query) {
return false;
}
// Challenge has been passed and non-expired points >= 100
-
+
// Reset flag if requirements are not met
//
// Also a bit performance critical but assurer flag is only set on
@@ -86,13 +87,64 @@ function fix_assurer_flag($userID = NULL)
`n`.`expire` > now()
OR `n`.`expire` IS NULL
)
+ AND `n`.`deleted` = 0
) < 100
)';
-
+
$query = mysql_query($sql);
if (!$query) {
return false;
}
-
+
return true;
-} \ No newline at end of file
+}
+
+/**
+ * Supported hash algorithms for signing certificates
+ */
+class HashAlgorithms {
+ /**
+ * Default hash algorithm identifier for signing
+ * @var string
+ */
+ public static $default = 'sha256';
+
+ /**
+ * Get display strings for the supported hash algorithms
+ * @return array(string=>array('name'=>string, 'info'=>string))
+ * - [$hash_identifier]['name'] = Name that should be displayed in UI
+ * - [$hash_identifier]['info'] = Additional information that can help
+ * with the selection of a suitable algorithm
+ */
+ public static function getInfo() {
+ return array(
+ 'sha256' => array(
+ 'name' => 'SHA-256',
+ 'info' => _('Currently recommended, because the other algorithms might break on some older versions of the GnuTLS library (older than 3.x) still shipped in Debian for example.'),
+ ),
+ 'sha384' => array(
+ 'name' => 'SHA-384',
+ 'info' => '',
+ ),
+ 'sha512' => array(
+ 'name' => 'SHA-512',
+ 'info' => _('Highest protection against hash collision attacks of the algorithms offered here.'),
+ ),
+ );
+ }
+
+ /**
+ * Check if the input is a supported hash algorithm identifier otherwise
+ * return the identifier of the default hash algorithm
+ *
+ * @param string $hash_identifier
+ * @return string The cleaned identifier
+ */
+ public static function clean($hash_identifier) {
+ if (array_key_exists($hash_identifier, self::getInfo() )) {
+ return $hash_identifier;
+ } else {
+ return self::$default;
+ }
+ }
+}
diff --git a/includes/lib/check_weak_key.php b/includes/lib/check_weak_key.php
index 217b885..8ad2ccf 100644
--- a/includes/lib/check_weak_key.php
+++ b/includes/lib/check_weak_key.php
@@ -128,15 +128,14 @@ function checkWeakKeyText($text)
if ($algorithm === "rsaEncryption")
{
- if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text,
- $keysize))
+ if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text, $keysize))
{
return failWithId("checkWeakKeyText(): Couldn't parse the RSA ".
"key size.\nData:\n$text");
} else {
$keysize = intval($keysize[1]);
}
-
+
if ($keysize < 2048)
{
return sprintf(_("The keys that you use are very small ".
@@ -146,8 +145,7 @@ function checkWeakKeyText($text)
"<a href='//wiki.cacert.org/WeakKeys#SmallKey'>",
"</a>");
}
-
-
+
$debianVuln = checkDebianVulnerability($text, $keysize);
if ($debianVuln === true)
{
@@ -165,7 +163,7 @@ function checkWeakKeyText($text)
"checkDebianVulnerability().\nKeysize: $keysize\n".
"Data:\n$text");
}
-
+
if (!preg_match('/^\s*Exponent: (\d+) \(0x[0-9a-fA-F]+\)$/m', $text,
$exponent))
{
@@ -187,9 +185,9 @@ function checkWeakKeyText($text)
"<a href='//wiki.cacert.org/WeakKeys#SmallExponent'>",
"</a>");
} elseif (!(bccomp($exponent, "65537") >= 0 &&
- (bccomp($exponent, "100000") === -1 ||
- // speed things up if way smaller than 2^256
- bccomp($exponent, bcpow("2", "256")) === -1) )) {
+ (bccomp($exponent, "100000") === -1 ||
+ // speed things up if way smaller than 2^256
+ bccomp($exponent, bcpow("2", "256")) === -1) )) {
// 65537 <= exponent < 2^256 recommended by NIST
// not critical but log so we have some statistics about
// affected users
@@ -198,10 +196,83 @@ function checkWeakKeyText($text)
E_USER_NOTICE);
}
}
- }
- /* No weakness found */
- return "";
+ // No weakness found
+ return "";
+ } // End RSA
+
+/*
+//Fails to work due to outdated OpenSSL 0.9.8o
+//For this to work OpenSSL 1.0.1f or newer is required
+//which is currently unavailable on the systems
+//If DSA2048 or longer is used the CSR hangs pending on the signer.
+ if ($algorithm === "dsaEncryption")
+ {
+ if (!preg_match('/^\s*Public Key Algorithm:\s+dsaEncryption\s+pub:\s+([0-9a-fA-F:\s]+)\s+P:\s+([0-9a-fA-F:\s]+)\s+Q:\s+([0-9a-fA-F:\s]+)\s+G:\s+([0-9a-fA-F:\s]+)\s+$/sm', $text, $keydetail))
+ {
+ return failWithId("checkWeakKeyText(): Couldn't parse the DSA ".
+ "key size.\nData:\n$text");
+ }
+
+ $key_pub = strtr(preg_replace("/[^0-9a-fA-F]/", "", $keydetail[1]), "ABCDEF", "abcdef");
+ $key_P = strtr(preg_replace("/[^0-9a-fA-F]/", "", $keydetail[2]), "ABCDEF", "abcdef");
+ $key_Q = strtr(preg_replace("/[^0-9a-fA-F]/", "", $keydetail[3]), "ABCDEF", "abcdef");
+ $key_G = strtr(preg_replace("/[^0-9a-fA-F]/", "", $keydetail[4]), "ABCDEF", "abcdef");
+
+ //Verify the numbers provided by the client
+ $num_pub = @gmp_init($key_pub, 16);
+ $num_P = @gmp_init($key_P, 16);
+ $num_Q = @gmp_init($key_Q, 16);
+ $num_G = @gmp_init($key_G, 16);
+
+ $bit_P = ltrim(gmp_strval($num_P, 2), "0");
+ $keysize = strlen($bit_P);
+
+ if ($keysize < 2048) {
+ return sprintf(_("The keys that you use are very small ".
+ "and therefore insecure. Please generate stronger ".
+ "keys. More information about this issue can be ".
+ "found in %sthe wiki%s"),
+ "<a href='//wiki.cacert.org/WeakKeys#SmallKey'>",
+ "</a>");
+ }
+
+ //Following checks based on description of key generation in Wikipedia
+ //These checks do not ensure a strong key, but at least check for enough sanity in the key material
+ // cf. https://en.wikipedia.org/wiki/Digital_Signature_Algorithm#Key_generation
+
+ //Check that P is prime
+ if(!gmp_testprime($num_P)) {
+ return failWithId("checkWeakKeyText(): The supplied DSA ".
+ "key does seem to have a non-prime public modulus.\nData:\n$text");
+ }
+
+ //Check that Q is prime
+ if(!gmp_testprime($num_Q)) {
+ return failWithId("checkWeakKeyText(): The supplied DSA ".
+ "key does seem to have a non-prime Q-value.\nData:\n$text");
+ }
+
+ //Check if P-1 is diviseable by Q
+ if(0 !== gmp_cmp("1", gmp_mod($num_P, $num_Q))) {
+ return failWithId("checkWeakKeyText(): The supplied DSA ".
+ "key does seem to have P mod Q === 1 (i.e. P-1 is not diviseable by Q).\nData:\n$text");
+ }
+
+ //Check the numbers are all less than the public modulus P
+ if(0 <= gmp_cmp($num_Q, $num_P) || 0 <= gmp_cmp($num_G, $num_P) || 0 <= gmp_cmp($num_pub, $num_P)) {
+ return failWithId("checkWeakKeyText(): The supplied DSA ".
+ "key does seem to be normalized to have Q < P, G < P and pub < P.\nData:\n$text");
+ }
+
+ // No weakness found
+ return "";
+ } // End DSA
+*/
+
+
+ return _("The keys you supplied use an unrecognized algorithm. ".
+ "For security reasons these keys can not be signed by CAcert.");
}
/**
diff --git a/includes/lib/general.php b/includes/lib/general.php
index 85b132d..5458788 100644
--- a/includes/lib/general.php
+++ b/includes/lib/general.php
@@ -18,10 +18,10 @@
/**
* Checks if the user may log in and retrieve the user id
- *
+ *
* Usually called with $_SERVER['SSL_CLIENT_M_SERIAL'] and
* $_SERVER['SSL_CLIENT_I_DN_CN']
- *
+ *
* @param $serial string
* usually $_SERVER['SSL_CLIENT_M_SERIAL']
* @param $issuer_cn string
@@ -32,9 +32,9 @@
function get_user_id_from_cert($serial, $issuer_cn)
{
$query = "select `memid` from `emailcerts` where
- `serial`='".mysql_escape_string($serial)."' and
+ `serial`='".mysql_real_escape_string($serial)."' and
`rootcert`= (select `id` from `root_certs` where
- `Cert_Text`='".mysql_escape_string($issuer_cn)."') and
+ `Cert_Text`='".mysql_real_escape_string($issuer_cn)."') and
`revoked`=0 and disablelogin=0 and
UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() > 0";
$res = mysql_query($query);
@@ -43,7 +43,7 @@ function get_user_id_from_cert($serial, $issuer_cn)
$row = mysql_fetch_assoc($res);
return intval($row['memid']);
}
-
+
return -1;
}
@@ -71,7 +71,7 @@ function failWithId($errormessage) {
/**
* Runs a command on the shell and return it's exit code and output
- *
+ *
* @param string $command
* The command to run. Make sure that you escapeshellarg() any non-constant
* parts as this is executed on a shell!
@@ -85,7 +85,7 @@ function failWithId($errormessage) {
* @param string|bool $errors
* The output the command wrote to STDERR (this is passed as reference),
* if true (default) the output will be written to the real STDERR
- *
+ *
* @return int|bool
* The exit code of the command, true if the execution of the command
* failed (true because then
@@ -93,38 +93,38 @@ function failWithId($errormessage) {
*/
function runCommand($command, $input = "", &$output = null, &$errors = true) {
$descriptorspec = array();
-
+
if ($input !== true) {
$descriptorspec[0] = array("pipe", "r"); // STDIN for child
}
-
+
if ($output !== true) {
$descriptorspec[1] = array("pipe", "w"); // STDOUT for child
}
-
+
if ($errors !== true) {
$descriptorspec[2] = array("pipe", "w"); // STDERR for child
}
-
+
$proc = proc_open($command, $descriptorspec, $pipes);
-
+
if (is_resource($proc))
{
if ($input !== true) {
fwrite($pipes[0], $input);
fclose($pipes[0]);
}
-
+
if ($output !== true) {
$output = stream_get_contents($pipes[1]);
}
-
+
if ($errors !== true) {
$errors = stream_get_contents($pipes[2]);
}
-
+
return proc_close($proc);
-
+
} else {
return true;
}
@@ -145,19 +145,18 @@ function runCommand($command, $input = "", &$output = null, &$errors = true) {
{
$Result |= 5;
}
-
- $query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now()');
+
+ $query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now() and `deleted` = 0');
$row = mysql_fetch_assoc($query);
if ($row['points'] < 100) {
$Result |= 3;
}
-
+
$query = mysql_query('SELECT `assurer_blocked` FROM `users` WHERE `id` = \''.(int)intval($userID).'\'');
$row = mysql_fetch_assoc($query);
if ($row['assurer_blocked'] > 0) {
$Result |= 9;
}
-
+
return $Result;
}
- \ No newline at end of file
diff --git a/includes/lib/l10n.php b/includes/lib/l10n.php
index 85b7aff..3153ee7 100644
--- a/includes/lib/l10n.php
+++ b/includes/lib/l10n.php
@@ -64,7 +64,7 @@ class L10n {
*
* @var array(string => string)
*/
- private static $locales = array(
+ public static $locales = array(
"ar" => "ar_JO",
"bg" => "bg_BG",
"cs" => "cs_CZ",
@@ -340,4 +340,21 @@ class L10n {
bindtextdomain($domain, $_SESSION['_config']['filepath'].'/locale');
textdomain($domain);
}
-} \ No newline at end of file
+
+ public static function set_recipient_language($accountid) {
+ //returns the language of a recipient to make sure that the language is correct
+ //use together with
+ $query = "select `language` from `users` where `id`='".intval($accountid)."'";
+ $res = mysql_query($query);
+ if (mysql_num_rows($res)>=0) {
+ $row = mysql_fetch_assoc($res);
+ if (NULL==$row['language'] || $row['language']=='') {
+ self::set_translation('en');
+ } else {
+ self::set_translation($row['language']);
+ }
+ } else {
+ self::set_translation('en');
+ }
+ }
+}
diff --git a/includes/loggedin.php b/includes/loggedin.php
index 4f9b8e8..c14f8c2 100644
--- a/includes/loggedin.php
+++ b/includes/loggedin.php
@@ -19,6 +19,7 @@
include_once("../includes/lib/general.php");
require_once("../includes/lib/l10n.php");
include_once("../includes/mysql.php");
+ require_once('../includes/notary.inc.php');
if(!isset($_SESSION['profile']) || !is_array($_SESSION['profile'])) {
$_SESSION['profile'] = array( 'id' => 0, 'loggedin' => 0 );
@@ -38,18 +39,18 @@
if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
continue;
if(is_int($key) || is_string($key))
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
- $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$uid'"));
+ $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($uid)."'"));
if($_SESSION['profile']['locked'] == 0)
$_SESSION['profile']['loggedin'] = 1;
else
unset($_SESSION['profile']);
}
-
+
if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && ($_SESSION['profile']['id'] == 0 || $_SESSION['profile']['loggedin'] == 0))
{
$user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'],
@@ -64,13 +65,13 @@
if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
continue;
if(is_int($key) || is_string($key))
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
$_SESSION['profile'] = mysql_fetch_assoc(mysql_query(
- "select * from `users` where `id`='".$user_id."'"));
+ "select * from `users` where `id`='".intval($user_id)."'"));
if($_SESSION['profile']['locked'] == 0)
$_SESSION['profile']['loggedin'] = 1;
else
@@ -82,38 +83,26 @@
{
if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5))
continue;
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
- $_SESSION['_config']['oldlocation'] = '';
-
- foreach($_GET as $key => $val)
- {
- if($_SESSION['_config']['oldlocation'])
- $_SESSION['_config']['oldlocation'] .= "&";
-
- $key = str_replace(array("\n", "\r"), '', $key);
- $val = str_replace(array("\n", "\r"), '', $val);
- $_SESSION['_config']['oldlocation'] .= "$key=$val";
- }
- $_SESSION['_config']['oldlocation'] = substr($_SERVER['SCRIPT_NAME'], 1)."?".$_SESSION['_config']['oldlocation'];
-
- header("location: https://".$_SESSION['_config']['securehostname']."/index.php?id=4");
+ $_SESSION['_config']['oldlocation'] = $_SERVER['REQUEST_URI'];
+ header("Location: https://{$_SESSION['_config']['securehostname']}/index.php?id=4");
exit;
}
}
if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && ($_SESSION['profile']['id'] <= 0 || $_SESSION['profile']['loggedin'] == 0))
{
- header("location: https://".$_SESSION['_config']['normalhostname']);
+ header("Location: https://{$_SESSION['_config']['normalhostname']}");
exit;
}
if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && $_SESSION['profile']['id'] > 0 && $_SESSION['profile']['loggedin'] > 0)
{
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -121,7 +110,7 @@
if($_SESSION['profile']['language'] == "")
{
$query = "update `users` set `language`='".L10n::get_translation()."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
} else {
L10n::set_translation($_SESSION['profile']['language']);
@@ -136,32 +125,28 @@
$_SESSION['profile'] = "";
foreach($_SESSION as $key => $value)
{
- unset($_SESSION[$key]);
- unset($$key);
- //session_unregister($key);
+ unset($_SESSION[$key]);
+ unset($$key);
+ //session_unregister($key);
}
- header("location: https://".$normalhost."/index.php");
+ header("Location: https://{$normalhost}/index.php");
exit;
}
if($_SESSION['profile']['loggedin'] < 1)
{
- $_SESSION['_config']['oldlocation'] = '';
-
- foreach($_REQUEST as $key => $val)
- {
- if('' != $_SESSION['_config']['oldlocation'])
- $_SESSION['_config']['oldlocation'] .= "&";
+ $_SESSION['_config']['oldlocation'] = $_SERVER['REQUEST_URI'];
+ header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4");
+ exit;
+ }
- $key = str_replace(array("\n", "\r"), '', $key);
- $val = str_replace(array("\n", "\r"), '', $val);
- $_SESSION['_config']['oldlocation'] .= "$key=$val";
+ if (!isset($_SESSION['profile']['ccaagreement']) || !$_SESSION['profile']['ccaagreement']) {
+ $_SESSION['profile']['ccaagreement']=get_user_agreement_status($_SESSION['profile']['id'],'CCA');
+ if (!$_SESSION['profile']['ccaagreement']) {
+ $_SESSION['_config']['oldlocation'] = $_SERVER['REQUEST_URI'];
+ header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=52");
+ exit;
}
- $_SESSION['_config']['oldlocation'] = substr($_SERVER['SCRIPT_NAME'], 1)."?".$_SESSION['_config']['oldlocation'];
- $hostname=$_SERVER['HTTP_HOST'];
- $hostname = str_replace(array("\n", "\r"), '', $hostname);
- header("location: https://".$hostname."/index.php?id=4");
- exit;
}
?>
diff --git a/includes/notary.inc.php b/includes/notary.inc.php
index b34b2f4..cd88c50 100644
--- a/includes/notary.inc.php
+++ b/includes/notary.inc.php
@@ -16,6 +16,9 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
+define('NULL_DATETIME', '0000-00-00 00:00:00');
+define('THAWTE_REVOCATION_DATETIME', '2010-11-16 00:00:00');
+
function query_init ($query)
{
return mysql_query($query);
@@ -35,7 +38,7 @@
function get_number_of_assurances ($userid)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting' AND `from`='".intval($userid)."' ");
+ WHERE `method` = 'Face to Face Meeting' AND `from`='".intval($userid)."' and `deleted` = 0");
$row = query_getnextrow($res);
return intval($row['list']);
@@ -44,7 +47,7 @@
function get_number_of_ttpassurances ($userid)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE (`method`='Trusted Third Parties' or `method`='TTP-Assisted') AND `to`='".intval($userid)."' ");
+ WHERE (`method`='Trusted Third Parties' or `method`='TTP-Assisted') AND `to`='".intval($userid)."' and `deleted` = 0");
$row = query_getnextrow($res);
return intval($row['list']);
@@ -53,7 +56,7 @@
function get_number_of_assurees ($userid)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting' AND `to`='".intval($userid)."' ");
+ WHERE `method` = 'Face to Face Meeting' AND `to`='".intval($userid)."' and `deleted` = 0");
$row = query_getnextrow($res);
return intval($row['list']);
@@ -62,7 +65,7 @@
function get_top_assurer_position ($no_of_assurances)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting'
+ WHERE `method` = 'Face to Face Meeting' and `deleted` = 0
GROUP BY `from` HAVING count(*) > '".intval($no_of_assurances)."'");
return intval(query_get_number_of_rows($res)+1);
}
@@ -70,32 +73,52 @@
function get_top_assuree_position ($no_of_assurees)
{
$res = query_init ("SELECT count(*) AS `list` FROM `notary`
- WHERE `method` = 'Face to Face Meeting'
+ WHERE `method` = 'Face to Face Meeting' and `deleted` = 0
GROUP BY `to` HAVING count(*) > '".intval($no_of_assurees)."'");
return intval(query_get_number_of_rows($res)+1);
}
- function get_given_assurances ($userid)
+ /**
+ * Get the list of assurances given by the user
+ * @param int $userid - id of the assurer
+ * @param int $log - if set to 1 also includes deleted assurances
+ * @return resource - a MySQL result set
+ */
+ function get_given_assurances($userid, $log=0)
{
- $res = query_init ("select * from `notary` where `from`='".intval($userid)."' and `from` != `to` order by `id` asc");
+ $deleted='';
+ if ($log == 0) {
+ $deleted = ' and `deleted` = 0 ';
+ }
+ $res = query_init("select * from `notary` where `from`='".intval($userid)."' and `from` != `to` $deleted order by `id` asc");
return $res;
}
- function get_received_assurances ($userid)
+ /**
+ * Get the list of assurances received by the user
+ * @param int $userid - id of the assuree
+ * @param int $log - if set to 1 also includes deleted assurances
+ * @return resource - a MySQL result set
+ */
+ function get_received_assurances($userid, $log=0)
{
- $res = query_init ("select * from `notary` where `to`='".intval($userid)."' and `from` != `to` order by `id` asc ");
+ $deleted='';
+ if ($log == 0) {
+ $deleted = ' and `deleted` = 0 ';
+ }
+ $res = query_init("select * from `notary` where `to`='".intval($userid)."' and `from` != `to` $deleted order by `id` asc ");
return $res;
}
function get_given_assurances_summary ($userid)
{
- $res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' group by points,awarded,method");
+ $res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' and `deleted` = 0 group by points,awarded,method");
return $res;
}
function get_received_assurances_summary ($userid)
{
- $res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' group by points,awarded,method");
+ $res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' and `deleted` = 0 group by points,awarded,method");
return $res;
}
@@ -113,69 +136,177 @@
return mysql_num_rows($res);
}
- function calc_experience ($row,&$points,&$experience,&$sum_experience,&$revoked)
+
+ /**
+ * Calculate awarded points (corrects some issues like out of range points
+ * or points that were issued by means that have been deprecated)
+ *
+ * @param array $row - associative array containing the data from the
+ * `notary` table
+ * @return int - the awarded points for this assurance
+ */
+ function calc_awarded($row)
+ {
+ // Back in the old days there was no `awarded` column => is now zero,
+ // there the `points` column contained that data
+ $points = max(intval($row['awarded']), intval($row['points']));
+
+ // Set negative points to zero, yes there are such things in the database
+ $points = max($points, 0);
+
+ switch ($row['method'])
+ {
+ // These programmes have been revoked
+ case 'Thawte Points Transfer': // revoke all Thawte-points (as per arbitration)
+ case 'CT Magazine - Germany': // revoke c't (only one test-entry)
+ case 'Temporary Increase': // revoke 'temporary increase' (Current usage breaks audit aspects, needs to be reimplemented)
+ $points = 0;
+ break;
+
+ case 'Administrative Increase': // ignore AI with 2 points or less (historical for experiance points, now other calculation)
+ if ($points <= 2) // maybe limit to 35/50 pts in the future?
+ $points = 0;
+ break;
+
+ // TTP assurances, limit to 35
+ case 'TTP-Assisted':
+ $points = min($points, 35);
+ break;
+
+ // TTP TOPUP, limit to 30
+ case 'TOPUP':
+ $points = min($points, 30);
+
+ // All these should be preserved for the time being
+ case 'Unknown': // to be revoked in the future? limit to max 50 pts?
+ case 'Trusted Third Parties': // to be revoked in the future? limit to max 35 pts?
+ case '': // to be revoked in the future? limit to max 50 pts?
+ case 'Face to Face Meeting': // normal assurances (and superassurances?), limit to 35/50 pts in the future?
+ break;
+
+ default: // should never happen ... ;-)
+ $points = 0;
+ }
+
+ return $points;
+ }
+
+
+ /**
+ * Calculate the experience points from a given Assurance
+ * @param array $row - [inout] associative array containing the data from
+ * the `notary` table, the keys 'experience' and 'calc_awarded' will be
+ * added
+ * @param int $sum_points - [inout] the sum of already counted assurance
+ * points the assurer issued
+ * @param int $sum_experience - [inout] the sum of already counted
+ * experience points that were awarded to the assurer
+ */
+ function calc_experience(&$row, &$sum_points, &$sum_experience)
{
- $apoints = max($row['points'], $row['awarded']);
- $points += $apoints;
- $experience = "&nbsp;";
- $revoked = false; # to be coded later (after DB-upgrade)
+ $row['calc_awarded'] = calc_awarded($row);
+
+ // Don't count revoked assurances even if we are displaying them
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $row['experience'] = 0;
+ return;
+ }
+
+ $experience = 0;
if ($row['method'] == "Face to Face Meeting")
{
- $sum_experience = $sum_experience +2;
- $experience = "2";
+ $experience = 2;
}
- return $apoints;
+ $sum_experience += $experience;
+ $row['experience'] = $experience;
+
+ $sum_points += $row['calc_awarded'];
}
- function calc_assurances ($row,&$points,&$experience,&$sumexperience,&$awarded,&$revoked)
+ /**
+ * Calculate the points received from a received Assurance
+ * @param array $row - [inout] associative array containing the data from
+ * the `notary` table, the keys 'experience' and 'calc_awarded' will be
+ * added
+ * @param int $sum_points - [inout] the sum of already counted assurance
+ * points the assuree received
+ * @param int $sum_experience - [inout] the sum of already counted
+ * experience points that were awarded to the assurer
+ */
+ function calc_assurances(&$row, &$sum_points, &$sum_experience)
{
- $awarded = calc_points($row);
- $revoked = false;
+ $row['calc_awarded'] = calc_awarded($row);
+ $experience = 0;
- if ($awarded > 100)
+ // High point values mean that some of them are experience points
+ if ($row['calc_awarded'] > 100)
{
- $experience = $awarded - 100; // needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100)
- $awarded = 100;
+ $experience = $row['calc_awarded'] - 100; // needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100)
+ $row['calc_awarded'] = 100;
}
- else
- $experience = 0;
switch ($row['method'])
{
case 'Thawte Points Transfer':
case 'CT Magazine - Germany':
case 'Temporary Increase': // Current usage of 'Temporary Increase' may break audit aspects, needs to be reimplemented
- $awarded=sprintf("<strong style='color: red'>%s</strong>",_("Revoked"));
- $experience=0;
- $revoked=true;
+ $experience = 0;
+ $row['deleted'] = THAWTE_REVOCATION_DATETIME;
break;
- default:
- $points += $awarded;
}
- $sumexperience = $sumexperience + $experience;
- }
+ // Don't count revoked assurances even if we are displaying them
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $row['experience'] = 0;
+ return;
+ }
+
+ $sum_experience += $experience;
+ $row['experience'] = $experience;
+ $sum_points += $row['calc_awarded'];
+ }
- function show_user_link ($name,$userid)
+ /**
+ * Generate a link to the support engineer page for the user with the name
+ * of the user as link text
+ * @param array $user - associative array containing the data from the
+ * `user` table
+ * @return string
+ */
+ function show_user_link($user)
{
- $name = trim($name);
+ $name = trim($user['fname'].' '.$user['lname']);
+ $userid = intval($user['id']);
+
if($name == "")
{
- if ($userid == 0)
+ if ($userid == 0) {
$name = _("System");
- else
+ } else {
$name = _("Deleted account");
+ }
}
else
- $name = "<a href='wot.php?id=9&amp;userid=".intval($userid)."'>".sanitizeHTML($name)."</a>";
+ {
+ $name = "<a href='wot.php?id=9&amp;userid=".$userid."'>".sanitizeHTML($name)."</a>";
+ }
+
return $name;
}
- function show_email_link ($email,$userid)
+ /**
+ * Generate a link to the support engineer page for the user with the email
+ * address as link text
+ * @param array $user - associative array containing the data from the
+ * `user` table
+ * @return string
+ */
+ function show_email_link($user)
{
- $email = trim($email);
- if($email != "")
- $email = "<a href='account.php?id=43&amp;userid=".intval($userid)."'>".sanitizeHTML($email)."</a>";
+ $email = trim($user['email']);
+ if($email != "") {
+ $email = "<a href='account.php?id=43&amp;userid=".intval($user['id'])."'>".sanitizeHTML($email)."</a>";
+ }
return $email;
}
@@ -201,93 +332,144 @@
?>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td class="title"><?=_("Assurer Ranking")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=sprintf(_("You have made %s assurances which ranks you as the #%s top assurer."), intval($num_of_assurances), intval($rank_of_assurer) )?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=sprintf(_("You have received %s assurances which ranks you as the #%s top assuree."), intval($num_of_assurees), intval($rank_of_assuree) )?></td>
- </tr>
+ <tr>
+ <td class="title"><?=_("Assurer Ranking")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=sprintf(_("You have made %s assurances which ranks you as the #%s top assurer."), intval($num_of_assurances), intval($rank_of_assurer) )?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=sprintf(_("You have received %s assurances which ranks you as the #%s top assuree."), intval($num_of_assurees), intval($rank_of_assuree) )?></td>
+ </tr>
</table>
<br/>
<?
}
- function output_assurances_header($title,$support)
+ /**
+ * Render header for the assurance table (same for given/received)
+ * @param string $title - The title for the table
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_assurances_header($title, $support, $log)
{
+ if ($support == 1) {
+ $log = 1;
+ }
+
+ $colspan = 7;
+ if ($support == 1) {
+ $colspan += 2;
+ }
+ if ($log == 1) {
+ $colspan += 1;
+ }
?>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
-<?
- if ($support == "1")
- {
-?>
- <td colspan="10" class="title"><?=$title?></td>
-<?
- } else {
-?>
- <td colspan="7" class="title"><?=$title?></td>
-<?
- }
-?>
+ <td colspan="<?=$colspan?>" class="title"><?=$title?></td>
</tr>
<tr>
<td class="DataTD"><strong><?=_("ID")?></strong></td>
<td class="DataTD"><strong><?=_("Date")?></strong></td>
<?
- if ($support == "1")
- {
+ if ($support == 1)
+ {
?>
- <td class="DataTD"><strong><?=_("When")?></strong></td>
- <td class="DataTD"><strong><?=_("Email")?></strong></td>
+ <td class="DataTD"><strong><?=_("When")?></strong></td>
+ <td class="DataTD"><strong><?=_("Email")?></strong></td>
<?
- }
+ }
?>
- <td class="DataTD"><strong><?=_("Who")?></strong></td>
- <td class="DataTD"><strong><?=_("Points")?></strong></td>
- <td class="DataTD"><strong><?=_("Location")?></strong></td>
- <td class="DataTD"><strong><?=_("Method")?></strong></td>
- <td class="DataTD"><strong><?=_("Experience Points")?></strong></td>
+ <td class="DataTD"><strong><?=_("Who")?></strong></td>
+ <td class="DataTD"><strong><?=_("Points")?></strong></td>
+ <td class="DataTD"><strong><?=_("Location")?></strong></td>
+ <td class="DataTD"><strong><?=_("Method")?></strong></td>
+ <td class="DataTD"><strong><?=_("Experience Points")?></strong></td>
<?
- if ($support == "1")
- {
+ if ($log == 1)
+ {
?>
- <td class="DataTD"><strong><?=_("Revoke")?></strong></td>
+ <td class="DataTD"><strong><?=_("Revoked")?></strong></td>
<?
- }
+ }
?>
- </tr>
+ </tr>
<?
}
- function output_assurances_footer($points_txt,$points,$experience_txt,$sumexperience,$support)
+ /**
+ * Render footer for the assurance table (same for given/received)
+ * @param string $points_txt - Description for sum of assurance points
+ * @param int $sumpoints - sum of assurance points
+ * @param string $experience_txt - Description for sum of experience points
+ * @param int $sumexperience - sum of experience points
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_assurances_footer(
+ $points_txt,
+ $sumpoints,
+ $experience_txt,
+ $sumexperience,
+ $support,
+ $log)
{
?>
<tr>
- <td<?=($support == "1")?' colspan="5"':' colspan="3"'?> class="DataTD"><strong><?=$points_txt?>:</strong></td>
- <td class="DataTD"><?=$points?></td>
+ <td colspan="<?=($support == 1) ? 5 : 3 ?>" class="DataTD"><strong><?=$points_txt?>:</strong></td>
+ <td class="DataTD"><?=intval($sumpoints)?></td>
<td class="DataTD">&nbsp;</td>
<td class="DataTD"><strong><?=$experience_txt?>:</strong></td>
- <td class="DataTD"><?=$sumexperience?></td>
+ <td class="DataTD"><?=intval($sumexperience)?></td>
<?
- if ($support == "1")
- {
+ if ($log == 1)
+ {
?>
- <td class="DataTD">&nbsp;</td>
+ <td class="DataTD">&nbsp;</td>
<?
- }
+ }
?>
-
</tr>
</table>
<br/>
<?
}
- function output_assurances_row($assuranceid,$date,$when,$email,$name,$awarded,$points,$location,$method,$experience,$userid,$support,$revoked)
+ /**
+ * Render an assurance for a view
+ * @param array $assurance - associative array containing the data from the `notary` table
+ * @param int $userid - Id of the user whichs given/received assurances are displayed
+ * @param array $other_user - associative array containing the other users data from the `users` table
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - ticket number currently set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_assurances_row(
+ $assurance,
+ $userid,
+ $other_user,
+ $support,
+ $ticketno,
+ $log)
{
+ $assuranceid = intval($assurance['id']);
+ $date = $assurance['date'];
+ $when = $assurance['when'];
+ $awarded = intval($assurance['calc_awarded']);
+ $points = intval($assurance['points']);
+ $location = $assurance['location'];
+ $method = $assurance['method'] ? _($assurance['method']) : '';
+ $experience = intval($assurance['experience']);
+ $revoked = $assurance['deleted'] !== NULL_DATETIME;
+
+ $email = show_email_link($other_user);
+ $name = show_user_link($other_user);
+
+ if ($support == 1) {
+ $log = 1;
+ }
$tdstyle="";
$emopen="";
@@ -295,7 +477,7 @@
if ($awarded == $points)
{
- if ($awarded == "0")
+ if ($awarded == 0)
{
if ($when < "2006-09-01")
{
@@ -310,7 +492,7 @@
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$assuranceid?><?=$emclose?></td>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$date?><?=$emclose?></td>
<?
- if ($support == "1")
+ if ($support == 1)
{
?>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$when?><?=$emclose?></td>
@@ -319,26 +501,30 @@
}
?>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$name?><?=$emclose?></td>
- <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$awarded?><?=$emclose?></td>
+ <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$revoked ? sprintf("<strong style='color: red'>%s</strong>",_("Revoked")) : $awarded?><?=$emclose?></td>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$location?><?=$emclose?></td>
<td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$method?><?=$emclose?></td>
- <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?><?=$emclose?></td>
+ <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?$experience:'&nbsp;'?><?=$emclose?></td>
<?
- if ($support == "1")
+ if ($log == 1)
{
if ($revoked == true)
{
?>
- <td class="DataTD" <?=$tdstyle?>>&nbsp;</td>
+ <td class="DataTD" <?=$tdstyle?>><?=$assurance['deleted']?></td>
+<?
+ } elseif ($support == 1) {
+?>
+ <td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&amp;userid=<?=intval($userid)?>&amp;assurance=<?=intval($assuranceid)?>&amp;csrf=<?=make_csrf('admdelassurance')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$assuranceid)?>');"><?=_("Revoke")?></a><?=$emclose?></td>
<?
} else {
?>
- <td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&amp;userid=<?=intval($userid)?>&amp;assurance=<?=intval($assuranceid)?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$assuranceid)?>');"><?=_("Revoke")?></a><?=$emclose?></td>
+ <td class="DataTD" <?=$tdstyle?>>&nbsp;</td>
<?
}
}
?>
- </tr>
+ </tr>
<?
}
@@ -346,14 +532,14 @@
{
?>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="4" class="title"><?=_("Summary of your Points")?></td>
- </tr>
- <tr>
- <td class="DataTD"><strong><?=_("Description")?></strong></td>
- <td class="DataTD"><strong><?=_("Points")?></strong></td>
- <td class="DataTD"><strong><?=_("Countable Points")?></strong></td>
- <td class="DataTD"><strong><?=_("Remark")?></strong></td>
+ <tr>
+ <td colspan="4" class="title"><?=_("Summary of your Points")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><strong><?=_("Description")?></strong></td>
+ <td class="DataTD"><strong><?=_("Points")?></strong></td>
+ <td class="DataTD"><strong><?=_("Countable Points")?></strong></td>
+ <td class="DataTD"><strong><?=_("Remark")?></strong></td>
</tr>
<?
}
@@ -369,47 +555,73 @@
function output_summary_row($title,$points,$points_countable,$remark)
{
?>
- <tr>
- <td class="DataTD"><strong><?=$title?></strong></td>
- <td class="DataTD"><?=$points?></td>
- <td class="DataTD"><?=$points_countable?></td>
- <td class="DataTD"><?=$remark?></td>
- </tr>
+ <tr>
+ <td class="DataTD"><strong><?=$title?></strong></td>
+ <td class="DataTD"><?=$points?></td>
+ <td class="DataTD"><?=$points_countable?></td>
+ <td class="DataTD"><?=$remark?></td>
+ </tr>
<?
}
// ************* output given assurances ******************
- function output_given_assurances_content($userid,&$points,&$sum_experience,$support)
+ /**
+ * Helper function to render assurances given by the user
+ * @param int $userid
+ * @param int& $sum_points - [out] sum of given points
+ * @param int& $sum_experience - [out] sum of experience points gained
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_given_assurances_content(
+ $userid,
+ &$sum_points,
+ &$sum_experience,
+ $support,
+ $ticketno,
+ $log)
{
- $points = 0;
+ $sum_points = 0;
$sumexperience = 0;
- $res = get_given_assurances(intval($userid));
+ $res = get_given_assurances(intval($userid), $log);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = get_user (intval($row['to']));
- $apoints = calc_experience ($row,$points,$experience,$sum_experience,$revoked);
- $name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['to']));
- $email = show_email_link ($fromuser['email'],intval($row['to']));
- output_assurances_row (intval($row['id']),$row['date'],$row['when'],$email,$name,$apoints,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience,$userid,$support,$revoked);
+ $assuree = get_user(intval($row['to']));
+ calc_experience($row, $sum_points, $sum_experience);
+ output_assurances_row($row, $userid, $assuree, $support, $ticketno, $log);
}
}
// ************* output received assurances ******************
- function output_received_assurances_content($userid,&$points,&$sum_experience,$support)
+ /**
+ * Helper function to render assurances received by the user
+ * @param int $userid
+ * @param int& $sum_points - [out] sum of received points
+ * @param int& $sum_experience - [out] sum of experience points the assurers gained
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_received_assurances_content(
+ $userid,
+ &$sum_points,
+ &$sum_experience,
+ $support,
+ $ticketno,
+ $log)
{
- $points = 0;
+ $sum_points = 0;
$sumexperience = 0;
- $res = get_received_assurances(intval($userid));
+ $res = get_received_assurances(intval($userid), $log);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = get_user (intval($row['from']));
- calc_assurances ($row,$points,$experience,$sum_experience,$awarded,$revoked);
- $name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['from']));
- $email = show_email_link ($fromuser['email'],intval($row['from']));
- output_assurances_row (intval($row['id']),$row['date'],$row['when'],$email,$name,$awarded,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience,$userid,$support,$revoked);
+ $fromuser = get_user(intval($row['from']));
+ calc_assurances($row, $sum_points, $sum_experience);
+ output_assurances_row($row, $userid, $fromuser, $support, $ticketno, $log);
}
}
@@ -422,41 +634,6 @@
return intval(query_get_number_of_rows($res));
}
- function calc_points($row)
- {
- $awarded = intval($row['awarded']);
- if ($awarded == "")
- $awarded = 0;
- if (intval($row['points']) < $awarded)
- $points = $awarded; // if 'sum of added points' > 100, awarded shows correct value
- else
- $points = intval($row['points']); // on very old assurances, awarded is '0' instead of correct value
- switch ($row['method'])
- {
- case 'Thawte Points Transfer': // revoke all Thawte-points (as per arbitration)
- case 'CT Magazine - Germany': // revoke c't (only one test-entry)
- case 'Temporary Increase': // revoke 'temporary increase' (Current usage breaks audit aspects, needs to be reimplemented)
- $points = 0;
- break;
- case 'Administrative Increase': // ignore AI with 2 points or less (historical for experiance points, now other calculation)
- if ($points <= 2) // maybe limit to 35/50 pts in the future?
- $points = 0;
- break;
- case 'Unknown': // to be revoked in the future? limit to max 50 pts?
- case 'Trusted Third Parties': // to be revoked in the future? limit to max 35 pts?
- case 'TTP-Assisted': // TTP assurances, limit to 35
- case 'TOPUP': // TOPUP to be delevoped in the future, limit to 30
- case '': // to be revoked in the future? limit to max 50 pts?
- case 'Face to Face Meeting': // normal assurances, limit to 35/50 pts in the future?
- break;
- default: // should never happen ... ;-)
- $points = 0;
- }
- if ($points < 0) // ignore negative points (bug needs to be fixed)
- $points = 0;
- return $points;
- }
-
function max_points($userid)
{
return output_summary_content ($userid,0);
@@ -486,7 +663,7 @@
$res = get_received_assurances_summary($userid);
while($row = mysql_fetch_assoc($res))
{
- $points = calc_points ($row);
+ $points = calc_awarded($row);
if ($points > $max_points) // limit to 100 points, above is experience (needs to be fixed)
{
@@ -591,18 +768,66 @@
return $issue_points;
}
- function output_given_assurances($userid,$support=0)
+ /**
+ * Render assurances given by the user
+ * @param int $userid
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_given_assurances($userid, $support=0, $ticketno='', $log=0)
{
- output_assurances_header(_("Assurance Points You Issued"),$support);
- output_given_assurances_content($userid,$points,$sum_experience,$support);
- output_assurances_footer(_("Total Points Issued"),$points,_("Total Experience Points"),$sum_experience,$support);
+ output_assurances_header(
+ _("Assurance Points You Issued"),
+ $support,
+ $log);
+
+ output_given_assurances_content(
+ $userid,
+ $sum_points,
+ $sum_experience,
+ $support,
+ $ticketno,
+ $log);
+
+ output_assurances_footer(
+ _("Total Points Issued"),
+ $sum_points,
+ _("Total Experience Points"),
+ $sum_experience,
+ $support,
+ $log);
}
- function output_received_assurances($userid,$support=0)
+ /**
+ * Render assurances received by the user
+ * @param int $userid
+ * @param int $support - set to 1 if the output is for the support interface
+ * @param string $ticketno - the ticket number set in the support interface
+ * @param int $log - if set to 1 also includes deleted assurances
+ */
+ function output_received_assurances($userid, $support=0, $ticketno='', $log=0)
{
- output_assurances_header(_("Your Assurance Points"),$support);
- output_received_assurances_content($userid,$points,$sum_experience,$support);
- output_assurances_footer(_("Total Assurance Points"),$points,_("Total Experience Points"),$sum_experience,$support);
+ output_assurances_header(
+ _("Assurance Points You Received"),
+ $support,
+ $log);
+
+ output_received_assurances_content(
+ $userid,
+ $sum_points,
+ $sum_experience,
+ $support,
+ $ticketno,
+ $log);
+
+ output_assurances_footer(
+ _("Total Points Received"),
+ $sum_points,
+ _("Total Experience Points"),
+ $sum_experience,
+ $support,
+ $log);
}
function output_summary($userid)
@@ -658,18 +883,31 @@
}
/**
- * get_first_user_agreement()
- * returns the first user_agreement entry of the requested type depending on thes status of active of a given user
- * @param mixed $memid
- * @param integer $active, 0 - passive, 1 -active
- * @param string $type
- * @return
+ * Get the first user_agreement entry of the requested type
+ * @param int $memid
+ * @param string $type - the type of user agreement, by default all
+ * agreements are listed
+ * @param int $active - whether to get active or passive agreements:
+ * 0 := passive
+ * 1 := active
+ * null := both
+ * @return array(string=>mixed) - an associative array containing
+ * 'document', 'date', 'method', 'comment', 'active'
*/
- function get_first_user_agreement($memid, $active=1, $type="CCA"){
- //returns an array (`document`,`date`,`method`, `comment`,`active`)
+ function get_first_user_agreement($memid, $type=null, $active=null){
+ $filter = '';
+ if (!is_null($type)) {
+ $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'";
+ }
+
+ if (!is_null($active)) {
+ $filter .= " AND u.`active` = ".intval($active);
+ }
+
$query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u
- WHERE u.`document` = '" . mysql_real_escape_string($type) . "' AND u.`memid`=" . intval($memid) . " AND u.`active`=" . intval($active) .
- " ORDER BY u.`date` Limit 1;";
+ WHERE u.`memid`=".intval($memid)."
+ $filter
+ ORDER BY u.`date` LIMIT 1";
$res = mysql_query($query);
if(mysql_num_rows($res) >0){
$rec = mysql_fetch_assoc($res);
@@ -680,15 +918,31 @@
}
/**
- * get_last_user_agreement()
- * returns the last user_agreement entry of a given type and of a given user
- * @param mixed $memid
- * @param string $type
- * @return
+ * Get the last user_agreement entry of the requested type
+ * @param int $memid
+ * @param string $type - the type of user agreement, by default all
+ * agreements are listed
+ * @param int $active - whether to get active or passive agreements:
+ * 0 := passive,
+ * 1 := active,
+ * null := both
+ * @return array(string=>mixed) - an associative array containing
+ * 'document', 'date', 'method', 'comment', 'active'
*/
- function get_last_user_agreement($memid, $type="CCA"){
- //returns an array (`document`,`date`,`method`, `comment`,`active`)
- $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM user_agreements u WHERE u.`document` = '" . mysql_real_escape_string($type) . "' AND (u.`memid`=" . intval($memid) . " ) order by `date` desc limit 1 " ;
+ function get_last_user_agreement($memid, $type=null, $active=null){
+ $filter = '';
+ if (!is_null($type)) {
+ $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'";
+ }
+
+ if (!is_null($active)) {
+ $filter .= " AND u.`active` = ".intval($active);
+ }
+
+ $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u
+ WHERE u.`memid`=".intval($memid)."
+ $filter
+ ORDER BY u.`date` DESC LIMIT 1";
$res = mysql_query($query);
if(mysql_num_rows($res) >0){
$rec = mysql_fetch_assoc($res);
@@ -698,6 +952,34 @@
return $rec;
}
+/**
+ * Get the all user_agreement entries of the requested type
+ * @param int $memid
+ * @param string $type - the type of user agreement, by default all
+ * agreements are listed
+ * @param int $active - whether to get an active or passive agreements:
+ * 0 := passive,
+ * 1 := active,
+ * null := both
+ * @return resource - a mysql result set containing all agreements
+ */
+function get_user_agreements($memid, $type=null, $active=null){
+ $filter = '';
+ if (!is_null($type)) {
+ $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'";
+ }
+
+ if (!is_null($active)) {
+ $filter .= " AND u.`active` = ".intval($active);
+ }
+
+ $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u
+ WHERE u.`memid`=".intval($memid)."
+ $filter
+ ORDER BY u.`date`";
+ return mysql_query($query);
+}
+
/**
* delete_user_agreement()
* deletes all entries for a given type from user_agreement of a given user, if type is not given all
@@ -706,7 +988,6 @@
* @return
*/
function delete_user_agreement($memid, $type=false){
- //deletes all entries to an user for the given type of user agreements
if ($type === false) {
$filter = '';
} else {
@@ -774,7 +1055,7 @@
<?
} else {
?>
- <input type="hidden" name="<?=$val?>" value="<?=$methods[0]?>" />
+ <input type="hidden" name="method" value="<?=$methods[0]?>" />
<?
}
}
@@ -909,11 +1190,6 @@
}
//change personal information to arbitration number and DOB=1900-01-01
- $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'";
- $details = mysql_fetch_assoc(mysql_query($query));
- $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}',
- `new-lname`='$arbno',`new-dob`='1900-01-01',`uid`='$id',`adminid`='".$adminid."'";
- mysql_query($query);
$query = "update `users` set `fname`='".$arbno."',
`mname`='".$arbno."',
`lname`='".$arbno."',
@@ -1125,3 +1401,907 @@
function check_date_difference($date, $diff=1){
return (strtotime($date)<=time()+$diff*86400);
}
+
+ // table layout for organisation
+ /**
+ * org_edit_org_table()
+ *
+ * @param mixed $orgname
+ * @param mixed $contactmail
+ * @param mixed $town
+ * @param mixed $state
+ * @param mixed $country
+ * @param mixed $comment
+ * @param integer $type 0 - new, 1, edit
+ * @return
+ */
+ function org_edit_org_table($orgname, $contactmail, $town, $state, $country, $comment, $type=0){
+ if ($type > 0) {
+ $title = _('Edit Organisation');
+ $action = _('Update');
+ } else {
+ $title = _('New Organisation');
+ $action = _('Next');
+ }
+ org_edit_org_table_header($title);
+ org_edit_org_table_row(_('Organisation Name'), 'O', $orgname, 64);
+ org_edit_org_table_row(_('Contact Email'), 'contact', $contactmail, 255);
+ org_edit_org_table_row(_('Town/Suburb'), 'L', $town, 128);
+ org_edit_org_table_row(_('State/Province'), 'ST', $state, 128);
+ org_edit_org_table_country(_('Country'), 'C', $country, 2);
+ org_edit_org_table_comment(_('Comments'), 'comments', $comment);
+ org_edit_org_table_footer($action);
+ }
+
+ /**
+ * org_edit_org_table_header()
+ *
+ * @param mixed $title
+ * @return
+ */
+ function org_edit_org_table_header($title){
+?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="3" class="title"><?=$title?></td>
+ </tr>
+<?
+ }
+
+ /**
+ * org_edit_org_table_row()
+ *
+ * @param mixed $label
+ * @param mixed $name
+ * @param mixed $value
+ * @param mixed $length
+ * @return
+ */
+ function org_edit_org_table_row($label, $name, $value, $length){
+?>
+ <tr>
+ <td class="DataTD"><?=$label?>:</td>
+ <td class="DataTD"><input type="text" name="<?=$name?>" value="<?=SanitizeHTML($value)?>" maxlength="<?=intval($length)?>" size="90"></td>
+ <td class="DataTD"><? printf(_('max %d characters'),$length)?></td>
+ </tr>
+<?
+ }
+
+ /**
+ * org_edit_org_table_country()
+ *
+ * @param mixed $label
+ * @param mixed $name
+ * @param mixed $value
+ * @param mixed $length
+ * @return
+ */
+ function org_edit_org_table_country($label, $name, $value, $length){
+?>
+ <tr>
+ <td class="DataTD"><?=$label?>:</td>
+ <td class="DataTD">
+ <input type="text" name="<?=$name?>" value="<?=SanitizeHTML($value)?>" maxlength="<?=intval($length)?>" size="<?=intval($length)?>" />
+ <? printf(_('(2 letter %s ISO code %s )'), '<a href="http://www.iso.org/iso/home/standards/country_codes/iso-3166-1_decoding_table.htm">', '</a>')?>
+ </td>
+ <td class="DataTD"><?=sprintf(_('max %d characters'),$length)?></td>
+ </tr>
+<?
+ }
+
+ /**
+ * org_edit_org_table_comment()
+ *
+ * @param mixed $label
+ * @param mixed $name
+ * @param mixed $value
+ * @return
+ */
+ function org_edit_org_table_comment($label, $name, $value){
+?>
+ <tr>
+ <td class="DataTD"><?=$label?>:</td>
+ <td class="DataTD"><textarea name="<?=$name?>" cols=60 rows=10><?=SanitizeHTML($value)?></textarea></td>
+ <td class="DataTD">&nbsp</td>
+ </tr>
+<?
+ }
+
+ /**
+ * org_edit_org_table_footer()
+ *
+ * @param mixed $label
+ * @return
+ */
+ function org_edit_org_table_footer($label){
+?>
+ <tr>
+ <td class="DataTD" colspan="3"><input type="submit" name="process" value="<?=$label?>"></td>
+ </tr>
+ </table>
+<?
+ }
+
+ /**
+ * get_array_from_ini()
+ * gets an array from an ini file and trims all entries
+ * @param mixed $inifile, path and filename of the ini file
+ * @return
+ */
+ function get_array_from_ini($inifile){
+ $array = parse_ini_file('../config/ttp.ini');
+ ksort($array);
+ foreach($array as $key => $value)
+ {
+ unset($array[$key]);
+ $array[trim($key)] = trim($value);
+ }
+ return $array;
+ }
+
+ /**
+ * create_selectbox_HTML()
+ *
+ * @param mixed $name, name for the select element
+ * @param mixed $options, array with the data for the dropdown
+ * @param string $value, TRUE if the value for the option should be added
+ * @param string $firstline, if the should be a first line like´Choose country
+ * @param string $selected, if selection matches option key the
+ * entry is preselected in the dropdownbox
+ * @return
+ */
+ function create_selectbox_HTML($name, array $options, $firstline = '', $value='', $selected = ''){
+ $return_str='<select name="' . $name . '">';
+ if (''!= $firstline) {
+ $return_str .= '<option>' . $firstline .'</option>';
+ }
+ foreach ($options as $key => $avalue) {
+ $return_str.='<option';
+ if ($value) {
+ $return_str.=' value="'.$avalue.'"';
+ }
+ if ($key==$selected){
+ $return_str.=' selected="selected"';
+ }
+ $return_str.='>'.$key.'</option>';
+ }
+ $return_str.='</select>';
+ return $return_str;
+ }
+
+/**
+ * Write some information to the adminlog
+ *
+ * @param int $uid - id of the user account
+ * @param int $adminid - id of the admin
+ * @param string $type - the operation that was performed on the user account
+ * @param string $info - the ticket / arbitration number or other information
+ * @return bool - true := success, false := error
+ */
+function write_se_log($uid, $adminid, $type, $info){
+ //records all support engineer actions changing a user account
+ $uid = intval($uid);
+ $adminid = intval($adminid);
+ $type = mysql_real_escape_string($type);
+ $info = mysql_real_escape_string($info);
+ $query="insert into `adminlog` (`when`, `uid`, `adminid`,`type`,`information`) values
+ (Now(), $uid, $adminid, '$type', '$info')";
+ return mysql_query($query);
+}
+
+/**
+ * Check if the entered information is a valid ticket or arbitration number
+ * @param string $ticketno
+ * @return bool
+ */
+function valid_ticket_number($ticketno){
+ //a arbitration case
+ //d dispute action
+ //s support case
+ //m board motion
+ $pattern='/[adsmADSM]\d{8}\.\d+/';
+ if (preg_match($pattern, $ticketno)) {
+ return true;
+ }
+ return false;
+}
+
+// function for handling account/43.php
+/**
+ * Get all data of an account given by the id from the `users` table
+ * @param int $userid - account id
+ * @param int $deleted - states if deleted data should be visible , default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_user_data($userid, $deleted=0){
+ $userid = intval($userid);
+ $filter='';
+ if (0==$deleted) {
+ $filter .=' and `users`.`deleted`=0';
+ }
+ $query = "select * from `users` where `users`.`id`='$userid' ".$filter;
+ return mysql_query($query);
+}
+
+/**
+ * Get the alert settings for a user
+ * @param int $userid for the requested account
+ * @return array - associative array
+ */
+function get_alerts($userid){
+ return mysql_fetch_assoc(mysql_query("select * from `alerts` where `memid`='".intval($userid)."'"));
+}
+
+/**
+ * Get all email addresses linked to the account
+ * @param int $userid
+ * @param string $exclude - if given the email address will be excluded
+ * @param int $deleted - states if deleted data should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_email_addresses($userid, $exclude, $deleted=0){
+ //should be entered in account/2.php
+ $userid = intval($userid);
+ $filter='';
+ if (0==$deleted) {
+ $filter .= ' and `deleted`=0';
+ }
+ if ($exclude) {
+ $filter .= " and `email`!='".mysql_real_escape_string($exclude)."'";
+ }
+ $query = "select * from `email` where `memid`='".$userid."' and `hash`='' ".$filter." order by `created`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all domains linked to the account
+ * @param int $userid
+ * @param int $deleted - states if deleted data should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_domains($userid, $deleted=0){
+ //should be entered in account/9.php
+ $userid = intval($userid);
+ $filter='';
+ if (0==$deleted) {
+ $filter .= ' and `deleted`=0';
+ }
+ $query = "select * from `domains` where `memid`='".$userid."' and `hash`=''".$filter." order by `created`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all training results for the account
+ * @param int $userid
+ * @return resource - a mysql result set
+ */
+function get_training_results($userid){
+ //should be entered in account/55.php
+ $userid = intval($userid);
+ $query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ".
+ " FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ".
+ " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".$userid."'".
+ " ORDER BY `CP`.`pass_date`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all SE log entries for the account
+ * @param int $userid
+ * @return resource - a mysql result set
+ */
+function get_se_log($userid){
+ $userid = intval($userid);
+ $query = "SELECT `adminlog`.`when`, `adminlog`.`type`, `adminlog`.`information`, `users`.`fname`, `users`.`lname`
+ FROM `adminlog`, `users`
+ WHERE `adminlog`.`adminid` = `users`.`id` and `adminlog`.`uid`=".$userid."
+ ORDER BY `adminlog`.`when`";
+ return mysql_query($query);
+}
+
+/**
+ * Get all client certificates linked to the account
+ * @param int $userid
+ * @param int $viewall - states if expired certs should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_client_certs($userid, $viewall=0){
+ //add to account/5.php
+ $userid = intval($userid);
+ $query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`,
+ UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
+ UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`,
+ `emailcerts`.`expire`,
+ `emailcerts`.`revoked` as `revoke`,
+ UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`,
+ `emailcerts`.`id`,
+ `emailcerts`.`CN`,
+ `emailcerts`.`serial`,
+ `emailcerts`.`disablelogin`,
+ `emailcerts`.`description`
+ from `emailcerts`
+ where `emailcerts`.`memid`='".$userid."'";
+ if($viewall == 0)
+ {
+ $query .= " AND `emailcerts`.`revoked`=0 AND `emailcerts`.`renewed`=0";
+ $query .= " HAVING `timeleft` > 0";
+ }
+ $query .= " ORDER BY `emailcerts`.`modified` desc";
+ return mysql_query($query);
+}
+
+/**
+ * Get all server certs linked to the account
+ * @param int $userid
+ * @param int $viewall - states if expired certs should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_server_certs($userid, $viewall=0){
+ //add to account/12.php
+ $userid = intval($userid);
+ $query = "select UNIX_TIMESTAMP(`domaincerts`.`created`) as `created`,
+ UNIX_TIMESTAMP(`domaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
+ UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired`,
+ `domaincerts`.`expire`,
+ `domaincerts`.`revoked` as `revoke`,
+ UNIX_TIMESTAMP(`revoked`) as `revoked`,
+ `domaincerts`.`CN`,
+ `domaincerts`.`serial`,
+ `domaincerts`.`id`,
+ `domaincerts`.`description`
+ from `domaincerts`,`domains`
+ where `domains`.`memid`='".$userid."' and `domaincerts`.`domid`=`domains`.`id`";
+ if($viewall == 0)
+ {
+ $query .= " AND `domaincerts`.`revoked`=0 AND `domaincerts`.`renewed`=0";
+ $query .= " HAVING `timeleft` > 0";
+ }
+ $query .= " ORDER BY `domaincerts`.`modified` desc";
+ return mysql_query($query);
+}
+
+/**
+ * Get all gpg certs linked to the account
+ * @param int $userid
+ * @param int $viewall - states if expired certs should be visible, default = 0 - not visible
+ * @return resource - a mysql result set
+ */
+function get_gpg_certs($userid, $viewall=0){
+ //add to gpg/2.php
+ $userid = intval($userid);
+ $query = $query = "select UNIX_TIMESTAMP(`issued`) as `issued`,
+ UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() as `timeleft`,
+ UNIX_TIMESTAMP(`expire`) as `expired`,
+ `expire`, `id`, `level`, `email`, `keyid`, `description`
+ from `gpg` where `memid`='".$userid."'";
+ if ($viewall == 0) {
+ $query .= " HAVING `timeleft` > 0";
+ }
+ $query .= " ORDER BY `issued` desc";
+ return mysql_query($query);
+}
+
+
+
+/**
+ * Show the table header to the email table for the admin log
+ */
+function output_log_email_header(){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Email, primary bold") ?></td>
+ <td class="DataTD bold"><?= _("Created") ?></td>
+ <td class="DataTD bold"><?= _("Deleted") ?></td>
+ </tr>
+
+ <?
+}
+/**
+ * Show all email data for the admin log
+ * @param array $row - associative array containing the column data
+ * @param string $primary - if given the primary address is highlighted
+ */
+function output_log_email($row, $primary){
+ $style = '';
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $style = ' deletedemailaddress';
+ } elseif ($primary == $row['email']) {
+ $style = ' primaryemailaddress';
+ }
+ ?>
+ <tr>
+ <td class="DataTD<?=$style?>"><?=$row['email']?></td>
+ <td class="DataTD<?=$style?>"><?=$row['created']?></td>
+ <td class="DataTD<?=$style?>"><?=$row['deleted']?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the domains table for the admin log
+ */
+function output_log_domains_header(){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Domain") ?></td>
+ <td class="DataTD bold"><?= _("Created") ?></td>
+ <td class="DataTD bold"><?= _("Deleted") ?></td>
+ </tr>
+
+ <?
+}
+
+/**
+ * Show the domain data for the admin log
+ * @param array $row - associative array containing the column data
+ */
+function output_log_domains($row){
+ $italic='';
+ if ($row['deleted'] !== NULL_DATETIME) {
+ $italic=' italic';
+ }
+ ?>
+ <tr>
+ <td class="DataTD<?=$italic?>"><?=$row['domain']?></td>
+ <td class="DataTD<?=$italic?>"><?=$row['created']?></td>
+ <td class="DataTD<?=$italic?>"><?=$row['deleted']?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the user agreement table for the admin log
+ */
+function output_log_agreement_header(){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Agreement") ?></td>
+ <td class="DataTD bold"><?= _("Date") ?></td>
+ <td class="DataTD bold"><?= _("Method") ?></td>
+ <td class="DataTD bold"><?= _("Active ") ?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the agreement data for the admin log
+ * @param array $row - associative array containing the column data
+ */
+function output_log_agreement($row){
+ ?>
+ <tr>
+ <td class="DataTD" ><?=$row['document']?></td>
+ <td class="DataTD" ><?=$row['date']?></td>
+ <td class="DataTD" ><?=$row['method']?></td>
+ <td class="DataTD"><?= ($row['active']==0)? _('passive'):_('active')?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the training table
+ */
+function output_log_training_header(){
+ //should be entered in account/55.php
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Agreement") ?></td>
+ <td class="DataTD bold"><?= _("Test") ?></td>
+ <td class="DataTD bold"><?= _("Variant") ?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the training data
+ * @param array $row - associative array containing the column data
+ */
+function output_log_training($row){
+ //should be entered in account/55.php
+ ?>
+ <tr>
+ <td class="DataTD"><?=$row['pass_date']?></td>
+ <td class="DataTD"><?=$row['type_text']?></td>
+ <td class="DataTD"><?=$row['test_text']?></td>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the SE log table for the admin log
+ * @param int $support - if support = 1 more information is visible
+ */
+function output_log_se_header($support=0){
+ ?>
+ <tr>
+ <td class="DataTD bold"><?= _("Date") ?></td>
+ <td class="DataTD bold"><?= _("Type") ?></td>
+ <?
+ if (1 == $support) {
+ ?>
+ <td class="DataTD bold"><?= _("Information") ?></td>
+ <td class="DataTD bold"><?= _("Admin") ?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the SE log data for the admin log
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 more information is visible
+ */
+function output_log_se($row, $support=0){
+ //should be entered in account/55.php
+ ?>
+ <tr>
+ <td class="DataTD"><?=$row['when']?></td>
+ <td class="DataTD"><?=$row['type']?></td>
+ <?
+ if (1 == $support) {
+ ?>
+ <td class="DataTD"><?=$row['information']?></td>
+ <td class="DataTD"><?=$row['fname'].' '.$row['lname']?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Shows the table header to the client cert table
+ * @param int $support - if support = 1 some columns ar not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_client_cert_header($support=0, $readonly=true){
+ //should be added to account/5.php
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
+ <?
+ }
+ ?>
+ <td class="DataTD"><?=_("Status")?></td>
+ <td class="DataTD"><?=_("Email Address")?></td>
+ <td class="DataTD"><?=_("SerialNumber")?></td>
+ <td class="DataTD"><?=_("Revoked")?></td>
+ <td class="DataTD"><?=_("Expires")?></td>
+ <td class="DataTD"><?=_("Login")?></td>
+ <?
+ if (1 != $support) {
+ ?>
+ <td colspan="2" class="DataTD"><?=_("Comment *")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the client cert data
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 some columns are not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_client_cert($row, $support=0, $readonly=true){
+ //should be entered in account/5.php
+ $verified="";
+ if ($row['timeleft'] > 0) {
+ $verified = _("Valid");
+ } else {
+ $verified = _("Expired");
+ }
+
+ if ($row['expired'] == 0) {
+ $verified = _("Pending");
+ }
+
+ if ($row['revoked'] == 0) {
+ $row['revoke'] = _("Not Revoked");
+ } else {
+ $verified = _("Revoked");
+ }
+
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>">
+ </td>
+ <?
+
+ } elseif ($verified === _("Revoked")) {
+ ?>
+ <td class="DataTD">&nbsp;</td>
+ <?
+
+ } else {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>">
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ <td class="DataTD"><?=$verified?></td>
+ <?
+
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : htmlspecialchars($row['CN']))?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="account.php?id=6&amp;cert=<?=intval($row['id'])?>">
+ <?=(trim($row['CN'])=="" ? _("empty") : htmlspecialchars($row['CN']))?>
+ </a>
+ </td>
+ <?
+ }
+
+ ?>
+ <td class="DataTD"><?=$row['serial']?></td>
+ <td class="DataTD"><?=$row['revoke']?></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <td class="DataTD">
+ <input type="checkbox" name="disablelogin_<?=intval($row['id'])?>" value="1" <?=$row['disablelogin']?"":"checked='checked'"?> <?=$readonly?'disabled="disabled"':''?>/>
+ <input type="hidden" name="cert_<?=intval($row['id'])?>" value="1" />
+ </td>
+ <?
+
+ if (1 != $support) {
+ ?>
+ <td class="DataTD">
+ <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" />
+ </td>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" />
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the server cert table
+ * @param int $support - if support = 1 some columns ar not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_server_certs_header($support=0, $readonly=true){
+ //should be entered in account/12.php
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
+ <?
+ }
+ ?>
+ <td class="DataTD"><?=_("Status")?></td>
+ <td class="DataTD"><?=_("CommonName")?></td>
+ <td class="DataTD"><?=_("SerialNumber")?></td>
+ <td class="DataTD"><?=_("Revoked")?></td>
+ <td class="DataTD"><?=_("Expires")?></td>
+ <?
+ if (1 != $support) {
+ ?>
+ <td colspan="2" class="DataTD"><?=_("Comment *")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the server cert data
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 some columns are not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_server_certs($row, $support=0, $readonly=true){
+ //should be entered in account/12.php
+ $verified="";
+ if ($row['timeleft'] > 0) {
+ $verified = _("Valid");
+ } else {
+ $verified = _("Expired");
+ }
+
+ if ($row['expired'] == 0) {
+ $verified = _("Pending");
+ }
+
+ if ($row['revoked'] == 0) {
+ $row['revoke'] = _("Not Revoked");
+ } else {
+ $verified = _("Revoked");
+ }
+
+ ?>
+ <tr>
+ <?
+ if (!$readonly) {
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"/>
+ </td>
+ <?
+ } elseif($verified === _("Revoked")) {
+ ?>
+ <td class="DataTD">&nbsp;</td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"/>
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ <td class="DataTD"><?=$verified?></td>
+ <?
+
+ if ($verified === _("Pending")) {
+ ?>
+ <td class="DataTD"><?=htmlspecialchars($row['CN'])?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="account.php?id=15&amp;cert=<?=intval($row['id'])?>">
+ <?=htmlspecialchars($row['CN'])?>
+ </a>
+ </td>
+ <?
+ }
+
+ ?>
+ <td class="DataTD"><?=$row['serial']?></td>
+ <td class="DataTD"><?=$row['revoke']?></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <?
+
+ if (1 != $support) {
+ ?>
+ <td class="DataTD">
+ <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" />
+ </td>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" />
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the table header to the gpg cert table
+ * @param int $support - if support = 1 some columns ar not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_gpg_certs_header($support=0, $readonly=true){
+ // $readonly is currently ignored but kept for consistency
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Status")?></td>
+ <td class="DataTD"><?=_("Email Address")?></td>
+ <td class="DataTD"><?=_("Expires")?></td>
+ <td class="DataTD"><?=_("Key ID")?></td>
+ <?
+ if (1 != $support) {
+ ?>
+ <td colspan="2" class="DataTD"><?=_("Comment *")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <?
+}
+
+/**
+ * Show the gpg cert data
+ * @param array $row - associative array containing the column data
+ * @param int $support - if support = 1 some columns are not visible
+ * @param bool $readonly - whether elements to modify data should be hidden, default is `true`
+ */
+function output_gpg_certs($row, $support=0, $readonly=true){
+ //should be entered in account/55.php
+ $verified="";
+ if ($row['timeleft'] > 0) {
+ $verified = _("Valid");
+ } else {
+ $verified = _("Expired");
+ }
+
+ if ($row['expired'] == 0) {
+ $verified = _("Pending");
+ }
+
+ ?>
+ <tr>
+ <td class="DataTD"><?=$verified?></td>
+ <?
+
+ if($verified == _("Pending")) {
+ ?>
+ <td class="DataTD"><?=htmlspecialchars($row['email'])?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>">
+ <?=htmlspecialchars($row['email'])?>
+ </a>
+ </td>
+ <?
+ }
+
+ ?>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <?
+
+ if($verified == _("Pending")) {
+ ?>
+ <td class="DataTD"><?=htmlspecialchars($row['keyid'])?></td>
+ <?
+ } else {
+ ?>
+ <td class="DataTD">
+ <a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>">
+ <?=htmlspecialchars($row['keyid'])?>
+ </a>
+ </td>
+ <?
+ }
+
+ if (1 != $support) {
+ ?>
+ <td class="DataTD">
+ <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" />
+ </td>
+ <?
+ if (!$readonly) {
+ ?>
+ <td class="DataTD">
+ <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" />
+ </td>
+ <?
+ }
+ }
+
+ ?>
+ </tr>
+ <?
+}
diff --git a/locale/Makefile b/locale/Makefile
index 4215a4f..a2b856b 100644
--- a/locale/Makefile
+++ b/locale/Makefile
@@ -144,7 +144,7 @@ GETTEXT_FILE_PATTERN := \
../pages/*/*.php \
../scripts/*.php \
../www/*.php \
-../www/*/*.php \
+../www/[a-z]*/*.php \
# ../tverify/*.php \
# ../tverify/*/*.php \
diff --git a/pages/account/10.php b/pages/account/10.php
index 8908400..17999a7 100644
--- a/pages/account/10.php
+++ b/pages/account/10.php
@@ -30,17 +30,66 @@
<p><?=_("If you are a valid organisation and would like the organisation name in the certificates you can apply for an organisation assurance. Contact us via support@cacert.org for more information.")?></p>
<form method="post" action="account.php">
+<p><label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br />
+ <input type="text" id="description" name="description" maxlength="80" size="80" />
+</p>
+<p><label for="CSR"><?=_("Paste your CSR (Certificate Signing Request) below...")?></label><br />
+ <textarea id="CSR" name="CSR" cols="80" rows="15"></textarea>
+</p>
+
+<fieldset>
+<legend>
+ <input type="checkbox" id="expertbox" onchange="showExpert(this.checked)" style="display:none" />
+ <label for="expertbox"><?=_("Advanced Options")?></label>
+</legend>
+<div id="advanced_options">
+
<? if($_SESSION['profile']['points'] >= 50) { ?>
-<input type="radio" name="rootcert" value="1"/> <?=_("Sign by class 1 root certificate")?><br />
-<input type="radio" name="rootcert" value="2" checked/> <?=_("Sign by class 3 root certificate")?><br />
+<ul class="no_indent">
+ <li>
+ <input type="radio" id="root1" name="rootcert" value="1" />
+ <label for="root1"><?=_("Sign by class 1 root certificate")?></label>
+ </li>
+ <li>
+ <input type="radio" id="root2" name="rootcert" value="2" checked="checked" />
+ <label for="root2"><?=_("Sign by class 3 root certificate")?></label>
+ </li>
+</ul>
<p><?=_("Please note: The class 3 root certificate needs to be setup in your webserver as a chained certificate, while slightly more complicated to setup, this root certificate is more likely to be trusted by more people.")?></p>
<? } ?>
-<p><?=_("Optional comment, only used in the certificate overview")?><br>
- <input type="text" name="description" maxlength="80" size=80/></p>
-<p><?=_("Paste your CSR(Certificate Signing Request) below...")?></p>
-<textarea name="CSR" cols="80" rows="15"></textarea><br />
-<p><input type="checkbox" name="CCA" /> <strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br />
- <?=_("Please Note: You need to accept the CCA to proceed.")?></p>
+
+<p class="attach_ul"><?=_("Hash algorithm used when signing the certificate:")?></p>
+<ul class="no_indent">
+<?
+foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) {
+?>
+ <li>
+ <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> />
+ <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label>
+ </li>
+<?
+}
+?>
+</ul>
+
+</div>
+</fieldset>
+
+<p><input type="checkbox" id="CCA" name="CCA" /> <label for="CCA"><strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br />
+ <?=_("Please note: You need to accept the CCA to proceed.")?></label></p>
<input type="submit" name="process" value="<?=_("Submit")?>" />
<input type="hidden" name="oldid" value="<?=$id?>" />
</form>
+
+
+<script language="javascript">
+function showExpert(a)
+{
+ var options=document.getElementById("advanced_options");
+ options.style.display = (a) ? "" : "none";
+
+ var checkbox=document.getElementById("expertbox");
+ checkbox.style.display = "";
+}
+showExpert(false);
+</script>
diff --git a/pages/account/12.php b/pages/account/12.php
index 9058a07..f4428aa 100644
--- a/pages/account/12.php
+++ b/pages/account/12.php
@@ -19,7 +19,7 @@
<form method="post" action="account.php">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
- <td colspan="8" class="title"><?=_("Domain Certificates")?> - <a href="account.php?id=12&amp;viewall=<?=!$viewall?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
+ <td colspan="8" class="title"><?=_("Domain Certificates")?> - <a href="account.php?id=12&amp;viewall=<?=intval(!$viewall)?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
</tr>
<tr>
<td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
@@ -34,17 +34,20 @@
$query = "select UNIX_TIMESTAMP(`domaincerts`.`created`) as `created`,
UNIX_TIMESTAMP(`domaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired`,
- `domaincerts`.`expire` as `expires`, `revoked` as `revoke`,
- UNIX_TIMESTAMP(`revoked`) as `revoked`, `CN`, `domaincerts`.`serial`, `domaincerts`.`id` as `id`,
+ `domaincerts`.`expire`,
+ `domaincerts`.`revoked` as `revoke`,
+ UNIX_TIMESTAMP(`revoked`) as `revoked`,
+ if (`domaincerts`.`expire`=0,CURRENT_TIMESTAMP(),`domaincerts`.`modified`) as `modified`,
+ `CN`, `domaincerts`.`serial`, `domaincerts`.`id` as `id`,
`domaincerts`.`description`
from `domaincerts`,`domains`
where `memid`='".intval($_SESSION['profile']['id'])."' and `domaincerts`.`domid`=`domains`.`id` ";
if($viewall != 1)
{
$query .= "AND `revoked`=0 AND `renewed`=0 ";
- $query .= "HAVING `timeleft` > 0 ";
+ $query .= "HAVING `timeleft` > 0 or `expire` = 0 ";
}
- $query .= "ORDER BY `domaincerts`.`modified` desc";
+ $query .= "ORDER BY `modified` desc";
//echo $query."<br>\n";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -69,24 +72,24 @@
?>
<tr>
<? if($verified != _("Pending") && $verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=$row['id']?>"/></td>
+ <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"/></td>
<? } else if($verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=$row['id']?>"/></td>
+ <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"/></td>
<? } else { ?>
<td class="DataTD">&nbsp;</td>
<? } ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="account.php?id=15&amp;cert=<?=$row['id']?>"><?=$row['CN']?></a></td>
+ <td class="DataTD"><a href="account.php?id=15&amp;cert=<?=intval($row['id'])?>"><?=htmlspecialchars($row['CN'])?></a></td>
<td class="DataTD"><?=$row['serial']?></td>
<td class="DataTD"><?=$row['revoke']?></td>
- <td class="DataTD"><?=$row['expires']?></td>
- <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
- <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
+ <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td>
</tr>
<? } ?>
<tr>
<td class="DataTD" colspan="8">
- <a href="account.php?id=12&amp;viewall=<?=!$viewall?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
+ <a href="account.php?id=12&amp;viewall=<?=intval(!$viewall)?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
</td>
</tr>
<tr>
@@ -104,6 +107,6 @@
<td class="DataTD" colspan="8"><?=_("From here you can delete pending requests, or revoke valid certificates.")?></td>
</tr>
</table>
-<input type="hidden" name="oldid" value="<?=$id?>"/>
+<input type="hidden" name="oldid" value="<?=intval($id)?>"/>
<input type="hidden" name="csrf" value="<?=make_csrf('srvcerchange')?>"/>
</form>
diff --git a/pages/account/13.php b/pages/account/13.php
index 08f325d..d468b3d 100644
--- a/pages/account/13.php
+++ b/pages/account/13.php
@@ -27,16 +27,19 @@
if($showdetails){
$body = sprintf(_("Hi %s,"),$user['fname'])."\n\n";
- $body .= _("You receive this automatic mail since you yourself or someone ".
+ $body .= sprintf(_("You receive this automatic mail since you yourself or someone ".
"else looked up your secret questions and answers for a forgotten ".
"password.\n\n".
+ "IP-Address: %s\nTime: %s\n\n".
"If it was you who looked up or changed that data, or clicked ".
"through the menu in your account, everything is in best order ".
"and you can ignore this mail.\n\n".
"But if you received this mail without a recognisable reason, ".
"there is a danger that an unauthorised person accessed your ".
"account, and you should promptly change your password and your ".
- "secret questions and answers.")."\n\n";
+ "secret questions and answers."),
+ $_SERVER['REMOTE_ADDR'],
+ date("Y-m-d H:i:s T"))."\n\n";
$body .= _("Best regards")."\n"._("CAcert Support");
@@ -52,22 +55,22 @@
<? if($_SESSION['profile']['points'] == 0) { ?>
<tr>
<td class="DataTD" width="125"><?=_("First Name")?>: </td>
- <td class="DataTD" width="125"><input type="text" name="fname" value="<?=$user['fname']?>"></td>
+ <td class="DataTD" width="125"><input type="text" name="fname" value="<?=sanitizeHTML($user['fname'])?>"></td>
</tr>
<tr>
<td class="DataTD" valign="top"><?=_("Middle Name(s)")?><br>
(<?=_("optional")?>)
</td>
- <td class="DataTD"><input type="text" name="mname" value="<?=$user['mname']?>"></td>
+ <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($user['mname'])?>"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Last Name")?>: </td>
- <td class="DataTD"><input type="text" name="lname" value="<?=$user['lname']?>"></td>
+ <td class="DataTD"><input type="text" name="lname" value="<?=sanitizeHTML($user['lname'])?>"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Suffix")?><br>
(<?=_("optional")?>)</td>
- <td class="DataTD"><input type="text" name="suffix" value="<?=$user['suffix']?>"></td>
+ <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($user['suffix'])?>"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Date of Birth")?><br>
@@ -100,22 +103,22 @@
<? } else { ?>
<tr>
<td class="DataTD" width="125"><?=_("First Name")?>: </td>
- <td class="DataTD" width="125"><?=$user['fname']?></td>
+ <td class="DataTD" width="125"><?=sanitizeHTML($user['fname'])?></td>
</tr>
<tr>
<td class="DataTD" valign="top"><?=_("Middle Name(s)")?><br>
(<?=_("optional")?>)
</td>
- <td class="DataTD"><?=$user['mname']?></td>
+ <td class="DataTD"><?=sanitizeHTML($user['mname'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Last Name")?>: </td>
- <td class="DataTD"><?=$user['lname']?></td>
+ <td class="DataTD"><?=sanitizeHTML($user['lname'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Suffix")?><br>
(<?=_("optional")?>)</td>
- <td class="DataTD"><?=$user['suffix']?></td>
+ <td class="DataTD"><?=sanitizeHTML($user['suffix'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Date of Birth")?><br>
@@ -124,7 +127,10 @@
</tr>
<? } ?>
<tr>
- <td colspan="2" class="title"><a href="account.php?id=13&amp;showdetails=<?=!$showdetails?>"><?=_("View secret question & answers and OTP phrases")?></a></td>
+ <td colspan="2" class="title"><a href="account.php?id=59&amp;oldid=13&amp;userid=<?=intval($_SESSION['profile']['id'])?>"><?=_('Show account history')?></a></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="title"><a href="account.php?id=13&amp;showdetails=<?=intval(!$showdetails)?>"><?=_("View secret question & answers and OTP phrases")?></a></td>
</tr>
<? if($showdetails){ ?>
<tr>
@@ -167,5 +173,5 @@
</tr>
</table>
<input type="hidden" name="csrf" value="<?=make_csrf('perschange')?>" />
-<input type="hidden" name="oldid" value="<?=$id?>">
+<input type="hidden" name="oldid" value="<?=intval($id)?>">
</form>
diff --git a/pages/account/15.php b/pages/account/15.php
index 6cd3115..405cb44 100644
--- a/pages/account/15.php
+++ b/pages/account/15.php
@@ -30,7 +30,7 @@
}
$row = mysql_fetch_assoc($res);
$crtname=escapeshellarg($row['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crtname`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname");
?>
<h3><?=_("Below is your Server Certificate")?></h3>
<pre>
diff --git a/pages/account/16.php b/pages/account/16.php
index 564463e..8783bc5 100644
--- a/pages/account/16.php
+++ b/pages/account/16.php
@@ -25,47 +25,101 @@
<tr>
<td class="DataTD"><?=_("Add")?></td>
<td class="DataTD"><?=_("Address")?></td>
-<? if(array_key_exists('emails',$_SESSION['_config']) && is_array($_SESSION['_config']['emails']))
- foreach($_SESSION['_config']['emails'] as $val) { ?>
+<?
+if (array_key_exists('emails',$_SESSION['_config']) && is_array($_SESSION['_config']['emails'])) {
+ $i = 1;
+ foreach($_SESSION['_config']['emails'] as $val) {
+?>
<tr>
- <td class="DataTD"><?=_("Email")?>:</td>
- <td class="DataTD"><input type="text" name="emails[]" value="<?=$val?>"/></td>
+ <td class="DataTD"><label for="email<?=$i?>"><?=_("Email")?></label></td>
+ <td class="DataTD"><input type="text" id="email<?=$i?>" name="emails[]" value="<?=$val?>"/></td>
</tr>
-<? } ?>
+<?
+ $i++;
+ }
+} ?>
<tr>
- <td class="DataTD"><?=_("Email")?>:</td>
- <td class="DataTD"><input type="text" name="emails[]"/></td>
+ <td class="DataTD"><label for="email0"><?=_("Email")?></td>
+ <td class="DataTD"><input type="text" id="email0" name="emails[]"/></td>
</tr>
<tr>
- <td class="DataTD"><?=_("Name")?>:</td>
- <td class="DataTD"><input type="text" name="name" value="<?=array_key_exists('name',$_SESSION['_config'])?($_SESSION['_config']['name']):''?>"/></td>
+ <td class="DataTD"><label for="name"><?=_("Name")?></label></td>
+ <td class="DataTD"><input type="text" id="name" name="name" value="<?=array_key_exists('name',$_SESSION['_config'])?($_SESSION['_config']['name']):''?>"/></td>
</tr>
<tr>
- <td class="DataTD"><?=_("Department")?>:</td>
- <td class="DataTD"><input type="text" name="OU" value="<?=array_key_exists('OU',$_SESSION['_config'])?($_SESSION['_config']['OU']):''?>"/></td>
+ <td class="DataTD"><label for="OU"><?=_("Department")?></label></td>
+ <td class="DataTD"><input type="text" id="OU" name="OU" value="<?=array_key_exists('OU',$_SESSION['_config'])?(sanitizeHTML($_SESSION['_config']['OU'])):''?>"/></td>
</tr>
- <tr>
+
+ <tr name="expertoff" style="display:none">
+ <td class="DataTD">
+ <input type="checkbox" id="expertbox" name="expertbox" onchange="showExpert(this.checked)" />
+ </td>
+ <td class="DataTD">
+ <label for="expertbox"><?=_("Show advanced options")?></label>
+ </td>
+ </tr>
+ <tr name="expert">
+ <td class="DataTD" colspan="2" align="left">
+ <input type="radio" id="root1" name="rootcert" value="1" /> <label for="root1"><?=_("Sign by class 1 root certificate")?></label><br />
+ <input type="radio" id="root2" name="rootcert" value="2" checked="checked" /> <label for="root2"><?=_("Sign by class 3 root certificate")?></label><br />
+ <?=str_replace("\n", "<br>\n", wordwrap(_("Please note: If you use a certificate signed by the class 3 root, the class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain."), 60))?>
+ </td>
+ </tr>
+
+ <tr name="expert">
<td class="DataTD" colspan="2" align="left">
- <input type="radio" name="rootcert" value="1" checked /> <?=_("Sign by class 1 root certificate")?><br />
- <input type="radio" name="rootcert" value="2" /> <?=_("Sign by class 3 root certificate")?><br />
- <?=str_replace("\n", "<br>\n", wordwrap(_("Please note: The class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain. Until we are included in browsers this might not be a desirable option for most people"), 60))?>
+ <?=_("Hash algorithm used when signing the certificate:")?><br />
+ <?
+ foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) {
+ ?>
+ <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> />
+ <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label><br />
+ <?
+ }
+ ?>
</td>
</tr>
+
<? if($_SESSION['profile']['codesign'] && $_SESSION['profile']['points'] >= 100) { ?>
- <tr>
- <td class="DataTD" colspan="2" align="left"><input type="checkbox" name="codesign" value="1" /><?=_("Code Signing")?></td>
+ <tr name="expert">
+ <td class="DataTD" colspan="2" align="left">
+ <input type="checkbox" id="codesign" name="codesign" value="1" />
+ <label for="codesign"><?=_("Code Signing")?></label>
+ </td>
</tr>
<? } ?>
- <tr>
- <td class="DataTD" colspan="2" align="left">
- <?=_("Optional comment, only used in the certificate overview")?><br />
- <input type="text" name="description" maxlength="80" size=80 />
- </td>
+ <tr>
+ <td class="DataTD" colspan="2" align="left">
+ <label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br />
+ <input type="text" id="description" name="description" maxlength="80" size="80" />
+ </td>
</tr>
<tr>
- <td class="DataTD" colspan="2"><input type="submit" name="add_email" value="<?=_("Another Email")?>">
- <input type="submit" name="process" value="<?=_("Next")?>" /></td>
+ <td class="DataTD" colspan="2">
+ <input type="submit" name="add_email" value="<?=_("Add Another Email Address")?>">
+ <input type="submit" name="process" value="<?=_("Next")?>" />
+ </td>
</tr>
</table>
<input type="hidden" name="oldid" value="<?=$id?>">
</form>
+
+<script language="javascript">
+function showExpert(a)
+{
+ b=document.getElementsByName("expert");
+ for(i=0;b.length>i;i++)
+ {
+ if(!a) {b[i].setAttribute("style","display:none"); }
+ else {b[i].removeAttribute("style");}
+ }
+ b=document.getElementsByName("expertoff");
+ for(i=0;b.length>i;i++)
+ {
+ b[i].removeAttribute("style");
+ }
+
+}
+showExpert(false);
+</script>
diff --git a/pages/account/18.php b/pages/account/18.php
index 9ab13b2..ca0a3c8 100644
--- a/pages/account/18.php
+++ b/pages/account/18.php
@@ -79,6 +79,7 @@ $status = array_key_exists('status',$_SESSION['_config']) ? intval($_SESSION['_c
UNIX_TIMESTAMP(`oemail`.`expire`) as `expired`,
`oemail`.`expire` as `expires`, `oemail`.`revoked` as `revoke`,
UNIX_TIMESTAMP(`oemail`.`revoked`) as `revoked`,
+ if (`oemail`.`expire`=0,CURRENT_TIMESTAMP(),`oemail`.`modified`) as `modified`,
`oemail`.`CN`, `oemail`.`serial`, `oemail`.`id`,
`oemail`.`description`, `oemail`.`ou`, `orginfo`.`O`
from `orgemailcerts` as `oemail`, `org`, `orginfo`
@@ -92,17 +93,17 @@ $status = array_key_exists('status',$_SESSION['_config']) ? intval($_SESSION['_c
if(0==$status)
{
$query .= "AND `oemail`.`revoked`=0 AND `oemail`.`renewed`=0 ";
- $query .= "HAVING `timeleft` > 0 AND `revoked`=0 ";
+ $query .= "HAVING `timeleft` > 0 AND `revoked`=0 or `expires` = 0 ";
}
switch ($sorting){
case 0:
- $query .= "ORDER BY `orginfo`.`O`, `oemail`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `modified` desc";
break;
case 1:
- $query .= "ORDER BY `orginfo`.`O`, `oemail`.`ou`, `oemail`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `oemail`.`ou`, `modified` desc";
break;
case 2:
- $query .= "ORDER BY `orginfo`.`O`, `oemail`.`CN`, `oemail`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `oemail`.`CN`, `modified` desc";
break;
}
$res = mysql_query($query);
diff --git a/pages/account/19.php b/pages/account/19.php
index 6a2749c..959111f 100644
--- a/pages/account/19.php
+++ b/pages/account/19.php
@@ -31,7 +31,7 @@
}
$row = mysql_fetch_assoc($res);
$crtname=escapeshellarg($row['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crtname`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname");
if($row['keytype'] == "NS")
{
diff --git a/pages/account/20.php b/pages/account/20.php
index ee16dd4..89bbc30 100644
--- a/pages/account/20.php
+++ b/pages/account/20.php
@@ -27,13 +27,60 @@
<p><?=_("If the Subscriber's name and/or domain name registration change the subscriber will immediately inform CAcert Inc. who shall revoke the digital certificate. When the Digital Certificate expires or is revoked the company will permanently remove the certificate from the server on which it is installed and will not use it for any purpose thereafter. The person responsible for key management and security is fully authorized to install and utilize the certificate to represent this organization's electronic presence.")?></p>
<form method="post" action="account.php">
-<input type="radio" name="rootcert" value="1" /> <?=_("Sign by class 1 root certificate")?><br />
-<input type="radio" name="rootcert" value="2" checked /> <?=_("Sign by class 3 root certificate")?><br />
-<p> <?=_("Optional comment, only used in the certificate overview")?><br />
- <input type="text" name="description" maxlength="80" size=80 /></p>
+<p><label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br />
+ <input type="text" id="description" name="description" maxlength="80" size="80" />
+</p>
+<p><label for="CSR"><?=_("Paste your CSR (Certificate Signing Request) below...")?></label><br />
+ <textarea id="CSR" name="CSR" cols="80" rows="15"></textarea>
+</p>
+
+<fieldset>
+<legend>
+ <input type="checkbox" id="expertbox" onchange="showExpert(this.checked)" style="display:none" />
+ <label for="expertbox"><?=_("Advanced Options")?></label>
+</legend>
+<div id="advanced_options">
+<ul class="no_indent">
+ <li>
+ <input type="radio" id="root1" name="rootcert" value="1" />
+ <label for="root1"><?=_("Sign by class 1 root certificate")?></label>
+ </li>
+ <li>
+ <input type="radio" id="root2" name="rootcert" value="2" checked="checked" />
+ <label for="root2"><?=_("Sign by class 3 root certificate")?></label>
+ </li>
+</ul>
<p><?=_("Please note: The class 3 root certificate needs to be setup in your webserver as a chained certificate, while slightly more complicated to setup, this root certificate is more likely to be trusted by more people.")?></p>
-<p><?=_("Paste your CSR below...")?></p>
-<textarea name="CSR" cols="80" rows="15"></textarea><br />
+
+<p class="attach_ul"><?=_("Hash algorithm used when signing the certificate:")?></p>
+<ul class="no_indent">
+<?
+foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) {
+?>
+ <li>
+ <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> />
+ <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label>
+ </li>
+<?
+}
+?>
+</ul>
+
+</div>
+</fieldset>
+
<input type="submit" name="process" value="<?=_("Submit")?>" />
<input type="hidden" name="oldid" value="<?=$id?>" />
-</form> \ No newline at end of file
+</form>
+
+<script language="javascript">
+function showExpert(a)
+{
+ var options=document.getElementById("advanced_options");
+ options.style.display = (a) ? "" : "none";
+
+ var checkbox=document.getElementById("expertbox");
+ checkbox.style.display = "";
+}
+showExpert(false);
+</script>
diff --git a/pages/account/21.php b/pages/account/21.php
index 75827fb..c5832b9 100644
--- a/pages/account/21.php
+++ b/pages/account/21.php
@@ -41,7 +41,7 @@ if (is_array($_SESSION['_config']['altrows'])) {
}
echo _("Organisation"), ": {$org['O']}<br>\n";
-echo _("Org. Unit"), ": {$_SESSION['_config']['OU']}<br>\n";
+echo _("Org. Unit"), ": ", sanitizeHTML($_SESSION['_config']['OU']), "<br>\n";
echo _("Location"), ": {$org['L']}<br>\n";
echo _("State/Province"), ": {$org['ST']}<br>\n";
echo _("Country"), ": {$org['C']}<br>\n";
@@ -52,7 +52,7 @@ echo _("Country"), ": {$org['C']}<br>\n";
<input type="submit" name="process" value="<?=_("Submit")?>">
<input type="hidden" name="oldid" value="<?=$id?>">
</p>
-
+
<?
if ($_SESSION['profile']['admin'] == 1) {
?>
diff --git a/pages/account/22.php b/pages/account/22.php
index 0413da0..7b7db2d 100644
--- a/pages/account/22.php
+++ b/pages/account/22.php
@@ -78,7 +78,9 @@ $status = array_key_exists('dstatus',$_SESSION['_config']) ? intval($_SESSION['_
UNIX_TIMESTAMP(`orgdomaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`orgdomaincerts`.`expire`) as `expired`,
`orgdomaincerts`.`expire` as `expires`, `revoked` as `revoke`,
- UNIX_TIMESTAMP(`revoked`) as `revoked`, `CN`,
+ UNIX_TIMESTAMP(`orgdomaincerts`.`revoked`) as `revoked`,
+ if (`orgdomaincerts`.`expire`=0,CURRENT_TIMESTAMP(),`orgdomaincerts`.`modified`) as `modified`,
+ `CN`,
`orgdomaincerts`.`serial`,
`orgdomaincerts`.`id` as `id`,
`orgdomaincerts`.`description`, `orginfo`.`O`
@@ -94,14 +96,14 @@ $status = array_key_exists('dstatus',$_SESSION['_config']) ? intval($_SESSION['_
if(0==$status)
{
$query .= "AND `revoked`=0 AND `renewed`=0 ";
- $query .= "HAVING `timeleft` > 0 ";
+ $query .= "HAVING `timeleft` > 0 or `expires` = 0 ";
}
switch ($sorting){
case 0:
- $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `modified` desc";
break;
case 1:
- $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`CN`, `orgdomaincerts`.`expire` desc";
+ $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`CN`, `modified` desc";
break;
}
diff --git a/pages/account/23.php b/pages/account/23.php
index 4ec56c3..4255b47 100644
--- a/pages/account/23.php
+++ b/pages/account/23.php
@@ -30,7 +30,7 @@
}
$row = mysql_fetch_assoc($res);
$crtname=escapeshellarg($row['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crtname`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname");
?>
<h3><?=_("Below is your Server Certificate")?></h3>
<pre>
diff --git a/pages/account/24.php b/pages/account/24.php
index 14a47c0..2ad526e 100644
--- a/pages/account/24.php
+++ b/pages/account/24.php
@@ -16,51 +16,25 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/ ?>
<?
- // Reset session variables regarding Org's, present empty form
- if (array_key_exists('O',$_SESSION['_config'])) $_SESSION['_config']['O'] = "";
- if (array_key_exists('contact',$_SESSION['_config'])) $_SESSION['_config']['contact'] = "";
- if (array_key_exists('L',$_SESSION['_config'])) $_SESSION['_config']['L'] = "";
- if (array_key_exists('ST',$_SESSION['_config'])) $_SESSION['_config']['ST'] = "";
- if (array_key_exists('C',$_SESSION['_config'])) $_SESSION['_config']['C'] = "";
- if (array_key_exists('comments',$_SESSION['_config'])) $_SESSION['_config']['comments'] = "";
-
+$orgname = '';
+$contactmail = '';
+$town = '';
+$state = '';
+$country = '';
+$comment = '';
+
+ // Reset session variables regarding Org's, present empty form
+if (array_key_exists('O',$_SESSION['_config'])) $_SESSION['_config']['O'] = "";
+if (array_key_exists('contact',$_SESSION['_config'])) $_SESSION['_config']['contact'] = "";
+if (array_key_exists('L',$_SESSION['_config'])) $_SESSION['_config']['L'] = "";
+if (array_key_exists('ST',$_SESSION['_config'])) $_SESSION['_config']['ST'] = "";
+if (array_key_exists('C',$_SESSION['_config'])) $_SESSION['_config']['C'] = "";
+if (array_key_exists('comments',$_SESSION['_config'])) $_SESSION['_config']['comments'] = "";
+
?>
<form method="post" action="account.php">
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="2" class="title"><?=_("New Organisation")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Organisation Name")?>:</td>
- <td class="DataTD"><input type="text" name="O" value="" maxlength="50" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Contact Email")?>:</td>
- <td class="DataTD"><input type="text" name="contact" value="" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Town/Suburb")?>:</td>
- <td class="DataTD"><input type="text" name="L" value="" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("State/Province")?>:</td>
- <td class="DataTD"><input type="text" name="ST" value="" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Country")?>:</td>
- <td class="DataTD"><input type="text" name="C" value="" size="5">
- <?php printf(_('(2 letter %s ISO code %s )'),
- '<a href="http://www.iso.org/iso/home/standards/country_codes/iso-3166-1_decoding_table.htm">',
- '</a>')?>
- </td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Comments")?>:</td>
- <td class="DataTD"><textarea name="comments" cols="60" rows="10"></textarea></td>
- </tr>
- <tr>
- <td class="DataTD" colspan="2"><input type="submit" name="process" value="<?=_("Next")?>"></td>
- </tr>
-</table>
+<?
+org_edit_org_table($orgname, $contactmail, $town, $state, $country, $comment, 0);
+?>
<input type="hidden" name="oldid" value="<?=$id?>">
</form>
diff --git a/pages/account/27.php b/pages/account/27.php
index a1086d4..d07a781 100644
--- a/pages/account/27.php
+++ b/pages/account/27.php
@@ -16,46 +16,20 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/ ?>
<?
- $row = mysql_fetch_assoc(mysql_query("select * from `orginfo` where `id`='".intval($_REQUEST['orgid'])."'"));
+ $orgid = intval($_REQUEST['orgid']);
+ $row = mysql_fetch_assoc(mysql_query("select * from `orginfo` where `id`='" . $orgid . "'"));
+ $orgname = $row['O'];
+ $contactmail = $row['contact'];
+ $town = $row['L'];
+ $state = $row['ST'];
+ $country = $row['C'];
+ $comment = $row['comments'];
?>
<form method="post" action="account.php">
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="2" class="title"><?=_("Edit Organisation")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Organisation Name")?>:</td>
- <td class="DataTD"><input type="text" name="O" value="<?=$row['O']?>" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Contact Email")?>:</td>
- <td class="DataTD"><input type="text" name="contact" value="<?=($row['contact'])?>" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Town/Suburb")?>:</td>
- <td class="DataTD"><input type="text" name="L" value="<?=($row['L'])?>" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("State/Province")?>:</td>
- <td class="DataTD"><input type="text" name="ST" value="<?=($row['ST'])?>" size="90"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Country")?>:</td>
- <td class="DataTD"><input type="text" name="C" value="<?=($row['C'])?>" size="5">
- <?php printf(_('(2 letter %s ISO code %s )'),
- '<a href="http://www.iso.org/iso/home/standards/country_codes/iso-3166-1_decoding_table.htm">',
- '</a>')?>
- </td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Comments")?>:</td>
- <td class="DataTD"><textarea name="comments" cols=60 rows=10><?=($row['comments'])?></textarea></td>
- </tr>
- <tr>
- <td class="DataTD" colspan="2"><input type="submit" name="process" value="<?=_("Update")?>"></td>
- </tr>
-</table>
+<?
+ org_edit_org_table($orgname, $contactmail, $town, $state, $country, $comment, 1);
+?>
<input type="hidden" name="oldid" value="<?=intval($id)?>">
-<input type="hidden" name="orgid" value="<?=intval($_REQUEST['orgid'])?>">
+<input type="hidden" name="orgid" value="<?=$orgid?>">
<input type="hidden" name="csrf" value="<?=make_csrf('orgdetchange')?>" />
</form>
diff --git a/pages/account/3.php b/pages/account/3.php
index 7e34300..cd62ce0 100644
--- a/pages/account/3.php
+++ b/pages/account/3.php
@@ -34,6 +34,7 @@
<tr>
<td class="DataTD"><?=_("Add")?></td>
<td class="DataTD"><?=_("Address")?></td>
+ </tr>
<?
$query = "select * from `email` where `memid`='".intval($_SESSION['profile']['id'])."' and `deleted`=0 and `hash`=''";
@@ -41,8 +42,8 @@
while($row = mysql_fetch_assoc($res))
{ ?>
<tr>
- <td class="DataTD"><input type="checkbox" name="addid[]" value="<?=intval($row['id'])?>"></td>
- <td class="DataTD"><?=sanitizeHTML($row['email'])?></td>
+ <td class="DataTD"><input type="checkbox" id="addid<?=intval($row['id'])?>" name="addid[]" value="<?=intval($row['id'])?>"></td>
+ <td class="DataTD" align="left"><label for="addid<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></label></td>
</tr>
<? }
if($_SESSION['profile']['points'] >= 50)
@@ -52,81 +53,120 @@ if($_SESSION['profile']['points'] >= 50)
$lname = $_SESSION['profile']['lname'];
$suffix = $_SESSION['profile']['suffix'];
?>
- <td class="DataTD" colspan="2" align="left">
- <input type="radio" name="rootcert" value="1" checked /> <?=_("Sign by class 1 root certificate")?><br />
- <input type="radio" name="rootcert" value="2" /> <?=_("Sign by class 3 root certificate")?><br />
- <?=str_replace("\n", "<br />\n", wordwrap(_("Please note: The class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain. Until we are included in browsers this might not be a desirable option for most people"), 125))?>
- </td>
- </tr>
<tr>
<td class="DataTD" colspan="2" align="left">
- <input type="radio" name="incname" value="0" checked /> <?=_("No Name")?><br />
- <? if($fname && $lname) { ?><input type="radio" name="incname" value="1" /> <?=_("Include")?> '<?=$fname." ".$lname?>'<br /><? } ?>
- <? if($fname && $mname && $lname) { ?><input type="radio" name="incname" value="2" /> <?=_("Include")?> '<?=$fname." ".$mname." ".$lname?>'<br /><? } ?>
- <? if($fname && $lname && $suffix) { ?><input type="radio" name="incname" value="3" /> <?=_("Include")?> '<?=$fname." ".$lname." ".$suffix?>'<br /><? } ?>
- <? if($fname && $mname && $lname && $suffix) { ?><input type="radio" name="incname" value="4" /> <?=_("Include")?> '<?=$fname." ".$mname." ".$lname." ".$suffix?>'<br /><? } ?>
+ <input type="radio" id="incname0" name="incname" value="0" checked="checked" />
+ <label for="incname0"><?=_("No Name")?></label><br />
+ <? if($fname && $lname) { ?>
+ <input type="radio" id="incname1" name="incname" value="1" />
+ <label for="incname1"><?=_("Include")?> '<?=$fname." ".$lname?>'</label><br />
+ <? } ?>
+ <? if($fname && $mname && $lname) { ?>
+ <input type="radio" id="incname2" name="incname" value="2" />
+ <label for="incname2"><?=_("Include")?> '<?=$fname." ".$mname." ".$lname?>'</label><br />
+ <? } ?>
+ <? if($fname && $lname && $suffix) { ?>
+ <input type="radio" id="incname3" name="incname" value="3" />
+ <label for="incname3"><?=_("Include")?> '<?=$fname." ".$lname." ".$suffix?>'</label><br />
+ <? } ?>
+ <? if($fname && $mname && $lname && $suffix) { ?>
+ <input type="radio" id="incname4" name="incname" value="4" />
+ <label for="incname4"><?=_("Include")?> '<?=$fname." ".$mname." ".$lname." ".$suffix?>'</label><br />
+ <? } ?>
</td>
</tr>
<? } ?>
-<? if($_SESSION['profile']['points'] >= 100 && $_SESSION['profile']['codesign'] > 0) { ?>
+
<tr>
<td class="DataTD">
- <input type="checkbox" name="codesign" value="1" />
+ <input type="checkbox" id="login" name="login" value="1" checked="checked" />
</td>
<td class="DataTD" align="left">
- <?=_("Code Signing")?><br />
- <?=_("Please Note: By ticking this box you will automatically have your name included in any certificates.")?>
+ <label for="login"><?=_("Enable certificate login with this certificate")?><br />
+ <?=_("By allowing certificate login, this certificate can be used to login into this account at https://secure.cacert.org/ .")?></label>
</td>
</tr>
-<? } ?>
-
<tr>
+ <td class="DataTD" colspan="2" align="left">
+ <label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br />
+ <input type="text" id="description" name="description" maxlength="100" size="100" />
+ </td>
+ </tr>
+
+ <tr name="expertoff" style="display:none">
<td class="DataTD">
- <input type="checkbox" name="login" value="1" checked="checked" />
+ <input type="checkbox" id="expertbox" name="expertbox" onchange="showExpert(this.checked)" />
</td>
- <td class="DataTD"> <?=_("Enable certificate login with this certificate")?><br />
- <?=_("By allowing certificate login, this certificate can be used to login into this account at https://secure.cacert.org/ .")?><br/>
+ <td class="DataTD" align="left">
+ <label for="expertbox"><?=_("Show advanced options")?></label>
</td>
</tr>
- <tr>
- <td class="DataTD" colspan="2" align="left">
- <?=_("Optional comment, only used in the certificate overview")?><br />
- <input type="text" name="description" maxlength="100" size="100" />
- </td>
+
+<?
+if($_SESSION['profile']['points'] >= 50)
+{
+?>
+ <tr name="expert">
+ <td class="DataTD" colspan="2" align="left">
+ <input type="radio" id="root1" name="rootcert" value="1" /> <label for="root1"><?=_("Sign by class 1 root certificate")?></label><br />
+ <input type="radio" id="root2" name="rootcert" value="2" checked="checked" /> <label for="root2"><?=_("Sign by class 3 root certificate")?></label><br />
+ <?=str_replace("\n", "<br />\n", wordwrap(_("Please note: If you use a certificate signed by the class 3 root, the class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain."), 125))?>
+ </td>
</tr>
+<? } ?>
- <tr name="expertoff" style="display:none">
+ <tr name="expert">
+ <td class="DataTD" colspan="2" align="left">
+ <?=_("Hash algorithm used when signing the certificate:")?><br />
+ <?
+ foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) {
+ ?>
+ <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> />
+ <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label><br />
+ <?
+ }
+ ?>
+ </td>
+ </tr>
+
+<? if($_SESSION['profile']['points'] >= 100 && $_SESSION['profile']['codesign'] > 0) { ?>
+ <tr name="expert">
<td class="DataTD">
- <input type="checkbox" name="expertbox" onchange="showExpert(this.checked)" />
+ <input type="checkbox" id="codesign" name="codesign" value="1" />
</td>
+ <td class="DataTD" align="left">
+ <label for="codesign"><?=_("Code Signing")?><br />
+ <?=_("Please note: By ticking this box you will automatically have your name included in the certificate.")?></label>
+ </td>
+ </tr>
+<? } ?>
+
+ <tr name="expert">
<td class="DataTD">
- <?=_("Show advanced options")?>
+ <input type="checkbox" id="SSO" name="SSO" value="1" />
+ </td>
+ <td class="DataTD" align="left">
+ <label for="SSO"><?=_("Add Single Sign On ID Information")?><br />
+ <?=str_replace("\n", "<br>\n", wordwrap(_("By adding Single Sign On (SSO) ID information to your certificates this could be used to track you, you can also issue certificates with no email addresses that are useful only for Authentication. Please see a more detailed description on our WIKI about it."), 125))?>
+ <a href="http://wiki.cacert.org/wiki/SSO"><?=_("SSO WIKI Entry")?></a></label>
</td>
</tr>
<tr name="expert">
- <td class="DataTD" colspan="2" align="left">
- <input type="radio" name="SSO" value="0" checked /> <?=_("No Single Sign On ID")?><br />
- <input type="radio" name="SSO" value="1" /> <?=_("Add Single Sign On ID Information")?><br />
- <?=str_replace("\n", "<br>\n", wordwrap(_("By adding Single Sign On (SSO) ID information to your certificates this could be used to track you, you can also issue certificates with no email addresses that are useful only for Authentication. Please see a more detailed description on our WIKI about it."), 125))?>
- <a href="http://wiki.cacert.org/wiki/SSO"><?=_("SSO WIKI Entry")?></a>
+ <td class="DataTD" colspan="2">
+ <label for="optionalCSR"><?=_("Optional Client CSR, no information on the certificate will be used")?></label><br />
+ <textarea id="optionalCSR" name="optionalCSR" cols="80" rows="5"></textarea>
</td>
</tr>
- <tr name="expert">
- <td class="DataTD" colspan="2"><?=_("Optional Client CSR, no information on the certificate will be used")?></td>
- </tr>
- <tr name="expert">
- <td class="DataTD" colspan="2"><textarea name="optionalCSR" cols="80" rows="5"></textarea></td>
- </tr>
- <tr>
+ <tr>
<td class="DataTD">
- <input type="checkbox" name="CCA" />
+ <input type="checkbox" id="CCA" name="CCA" />
</td>
<td class="DataTD" align="left">
- <strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br />
- <?=_("Please Note: You need to accept the CCA to proceed.")?>
+ <label for="CCA"><strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br />
+ <?=_("Please note: You need to accept the CCA to proceed.")?></label>
</td>
</tr>
<tr>
@@ -154,4 +194,3 @@ function showExpert(a)
}
showExpert(false);
</script>
-
diff --git a/pages/account/41.php b/pages/account/41.php
index d61d8db..f644025 100644
--- a/pages/account/41.php
+++ b/pages/account/41.php
@@ -57,7 +57,7 @@ require_once($_SESSION['_config']['filepath'].'/includes/lib/l10n.php');
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
- $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='".mysql_escape_string($row['lang'])."'"));
+ $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='".mysql_real_escape_string($row['lang'])."'"));
?>
<tr>
<td class="DataTD"><?=_("Additional Language")?>:</td>
diff --git a/pages/account/43.php b/pages/account/43.php
index 53b24d3..4fc67a0 100644
--- a/pages/account/43.php
+++ b/pages/account/43.php
@@ -14,30 +14,30 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?
+*/
+
include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
+$ticketno='';
+$ticketvalidation=FALSE;
- if(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0)
- {
- $assurance = mysql_escape_string(intval($_REQUEST['assurance']));
- $row = 0;
- $res = mysql_query("select `to` from `notary` where `id`='$assurance'");
- if ($res) {
- $row = mysql_fetch_assoc($res);
- }
- mysql_query("delete from `notary` where `id`='$assurance'");
- if ($row) {
- fix_assurer_flag($row['to']);
- }
- }
+if (isset($_SESSION['ticketno'])) {
+ $ticketno = $_SESSION['ticketno'];
+ $ticketvalidation = valid_ticket_number($ticketno);
+}
+if (isset($_SESSION['ticketmsg'])) {
+ $ticketmsg = $_SESSION['ticketmsg'];
+} else {
+ $ticketmsg = '';
+}
- if(intval(array_key_exists('userid',$_REQUEST)?$_REQUEST['userid']:0) <= 0)
- {
+
+// search for an account by email search, if more than one is found display list to choose
+if(intval(array_key_exists('userid',$_REQUEST)?$_REQUEST['userid']:0) <= 0)
+{
$_REQUEST['userid'] = 0;
- $emailsearch = $email = mysql_escape_string(stripslashes($_REQUEST['email']));
+ $emailsearch = $email = mysql_real_escape_string(stripslashes(trim($_REQUEST['email'])));
//Disabled to speed up the queries
//if(!strstr($email, "%"))
@@ -45,877 +45,1036 @@ include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
// bug-975 ted+uli changes --- begin
if(preg_match("/^[0-9]+$/", $email)) {
- // $email consists of digits only ==> search for IDs
- // Be defensive here (outer join) if primary mail is not listed in email table
- $query = "select `users`.`id` as `id`, `email`.`email` as `email`
- from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
- where (`email`.`id`='$email' or `users`.`id`='$email')
- and `users`.`deleted`=0
- group by `users`.`id` limit 100";
+ // $email consists of digits only ==> search for IDs
+ // Be defensive here (outer join) if primary mail is not listed in email table
+ $query = "select `users`.`id` as `id`, `email`.`email` as `email`
+ from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
+ where (`email`.`id`='$email' or `users`.`id`='$email')
+ and `users`.`deleted`=0
+ group by `users`.`id` limit 100";
} else {
- // $email contains non-digits ==> search for mail addresses
- // Be defensive here (outer join) if primary mail is not listed in email table
- $query = "select `users`.`id` as `id`, `email`.`email` as `email`
- from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
- where (`email`.`email` like '$emailsearch'
- or `users`.`email` like '$emailsearch')
- and `users`.`deleted`=0
- group by `users`.`id` limit 100";
+ // $email contains non-digits ==> search for mail addresses
+ // Be defensive here (outer join) if primary mail is not listed in email table
+ $query = "select `users`.`id` as `id`, `email`.`email` as `email`
+ from `users` left outer join `email` on (`users`.`id`=`email`.`memid`)
+ where (`email`.`email` like '$emailsearch'
+ or `users`.`email` like '$emailsearch')
+ and `users`.`deleted`=0
+ group by `users`.`id` limit 100";
}
// bug-975 ted+uli changes --- end
$res = mysql_query($query);
- if(mysql_num_rows($res) > 1) { ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Select Specific Account Details")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("User ID")?></td>
- <td class="DataTD"><?=_("Email")?></td>
- </tr>
-<?
- while($row = mysql_fetch_assoc($res))
- { ?>
- <tr>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=intval($row['id'])?></a></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
- </tr>
-<? } if(mysql_num_rows($res) >= 100) { ?>
- <tr>
- <td class="DataTD" colspan="2"><?=_("Only the first 100 rows are displayed.")?></td>
- </tr>
-<? } else { ?>
- <tr>
- <td class="DataTD" colspan="2"><? printf(_("%s rows displayed."), mysql_num_rows($res)); ?></td>
- </tr>
-<? } ?>
-</table><br><br>
-<? } elseif(mysql_num_rows($res) == 1) {
- $row = mysql_fetch_assoc($res);
- $_REQUEST['userid'] = $row['id'];
- } else {
- printf(_("No users found matching %s"), sanitizeHTML($email));
- }
- }
-
- if(intval($_REQUEST['userid']) > 0)
- {
- $userid = intval($_REQUEST['userid']);
- $query = "select * from `users` where `users`.`id`='$userid' and `users`.`deleted`=0";
- $res = mysql_query($query);
- if(mysql_num_rows($res) <= 0)
- {
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
- } else {
- $row = mysql_fetch_assoc($res);
- $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($row['id'])."'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $alerts = mysql_fetch_assoc(mysql_query("select * from `alerts` where `memid`='".intval($row['id'])."'"));
+ if(mysql_num_rows($res) > 1) {
?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><? printf(_("%s's Account Details"), sanitizeHTML($row['email'])); ?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Email")?>:</td>
- <td class="DataTD"><?=sanitizeHTML($row['email'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("First Name")?>:</td>
- <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to modify this DOB and/or last name?")?>')) return false;">
- <input type="hidden" name="csrf" value="<?=make_csrf('admchangepers')?>" />
- <input type="text" name="fname" value="<?=sanitizeHTML($row['fname'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Middle Name")?>:</td>
- <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($row['mname'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Last Name")?>:</td>
- <td class="DataTD"> <input type="hidden" name="oldid" value="43">
- <input type="hidden" name="action" value="updatedob">
- <input type="hidden" name="userid" value="<?=intval($userid)?>">
- <input type="text" name="lname" value="<?=sanitizeHTML($row['lname'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Suffix")?>:</td>
- <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($row['suffix'])?>"></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Date of Birth")?>:</td>
- <td class="DataTD">
-<?
- $year = intval(substr($row['dob'], 0, 4));
- $month = intval(substr($row['dob'], 5, 2));
- $day = intval(substr($row['dob'], 8, 2));
- ?><nobr><select name="day">
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Select Specific Account Details")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("User ID")?></td>
+ <td class="DataTD"><?=_("Email")?></td>
+ </tr>
<?
- for($i = 1; $i <= 31; $i++)
+ while($row = mysql_fetch_assoc($res))
{
- echo "<option";
- if($day == $i)
- echo " selected='selected'";
- echo ">$i</option>";
- }
?>
- </select>
- <select name="month">
+ <tr>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=intval($row['id'])?></a></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
+ </tr>
<?
- for($i = 1; $i <= 12; $i++)
- {
- echo "<option value='$i'";
- if($month == $i)
- echo " selected='selected'";
- echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))."</option>";
}
+
+ if(mysql_num_rows($res) >= 100) {
?>
- </select>
- <input type="text" name="year" value="<?=$year?>" size="4">
- <input type="submit" value="Go"></form></nobr></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("CCA accepted")?>:</td>
- <td class="DataTD"><a href="account.php?id=57&amp;userid=<?=intval($row['id'])?>"><?=intval(get_user_agreement_status($row['id'])) ? _("Yes") : _("No") ?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Trainings")?>:</td>
- <td class="DataTD"><a href="account.php?id=55&amp;userid=<?=intval($row['id'])?>">show</a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Is Assurer")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;assurer=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admsetassuret')?>"><?=$row['assurer']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Blocked Assurer")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;assurer_blocked=<?=intval($row['id'])?>"><?=$row['assurer_blocked']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Account Locking")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;locked=<?=$row['id']?>&amp;csrf=<?=make_csrf('admactlock')?>"><?=$row['locked']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Code Signing")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;codesign=<?=$row['id']?>&amp;csrf=<?=make_csrf('admcodesign')?>"><?=$row['codesign']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Org Assurer")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;orgadmin=<?=$row['id']?>&amp;csrf=<?=make_csrf('admorgadmin')?>"><?=$row['orgadmin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("TTP Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;ttpadmin=<?=$row['id']?>&amp;csrf=<?=make_csrf('admttpadmin')?>"><?=$row['ttpadmin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Location Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;locadmin=<?=$row['id']?>"><?=$row['locadmin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;admin=<?=$row['id']?>&amp;csrf=<?=make_csrf('admsetadmin')?>"><?=$row['admin']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Ad Admin")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;adadmin=<?=$row['id']?>"><?=$row['adadmin']?></a> (0 = none, 1 = submit, 2 = approve)</td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Tverify Account")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;tverify=<?=$row['id']?>"><?=$row['tverify']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("General Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;general=<?=$row['id']?>"><?=$alerts['general']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Country Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;country=<?=$row['id']?>"><?=$alerts['country']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Regional Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;regional=<?=$row['id']?>"><?=$alerts['regional']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Within 200km Announcements")?>:</td>
- <td class="DataTD"><a href="account.php?id=43&amp;radius=<?=$row['id']?>"><?=$alerts['radius']?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Change Password")?>:</td>
- <td class="DataTD"><a href="account.php?id=44&amp;userid=<?=$row['id']?>"><?=_("Change Password")?></a></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Delete Account")?>:</td>
- <td class="DataTD"><a href="account.php?id=50&amp;userid=<?=$row['id']?>&amp;csrf=<?=make_csrf('admdelaccount')?>"><?=_("Delete Account")?></a></td>
- </tr>
+ <tr>
+ <td class="DataTD" colspan="2"><?=_("Only the first 100 rows are displayed.")?></td>
+ </tr>
<?
- // This is intensionally a $_GET for audit purposes. DO NOT CHANGE!!!
- if(array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes") {
+ } else {
?>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q1:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q1'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A1:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A1'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q2:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q2'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A2:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A2'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q3:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q3'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A3:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A3'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q4:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q4'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A4:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A4'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - Q5:</td>
- <td class="DataTD"><?=sanitizeHTML($row['Q5'])?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("Lost Password")?> - A5:</td>
- <td class="DataTD"><?=sanitizeHTML($row['A5'])?></td>
- </tr>
-<? } else { ?>
- <tr>
- <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;showlostpw=yes"><?=_("Show Lost Password Details")?></a></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD"><?=_("Assurance Points")?>:</td>
- <td class="DataTD"><?=intval($drow['points'])?></td>
- </tr>
-</table>
-<br><?
- $query = "select * from `email` where `memid`='".intval($row['id'])."' and `deleted`=0 and `hash`=''
- and `email`!='".mysql_escape_string($row['email'])."'";
- $dres = mysql_query($query);
- if(mysql_num_rows($dres) > 0) { ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Alternate Verified Email Addresses")?></td>
- </tr><?
- $rc = mysql_num_rows($dres);
- while($drow = mysql_fetch_assoc($dres))
- { ?>
- <tr>
- <td class="DataTD"><?=_("Secondary Emails")?>:</td>
- <td class="DataTD"><?=sanitizeHTML($drow['email'])?></td>
- </tr>
-<? } ?>
-</table>
-<br><? } ?>
+ <tr>
+ <td class="DataTD" colspan="2"><? printf(_("%s rows displayed."), mysql_num_rows($res)); ?></td>
+ </tr>
<?
- $query = "select * from `domains` where `memid`='".intval($row['id'])."' and `deleted`=0 and `hash`=''";
- $dres = mysql_query($query);
- if(mysql_num_rows($dres) > 0) { ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Verified Domains")?></td>
- </tr><?
- $rc = mysql_num_rows($dres);
- while($drow = mysql_fetch_assoc($dres))
- { ?>
- <tr>
- <td class="DataTD"><?=_("Domain")?>:</td>
- <td class="DataTD"><?=sanitizeHTML($drow['domain'])?></td>
- </tr>
-<? } ?>
-</table>
-<br>
-<? } ?>
-<? // Begin - Debug infos ?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="2" class="title"><?=_("Account State")?></td>
- </tr>
-
-<?
- // --- bug-975 begin ---
- // potential db inconsistency like in a20110804.1
- // Admin console -> don't list user account
- // User login -> impossible
- // Assurer, assure someone -> user displayed
- /* regular user account search with regular settings
-
- --- Admin Console find user query
- $query = "select `users`.`id` as `id`, `email`.`email` as `email` from `users`,`email`
- where `users`.`id`=`email`.`memid` and
- (`email`.`email` like '$emailsearch' or `email`.`id`='$email' or `users`.`id`='$email') and
- `email`.`hash`='' and `email`.`deleted`=0 and `users`.`deleted`=0
- group by `users`.`id` limit 100";
- => requirements
- 1. email.hash = ''
- 2. email.deleted = 0
- 3. users.deleted = 0
- 4. email.email = primary-email (???) or'd
- not covered by admin console find user routine, but may block users login
- 5. users.verified = 0|1
- further "special settings"
- 6. users.locked (setting displayed in display form)
- 7. users.assurer_blocked (setting displayed in display form)
-
- --- User login user query
- select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or
- `password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0
- => requirements
- 1. users.verified = 1
- 2. users.deleted = 0
- 3. users.locked = 0
- 4. users.email = primary-email
-
- --- Assurer, assure someone find user query
- select * from `users` where `email`='".mysql_escape_string(stripslashes($_POST['email']))."'
- and `deleted`=0
- => requirements
- 1. users.deleted = 0
- 2. users.email = primary-email
- Admin User Assurer
- bit Console Login assure someone
-
- 1. email.hash = '' Yes No No
- 2. email.deleted = 0 Yes No No
- 3. users.deleted = 0 Yes Yes Yes
- 4. users.verified = 1 No Yes No
- 5. users.locked = 0 No Yes No
- 6. users.email = prim-email No Yes Yes
- 7. email.email = prim-email Yes No No
-
- full usable account needs all 7 requirements fulfilled
- so if one setting isn't set/cleared there is an inconsistency either way
- if eg email.email is not avail, admin console cannot open user info
- but user can login and assurer can display user info
- if user verified is not set to 1, admin console displays user record
- but user cannot login, but assurer can search for the user and the data displays
-
- consistency check:
- 1. search primary-email in users.email
- 2. search primary-email in email.email
- 3. userid = email.memid
- 4. check settings from table 1. - 5.
-
- */
-
- $inconsistency = 0;
- $inconsistencydisp = "";
- $inccause = "";
- // current userid intval($row['id'])
- $query = "select `email` as `uemail`, `deleted` as `udeleted`, `verified`, `locked`
- from `users` where `id`='".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $uemail = $drow['uemail'];
- $udeleted = $drow['udeleted'];
- $uverified = $drow['verified'];
- $ulocked = $drow['locked'];
-
- $query = "select `hash`, `email` as `eemail` from `email`
- where `memid`='".intval($row['id'])."' and
- `email` ='".$uemail."' and
- `deleted` = 0";
- $dres = mysql_query($query);
- if ($drow = mysql_fetch_assoc($dres)) {
- $drow['edeleted'] = 0;
- } else {
- // try if there are deleted entries
- $query = "select `hash`, `deleted` as `edeleted`, `email` as `eemail` from `email`
- where `memid`='".intval($row['id'])."' and
- `email` ='".$uemail."'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- }
-
- if ($drow) {
- $eemail = $drow['eemail'];
- $edeleted = $drow['edeleted'];
- $ehash = $drow['hash'];
- if ($udeleted!=0) {
- $inconsistency += 1;
- $inccause .= (empty($inccause)?"":"<br>")._("Users record set to deleted");
- }
- if ($uverified!=1) {
- $inconsistency += 2;
- $inccause .= (empty($inccause)?"":"<br>")._("Users record verified not set");
- }
- if ($ulocked!=0) {
- $inconsistency += 4;
- $inccause .= (empty($inccause)?"":"<br>")._("Users record locked set");
- }
- if ($edeleted!=0) {
- $inconsistency += 8;
- $inccause .= (empty($inccause)?"":"<br>")._("Email record set deleted");
- }
- if ($ehash!='') {
- $inconsistency += 16;
- $inccause .= (empty($inccause)?"":"<br>")._("Email record hash not unset");
- }
- } else {
- $inconsistency = 32;
- $inccause = _("Prim. email, Email record doesn't exist");
- }
- if ($inconsistency>0) {
- // $inconsistencydisp = _("Yes");
-?>
- <tr>
- <td class="DataTD"><?=_("Account inconsistency")?>:</td>
- <td class="DataTD"><?=$inccause?><br>code: <?=$inconsistency?></td>
- </tr>
- <tr>
- <td colspan="2" class="DataTD" style="max-width: 75ex">
- <?=_("Account inconsistency can cause problems in daily account ".
- "operations and needs to be fixed manually through arbitration/critical ".
- "team.")?>
- </td>
- </tr>
-<? }
-
- // --- bug-975 end ---
+ }
?>
-</table>
-<br>
+ </table><br><br>
<?
- // End - Debug infos
-?>
+ } elseif(mysql_num_rows($res) == 1) {
+ $row = mysql_fetch_assoc($res);
+ $_REQUEST['userid'] = $row['id'];
+ } else {
+ printf(_("No users found matching %s"), sanitizeHTML($email));
+ }
+}
+
+// display user information for given user id
+if(intval($_REQUEST['userid']) > 0) {
+ $userid = intval($_REQUEST['userid']);
+ $res =get_user_data($userid);
+ if(mysql_num_rows($res) <= 0) {
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
+ } else {
+ $row = mysql_fetch_assoc($res);
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($row['id'])."' and `deleted` = 0";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $alerts =get_alerts(intval($row['id']));
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="6" class="title"><?=_("Certificates")?></td>
- </tr>
-
- <tr>
- <td class="DataTD"><?=_("Cert Type")?>:</td>
- <td class="DataTD"><?=_("Total")?></td>
- <td class="DataTD"><?=_("Valid")?></td>
- <td class="DataTD"><?=_("Expired")?></td>
- <td class="DataTD"><?=_("Revoked")?></td>
- <td class="DataTD"><?=_("Latest Expire")?></td>
- </tr>
-<!-- server certificates -->
- <tr>
- <td class="DataTD"><?=_("Server")?>:</td>
- <?
- $query = "select COUNT(*) as `total`,
- MAX(`domaincerts`.`expire`) as `maxexpire`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."'
- and `revoked` = '0000-00-00 00:00:00'
- and `expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."'
- and `expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `domains` inner join `domaincerts`
- on `domains`.`id` = `domaincerts`.`domid`
- where `domains`.`memid` = '".intval($row['id'])."'
- and `revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- client certificates -->
- <tr>
- <td class="DataTD"><?=_("Client")?>:</td>
- <?
- $query = "select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."'
- and `revoked` = '0000-00-00 00:00:00'
- and `expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."'
- and `expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `emailcerts`
- where `memid` = '".intval($row['id'])."'
- and `revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- gpg certificates -->
- <tr>
- <td class="DataTD"><?=_("GPG")?>:</td>
- <?
- $query = "select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
- from `gpg`
- where `memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `gpg`
- where `memid` = '".intval($row['id'])."'
- and `expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `gpg`
- where `memid` = '".intval($row['id'])."'
- and `expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- org server certificates -->
- <tr>
- <td class="DataTD"><a href="account.php?id=58&amp;userid=<?=intval($row['id'])?>"><?=_("Org Server")?></a>:</td>
- <?
- $query = "select COUNT(*) as `total`,
- MAX(`orgcerts`.`expire`) as `maxexpire`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
- and `orgcerts`.`expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `orgdomaincerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
-<!-- org client certificates -->
- <tr>
- <td class="DataTD"><?=_("Org Client")?>:</td>
- <?
- $query = "select COUNT(*) as `total`,
- MAX(`orgcerts`.`expire`) as `maxexpire`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."' ";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $total = $drow['total'];
-
- $maxexpire = "0000-00-00 00:00:00";
- if ($drow['maxexpire']) {
- $maxexpire = $drow['maxexpire'];
- }
-
- if($total > 0) {
- $query = "select COUNT(*) as `valid`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
- and `orgcerts`.`expire` > NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $valid = $drow['valid'];
-
- $query = "select COUNT(*) as `expired`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`expire` <= NOW()";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $expired = $drow['expired'];
-
- $query = "select COUNT(*) as `revoked`
- from `orgemailcerts` as `orgcerts` inner join `org`
- on `orgcerts`.`orgid` = `org`.`orgid`
- where `org`.`memid` = '".intval($row['id'])."'
- and `orgcerts`.`revoked` != '0000-00-00 00:00:00'";
- $dres = mysql_query($query);
- $drow = mysql_fetch_assoc($dres);
- $revoked = $drow['revoked'];
- ?>
- <td class="DataTD"><?=intval($total)?></td>
- <td class="DataTD"><?=intval($valid)?></td>
- <td class="DataTD"><?=intval($expired)?></td>
- <td class="DataTD"><?=intval($revoked)?></td>
- <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?
- substr($maxexpire, 0, 10) : _("Pending")?></td>
- <?
- } else { // $total > 0
- ?>
- <td colspan="5" class="DataTD"><?=_("None")?></td>
- <?
- } ?>
- </tr>
- <tr>
- <td colspan="6" class="title">
- <form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to revoke all private certificates?")?>')) return false;">
- <input type="hidden" name="action" value="revokecert">
- <input type="hidden" name="oldid" value="43">
- <input type="hidden" name="userid" value="<?=intval($userid)?>">
- <input type="submit" value="<?=_('revoke certificates')?>">
- </form>
- </td>
- </tr>
-</table>
-<br>
-
-
-<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredto"><?=_("Show Assurances the user got")?></a>
- (<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredto15"><?=_("New calculation")?></a>)
-<br />
-<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredby"><?=_("Show Assurances the user gave")?></a>
- (<a href="account.php?id=43&amp;userid=<?=$row['id']?>&amp;shownotary=assuredby15"><?=_("New calculation")?></a>)
-<br />
+//display account data
-<?
-// if(array_key_exists('assuredto',$_GET) && $_GET['assuredto'] == "yes") {
+//deletes an assurance
+ if(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0 && $ticketvalidation == true)
+ {
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE assurance revoke', $ticketno)) {
+ $ticketmsg=_("Writing to the admin log failed. Can't continue.");
+ } else {
+ $assurance = intval($_REQUEST['assurance']);
+ $trow = 0;
+ $res = mysql_query("select `to` from `notary` where `id`='".intval($assurance)."' and `deleted` = 0");
+ if ($res) {
+ $trow = mysql_fetch_assoc($res);
+ if ($trow) {
+ mysql_query("update `notary` set `deleted`=NOW() where `id`='".intval($assurance)."'");
+ fix_assurer_flag($trow['to']);
+ }
+ }
+ }
+ } elseif(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0 && $ticketvalidation == FALSE) {
+ $ticketmsg=_('No assurance revoked. Ticket number is missing!');
+ }
-function showassuredto()
-{
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="8" class="title"><?=_("Assurance Points")?></td>
- </tr>
- <tr>
- <td class="DataTD"><b><?=_("ID")?></b></td>
- <td class="DataTD"><b><?=_("Date")?></b></td>
- <td class="DataTD"><b><?=_("Who")?></b></td>
- <td class="DataTD"><b><?=_("Email")?></b></td>
- <td class="DataTD"><b><?=_("Points")?></b></td>
- <td class="DataTD"><b><?=_("Location")?></b></td>
- <td class="DataTD"><b><?=_("Method")?></b></td>
- <td class="DataTD"><b><?=_("Revoke")?></b></td>
- </tr>
-<?
- $query = "select * from `notary` where `to`='".intval($_GET['userid'])."'";
- $dres = mysql_query($query);
- $points = 0;
- while($drow = mysql_fetch_assoc($dres))
- {
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['from'])."'"));
- $points += $drow['points'];
+//Ticket number
?>
- <tr>
- <td class="DataTD"><?=$drow['id']?></td>
- <td class="DataTD"><?=sanitizeHTML($drow['date'])?></td>
- <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['fname'])." ".sanitizeHTML($fromuser['lname'])?></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
- <td class="DataTD"><?=intval($drow['points'])?></td>
- <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td>
- <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>&amp;assurance=<?=intval($drow['id'])?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$drow['id'])?>');"><?=_("Revoke")?></a></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
- <td class="DataTD"><?=$points?></td>
- <td class="DataTD" colspan="3">&nbsp;</td>
- </tr>
-</table>
-<? } ?>
+<form method="post" action="account.php?id=43&userid=<?=intval($_REQUEST['userid'])?>">
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="2" class="title"><?=_('Ticket handling') ?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_('Ticket no')?>:</td>
+ <td class="DataTD"><input type="text" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="DataTDError"><?=$ticketmsg?></td><?php $_SESSION['ticketmsg']='' ?>
+ </tr>
+ <tr>
+ <td colspan="2" ><input type="submit" value="<?=_('Set ticket number') ?>"></td>
+ </tr>
+ </table>
+</form>
+<br/>
+
+
+<!-- display data table -->
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><? printf(_("%s's Account Details"), sanitizeHTML($row['email'])); ?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Email")?>:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['email'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("First Name")?>:</td>
+ <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to modify this DOB and/or last name?")?>')) return false;">
+ <input type="hidden" name="csrf" value="<?=make_csrf('admchangepers')?>" />
+ <input type="text" name="fname" value="<?=sanitizeHTML($row['fname'])?>">
+ </td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Middle Name")?>:</td>
+ <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($row['mname'])?>"></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Last Name")?>:</td>
+ <td class="DataTD"> <input type="hidden" name="oldid" value="43">
+ <input type="hidden" name="action" value="updatedob">
+ <input type="hidden" name="userid" value="<?=intval($userid)?>">
+ <input type="text" name="lname" value="<?=sanitizeHTML($row['lname'])?>">
+ </td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Suffix")?>:</td>
+ <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($row['suffix'])?>"></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Date of Birth")?>:</td>
+ <td class="DataTD">
+ <?
+ $year = intval(substr($row['dob'], 0, 4));
+ $month = intval(substr($row['dob'], 5, 2));
+ $day = intval(substr($row['dob'], 8, 2));
+ ?>
+ <nobr>
+ <select name="day">
+ <?
+ for($i = 1; $i <= 31; $i++) {
+ echo "<option";
+ if($day == $i) {
+ echo " selected='selected'";
+ }
+ echo ">$i</option>";
+ }
+ ?>
+ </select>
+ <select name="month">
+ <?
+ for($i = 1; $i <= 12; $i++) {
+ echo "<option value='$i'";
+ if($month == $i)
+ echo " selected='selected'";
+ echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))."</option>";
+ }
+ ?>
+ </select>
+ <input type="text" name="year" value="<?=$year?>" size="4">
+ <input type="submit" value="Go">
+ <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/>
+ </form>
+ </nobr>
+ </td>
+ </tr>
+
+ <? // list of flags ?>
+ <tr>
+ <td class="DataTD"><?=_("CCA accepted")?>:</td>
+ <td class="DataTD"><a href="account.php?id=57&amp;userid=<?=intval($row['id'])?>"><?=intval(get_user_agreement_status($row['id'], 'CCA')) ? _("Yes") : _("No") ?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Trainings")?>:</td>
+ <td class="DataTD"><a href="account.php?id=55&amp;userid=<?=intval($row['id'])?>">show</a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Is Assurer")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;assurer=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admsetassuret')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['assurer'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Blocked Assurer")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;assurer_blocked=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['assurer_blocked'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Account Locking")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;locked=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admactlock')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['locked'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Code Signing")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;codesign=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admcodesign')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['codesign'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Org Assurer")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;orgadmin=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admorgadmin')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['orgadmin'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("TTP Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;ttpadmin=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admttpadmin')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['ttpadmin'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Location Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;locadmin=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['locadmin']?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;admin=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admsetadmin')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['admin'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Ad Admin")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;adadmin=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['adadmin'])?></a> (0 = none, 1 = submit, 2 = approve)</td>
+ </tr>
+ <!-- presently not needed
+ <tr>
+ <td class="DataTD"><?=_("Tverify Account")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;tverify=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['tverify'])?></a></td>
+ </tr>
+ -->
+ <tr>
+ <td class="DataTD"><?=_("General Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;general=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['general'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Country Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;country=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['country'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Regional Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;regional=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['regional'])?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Within 200km Announcements")?>:</td>
+ <td class="DataTD"><a href="account.php?id=43&amp;radius=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['radius'])?></a></td>
+ </tr>
+ <? //change password, view secret questions and delete account section ?>
+ <tr>
+ <td class="DataTD"><?=_("Change Password")?>:</td>
+ <td class="DataTD"><a href="account.php?id=44&amp;userid=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Change Password")?></a></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Delete Account")?>:</td>
+ <td class="DataTD"><a href="account.php?id=50&amp;userid=<?=intval($row['id'])?>&amp;csrf=<?=make_csrf('admdelaccount')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Delete Account")?></a></td>
+ </tr>
+ <?
+ // This is intensionally a $_GET for audit purposes. DO NOT CHANGE!!!
+ if(array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes" && $ticketvalidation==true) {
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE view lost password information', $ticketno)) {
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><?=_("Writing to the admin log failed. Can't continue.")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;showlostpw=yes&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td>
+ </tr>
+ <?
+ } else {
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q1:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q1'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A1:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A1'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q2:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q2'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A2:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A2'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q3:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q3'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A3:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A3'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q4:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q4'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A4:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A4'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - Q5:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['Q5'])?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Lost Password")?> - A5:</td>
+ <td class="DataTD"><?=sanitizeHTML($row['A5'])?></td>
+ </tr>
+ <?
+ }
+ } elseif (array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes" && $ticketvalidation==false) {
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><?=_('No access granted. Ticket number is missing')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;showlostpw=yes&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td>
+ </tr>
+ <?
+ } else {
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;showlostpw=yes&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td>
+ </tr>
+ <? }
+
+ // list assurance points
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Assurance Points")?>:</td>
+ <td class="DataTD"><?=intval($drow['points'])?></td>
+ </tr>
+ <?
+ // show account history
+ ?>
+ <tr>
+ <td class="DataTD" colspan="2"><a href="account.php?id=59&amp;oldid=43&amp;userid=<?=intval($row['id'])?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_('Show account history')?></a></td>
+ </tr>
+ </table>
+ <br/>
+ <?
+ //list secondary email addresses
+ $dres = get_email_addresses(intval($row['id']),$row['email']);
+ if(mysql_num_rows($dres) > 0) {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Alternate Verified Email Addresses")?></td>
+ </tr>
+ <?
+ while($drow = mysql_fetch_assoc($dres)) {
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Secondary Emails")?>:</td>
+ <td class="DataTD"><?=sanitizeHTML($drow['email'])?></td>
+ </tr>
+ <?
+ }
+ ?>
+ </table>
+ <br/>
+ <?
+ }
+
+ // list of domains
+ $dres=get_domains(intval($row['id']));
+ if(mysql_num_rows($dres) > 0) {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Verified Domains")?></td>
+ </tr>
+ <?
+ while($drow = mysql_fetch_assoc($dres)) {
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Domain")?>:</td>
+ <td class="DataTD"><?=sanitizeHTML($drow['domain'])?></td>
+ </tr>
+ <?
+ }
+ ?>
+ </table>
+ <br/>
+ <?
+ }
+ ?>
+ <? // Begin - Debug infos ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="2" class="title"><?=_("Account State")?></td>
+ </tr>
+
+ <?
+ // --- bug-975 begin ---
+ // potential db inconsistency like in a20110804.1
+ // Admin console -> don't list user account
+ // User login -> impossible
+ // Assurer, assure someone -> user displayed
+ /* regular user account search with regular settings
+
+ --- Admin Console find user query
+ $query = "select `users`.`id` as `id`, `email`.`email` as `email` from `users`,`email`
+ where `users`.`id`=`email`.`memid` and
+ (`email`.`email` like '$emailsearch' or `email`.`id`='$email' or `users`.`id`='$email') and
+ `email`.`hash`='' and `email`.`deleted`=0 and `users`.`deleted`=0
+ group by `users`.`id` limit 100";
+ => requirements
+ 1. email.hash = ''
+ 2. email.deleted = 0
+ 3. users.deleted = 0
+ 4. email.email = primary-email (???) or'd
+ not covered by admin console find user routine, but may block users login
+ 5. users.verified = 0|1
+ further "special settings"
+ 6. users.locked (setting displayed in display form)
+ 7. users.assurer_blocked (setting displayed in display form)
+
+ --- User login user query
+ select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or
+ `password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0
+ => requirements
+ 1. users.verified = 1
+ 2. users.deleted = 0
+ 3. users.locked = 0
+ 4. users.email = primary-email
+
+ --- Assurer, assure someone find user query
+ select * from `users` where `email`='".mysql_real_escape_string(stripslashes($_POST['email']))."'
+ and `deleted`=0
+ => requirements
+ 1. users.deleted = 0
+ 2. users.email = primary-email
+
+ Admin User Assurer
+ bit Console Login assure someone
+
+ 1. email.hash = '' Yes No No
+ 2. email.deleted = 0 Yes No No
+ 3. users.deleted = 0 Yes Yes Yes
+ 4. users.verified = 1 No Yes No
+ 5. users.locked = 0 No Yes No
+ 6. users.email = prim-email No Yes Yes
+ 7. email.email = prim-email Yes No No
+
+ full usable account needs all 7 requirements fulfilled
+ so if one setting isn't set/cleared there is an inconsistency either way
+ if eg email.email is not avail, admin console cannot open user info
+ but user can login and assurer can display user info
+ if user verified is not set to 1, admin console displays user record
+ but user cannot login, but assurer can search for the user and the data displays
+
+ consistency check:
+ 1. search primary-email in users.email
+ 2. search primary-email in email.email
+ 3. userid = email.memid
+ 4. check settings from table 1. - 5.
+
+ */
+
+ $inconsistency = 0;
+ $inconsistencydisp = "";
+ $inccause = "";
+
+ // current userid intval($row['id'])
+ $query = "select `email` as `uemail`, `deleted` as `udeleted`, `verified`, `locked`
+ from `users` where `id`='".intval($row['id'])."' ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $uemail = $drow['uemail'];
+ $udeleted = $drow['udeleted'];
+ $uverified = $drow['verified'];
+ $ulocked = $drow['locked'];
+
+ $query = "select `hash`, `email` as `eemail` from `email`
+ where `memid`='".intval($row['id'])."' and
+ `email` ='".$uemail."' and
+ `deleted` = 0";
+ $dres = mysql_query($query);
+ if ($drow = mysql_fetch_assoc($dres)) {
+ $drow['edeleted'] = 0;
+ } else {
+ // try if there are deleted entries
+ $query = "select `hash`, `deleted` as `edeleted`, `email` as `eemail` from `email`
+ where `memid`='".intval($row['id'])."' and
+ `email` ='".$uemail."'";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ }
+
+ if ($drow) {
+ $eemail = $drow['eemail'];
+ $edeleted = $drow['edeleted'];
+ $ehash = $drow['hash'];
+ if ($udeleted!=0) {
+ $inconsistency += 1;
+ $inccause .= (empty($inccause)?"":"<br>")._("Users record set to deleted");
+ }
+ if ($uverified!=1) {
+ $inconsistency += 2;
+ $inccause .= (empty($inccause)?"":"<br>")._("Users record verified not set");
+ }
+ if ($ulocked!=0) {
+ $inconsistency += 4;
+ $inccause .= (empty($inccause)?"":"<br>")._("Users record locked set");
+ }
+ if ($edeleted!=0) {
+ $inconsistency += 8;
+ $inccause .= (empty($inccause)?"":"<br>")._("Email record set deleted");
+ }
+ if ($ehash!='') {
+ $inconsistency += 16;
+ $inccause .= (empty($inccause)?"":"<br>")._("Email record hash not unset");
+ }
+ } else {
+ $inconsistency = 32;
+ $inccause = _("Prim. email, Email record doesn't exist");
+ }
+ if ($inconsistency>0) {
+ // $inconsistencydisp = _("Yes");
+ ?>
+ <tr>
+ <td class="DataTD"><?=_("Account inconsistency")?>:</td>
+ <td class="DataTD"><?=$inccause?><br>code: <?=intval($inconsistency)?></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="DataTD" style="max-width: 75ex;">
+ <?=_("Account inconsistency can cause problems in daily account operations and needs to be fixed manually through arbitration/critical team.")?>
+ </td>
+ </tr>
+ <?
+ }
+
+ // --- bug-975 end ---
+ ?>
+ </table>
+ <br />
+ <?
+ // End - Debug infos
+
+ // certificate overview
+ ?>
+
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="6" class="title"><?=_("Certificates")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Cert Type")?>:</td>
+ <td class="DataTD"><?=_("Total")?></td>
+ <td class="DataTD"><?=_("Valid")?></td>
+ <td class="DataTD"><?=_("Expired")?></td>
+ <td class="DataTD"><?=_("Revoked")?></td>
+ <td class="DataTD"><?=_("Latest Expire")?></td>
+ </tr>
+ <!-- server certificates -->
+ <tr>
+ <td class="DataTD"><?=_("Server")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`,
+ MAX(`domaincerts`.`expire`) as `maxexpire`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ and `revoked` = '0000-00-00 00:00:00'
+ and `expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ and `expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `domains` inner join `domaincerts`
+ on `domains`.`id` = `domaincerts`.`domid`
+ where `domains`.`memid` = '".intval($row['id'])."'
+ and `revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- client certificates -->
+ <tr>
+ <td class="DataTD"><?=_("Client")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ and `revoked` = '0000-00-00 00:00:00'
+ and `expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ and `expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `emailcerts`
+ where `memid` = '".intval($row['id'])."'
+ and `revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- gpg certificates -->
+ <tr>
+ <td class="DataTD"><?=_("GPG")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`, MAX(`expire`) as `maxexpire`
+ from `gpg`
+ where `memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `gpg`
+ where `memid` = '".intval($row['id'])."'
+ and `expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `gpg`
+ where `memid` = '".intval($row['id'])."'
+ and `expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- org server certificates -->
+ <tr>
+ <td class="DataTD"><a href="account.php?id=58&amp;userid=<?=intval($row['id'])?>"><?=_("Org Server")?></a>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`,
+ MAX(`orgcerts`.`expire`) as `maxexpire`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
+ and `orgcerts`.`expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `orgdomaincerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <!-- org client certificates -->
+ <tr>
+ <td class="DataTD"><?=_("Org Client")?>:</td>
+ <?
+ $query = "
+ select COUNT(*) as `total`,
+ MAX(`orgcerts`.`expire`) as `maxexpire`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $total = $drow['total'];
+
+ $maxexpire = "0000-00-00 00:00:00";
+ if ($drow['maxexpire']) {
+ $maxexpire = $drow['maxexpire'];
+ }
+
+ if($total > 0) {
+ $query = "
+ select COUNT(*) as `valid`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` = '0000-00-00 00:00:00'
+ and `orgcerts`.`expire` > NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $valid = $drow['valid'];
+
+ $query = "
+ select COUNT(*) as `expired`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`expire` <= NOW()
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $expired = $drow['expired'];
+
+ $query = "
+ select COUNT(*) as `revoked`
+ from `orgemailcerts` as `orgcerts` inner join `org`
+ on `orgcerts`.`orgid` = `org`.`orgid`
+ where `org`.`memid` = '".intval($row['id'])."'
+ and `orgcerts`.`revoked` != '0000-00-00 00:00:00'
+ ";
+ $dres = mysql_query($query);
+ $drow = mysql_fetch_assoc($dres);
+ $revoked = $drow['revoked'];
+ ?>
+ <td class="DataTD"><?=intval($total)?></td>
+ <td class="DataTD"><?=intval($valid)?></td>
+ <td class="DataTD"><?=intval($expired)?></td>
+ <td class="DataTD"><?=intval($revoked)?></td>
+ <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td>
+ <?
+ } else { // $total > 0
+ ?>
+ <td colspan="5" class="DataTD"><?=_("None")?></td>
+ <?
+ }
+ ?>
+ </tr>
+ <tr>
+ <td colspan="6" class="title">
+ <form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to revoke all private certificates?")?>')) return false;">
+ <input type="hidden" name="action" value="revokecert">
+ <input type="hidden" name="oldid" value="43">
+ <input type="hidden" name="userid" value="<?=intval($userid)?>">
+ <input type="submit" value="<?=_('revoke certificates')?>">
+ <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/>
+ </form>
+ </td>
+ </tr>
+ </table>
+ <br />
+ <? // list assurances ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td class="DataTD">
+ <a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredto&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user got")?></a>
+ (<a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredto15&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>)
+ </td>
+ </tr>
+ <tr>
+ <td class="DataTD">
+ <a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredby&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user gave")?></a>
+ (<a href="account.php?id=43&amp;userid=<?=intval($row['id'])?>&amp;shownotary=assuredby15&amp;ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>)
+ </td>
+ </tr>
+ </table>
+ <?
+ // if(array_key_exists('assuredto',$_GET) && $_GET['assuredto'] == "yes") {
+
+
+ function showassuredto($ticketno)
+ {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="8" class="title"><?=_("Assurance Points")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><b><?=_("ID")?></b></td>
+ <td class="DataTD"><b><?=_("Date")?></b></td>
+ <td class="DataTD"><b><?=_("Who")?></b></td>
+ <td class="DataTD"><b><?=_("Email")?></b></td>
+ <td class="DataTD"><b><?=_("Points")?></b></td>
+ <td class="DataTD"><b><?=_("Location")?></b></td>
+ <td class="DataTD"><b><?=_("Method")?></b></td>
+ <td class="DataTD"><b><?=_("Revoke")?></b></td>
+ </tr>
+ <?
+ $query = "select * from `notary` where `to`='".intval($_GET['userid'])."' and `deleted` = 0";
+ $dres = mysql_query($query);
+ $points = 0;
+ while($drow = mysql_fetch_assoc($dres)) {
+ $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['from'])."'"));
+ $points += $drow['points'];
+ ?>
+ <tr>
+ <td class="DataTD"><?=$drow['id']?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['date'])?></td>
+ <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['fname'])." ".sanitizeHTML($fromuser['lname'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
+ <td class="DataTD"><?=intval($drow['points'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>&amp;assurance=<?=intval($drow['id'])?>&amp;csrf=<?=make_csrf('admdelassurance')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),intval($drow['id']))?>');"><?=_("Revoke")?></a></td>
+ </tr>
+ <?
+ }
+ ?>
+ <tr>
+ <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
+ <td class="DataTD"><?=intval($points)?></td>
+ <td class="DataTD" colspan="3">&nbsp;</td>
+ </tr>
+ </table>
+ <?
+ }
+
+ function showassuredby($ticketno)
+ {
+ ?>
+ <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="8" class="title"><?=_("Assurance Points The User Issued")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><b><?=_("ID")?></b></td>
+ <td class="DataTD"><b><?=_("Date")?></b></td>
+ <td class="DataTD"><b><?=_("Who")?></b></td>
+ <td class="DataTD"><b><?=_("Email")?></b></td>
+ <td class="DataTD"><b><?=_("Points")?></b></td>
+ <td class="DataTD"><b><?=_("Location")?></b></td>
+ <td class="DataTD"><b><?=_("Method")?></b></td>
+ <td class="DataTD"><b><?=_("Revoke")?></b></td>
+ </tr>
+ <?
+ $query = "select * from `notary` where `from`='".intval($_GET['userid'])."' and `deleted` = 0";
+ $dres = mysql_query($query);
+ $points = 0;
+ while($drow = mysql_fetch_assoc($dres)) {
+ $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['to'])."'"));
+ $points += intval($drow['points']);
+ ?>
+ <tr>
+ <td class="DataTD"><?=intval($drow['id'])?></td>
+ <td class="DataTD"><?=$drow['date']?></td>
+ <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['fname']." ".$fromuser['lname'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
+ <td class="DataTD"><?=intval($drow['points'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td>
+ <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['from'])?>&assurance=<?=intval($drow['id'])?>&amp;csrf=<?=make_csrf('admdelassurance')?>&amp;ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),intval($drow['id']))?>');"><?=_("Revoke")?></a></td>
+ </tr>
+ <?
+ }
+ ?>
+ <tr>
+ <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
+ <td class="DataTD"><?=intval($points)?></td>
+ <td class="DataTD" colspan="3">&nbsp;</td>
+ </tr>
+ </table>
+ <?} ?>
+<br/><br/>
<?
-function showassuredby()
-{
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="8" class="title"><?=_("Assurance Points The User Issued")?></td>
- </tr>
- <tr>
- <td class="DataTD"><b><?=_("ID")?></b></td>
- <td class="DataTD"><b><?=_("Date")?></b></td>
- <td class="DataTD"><b><?=_("Who")?></b></td>
- <td class="DataTD"><b><?=_("Email")?></b></td>
- <td class="DataTD"><b><?=_("Points")?></b></td>
- <td class="DataTD"><b><?=_("Location")?></b></td>
- <td class="DataTD"><b><?=_("Method")?></b></td>
- <td class="DataTD"><b><?=_("Revoke")?></b></td>
- </tr>
-<?
- $query = "select * from `notary` where `from`='".intval($_GET['userid'])."'";
- $dres = mysql_query($query);
- $points = 0;
- while($drow = mysql_fetch_assoc($dres))
- {
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$drow['to']."'"));
- $points += $drow['points'];
-?>
- <tr>
- <td class="DataTD"><?=$drow['id']?></td>
- <td class="DataTD"><?=$drow['date']?></td>
- <td class="DataTD"><a href="wot.php?id=9&userid=<?=$drow['to']?>"><?=$fromuser['fname']." ".$fromuser['lname']?></td>
- <td class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td>
- <td class="DataTD"><?=$drow['points']?></td>
- <td class="DataTD"><?=$drow['location']?></td>
- <td class="DataTD"><?=$drow['method']?></td>
- <td class="DataTD"><a href="account.php?id=43&userid=<?=$drow['from']?>&assurance=<?=$drow['id']?>&amp;csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID &quot;%s&quot;?"),$drow['id'])?>');"><?=_("Revoke")?></a></td>
- </tr>
-<? } ?>
- <tr>
- <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td>
- <td class="DataTD"><?=$points?></td>
- <td class="DataTD" colspan="3">&nbsp;</td>
- </tr>
-</table>
-<? } ?>
-<br><br>
-<? } }
+} }
if(isset($_GET['shownotary'])) {
switch($_GET['shownotary']) {
case 'assuredto':
- showassuredto();
+ showassuredto($ticketno);
break;
case 'assuredby':
- showassuredby();
+ showassuredby($ticketno);
break;
case 'assuredto15':
- output_received_assurances(intval($_GET['userid']),1);
+ output_received_assurances(intval($_GET['userid']),1,$ticketno);
break;
case 'assuredby15':
- output_given_assurances(intval($_GET['userid']),1);
+ output_given_assurances(intval($_GET['userid']),1, $ticketno);
break;
}
}
diff --git a/pages/account/44.php b/pages/account/44.php
index fd34612..718f0e0 100644
--- a/pages/account/44.php
+++ b/pages/account/44.php
@@ -14,8 +14,28 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<? if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") { ?><div color="orange">ERROR: <?=$_SESSION['_config']['error']?></div><? unset($_SESSION['_config']['error']); } ?>
+*/
+
+if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") {
+ ?>
+ <div style="color: orange;">ERROR: <?=$_SESSION['_config']['error']?></div>
+ <?
+ unset($_SESSION['_config']['error']);
+}
+
+$ticketno = "";
+if (array_key_exists('ticketno', $_SESSION)) {
+ $ticketno = $_SESSION['ticketno'];
+}
+
+if (!valid_ticket_number($ticketno)) {
+ printf(_("I'm sorry, you did not enter a ticket number! %s You cannot reset the password."), '<br/>');
+ echo '<br/><a href="account.php?id=43&amp;userid='.intval($_REQUEST['userid']).'">'._('Back to previous page.').'</a>';
+ showfooter();
+ exit;
+ }
+?>
+
<form method="post" action="account.php">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
@@ -34,5 +54,6 @@
</tr>
</table>
<input type="hidden" name="userid" value="<?=intval($_REQUEST['userid'])?>">
-<input type="hidden" name="oldid" value="<?=$id?>">
+<input type="hidden" name="oldid" value="<?=intval($id)?>">
+<input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/>
</form>
diff --git a/pages/account/49.php b/pages/account/49.php
index 0218fa0..e1e6206 100644
--- a/pages/account/49.php
+++ b/pages/account/49.php
@@ -19,14 +19,20 @@
$userid=0; if(array_key_exists('userid',$_GET)) $userid=intval($_GET['userid']);
if($userid <= 0)
{
- $domainsearch = $domain = mysql_escape_string(stripslashes($_POST['domain']));
+ $domainsearch = $domain = mysql_real_escape_string(stripslashes($_POST['domain']));
if(!strstr($domain, "%"))
$domainsearch = "%$domain%";
if(preg_match("/^\d+$/",$domain))
$domainsearch = "";
+ //check if request is id if not set search ID to -1
+ $domainid = intval($domain);
+ if($domain !== $domainid){
+ $domainid = -1;
+ }
+
$query = "select `users`.`id` as `id`, `domains`.`domain` as `domain`, `domains`.`id`as `domid` from `users`,`domains`
where `users`.`id`=`domains`.`memid` and
- (`domains`.`domain` like '$domainsearch' or `domains`.`id`='$domain') and
+ (`domains`.`domain` like '$domainsearch' or `domains`.`id`='$domainid') and
`domains`.`deleted`=0 and `users`.`deleted`=0 and
`users`.`verified`=1
group by `users`.`id` limit 100";
@@ -64,8 +70,7 @@
</tr>
</table><br><br><?
}
-
- $query = "select `orgid`,`domain`,`id` from `orgdomains` where `domain` like '$domainsearch' or `id`='$domain' limit 100";
+ $query = "select `orgid`,`domain`,`id` from `orgdomains` where `domain` like '$domainsearch' or `id`='$domainid' limit 100";
$res = mysql_query($query);
if(mysql_num_rows($res) >= 1) { ?>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
diff --git a/pages/account/5.php b/pages/account/5.php
index 934ca0c..efed0ab 100644
--- a/pages/account/5.php
+++ b/pages/account/5.php
@@ -19,7 +19,7 @@
<form method="post" action="account.php">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
- <td colspan="10" class="title"><?=_("Client Certificates")?> - <a href="account.php?id=5&amp;viewall=<?=!$viewall?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
+ <td colspan="10" class="title"><?=_("Client Certificates")?> - <a href="account.php?id=5&amp;viewall=<?=intval(!$viewall)?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td>
</tr>
<tr>
<td class="DataTD"><?=_("Renew/Revoke/Delete")?></td>
@@ -34,23 +34,24 @@
$query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`,
- `emailcerts`.`expire` as `expires`,
+ `emailcerts`.`expire`,
`emailcerts`.`revoked` as `revoke`,
UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`,
+ if (`emailcerts`.`expire`=0,CURRENT_TIMESTAMP(),`emailcerts`.`modified`) as `modified` ,
`emailcerts`.`id`,
`emailcerts`.`CN`,
`emailcerts`.`serial`,
`emailcerts`.`disablelogin` as `disablelogin`,
`emailcerts`.`description`
from `emailcerts`
- where `emailcerts`.`memid`='".$_SESSION['profile']['id']."'
+ where `emailcerts`.`memid`='".intval($_SESSION['profile']['id'])."'
";
if($viewall != 1)
$query .= " AND `revoked`=0 AND `renewed`=0 ";
$query .= " GROUP BY `emailcerts`.`id` ";
if($viewall != 1)
- $query .= " HAVING `timeleft` > 0 ";
- $query .= " ORDER BY `emailcerts`.`modified` desc";
+ $query .= " HAVING `timeleft` > 0 or `expire` = 0 ";
+ $query .= " ORDER BY `modified` desc";
// echo $query."<br>\n";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
@@ -75,32 +76,32 @@
?>
<tr>
<? if($verified != _("Pending") && $verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=$row['id']?>"></td>
+ <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"></td>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="account.php?id=6&amp;cert=<?=$row['id']?>"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></a></td>
+ <td class="DataTD"><a href="account.php?id=6&amp;cert=<?=intval($row['id'])?>"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></a></td>
<? } else if($verified != _("Revoked")) { ?>
- <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=$row['id']?>"></td>
+ <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"></td>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td>
<? } else { ?>
<td class="DataTD">&nbsp;</td>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td>
<? } ?>
- <td class="DataTD"><?=$row['serial']?></td>
- <td class="DataTD"><?=$row['revoke']?></td>
- <td class="DataTD"><?=$row['expires']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['serial'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['revoke'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['expire'])?></td>
<td class="DataTD">
- <input type="checkbox" name="disablelogin_<?=$row['id']?>" value="1" <?=$row['disablelogin']?"":'checked="checked"'?>/>
- <input type="hidden" name="cert_<?=$row['id']?>" value="1" />
+ <input type="checkbox" name="disablelogin_<?=intval($row['id'])?>" value="1" <?=$row['disablelogin']?"":'checked="checked"'?>/>
+ <input type="hidden" name="cert_<?=intval($row['id'])?>" value="1" />
</td>
- <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
- <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td>
+ <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
+ <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td>
</tr>
<? } ?>
<tr>
<td class="DataTD" colspan="9">
- <a href="account.php?id=5&amp;viewall=<?=!$viewall?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
+ <a href="account.php?id=5&amp;viewall=<?=intval(!$viewall)?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a>
</td>
</tr>
@@ -119,7 +120,7 @@
</tr>
<? } ?>
</table>
-<input type="hidden" name="oldid" value="<?=$id?>" />
+<input type="hidden" name="oldid" value="<?=intval($id)?>" />
<input type="hidden" name="csrf" value="<?=make_csrf('clicerchange')?>" />
</form>
<p><?=_("From here you can delete pending requests, or revoke valid certificates.")?></p>
diff --git a/pages/account/52.php b/pages/account/52.php
index 77a3bae..6c00c26 100644
--- a/pages/account/52.php
+++ b/pages/account/52.php
@@ -14,45 +14,51 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<? if($_SESSION['profile']['tverify'] <= 0) { echo _("You don't have access to this area."); } else { ?>
-<?
+*/
+
+if($_SESSION['profile']['tverify'] <= 0) {
+ echo _("You don't have access to this area.");
+} else {
$uid = intval($_GET['uid']);
- $query = "select * from `tverify` where `id`='$uid' and `modified`=0";
+ $query = "select * from `tverify` where `id`='".intval($uid)."' and `modified`=0";
$res = mysql_query($query);
- if(mysql_num_rows($res) > 0)
- {
+ if(mysql_num_rows($res) > 0) {
$row = mysql_fetch_assoc($res);
$memid = intval($row['memid']);
- $query2 = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".intval($_SESSION['profile']['id'])."'";
- $rc2 = mysql_num_rows(mysql_query($query2));
- if($rc2 > 0)
- {
+ $query2 = "select * from `tverify-vote` where `tverify`='".intval($uid)."' and `memid`='".intval($_SESSION['profile']['id'])."'";
+ $rc2 = mysql_num_rows(mysql_query($query2));
+ if($rc2 > 0) {
showheader(_("My CAcert.org Account!"));
echo _("You have already voted on this request.");
showfooter();
exit;
}
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid'";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `deleted` = 0";
$notary = mysql_fetch_assoc(mysql_query($query));
- $query = "select * from `users` where `id`='$memid'";
+ $query = "select * from `users` where `id`='".intval($memid)."'";
$user = mysql_fetch_assoc(mysql_query($query));
$tobe = 50 - $notary['points'];
- if($row['URL'] != '' && $row['photoid'] != '')
+ if($row['URL'] != '' && $row['photoid'] != '') {
$tobe = 150 - $notary['points'];
- else if($row['URL'] != '')
+ } else if($row['URL'] != '') {
$tobe = 90 - $notary['points'];
- if(intval($tobe) <= 0)
+ }
+ if(intval($tobe) <= 0) {
$tobe = 0;
+ }
?>
<?=_("Request Details")?>:<br>
-<?=_("Name on file")?>: <?=$user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix']?><br>
-<?=_("Primary email address")?>: <?=$user['email']." (".$user['id'].")"?><br>
-<?=_("Certificate Subject")?>: <?=$row['CN']?><br>
-<? if($row['URL'] != '') { ?><?=_("Notary URL")?>: <a href="<?=$row['URL']?>"><?=$row['URL']?></a><br><? } ?>
-<? if($row['photoid'] != '') { ?><?=_("Photo ID URL")?>: <a href="/account.php?id=51&amp;photoid=<?=intval($row['id'])?>"><?=_("Here")?></a><br><? } ?>
+<?=_("Name on file")?>: <?=sanitizeHTML($user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix'])?><br>
+<?=_("Primary email address")?>: <?=sanitizeHTML($user['email'])." (".intval($user['id']).")"?><br>
+<?=_("Certificate Subject")?>: <?=sanitizeHTML($row['CN'])?><br>
+<? if($row['URL'] != '') { ?>
+<?=_("Notary URL")?>: <a href="<?=$row['URL']?>"><?=$row['URL']?></a><br>
+<? } ?>
+<? if($row['photoid'] != '') { ?>
+<?=_("Photo ID URL")?>: <a href="/account.php?id=51&amp;photoid=<?=intval($row['id'])?>"><?=_("Here")?></a><br>
+<? } ?>
<?=_("Current Points")?>: <?=intval($notary['points'])?><br>
<?=_("Potential Points")?>: <?=intval($tobe)?><br>
<?=_("Date of Birth")?>: <?=$user['dob']?> (YYYY-MM-DD)<br>
@@ -63,40 +69,37 @@
<input type="submit" name="agree" value="<?=_("I agree with this Application")?>">
<input type="submit" name="disagree" value="<?=_("I don't agree with this Application")?>">
<input type="hidden" name="oldid" value="<?=intval($_GET['id'])?>">
-<input type="hidden" name="uid" value="<?=$uid?>">
+<input type="hidden" name="uid" value="<?=intval($uid)?>">
</form>
-<? } else {
- $query = "select * from `tverify` where `id`='$uid' and `modified`=1";
- $res = mysql_query($query);
- if(mysql_num_rows($res) > 0)
- {
- echo _("This UID has already been voted on.")."<br/>";
+<?
} else {
- if($uid) echo _("Unable to locate a valid request for that UID.")."<br/>";
- }
-
- // Search for open requests:
- $query = "select * from `tverify` where `modified`=0";
- $res = mysql_query($query);
- if(mysql_num_rows($res) > 0)
- {
- echo "<br/>"._("The following requests are still open:")."<br/><ul>";
- while($row = mysql_fetch_assoc($res))
- {
- $uid=intval($row['id']);
- $query3 = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".intval($_SESSION['profile']['id'])."'";
- $rc3 = mysql_num_rows(mysql_query($query3));
- if($rc3 <= 0)
- {
- echo "<li><a href='account.php?id=52&amp;uid=".intval($row['id'])."'>".intval($row['id'])."</a></li>\n";
+ $query = "select * from `tverify` where `id`='".intval($uid)."' and `modified`=1";
+ $res = mysql_query($query);
+ if(mysql_num_rows($res) > 0) {
+ echo _("This UID has already been voted on.")."<br/>";
+ } else {
+ if($uid) echo _("Unable to locate a valid request for that UID.")."<br/>";
+ }
+
+ // Search for open requests:
+ $query = "select * from `tverify` where `modified`=0";
+ $res = mysql_query($query);
+ if(mysql_num_rows($res) > 0) {
+ echo "<br/>"._("The following requests are still open:")."<br/><ul>";
+ while($row = mysql_fetch_assoc($res)) {
+ $uid=intval($row['id']);
+ $query3 = "select * from `tverify-vote` where `tverify`='".intval($uid)."' and `memid`='".intval($_SESSION['profile']['id'])."'";
+ $rc3 = mysql_num_rows(mysql_query($query3));
+ if($rc3 <= 0)
+ {
+ echo "<li><a href='account.php?id=52&amp;uid=".intval($row['id'])."'>".intval($row['id'])."</a></li>\n";
+ }
}
- }
- echo "</ul>\n<br>\n";
- }
- else
- {
- echo "<br/>"._("There are no pending requests where you haven't voted yet.");
+ echo "</ul>\n<br>\n";
+ } else {
+ echo "<br/>"._("There are no pending requests where you haven't voted yet.");
+ }
}
+}
-
- } } ?>
+?>
diff --git a/pages/account/53.php b/pages/account/53.php
index cc9e2d6..1ec04b2 100644
--- a/pages/account/53.php
+++ b/pages/account/53.php
@@ -16,7 +16,7 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/ ?>
<?
- $town = array_key_exists('town',$_REQUEST)?mysql_escape_string(stripslashes($_REQUEST['town'])):"";
+ $town = array_key_exists('town',$_REQUEST)?mysql_real_escape_string(stripslashes($_REQUEST['town'])):"";
$regid = array_key_exists('regid',$_REQUEST)?intval($_REQUEST['regid']):0;
$ccid = array_key_exists('ccid',$_REQUEST)?intval($_REQUEST['ccid']):0;
$start = array_key_exists('start',$_REQUEST)?intval($_REQUEST['start']):0;
diff --git a/pages/account/54.php b/pages/account/54.php
index 753b4af..35dce33 100644
--- a/pages/account/54.php
+++ b/pages/account/54.php
@@ -19,7 +19,7 @@
$ccid = array_key_exists('ccid',$_REQUEST)?intval($_REQUEST['ccid']):0;
$regid = array_key_exists('regid',$_REQUEST)?intval($_REQUEST['regid']):0;
$locid = array_key_exists('locid',$_REQUEST)?intval($_REQUEST['locid']):0;
- $name = array_key_exists('name',$_REQUEST)?mysql_escape_string($_REQUEST['name']):"";
+ $name = array_key_exists('name',$_REQUEST)?mysql_real_escape_string($_REQUEST['name']):"";
if($ccid > 0 && $_REQUEST['action'] == "add") { ?>
<form method="post" action="account.php">
diff --git a/pages/account/55.php b/pages/account/55.php
index ec401a0..24cc86d 100644
--- a/pages/account/55.php
+++ b/pages/account/55.php
@@ -1,112 +1,122 @@
-<? /*
- LibreSSL - CAcert web application
- Copyright (C) 2004-2008 CAcert Inc.
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; version 2 of the License.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?
- if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST) || intval($_REQUEST['userid']) < 1) {
- $user_id = intval($_SESSION['profile']['id']);
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Your passed Tests")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("The list of tests you did pass at").' <a href="https://cats.cacert.org/">https://cats.cacert.org/</a>'?></td>
- </tr>
-</table>
-<?
- } else {
- $user_id = intval($_REQUEST['userid']);
- $query = "select * from `users` where `id`='$user_id' and `users`.`deleted`=0";
- $res = mysql_query($query);
- if(mysql_num_rows($res) <= 0)
- {
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
- } else {
- $row = mysql_fetch_assoc($res);
- }
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Passed Tests of")." ".sanitizeHTML($row['fname'])." ".sanitizeHTML($row['mname'])." ".sanitizeHTML($row['lname'])?></td>
- </tr>
-</table>
-
-<?
- }
-?>
-<br>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td class="DataTD"><b><?=_("Date")?></b></td>
- <td class="DataTD"><b><?=_("Test")?></b></td>
- <td class="DataTD"><b><?=_("Variant")?></b></td>
- </tr>
-<?
- $query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ".
- " FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ".
- " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".(int)$user_id."'".
- " ORDER BY `CP`.`pass_date`";
-
- $res = mysql_query($query);
-
- $HaveTest=0;
- while($row = mysql_fetch_array($res, MYSQL_NUM))
- {
- if ($row[1] == "Assurer Challenge") {
- $HaveTest=1;
- }
-?>
- <tr>
- <td class="DataTD"><?=$row[0]?></td>
- <td class="DataTD"><?=$row[1]?></td>
- <td class="DataTD"><?=$row[2]?></td>
- </tr>
-<? }
-?>
-</table>
-<br>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
-<?
- if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) {
-?>
- <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=$user_id ?>">back</a></td></tr>
-<? } else {
- $query = 'SELECT `u`.id, `u`.`assurer`, SUM(`points`) FROM `users` AS `u`, `notary` AS `n` '.
- ' WHERE `u`.`id` = \''.(int)intval($_SESSION['profile']['id']).'\' AND `n`.`to` = `u`.`id` AND `expire` < now() '.
- ' GROUP BY `u`.id, `u`.`assurer`';
- $res = mysql_query($query);
- if (!$res) {
- print '<td colspan="3" class="DataTD">'._('Internal Error').'</td>'."\n";
- } else {
- $row = mysql_fetch_array($res, MYSQL_NUM);
- if ($HaveTest && ($row[2]>=100)) {
- if (!$row[1]) {
- // This should not happen...
- fix_assurer_flag($_SESSION['profile']['id']);
- }
-?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge and collected at least 100 Assurance Points, you are an Assurer.")?></td>
-<? } elseif (($row[2]>=100) && !$HaveTest) {
-?> <td colspan="3" class="DataTD"><?=_("You have at least 100 Assurance Points, if you want to become an assurer try the ").'<a href="https://cats.cacert.org">'._("Assurer Challenge").'</a>!'?></td>
-<? } elseif ($HaveTest && ($row[2]<100)) {
-?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge, but to become an Assurer you still have to reach 100 Assurance Points!")?></td>
-<? }
- }
- }
-?> </tr>
-</table>
-
+<? /*
+ LibreSSL - CAcert web application
+ Copyright (C) 2004-2008 CAcert Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/ ?>
+<?
+ if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST) || intval($_REQUEST['userid']) < 1) {
+ $user_id = intval($_SESSION['profile']['id']);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Your passed Tests")?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("The list of tests you did pass at").' <a href="https://cats.cacert.org/">https://cats.cacert.org/</a>'?></td>
+ </tr>
+</table>
+<?
+ } else {
+ $user_id = intval($_REQUEST['userid']);
+ $query = "select * from `users` where `id`='$user_id' and `users`.`deleted`=0";
+ $res = mysql_query($query);
+ if(mysql_num_rows($res) <= 0)
+ {
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
+ } else {
+ $row = mysql_fetch_assoc($res);
+ }
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="5" class="title"><?=_("Passed Tests of")." ".sanitizeHTML($row['fname'])." ".sanitizeHTML($row['mname'])." ".sanitizeHTML($row['lname'])?></td>
+ </tr>
+</table>
+
+<?
+ }
+?>
+<br>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td class="DataTD"><b><?=_("Date")?></b></td>
+ <td class="DataTD"><b><?=_("Test")?></b></td>
+ <td class="DataTD"><b><?=_("Variant")?></b></td>
+ </tr>
+<?
+ $query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ".
+ " FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ".
+ " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".intval($user_id)."'".
+ " ORDER BY `CP`.`pass_date`";
+
+ $res = mysql_query($query);
+
+ $HaveTest=0;
+ while($row = mysql_fetch_array($res, MYSQL_NUM))
+ {
+ if ($row[1] == "Assurer Challenge") {
+ $HaveTest=1;
+ }
+?>
+ <tr>
+ <td class="DataTD"><?=sanitizeHTML($row[0])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row[1])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row[2])?></td>
+ </tr>
+<? }
+?>
+</table>
+<br>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+<?
+ if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) {
+?>
+ <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($user_id)?>">back</a></td></tr>
+<?
+ } else {
+ $query = '
+ SELECT `u`.`id`,
+ `u`.`assurer`,
+ SUM(`points`)
+ FROM `users` AS `u`,
+ `notary` AS `n`
+ WHERE `u`.`id` = \''.intval($_SESSION['profile']['id']).'\'
+ AND `n`.`to` = `u`.`id`
+ AND `expire` < NOW()
+ AND `n`.`deleted` = 0
+ GROUP BY `u`.`id`, `u`.`assurer`
+ ';
+ $res = mysql_query($query);
+ if (!$res) {
+ print '<td colspan="3" class="DataTD">'._('Internal Error').'</td>'."\n";
+ } else {
+ $row = mysql_fetch_array($res, MYSQL_NUM);
+ if ($HaveTest && ($row[2]>=100)) {
+ if (!$row[1]) {
+ // This should not happen...
+ fix_assurer_flag($_SESSION['profile']['id']);
+ }
+?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge and collected at least 100 Assurance Points, you are an Assurer.")?></td>
+<? } elseif (($row[2]>=100) && !$HaveTest) {
+?> <td colspan="3" class="DataTD"><?=_("You have at least 100 Assurance Points, if you want to become an assurer try the ").'<a href="https://cats.cacert.org">'._("Assurer Challenge").'</a>!'?></td>
+<? } elseif ($HaveTest && ($row[2]<100)) {
+?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge, but to become an Assurer you still have to reach 100 Assurance Points!")?></td>
+<? }
+ }
+ }
+?> </tr>
+</table>
+
diff --git a/pages/account/56.php b/pages/account/56.php
index 348cc49..cabe8e0 100644
--- a/pages/account/56.php
+++ b/pages/account/56.php
@@ -1,41 +1,41 @@
-<? /*
-LibreSSL - CAcert web application
-Copyright (C) 2004-2008 CAcert Inc.
-
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; version 2 of the License.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?=_("List of Organisation Assurers:")?>
-
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="1" class="title"><?=_("Name")?></td>
- <td colspan="1" class="title"><?=_("Email")?></td>
- <td colspan="1" class="title"><?=_("Country")?></td>
- </tr>
- <?
- $query = "select users.fname,users.lname,users.email, countries.name from users left join countries on users.ccid=countries.id where orgadmin=1;";
- $res = mysql_query($query);
- while($row = mysql_fetch_assoc($res))
- {
- ?>
- <tr>
- <td><?=sanitizeHTML($row['fname'])." ".sanitizeHTML($row['lname'])?></td>
- <td><a href="mailto:<?=sanitizeHTML($row['email'])?>"><?=sanitizeHTML($row['email'])?></a></td>
- <td><?=sanitizeHTML($row['name'])?></td>
- </tr>
- <?
- }
-?>
-</table>
-
+<? /*
+LibreSSL - CAcert web application
+Copyright (C) 2004-2008 CAcert Inc.
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; version 2 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/ ?>
+<?=_("List of Organisation Assurers:")?>
+
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="1" class="title"><?=_("Name")?></td>
+ <td colspan="1" class="title"><?=_("Email")?></td>
+ <td colspan="1" class="title"><?=_("Country")?></td>
+ </tr>
+ <?
+ $query = "select users.fname,users.lname,users.email, countries.name from users left join countries on users.ccid=countries.id where orgadmin=1;";
+ $res = mysql_query($query);
+ while($row = mysql_fetch_assoc($res))
+ {
+ ?>
+ <tr>
+ <td><?=sanitizeHTML($row['fname'])." ".sanitizeHTML($row['lname'])?></td>
+ <td><a href="mailto:<?=sanitizeHTML($row['email'])?>"><?=sanitizeHTML($row['email'])?></a></td>
+ <td><?=sanitizeHTML($row['name'])?></td>
+ </tr>
+ <?
+ }
+?>
+</table>
+
diff --git a/pages/account/57.php b/pages/account/57.php
index 76eee27..9db7ccf 100644
--- a/pages/account/57.php
+++ b/pages/account/57.php
@@ -17,18 +17,18 @@
*/ ?>
<?
include_once($_SESSION['_config']['filepath'].'/includes/notary.inc.php');
-
+
if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST) || intval($_REQUEST['userid']) < 1) {
echo _('You do not have access to this page');
- } else {
+ } else {
$user_id = intval($_REQUEST['userid']);
$query = "select * from `users` where `id`='$user_id' and `users`.`deleted`=0";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
{
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
} else {
$row = mysql_fetch_assoc($res);
?>
@@ -38,7 +38,7 @@
</tr>
</table>
-
+
<br>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
@@ -48,21 +48,21 @@
<td class="DataTD"><b><?=_('Type')?></b></td>
</tr>
<?
- $data=get_first_user_agreement($user_id,1);
+ $data=get_first_user_agreement($user_id, 'CCA', 1);
if (!isset($data['active'])){
$type='';
- }else{
+ }else{
$type=_('active');
- }
+ }
?>
<tr>
<td class="DataTD"><?=_('First active CCA')?></td>
- <td class="DataTD"><?=$data['date']?></td>
- <td class="DataTD"><?=$data['method']?></td>
+ <td class="DataTD"><?=isset($data['date'])?$data['date']:''?></td>
+ <td class="DataTD"><?=isset($data['method'])?$data['method']:''?></td>
<td class="DataTD"><?=$type?></td>
</tr>
<?
- $data=get_first_user_agreement($user_id,0);
+ $data=get_first_user_agreement($user_id, 'CCA', 0);
if (!isset($data['active'])){
$type="";
}else{
@@ -71,35 +71,35 @@
?>
<tr>
<td class="DataTD"><?=_('First passive CCA')?></td>
- <td class="DataTD"><?=$data['date']?></td>
- <td class="DataTD"><?=$data['method']?></td>
+ <td class="DataTD"><?=isset($data['date'])?$data['date']:''?></td>
+ <td class="DataTD"><?=isset($data['method'])?$data['method']:''?></td>
<td class="DataTD"><?=$type?></td>
</tr>
<?
- $data=get_last_user_agreement($user_id);
+ $data=get_last_user_agreement($user_id, 'CCA');
if (!isset($data['active'])){
- $type="";
- }elseif($data['active']==1){
- $type=_('active');
- }else{
- $type=_('passive');
- }
+ $type="";
+ }elseif($data['active']==1){
+ $type=_('active');
+ }else{
+ $type=_('passive');
+ }
?>
<tr>
<td class="DataTD"><?=_('Last CCA')?></td>
- <td class="DataTD"><?=$data['date']?></td>
- <td class="DataTD"><?=$data['method']?></td>
+ <td class="DataTD"><?=isset($data['date'])?$data['date']:''?></td>
+ <td class="DataTD"><?=isset($data['method'])?$data['method']:''?></td>
<td class="DataTD"><?=$type?></td>
</tr>
</table>
<br>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
+ <tr>
<?
if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) {
?>
- <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=$user_id ?>">back</a></td></tr>
-<? }
+ <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&amp;userid=<?=intval($user_id)?>">back</a></td></tr>
+<? }
?> </table>
<?
}
diff --git a/pages/account/58.php b/pages/account/58.php
index 1f6b1a0..af26b70 100644
--- a/pages/account/58.php
+++ b/pages/account/58.php
@@ -23,7 +23,7 @@ if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST)
$query = "select `users`.`fname`, `users`.`mname`, `users`.`lname` from `users` where `id`='$user_id' and `users`.`deleted`=0";
$res = mysql_query($query);
if(mysql_num_rows($res) != 1){
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
} else {
if ($row = mysql_fetch_assoc($res)){
$username=sanitizeHTML($row['fname']).' '.sanitizeHTML($row['mname']).' '.sanitizeHTML($row['lname']);
@@ -54,7 +54,7 @@ if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST)
}
?></table>
<? }else{
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
}
}
}
diff --git a/pages/account/59.php b/pages/account/59.php
new file mode 100644
index 0000000..1c73ae5
--- /dev/null
+++ b/pages/account/59.php
@@ -0,0 +1,385 @@
+<?/*
+ LibreSSL - CAcert web application
+ Copyright (C) 2004-2008 CAcert Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/
+include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
+
+
+$userid = intval($_REQUEST['userid']);
+
+$res = get_user_data($userid);
+if (mysql_num_rows($res) <= 0)
+{
+ echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!");
+ exit;
+}
+
+$user = mysql_fetch_assoc($res);
+
+$fname = $user['fname'];
+$mname = $user['mname'];
+$lname = $user['lname'];
+$suffix = $user['suffix'];
+$dob = $user['dob'];
+$username = $fname." ".$mname." ".$lname." ".$suffix;
+$email = $user['email'];
+$alerts =get_alerts($userid);
+
+$ticketno = "";
+if (array_key_exists('ticketno', $_SESSION)) {
+ $ticketno = $_SESSION['ticketno'];
+}
+
+$oldid = 0;
+if (array_key_exists('oldid', $_REQUEST)) {
+ $oldid = intval($_REQUEST['oldid']);
+}
+
+// Support Engineer access restrictions
+$support=0;
+if ($userid != $_SESSION['profile']['id']) {
+ // Check if support engineer
+ if (array_key_exists('admin', $_SESSION['profile']) &&
+ $_SESSION['profile']['admin'] != 0)
+ {
+ $support=$_SESSION['profile']['admin'];
+
+ } else {
+ echo _("You do not have access to this page.");
+ showfooter();
+ exit;
+ }
+
+ if (!valid_ticket_number($ticketno)) {
+ printf(_("I'm sorry, you did not enter a ticket number! %s Support is not allowed to view the account history without a ticket number."), '<br/>');
+ echo '<br/><a href="account.php?id=43&amp;userid='.intval($userid).'">'. _('Back to previous page.') .'</a>';
+ showfooter();
+ exit;
+ }
+
+ if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE View account history', $ticketno)) {
+ echo _("Writing to the admin log failed. Can't continue.");
+ echo '<br/><a href="account.php?id=43&amp;userid='.intval($userid).'">'. _('Back to previous page.') .'</a>';
+ showfooter();
+ exit;
+ }
+}
+
+// Account details
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="2" class="title"><?printf(_('Account history of %s'),$username)?></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="title"><?=_('User actions')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_('User name')?></td>
+ <td class="DataTD"><?=sanitizeHTML($username)?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_('Date of Birth')?></td>
+ <td class="DataTD"><?=sanitizeHTML($dob)?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Is Assurer")?>:</td>
+ <td class="DataTD"><?= ($user['assurer']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Blocked Assurer")?>:</td>
+ <td class="DataTD"><?= ($user['assurer_blocked']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Account Locking")?>:</td>
+ <td class="DataTD"><?= ($user['locked']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Code Signing")?>:</td>
+ <td class="DataTD"><?= ($user['codesign']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Org Assurer")?>:</td>
+ <td class="DataTD"><?= ($user['orgadmin']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("TTP Admin")?>:</td>
+ <td class="DataTD"><?= $user['ttpadmin']._(' - 0 = none, 1 = TTP Admin, 2 = TTP TOPUP admin')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Location Admin")?>:</td>
+ <td class="DataTD"><?= ($user['locadmin']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Admin")?>:</td>
+ <td class="DataTD"><?= ($user['admin']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Ad Admin")?>:</td>
+ <td class="DataTD"><?= $user['adadmin']._(' - 0 = none, 1 = submit, 2 = approve')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("General Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['general']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Country Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['country']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Regional Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['regional']==0)? _('No'):_('Yes')?></td>
+ </tr>
+ <tr>
+ <td class="DataTD"><?=_("Within 200km Announcements")?>:</td>
+ <td class="DataTD"><?= ($alerts['radius']==0)? _('No'):_('Yes')?></td>
+ </tr>
+</table>
+<br/>
+<?
+
+// Email addresses
+$dres = get_email_addresses($userid,'',1);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="3" class="title"><?=_('Email addresses')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_email_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_email($drow,$email);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="3" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+<?
+
+// Domains
+$dres = get_domains($userid, 1);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="3" class="title"><?=_('Domains')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_domains_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_domains($drow);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="3" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// Trainings
+$dres = get_training_results($userid);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="3" class="title"><?=_('Trainings')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_training_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_training($drow);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="3" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// User Agreements
+$dres = get_user_agreements($userid);
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="4" class="title"><?=_('User agreements')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_agreement_header();
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_agreement($drow);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="4" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// Client Certificates
+$dres = get_client_certs($userid, 1);
+$colspan=8;
+if (1 == $support) {
+ $colspan=6;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('Client certificates')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_client_cert_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_client_cert($drow,$support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// Server Certificates
+$dres = get_server_certs($userid,1);
+$colspan = 7;
+if (1 == $support) {
+ $colspan = 5;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('Server certificates')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_server_certs_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_server_certs($drow,$support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+</table>
+<br/>
+
+<?
+// GPG Certificates
+$dres = get_gpg_certs($userid,1);
+$colspan = 6;
+if (1 == $support) {
+ $colspan = 4;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('GPG/PGP certificates')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_gpg_certs_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_gpg_certs($drow, $support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}?>
+</table>
+<br/>
+
+<?
+
+output_given_assurances($userid, $support, $ticketno, 1);
+?><br/><?
+
+output_received_assurances($userid, $support, $ticketno, 1);
+?><br/><?
+
+$dres = get_se_log($userid);
+$colspan = 2;
+if (1 == $support) {
+ $colspan = 4;
+}
+?>
+<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
+ <tr>
+ <td colspan="<?=$colspan?>" class="title"><?=_('Admin log')?></td>
+ </tr>
+<?
+if (mysql_num_rows($dres) > 0) {
+ output_log_se_header($support);
+ while ($drow = mysql_fetch_assoc($dres))
+ {
+ output_log_se($drow,$support);
+ }
+} else {
+ ?>
+ <tr>
+ <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td>
+ </tr>
+ <?
+}
+?>
+<tr>
+ <td colspan="<?=$colspan?>" >
+ <a href="account.php?id=<?=$oldid?intval($oldid):($support?43:13)?>&amp;userid=<?=intval($userid)?>"><?= _('Back to previous page.')?></a>
+ </td>
+</tr>
+
+</table>
diff --git a/pages/account/6.php b/pages/account/6.php
index 8455499..fc21d39 100644
--- a/pages/account/6.php
+++ b/pages/account/6.php
@@ -25,7 +25,7 @@ if(array_key_exists('cert',$_REQUEST)) {
$query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`,
- `emailcerts`.`expire` as `expires`,
+ `emailcerts`.`expire`,
`emailcerts`.`revoked` as `revoke`,
UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`,
`emailcerts`.`id`,
@@ -60,7 +60,7 @@ if (array_key_exists('format', $_REQUEST)) {
}
$crtname=escapeshellarg($row['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crtname $outform`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname $outform");
header("Content-Type: application/pkix-cert");
header("Content-Length: ".strlen($cert));
@@ -82,7 +82,7 @@ if (array_key_exists('format', $_REQUEST)) {
} else {
// All other browsers
$crtname=escapeshellarg($row['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crtname -outform DER`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname -outform DER");
header("Content-Type: application/x-x509-user-cert");
header("Content-Length: ".strlen($cert));
@@ -111,10 +111,10 @@ if (array_key_exists('format', $_REQUEST)) {
// Allow to directly copy and paste the cert in PEM format
$crtname=escapeshellarg($row['crt_name']);
- $cert = `/usr/bin/openssl x509 -in $crtname -outform PEM`;
+ $cert = shell_exec("/usr/bin/openssl x509 -in $crtname -outform PEM");
echo "<pre>$cert</pre>";
+?>
- ?>
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
<td colspan="2" class="title"><?=_("Information about the certificate")?></td>
@@ -137,11 +137,11 @@ if (array_key_exists('format', $_REQUEST)) {
</tr>
<tr>
<td class="DataTD"><?=_("Email Address")?></td>
- <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td>
+ <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td>
</tr>
<tr>
<td class="DataTD"><?=_("SerialNumber")?></td>
- <td class="DataTD"><?=$row['serial']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['serial'])?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Revoked")?></td>
@@ -149,7 +149,7 @@ if (array_key_exists('format', $_REQUEST)) {
</tr>
<tr>
<td class="DataTD"><?=_("Expires")?></td>
- <td class="DataTD"><?=$row['expires']?></td>
+ <td class="DataTD"><?=$row['expire']?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Login")?></td>
diff --git a/pages/gpg/2.php b/pages/gpg/2.php
index cc8a872..84e11d2 100644
--- a/pages/gpg/2.php
+++ b/pages/gpg/2.php
@@ -30,7 +30,7 @@
$query = "select UNIX_TIMESTAMP(`issued`) as `issued`,
UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() as `timeleft`,
UNIX_TIMESTAMP(`expire`) as `expired`,
- `expire` as `expires`, `id`, `level`,
+ `expire`, `id`, `level`,
`email`,`keyid`,`description` from `gpg` where `memid`='".intval($_SESSION['profile']['id'])."'
ORDER BY `issued` desc";
$res = mysql_query($query);
@@ -43,6 +43,7 @@
<? } else {
while($row = mysql_fetch_assoc($res))
{
+ $verified = '';
if($row['timeleft'] > 0)
$verified = _("Valid");
if($row['timeleft'] < 0)
@@ -53,18 +54,18 @@
<tr>
<? if($verified == _("Valid")) { ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=$row['id']?>"><?=$row['email']?></a></td>
+ <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
<? } else if($verified == _("Pending")) { ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><?=$row['email']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['email'])?></td>
<? } else { ?>
<td class="DataTD"><?=$verified?></td>
- <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=$row['id']?>"><?=$row['email']?></a></td>
+ <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td>
<? } ?>
- <td class="DataTD"><?=$row['expires']?></td>
- <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=$row['id']?>"><?=$row['keyid']?></a></td>
- <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
- <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td>
+ <td class="DataTD"><?=$row['expire']?></td>
+ <td class="DataTD"><a href="gpg.php?id=3&amp;cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['keyid'])?></a></td>
+ <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td>
+ <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td>
</tr>
<? } ?>
<? } ?>
@@ -77,5 +78,5 @@
<td class="DataTD" colspan="6"><input type="submit" name="change" value="<?=_("Change settings")?>" /> </td>
</tr>
</table>
-<input type="hidden" name="oldid" value="<?=$id?>" />
+<input type="hidden" name="oldid" value="<?=intval($id)?>" />
</form>
diff --git a/pages/index/0.php b/pages/index/0.php
index c5301d3..de5cb7c 100644
--- a/pages/index/0.php
+++ b/pages/index/0.php
@@ -19,11 +19,11 @@
<p><?=_("CAcert.org is a community-driven Certificate Authority that issues certificates to the public at large for free.")?></p>
-<p><?=_("CAcert's goal is to promote awareness and education on computer security through the use of encryption, specifically by providing cryptographic certificates. These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the internet. Any application that supports the Secure Socket Layer Protocol (SSL or TLS) can make use of certificates signed by CAcert, as can any application that uses X.509 certificates, e.g. for encryption or code signing and document signatures.")?></p>
+<p><?=_("CAcert's goal is to promote awareness and education on computer security through the use of encryption, specifically by providing cryptographic certificates. These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the internet. Any application that supports the Secure Socket Layer protocol (SSL or TLS) can make use of certificates signed by CAcert, as can any application that uses X.509 certificates, e.g. for encryption or code signing and document signatures.")?></p>
<p><?=sprintf(_("If you want to have free certificates issued to you, %s join the CAcert Community %s."),'<a href="https://www.cacert.org/index.php?id=1">', '</a>')?></p>
-<p><?=sprintf(_("If you want to use certificates issued by CAcert, read the CAcert %s Root Distribution License %s."),'<a href="/policy/RootDistributionLicense.php">',"</a>")?>
+<p><?=sprintf(_("If you want to use certificates issued by CAcert, read the CAcert %s Root Distribution License %s."),'<a href="/policy/RootDistributionLicense.html">',"</a>")?>
<?=sprintf(_("This license applies to using the CAcert %s root keys %s."),'<a href="/index.php?id=3">','</a>')?></p>
@@ -87,7 +87,7 @@
<p><?=sprintf(_("Have you passed the CAcert %s Assurer Challenge %s yet?"),'<a href="http://wiki.cacert.org/wiki/AssurerChallenge">','</a>')?></p>
-<p><?=sprintf(_("Have you read the CAcert %sCommunity Agreement%s yet?"),'<a href="/policy/CAcertCommunityAgreement.php">','</a>')?></p>
+<p><?=sprintf(_("Have you read the CAcert %sCommunity Agreement%s yet?"),'<a href="/policy/CAcertCommunityAgreement.html">','</a>')?></p>
<p><?=sprintf(_("For general documentation and help, please visit the CAcert %sWiki Documentation site %s."),'<a href="http://wiki.CAcert.org">','</a>')?>
<?=sprintf(_("For specific policies, see the CAcert %sApproved Policies page%s."),'<a href="/policy/">',"</a>")?></p>
diff --git a/pages/index/1.php b/pages/index/1.php
index 4f0ca83..05e59df 100644
--- a/pages/index/1.php
+++ b/pages/index/1.php
@@ -35,32 +35,32 @@
<tr>
<td class="DataTD" width="125"><?=_("First Name")?>: </td>
- <td class="DataTD" width="125"><input type="text" name="fname" value="<?=array_key_exists('fname',$_REQUEST)?sanitizeHTML($_REQUEST['fname']):""?>" autocomplete="off"></td>
- <td rowspan="4" class="DataTD" width="125"><? printf(_("Help on Names %sin the wiki%s"),'<a href="//wiki.cacert.org/FAQ/HowToEnterNamesInJoinForm" target="_blank">','</a>')?></td>
+ <td class="DataTD" width="125"><input type="text" name="fname" size="30" value="<?=array_key_exists('fname',$_REQUEST)?sanitizeHTML($_REQUEST['fname']):""?>" tabindex="1" autocomplete="off"></td>
+ <td rowspan="4" class="DataTD" width="125"><? printf(_("Help on Names %sin the wiki%s"),'<a tabindex="1" href="//wiki.cacert.org/FAQ/HowToEnterNamesInJoinForm" target="_blank">','</a>')?></td>
</tr>
<tr>
<td class="DataTD" valign="top"><?=_("Middle Name(s)")?><br>
(<?=_("optional")?>)
</td>
- <td class="DataTD"><input type="text" name="mname" value="<?=array_key_exists('mname',$_REQUEST)?sanitizeHTML($_REQUEST['mname']):""?>" autocomplete="off"></td>
+ <td class="DataTD"><input type="text" name="mname" size="30" value="<?=array_key_exists('mname',$_REQUEST)?sanitizeHTML($_REQUEST['mname']):""?>" tabindex="3" autocomplete="off"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Last Name")?>: </td>
- <td class="DataTD"><input type="text" name="lname" value="<?=array_key_exists('lname',$_REQUEST)?sanitizeHTML($_REQUEST['lname']):""?>" autocomplete="off"></td>
+ <td class="DataTD"><input type="text" name="lname" size="30" value="<?=array_key_exists('lname',$_REQUEST)?sanitizeHTML($_REQUEST['lname']):""?>" tabindex="4" autocomplete="off"></td>
</tr>
<tr>
<td class="DataTD"><?=_("Suffix")?><br>
(<?=_("optional")?>)</td>
- <td class="DataTD"><input type="text" name="suffix" value="<?=array_key_exists('suffix',$_REQUEST)?sanitizeHTML($_REQUEST['suffix']):""?>" autocomplete="off"><br><?=sprintf(_("Please only write Name Suffixes into this field."))?></td>
+ <td class="DataTD"><input type="text" name="suffix" size="30" value="<?=array_key_exists('suffix',$_REQUEST)?sanitizeHTML($_REQUEST['suffix']):""?>" tabindex="5" autocomplete="off"><br><?=sprintf(_("Please only write Name Suffixes into this field."))?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Date of Birth")?><br>
(<?=_("dd/mm/yyyy")?>)</td>
- <td class="DataTD"><nobr><select name="day">
+ <td class="DataTD"><nobr><select name="day" tabindex="6">
<?
for($i = 1; $i <= 31; $i++)
{
@@ -71,7 +71,7 @@
}
?>
</select>
- <select name="month">
+ <select name="month" tabindex="7">
<?
for($i = 1; $i <= 12; $i++)
{
@@ -82,25 +82,25 @@
}
?>
</select>
- <input type="text" name="year" value="<?=array_key_exists('year',$_SESSION['signup']) ? sanitizeHTML($_SESSION['signup']['year']):""?>" size="4" autocomplete="off"></nobr>
+ <input type="text" name="year" value="<?=array_key_exists('year',$_SESSION['signup']) ? sanitizeHTML($_SESSION['signup']['year']):""?>" size="4" tabindex="8" autocomplete="off"></nobr>
</td>
<td class="DataTD">&nbsp;</td>
</tr>
<tr>
<td class="DataTD"><?=_("Email Address")?>: </td>
- <td class="DataTD"><input type="text" name="email" value="<?=array_key_exists('email',$_REQUEST)?sanitizeHTML($_REQUEST['email']):""?>" autocomplete="off"></td>
+ <td class="DataTD"><input type="text" name="email" size="30" value="<?=array_key_exists('email',$_REQUEST)?sanitizeHTML($_REQUEST['email']):""?>" tabindex="9" autocomplete="off"></td>
<td class="DataTD"><?=_("I own or am authorised to control this email address")?></td>
</tr>
<tr>
<td class="DataTD"><?=_("Pass Phrase")?><font color="red">*</font>: </td>
- <td class="DataTD"><input type="password" name="pword1" autocomplete="off"></td>
+ <td class="DataTD"><input type="password" name="pword1" size="30" tabindex="10" autocomplete="off"></td>
<td class="DataTD" rowspan="2">&nbsp;</td>
</tr>
<tr>
<td class="DataTD"><?=_("Pass Phrase Again")?><font color="red">*</font>: </td>
- <td class="DataTD"><input type="password" name="pword2" autocomplete="off"></td>
+ <td class="DataTD"><input type="password" name="pword2" size="30" tabindex="11" autocomplete="off"></td>
</tr>
<tr>
@@ -112,29 +112,39 @@
</tr>
<tr>
- <td class="DataTD">1)&nbsp;<input type="text" name="Q1" size="15" value="<?=array_key_exists('Q1',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q1']):""?>"></td>
- <td class="DataTD"><input type="text" name="A1" value="<?=array_key_exists('A1',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A1']):""?>" autocomplete="off"></td>
- <td class="DataTD" rowspan="5">&nbsp;</td>
+ <td class="DataTD">&nbsp;</td>
+ <td class="DataTD"><?=_("Question")?></td>
+ <td class="DataTD"><?=_("Answer")?></td>
</tr>
<tr>
- <td class="DataTD">2)&nbsp;<input type="text" name="Q2" size="15" value="<?=array_key_exists('Q2',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q2']):""?>"></td>
- <td class="DataTD"><input type="text" name="A2" value="<?=array_key_exists('A2',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A2']):""?>" autocomplete="off"></td>
+ <td class="DataTD">1)</td>
+ <td class="DataTD"><input type="text" name="Q1" size="30" value="<?=array_key_exists('Q1',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q1']):""?>" tabindex="12"></td>
+ <td class="DataTD"><input type="text" name="A1" size="30" value="<?=array_key_exists('A1',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A1']):""?>" tabindex="13" autocomplete="off"></td>
</tr>
<tr>
- <td class="DataTD">3)&nbsp;<input type="text" name="Q3" size="15" value="<?=array_key_exists('Q3',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q3']):""?>"></td>
- <td class="DataTD"><input type="text" name="A3" value="<?=array_key_exists('A3',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A3']):""?>" autocomplete="off"></td>
+ <td class="DataTD">2)</td>
+ <td class="DataTD"><input type="text" name="Q2" size="30" value="<?=array_key_exists('Q2',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q2']):""?>" tabindex="14"></td>
+ <td class="DataTD"><input type="text" name="A2" size="30" value="<?=array_key_exists('A2',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A2']):""?>" tabindex="15" autocomplete="off"></td>
</tr>
<tr>
- <td class="DataTD">4)&nbsp;<input type="text" name="Q4" size="15" value="<?=array_key_exists('Q4',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q4']):""?>"></td>
- <td class="DataTD"><input type="text" name="A4" value="<?=array_key_exists('A4',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A4']):""?>" autcomplete="off"></td>
+ <td class="DataTD">3)</td>
+ <td class="DataTD"><input type="text" name="Q3" size="30" value="<?=array_key_exists('Q3',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q3']):""?>" tabindex="16"></td>
+ <td class="DataTD"><input type="text" name="A3" size="30"value="<?=array_key_exists('A3',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A3']):""?>" tabindex="17" autocomplete="off"></td>
</tr>
<tr>
- <td class="DataTD">5)&nbsp;<input type="text" name="Q5" size="15" value="<?=array_key_exists('Q5',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q5']):""?>"></td>
- <td class="DataTD"><input type="text" name="A5" value="<?=array_key_exists('A5',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A5']):""?>" autocomplete="off"></td>
+ <td class="DataTD">4)</td>
+ <td class="DataTD"><input type="text" name="Q4" size="30"" value="<?=array_key_exists('Q4',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q4']):""?>" tabindex="18"></td>
+ <td class="DataTD"><input type="text" name="A4" size="30" value="<?=array_key_exists('A4',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A4']):""?>" tabindex="19" autcomplete="off"></td>
+ </tr>
+
+ <tr>
+ <td class="DataTD">5)</td>
+ <td class="DataTD"><input type="text" name="Q5" size="30" value="<?=array_key_exists('Q5',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['Q5']):""?>" tabindex="20"></td>
+ <td class="DataTD"><input type="text" name="A5" size="30" value="<?=array_key_exists('A5',$_SESSION['signup'])?sanitizeHTML($_SESSION['signup']['A5']):""?>" tabindex="21" autocomplete="off"></td>
</tr>
<tr>
@@ -144,10 +154,10 @@
<tr>
<td class="DataTD" valign="top"><?=_("Alert me if")?>: </td>
<td class="DataTD" align="left">
- <input type="checkbox" name="general" value="1" <?=array_key_exists('general',$_SESSION['signup'])? ($_SESSION['signup']['general'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("General Announcements")?><br>
- <input type="checkbox" name="country" value="1" <?=array_key_exists('country',$_SESSION['signup'])? ($_SESSION['signup']['country'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("Country Announcements")?><br>
- <input type="checkbox" name="regional" value="1" <?=array_key_exists('regional',$_SESSION['signup'])? ($_SESSION['signup']['regional'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("Regional Announcements")?><br>
- <input type="checkbox" name="radius" value="1" <?=array_key_exists('radius',$_SESSION['signup'])? ($_SESSION['signup']['radius'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("Within 200km Announcements")?></td>
+ <input type="checkbox" name="general" value="1" tabindex="22" <?=array_key_exists('general',$_SESSION['signup'])? ($_SESSION['signup']['general'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("General Announcements")?><br>
+ <input type="checkbox" name="country" value="1" tabindex="23" <?=array_key_exists('country',$_SESSION['signup'])? ($_SESSION['signup']['country'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("Country Announcements")?><br>
+ <input type="checkbox" name="regional" value="1" tabindex="24" <?=array_key_exists('regional',$_SESSION['signup'])? ($_SESSION['signup']['regional'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("Regional Announcements")?><br>
+ <input type="checkbox" name="radius" value="1" tabindex="25" <?=array_key_exists('radius',$_SESSION['signup'])? ($_SESSION['signup']['radius'] == "0" ?"":"checked=\"checked\""):"checked=\"checked\"" ?>><?=_("Within 200km Announcements")?></td>
<td class="DataTD">&nbsp;</td>
</tr>
@@ -155,11 +165,15 @@
<td class="DataTD" colspan="3"><?=_("When you click on next, we will send a confirmation email to the email address you have entered above.")?></td>
</tr>
<tr>
- <td class="DataTD" colspan="3"><input type="checkbox" name="cca_agree" value="1" <?=array_key_exists('cca_agree',$_SESSION['signup'])? ($_SESSION['signup']['cca_agree'] == "1" ?"checked=\"checked\"":""):"" ?> ><?=_("I agree to the terms and conditions of the CAcert Community Agreement")?>: <a href="/policy/CAcertCommunityAgreement.php">http://www.cacert.org/policy/CAcertCommunityAgreement.php</a></td>
+ <td class="DataTD" colspan="3">
+ <input type="checkbox" name="cca_agree" tabindex="26" value="1" <?=array_key_exists('cca_agree',$_SESSION['signup'])? ($_SESSION['signup']['cca_agree'] == "1" ?"checked=\"checked\"":""):"" ?> >
+ <br/>
+ <?=_("I agree to the terms and conditions of the CAcert Community Agreement")?>: <a href="/policy/CAcertCommunityAgreement.html" tabindex="28" >http://www.cacert.org/policy/CAcertCommunityAgreement.php</a>
+ </td>
</tr>
<tr>
- <td class="DataTD" colspan="3"><input type="submit" name="process" value="<?=_("Next")?>"></td>
+ <td class="DataTD" colspan="3"><input type="submit" name="process" value="<?=_("Next")?>" tabindex="27"></td>
</tr>
</table>
diff --git a/pages/index/10.php b/pages/index/10.php
index 7280e09..7dd8200 100644
--- a/pages/index/10.php
+++ b/pages/index/10.php
@@ -17,5 +17,5 @@
*/
header('HTTP/1.0 301 Moved Permanently');
- header('Location: http://www.cacert.org/policy/CertificationPracticeStatement.php');
+ header('Location: http://www.cacert.org/policy/CertificationPracticeStatement.html');
exit();
diff --git a/pages/index/16.php b/pages/index/16.php
index c2cb391..ba3b4ed 100644
--- a/pages/index/16.php
+++ b/pages/index/16.php
@@ -16,7 +16,7 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/ ?>
-<p><?=sprintf(_("You are bound by the %s Root Distribution Licence %s for any re-distributions of CAcert's roots."),"<a href='/policy/RootDistributionLicense.php'>","</a>")?></p>
+<p><?=sprintf(_("You are bound by the %s Root Distribution Licence %s for any re-distributions of CAcert's roots."),"<a href='/policy/RootDistributionLicense.html'>","</a>")?></p>
<p>
Class 1 <?=_("PKI Key")?><br>
diff --git a/pages/index/3.php b/pages/index/3.php
index a107c29..7c52447 100644
--- a/pages/index/3.php
+++ b/pages/index/3.php
@@ -16,7 +16,7 @@
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/ ?>
-<p><?=sprintf(_("You are bound by the %s Root Distribution Licence %s for any re-distributions of CAcert's roots."),"<a href='/policy/RootDistributionLicense.php'>","</a>")?></p>
+<p><?=sprintf(_("You are bound by the %s Root Distribution Licence %s for any re-distributions of CAcert's roots."),"<a href='/policy/RootDistributionLicense.html'>","</a>")?></p>
<h3><?=_("Windows Installer") ?></h3>
<ul class="no_indent">
@@ -29,6 +29,7 @@
<ul class="no_indent">
<li><a href="certs/root.crt"><?=_("Root Certificate (PEM Format)")?></a></li>
<li><a href="certs/root.der"><?=_("Root Certificate (DER Format)")?></a></li>
+ <li><a href="certs/root.cer"><?=_("Root Certificate (CER Format base64 encoded)")?></a></li>
<li><a href="certs/root.txt"><?=_("Root Certificate (Text Format)")?></a></li>
<li><a href="<?=$_SERVER['HTTPS']?"https":"http"?>://crl.cacert.org/revoke.crl">CRL</a></li>
<li><?=_("SHA1 Fingerprint:")?> 13:5C:EC:36:F4:9C:B8:E9:3B:1A:B2:70:CD:80:88:46:76:CE:8F:33</li>
@@ -39,6 +40,7 @@
<ul class="no_indent">
<li><a href="certs/class3.crt"><?=_("Intermediate Certificate (PEM Format)")?></a></li>
<li><a href="certs/class3.der"><?=_("Intermediate Certificate (DER Format)")?></a></li>
+ <li><a href="certs/class3.der"><?=_("Intermediate Certificate (CER Format base64 encoded)")?></a></li>
<li><a href="certs/class3.txt"><?=_("Intermediate Certificate (Text Format)")?></a></li>
<li><a href="<?=$_SERVER['HTTPS']?"https":"http"?>://crl.cacert.org/class3-revoke.crl">CRL</a></li>
<?php /*
diff --git a/pages/index/52.php b/pages/index/52.php
new file mode 100644
index 0000000..9132b8b
--- /dev/null
+++ b/pages/index/52.php
@@ -0,0 +1,32 @@
+<?/*
+ LibreSSL - CAcert web application
+ Copyright (C) 2004-2008 CAcert Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/
+
+?>
+
+<div style="text-align: center;">
+ <h1><?=_('CAcert Community Agreement Acceptance')?></h1>
+ <p><?=sprintf(_('To get access to your account you need to accept the %s CAcert Community Agreement %s (CCA).'),'<a href="/policy/CAcertCommunityAgreement.php">', '</a>')?></p>
+ <p><?=_('#### Explanation why #### Please replace me ####')?></p>
+ <p><?=sprintf(_('If you do not want to accept the CCA you should think about closing your account. In this case please send an email to support (%s).'),'<a href="mailto:support@cacert.org">support@cacert.org</a>')?></p>
+ <form method="post" action="index.php">
+ <input type="submit" name="agree" value="<?=_('I agree CCA')?>">
+ <input type="submit" name="disagree" value="<?=_('I do not want to accept the CCA')?>">
+
+ <input type="hidden" name="oldid" value="<?=$id?>">
+ </form>
+</div>
diff --git a/pages/index/feed.rss b/pages/index/feed.rss
new file mode 100644
index 0000000..def221f
--- /dev/null
+++ b/pages/index/feed.rss
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="UTF-8"?><!-- generator="WordPress/2.5.1" -->
+<rss version="0.92">
+ <channel>
+ <title>CAcert NEWS Blog</title>
+ <link>http://blog.cacert.org</link>
+ <description>CAcert NEWS and up coming events.</description>
+ <lastBuildDate>Fri, 20 Aug 2010 11:54:30 +0000</lastBuildDate>
+ <docs>http://backend.userland.com/rss092</docs>
+ <language>en</language>
+
+ <item>
+ <title>Looking for confirmation email on creating account?</title>
+ <description>Please go to https://ca-mgr1.it-sls.de/login login with your just created account and password. Under MAIL you'll find your individual confirmation email.
+ </description>
+ <link>https://ca-mgr1.it-sls.de/testsystemdoc.html</link>
+ </item>
+ <item>
+ <title>You are interested in helping Testing ?</title>
+ <description>Create your test account on the Testserver. Beware of the confirmation email (see above) Entry page for Testers: https://wiki.cacert.org/Software/CurrentTest. Please contact Ulrich becoming a Testteam member.</description>
+ <link>https://wiki.cacert.org/Software/CurrentTest</link>
+ </item>
+ <item>
+ <title>Dear Testers</title>
+ <description>We had one work with no activity on the testserver caused by inactivity by the Software-Assessment team, caused by router problems at the hosting site of the testserver. Probably latter has been fixed.
+
+ The reported bugs can be categorized into
+ 1. Testserver-Mgmt-System related
+ 2. Production Server recovery process to Testserver
+ 3. general software errors
+
+ Group 1+2 are essential for our current test phase, as they covers the problems in building the base testserver environment that is needed for testing.
+
+ So language and country selection support is an essential feature we've worked on the last week.
+
+ One problem couldn't be solved till today: secondary language selection all other country and language related bugs should be fixed in the meantime.
+
+ Also the Show my Points details now has the correct script (after some confusion in the Software-Assessment team and one developer), comparable to the script on the production website.
+
+ On the main entry page for testers https://wiki.cacert.org/Software/CurrentTest the updates on the bugs are marked with (i) so here comes the 2nd test round ...
+
+ Please report your found bugs and also success reports to the listed bug numbers
+
+ Thanks for your assistance .... ;)</description>
+ <link>https://cacert1.it-sls.de/</link>
+ </item>
+ </channel>
+</rss>
diff --git a/pages/wot/1.php b/pages/wot/1.php
index a45b5df..9047f27 100644
--- a/pages/wot/1.php
+++ b/pages/wot/1.php
@@ -14,9 +14,9 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?
- $res=mysql_fetch_assoc(mysql_query("select sum(acount) as summe from countries"));
+*/
+
+ $res=mysql_fetch_assoc(mysql_query("select sum(acount) as summe from countries"));
$total1 =$res['summe'];
$locid=array_key_exists('locid',$_REQUEST)?intval($_REQUEST['locid']):0;
@@ -91,7 +91,7 @@
{
$query = "select *, `users`.`id` as `id` from `users`,`notary` where `listme`='1' and
`ccid`='".$ccid."' and `regid`='".$regid."' and
- `locid`='".$locid."' and `users`.`id`=`notary`.`to`
+ `locid`='".$locid."' and `users`.`id`=`notary`.`to` and `notary`.`deleted`=0
group by `notary`.`to` HAVING SUM(`points`) >= 100 order by `points` desc";
$list = mysql_query($query);
if(mysql_num_rows($list) > 0)
@@ -104,19 +104,19 @@
<td class="title"><?=_("Contact Details")?></td>
<td class="title"><?=_("Email Assurer")?></td>
<td class="title"><?=_("Assurer Challenge")?></td>
-
</tr>
-<? while($row = mysql_fetch_assoc($list)) { ?>
+
+<? while($row = mysql_fetch_assoc($list)) { ?>
<tr>
- <td class="DataTD" width="100"><nobr><?=$row['fname']?> <?=substr($row['lname'], 0, 1)?></nobr></td>
+ <td class="DataTD" width="100"><nobr><?=sanitizeHTML($row['fname'])?> <?=substr($row['lname'], 0, 1)?>.</nobr></td>
<td class="DataTD"><?=maxpoints($row['id'])?></td>
- <td class="DataTD"><?=$row['contactinfo']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['contactinfo'])?></td>
<td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($row['id'])?>"><?=_("Email Me")?></a></td>
<td class="DataTD"><?=$row['assurer']?_("Yes"):("<font color=\"#ff0000\">"._("Not yet!")."</font>")?></td>
-
</tr>
-<? }
- }
+<?
+ }
+ }
?>
</table>
<br>
diff --git a/pages/wot/10.php b/pages/wot/10.php
index bc76a86..b5e146c 100644
--- a/pages/wot/10.php
+++ b/pages/wot/10.php
@@ -24,7 +24,7 @@
<td colspan="5" class="title"><?=_("Assurer Ranking")?></td>
</tr>
<tr>
-<?
+<?// the rank calculation is not adjusted to the new deletion method
$query = "SELECT `users`. *, count(*) AS `list` FROM `users`, `notary`
WHERE `users`.`id` = `notary`.`from` AND `notary`.`from` != `notary`.`to`
AND `from`='".intval($_SESSION['profile']['id'])."' GROUP BY `notary`.`from`";
@@ -36,8 +36,8 @@
WHERE `users`.`id` = `notary`.`from` AND `notary`.`from` != `notary`.`to`
GROUP BY `notary`.`from` HAVING count(*) > '$rc' ORDER BY `notary`.`when` DESC";
*/
- $query = "SELECT count(*) AS `list` FROM `users`
- inner join `notary` on `users`.`id` = `notary`.`from`
+ $query = "SELECT count(*) AS `list` FROM `users`
+ inner join `notary` on `users`.`id` = `notary`.`from`
GROUP BY `notary`.`from` HAVING count(*) > '$rc'";
$rank = mysql_num_rows(mysql_query($query)) + 1;
@@ -64,18 +64,18 @@
<td class="DataTD"><b><?=_("Method")?></b></td>
</tr>
<?
- $query = "select * from `notary` where `to`='".intval($_SESSION['profile']['id'])."'";
+ $query = "select `id`, `date`, `from`, `points`, `location`, `method` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0";
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($row['from'])."'"));
+ $fromuser = mysql_fetch_assoc(mysql_query("select `fname`, `lname` from `users` where `id`='".intval($row['from'])."'"));
?>
<tr>
- <td class="DataTD"><?=$row['id']?></td>
+ <td class="DataTD"><?=intval($row['id'])?></td>
<td class="DataTD"><?=$row['date']?></td>
- <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($row['from'])?>"><?=$fromuser['fname']." ".$fromuser['lname']?></td>
- <td class="DataTD"><?=$row['points']?></td>
- <td class="DataTD"><?=$row['location']?></td>
+ <td class="DataTD"><a href="wot.php?id=9&amp;userid=<?=intval($row['from'])?>"><?=sanitizeHTML(trim($fromuser['fname']." ".$fromuser['lname']))?></td>
+ <td class="DataTD"><?=intval($row['points'])?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['location'])?></td>
<td class="DataTD"><?=_(sprintf("%s", $row['method']))?></td>
</tr>
<?
@@ -114,30 +114,30 @@ if ($thawte)
</tr>
<?
$points = 0;
- $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and `to`!='".intval($_SESSION['profile']['id'])."'";
+ $query = "select `id`, `date`, `points`, `to`, `location`, `method` from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and `to`!='".intval($_SESSION['profile']['id'])."' and `deleted`=0" ;
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
- $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($row['to'])."'"));
- $points += $row['points'];
+ $fromuser = mysql_fetch_assoc(mysql_query("select `fname`, `lname` from `users` where `id`='".intval($row['to'])."'"));
+ $points += intval($row['points']);
$name = trim($fromuser['fname']." ".$fromuser['lname']);
if($name == "")
$name = _("Deleted before Verification");
else
- $name = "<a href='wot.php?id=9&amp;userid=".intval($row['to'])."'>$name</a>";
+ $name = "<a href='wot.php?id=9&amp;userid=".intval($row['to'])."'>".sanitizeHTML($name)."</a>";
?>
<tr>
<td class="DataTD"><?=intval($row['id'])?></td>
<td class="DataTD"><?=$row['date']?></td>
<td class="DataTD"><?=$name?></td>
<td class="DataTD"><?=intval($row['points'])?></td>
- <td class="DataTD"><?=$row['location']?></td>
+ <td class="DataTD"><?=sanitizeHTML($row['location'])?></td>
<td class="DataTD"><?=$row['method']==""?"":_(sprintf("%s", $row['method']))?></td>
</tr>
<? } ?>
<tr>
<td class="DataTD" colspan="3"><b><?=_("Total Points Issued")?>:</b></td>
- <td class="DataTD"><?=$points?></td>
+ <td class="DataTD"><?=intval($points)?></td>
<td class="DataTD" colspan="2">&nbsp;</td>
</tr>
</table>
diff --git a/pages/wot/12.php b/pages/wot/12.php
index a0bbf50..e6b20ca 100644
--- a/pages/wot/12.php
+++ b/pages/wot/12.php
@@ -65,9 +65,9 @@ document.f.location.focus();
{
$bits = explode(",", $_REQUEST['location']);
- $loc = trim(mysql_escape_string($bits['0']));
- $reg = ""; if(array_key_exists('1',$bits)) $reg=trim(mysql_escape_string($bits['1']));
- $ccname = ""; if(array_key_exists('2',$bits)) $ccname=trim(mysql_escape_string($bits['2']));
+ $loc = trim(mysql_real_escape_string($bits['0']));
+ $reg = ""; if(array_key_exists('1',$bits)) $reg=trim(mysql_real_escape_string($bits['1']));
+ $ccname = ""; if(array_key_exists('2',$bits)) $ccname=trim(mysql_real_escape_string($bits['2']));
$query = "select `locations`.`id` as `locid` from `locations`, `regions`, `countries` where
`locations`.`name` like '$loc%' and `regions`.`name` like '$reg%' and `countries`.`name` like '$ccname%' and
diff --git a/pages/wot/13.php b/pages/wot/13.php
index eac7e18..1143769 100644
--- a/pages/wot/13.php
+++ b/pages/wot/13.php
@@ -21,9 +21,9 @@ if(array_key_exists('location',$_REQUEST) && $_REQUEST['location'] != "") {
{
$bits = explode(",", $_REQUEST['location']);
- $loc = trim(mysql_escape_string($bits['0']));
- $reg = ''; if(array_key_exists('1',$bits)) $reg=trim(mysql_escape_string($bits['1']));
- $ccname = ''; if(array_key_exists('2',$bits)) $ccname=trim(mysql_escape_string($bits['2']));
+ $loc = trim(mysql_real_escape_string($bits['0']));
+ $reg = ''; if(array_key_exists('1',$bits)) $reg=trim(mysql_real_escape_string($bits['1']));
+ $ccname = ''; if(array_key_exists('2',$bits)) $ccname=trim(mysql_real_escape_string($bits['2']));
$query = "select `locations`.`id` as `locid` from `locations`, `regions`, `countries` where
`locations`.`name` like '$loc%' and `regions`.`name` like '$reg%' and `countries`.`name` like '$ccname%' and
`locations`.`regid`=`regions`.`id` and `locations`.`ccid`=`countries`.`id`
diff --git a/pages/wot/15.php b/pages/wot/15.php
index cca2702..c1f3e0f 100644
--- a/pages/wot/15.php
+++ b/pages/wot/15.php
@@ -14,7 +14,7 @@
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/
+*/
require_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
diff --git a/pages/wot/16.php b/pages/wot/16.php
new file mode 100644
index 0000000..069b7a2
--- /dev/null
+++ b/pages/wot/16.php
@@ -0,0 +1,143 @@
+<?php
+/*LibreSSL - CAcert web application
+Copyright (C) 2004-2008 CAcert Inc.
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; version 2 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/
+
+//******************* TTP Console ************
+
+if ($_SESSION['profile']['ttpadmin'] < 1) {
+ echo _("You are not allowed to view this page.");
+ exit;
+}
+
+//Check for test or productive environment, in case of test the user data for the print out is extended by 'test system'
+$testserver='';
+if ($_SESSION['_config']['normalhostname']=='cacert1.it-sls.de') {
+ $testserver=' test system';
+}
+
+$row = $_SESSION['_config']['notarise'];
+$fname = $row['fname'];
+$mname = $row['mname'];
+$lname = $row['lname'];
+$suffix = $row['suffix'];
+$fullname = $fname." ".$mname." ".$lname." ".$suffix;
+$email = $row['email'];
+$dob = date_format(new DateTime($row['dob']), 'Y-m-d');
+$userid = $row['id'];
+
+//List TTP Assurances and TotalPoints
+//changed get_received_assurances ($userid, $support)
+
+//include_once($_SESSION['_config']['filepath']."/includes/wot.inc.php");
+include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php");
+
+output_received_assurances(intval($userid),2); //support==2 => TTP
+
+
+$query = "select sum(`points`) as `points` from `notary` where `to`='".intval($userid)."'";
+$dres = mysql_query($query);
+$drow = mysql_fetch_assoc($dres);
+
+$points=$drow['points'];
+if ($points<1) {
+ $points=0;
+}
+
+$res = get_received_assurances(intval($userid), 2);
+$ttp_assurances_count=$num_rows = mysql_num_rows($res);
+
+//Form
+?>
+<table align="center" class="wrapper">
+ <tr>
+ <td class="title"><?=sprintf(_('Total assurance points for %s'),$fullname)?></td>
+ </tr>
+ <tr>
+ <td><?=sprintf(_('%s points'), $points)?></td>
+ </tr>
+</table>
+<br/>
+<form action="https://pdf.cacert.eu/cacertpdf.php" method="get" accept-charset="UTF-8">
+ <table align="center" class="wrapper">
+ <tr>
+ <td colspan="2" class="title"><?= _('TTP CAP form creation')?></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="title"><?= _('User information')?></td>
+ </tr>
+ <tr>
+ <td><?=_('Fullname')?><input type="hidden" name="fullname" value="<?=$fullname.$testserver?>"/></td>
+ <td><?=$fullname?></td>
+ </tr>
+ <tr>
+ <td><?=_('Date of Birth')?><input type="hidden" name="dob" value="<?=$dob.$testserver?>"/></td>
+ <td><?=$dob?></td>
+ </tr>
+ <tr>
+ <td><?=_('Email')?><input type="hidden" name="email" value="<?=$email.$testserver?>"/></td>
+ <td><?=$email?></td>
+ </tr>
+ <tr></tr>
+ <tr>
+ <td><?=_('Country where the TTP will be visited')?></td>
+ <td>
+ <?
+ $ttpcountries=get_array_from_ini('../config/ttp.ini');
+ echo create_selectbox_HTML('type',$ttpcountries, '',TRUE);
+ ?>
+ </td>
+ </tr>
+ <tr>
+ <td colspan="2" class="title"><?=_('TTP Admin postal address, including name, street, country etc.')?></td>
+ </tr>
+ <tr>
+ <td><?=_('Line').' 1'?></td>
+ <td><input type="text" name="adress" /></td>
+ </tr>
+ <tr>
+ <td><?=_('Line').' 2'?></td>
+ <td><input type="text" name="adress1" /></td>
+ </tr>
+ <tr>
+ <td><?=_('Line').' 3'?></td>
+ <td><input type="text" name="adress2" /></td>
+ </tr>
+ <tr>
+ <td><?=_('Line').' 4'?></td>
+ <td><input type="text" name="adress3" /></td>
+ </tr>
+ <tr>
+ <td><?=_('Line').' 5'?></td>
+ <td><input type="text" name="adress4" /></td>
+ </tr>
+ <tr>
+ <td colspan="2" class="title">
+ <?
+ if ($points>=100 || $ttp_assurances_count>=2) {
+ echo _('No TTP assurance allowed');
+ }else{
+ ?><input type="submit" value="<?=_('Create TTP CAP pdf file')?>"/><?
+ }?>
+ </td>
+ </tr>
+ </table>
+ <input type="hidden" name="lang" value="en"/>
+</form>
+
+<div class="blockcenter">
+ <a href="wot.php?id=6&amp;userid=<?=$userid ?>"><?=_("Back")?></a>
+</div>
diff --git a/pages/wot/4.php b/pages/wot/4.php
index 628e6a5..954bc76 100644
--- a/pages/wot/4.php
+++ b/pages/wot/4.php
@@ -43,12 +43,13 @@ if ($_SESSION['profile']['points']<100){
<form method="post" action="wot.php">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
- <td class="DataTD"><?=_("Country where you want to visit the TTP")?></td>
- <td class="DataTD"><select size="1" name="country">
- <option>Australia</option>
- <option>Puerto Rico</option>
- <option>USA</option>
- </select></td>
+ <td class="DataTD"><?=_('Country where you want to visit the TTP')?></td>
+ <td class="DataTD">
+ <?
+ $ttpcountries=get_array_from_ini('../config/ttp.ini');
+ echo create_selectbox_HTML('country',$ttpcountries, _('Choose country'));
+ ?>
+ </td>
</tr>
<tr>
<td class="DataTD"><?=_("I want to take part in the TTP Topup programme")?></td>
@@ -72,7 +73,7 @@ if ($_SESSION['profile']['points']<100){
</form>
*/
?>
- <p><?=_("We are working to develop the TTP TOPUP process to be able to fill the gap of the missing 30 assurance points to 100 assurance points. Meanwhile you have to close this gap with face to face assurances from CAcert Assurers. Think not only travelling to populated countries, but as well to assurers visiting your country or area.")?></p>
+ <p><?=_("We are working to develop the TTP TOPUP process to be able to fill the gap of the missing 30 assurance points to 100 assurance points. Meanwhile you have to close this gap with face to face assurances from CAcert Assurers. Think not only travelling to populated countries, but as well to assurers visiting your country or area.")?></p>
<?
}
} else {
diff --git a/pages/wot/5.php b/pages/wot/5.php
index c1a6438..a9c3dcb 100644
--- a/pages/wot/5.php
+++ b/pages/wot/5.php
@@ -18,14 +18,24 @@
include_once("../includes/shutdown.php");
require_once("../includes/lib/l10n.php");
?>
-<?
- if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "")
+<?
+ if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "")
{
?><font color="orange" size="+1">
<? echo _("ERROR").": ".$_SESSION['_config']['error'] ?>
</font>
<?unset($_SESSION['_config']['error']);
- }
+ }
+
+ if (!isset($_SESSION['assuresomeone']['year'])) {
+ $_SESSION['assuresomeone']['year'] = '';
+ }
+ if (!isset($_SESSION['assuresomeone']['month'])) {
+ $_SESSION['assuresomeone']['month'] = '';
+ }
+ if (!isset($_SESSION['assuresomeone']['day'])) {
+ $_SESSION['assuresomeone']['day'] = '';
+ }
?>
<? if(array_key_exists('noemailfound',$_SESSION['_config']) && $_SESSION['_config']['noemailfound'] == 1) { ?>
<form method="post" action="wot.php">
@@ -60,6 +70,37 @@
<td class="DataTD"><input type="text" name="email" id="email" value="<?=array_key_exists('email',$_POST)?sanitizeHTML($_POST['email']):""?>"></td>
<? } ?>
</tr>
+ <tr>
+ <td class="DataTD">
+ <?=_("Date of Birth")?><br/>
+ (<?=_("yyyy/mm/dd")?>)</td>
+ <td class="DataTD">
+ <input type="text" name="year" value="<?=array_key_exists('year',$_SESSION['assuresomeone']) ? sanitizeHTML($_SESSION['assuresomeone']['year']):""?>" size="4" autocomplete="off"></nobr>
+ <select name="month">
+<?
+for($i = 1; $i <= 12; $i++)
+{
+ echo "<option value='$i'";
+ if(array_key_exists('month',$_SESSION['assuresomeone']) && $_SESSION['assuresomeone']['month'] == $i)
+ echo " selected=\"selected\"";
+ echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))." ($i)</option>\n";
+}
+?>
+ </select>
+ <select name="day">
+<?
+for($i = 1; $i <= 31; $i++)
+{
+ echo "<option";
+ if(array_key_exists('day',$_SESSION['assuresomeone']) && $_SESSION['assuresomeone']['day'] == $i)
+ echo " selected=\"selected\"";
+ echo ">$i</option>";
+}
+?>
+ </select>
+ </td>
+ </tr>
+
<tr>
<td class="DataTD" colspan="2"><input type="submit" name="process" value="<?=_("Next")?>"></td>
</tr>
diff --git a/pages/wot/6.php b/pages/wot/6.php
index a565aa7..d48fc21 100644
--- a/pages/wot/6.php
+++ b/pages/wot/6.php
@@ -17,20 +17,23 @@
*/ ?>
<?
- if(!array_key_exists('notarise',$_SESSION['_config']))
+if(!array_key_exists('notarise',$_SESSION['_config']))
{
- echo "Error: No user data found.";
- exit;
+ echo "Error: No user data found.";
+ exit;
}
$row = $_SESSION['_config']['notarise'];
+ $_SESSION['assuresomeone']['year'] = '';
+ $_SESSION['assuresomeone']['month'] = '';
+ $_SESSION['assuresomeone']['day'] = '';
- if($_SESSION['profile']['ttpadmin'] == 1)
-// $methods = array("Face to Face Meeting", "Trusted 3rd Parties", "TopUP");
-// else
- $methods = array("Face to Face Meeting", "Trusted 3rd Parties");
+ if($_SESSION['profile']['ttpadmin'] == 2)
+ $methods = array('Face to Face Meeting', 'TTP-Assisted', 'TTP-TOPUP');
+ elseif($_SESSION['profile']['ttpadmin'] == 1)
+ $methods = array('Face to Face Meeting', 'TTP-Assisted');
else
- $methods = array("Face to Face Meeting");
+ $methods = array('Face to Face Meeting');
$mnames = array(
'01' => _('January'),
@@ -79,7 +82,12 @@
AssureTextLine("",_("Only tick the next box if the Assurance was face to face."));
AssureBoxLine("assertion",_("I believe that the assertion of identity I am making is correct, complete and verifiable. I have seen original documentation attesting to this identity. I accept that the CAcert Arbitrator may call upon me to provide evidence in any dispute, and I may be held responsible."),array_key_exists('assertion',$_POST) && $_POST['assertion'] == 1);
AssureBoxLine("rules",_("I have read and understood the CAcert Community Agreement (CCA), Assurance Policy and the Assurance Handbook. I am making this Assurance subject to and in compliance with the CCA, Assurance policy and handbook."),array_key_exists('rules',$_POST) && $_POST['rules'] == 1);
- AssureTextLine(_("Policy"),"<a href=\"/policy/CAcertCommunityAgreement.php\" target=\"_blank\">"._("CAcert Community Agreement")."</a> -<a href=\"/policy/AssurancePolicy.php\" target=\"_blank\">"._("Assurance Policy")."</a> - <a href=\"http://wiki.cacert.org/AssuranceHandbook2\" target=\"_blank\">"._("Assurance Handbook")."</a>");
+ AssureTextLine(_("Policy"),"<a href=\"/policy/CAcertCommunityAgreement.html\" target=\"_blank\">"._("CAcert Community Agreement")."</a> - <a href=\"/policy/AssurancePolicy.html\" target=\"_blank\">"._("Assurance Policy")."</a> - <a href=\"http://wiki.cacert.org/AssuranceHandbook2\" target=\"_blank\">"._("Assurance Handbook")."</a>");
AssureInboxLine("points",_("Points"),"","<br />(Max. ".maxpoints().")");
AssureFoot($id,_("I confirm this Assurance"));
+
+ if($_SESSION['profile']['ttpadmin'] >= 1) {
+ ?><div class='blockcenter'><a href="wot.php?id=16"><?=_('Show TTP details')?></a></div><?
+ }
+
?>
diff --git a/pages/wot/9.php b/pages/wot/9.php
index bfa7a98..839ba42 100644
--- a/pages/wot/9.php
+++ b/pages/wot/9.php
@@ -15,9 +15,9 @@
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
-
+
require_once($_SESSION['_config']['filepath'].'/includes/lib/l10n.php');
-
+
$res = mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."' and `listme`='1'");
if(mysql_num_rows($res) <= 0)
@@ -28,9 +28,8 @@
$user = mysql_fetch_array($res);
$userlang = $user['language'];
$points = mysql_num_rows(mysql_query("select sum(`points`) as `total` from `notary`
- where `to`='".$user['id']."' group by `to` HAVING SUM(`points`) > 0"));
- if($points <= 0)
- {
+ where `to`='".intval($user['id'])."' and `deleted`=0 group by `to` HAVING SUM(`points`) > 0"));
+ if($points <= 0) {
echo _("Sorry, I was unable to locate that user.");
} else {
@@ -38,31 +37,42 @@
?>
<? if($_SESSION['_config']['error'] != "") { ?><font color="#ff0000" size="+1">ERROR: <?=$_SESSION['_config']['error']?></font><? unset($_SESSION['_config']['error']); } ?>
<form method="post" action="wot.php">
-<input type="hidden" name="userid" value="<?=$user['id']?>">
+<input type="hidden" name="userid" value="<?=intval($user['id'])?>">
<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
<tr>
<td colspan="2" class="title"><?=_("Contact Assurer")?></td>
</tr>
<tr>
<td class="DataTD"><?=_("To")?>:</td>
- <td class="DataTD" align="left"><?=$user['fname']?> <?=substr($user['lname'], 0, 1)?></td>
+ <td class="DataTD" align="left"><?=sanitizeHTML(trim($user['fname'].' '.substr($user['lname'], 0, 1)))?></td>
</tr>
<? if($userlang != "") { ?>
<tr>
<td class="DataTD"><?=_("Language")?>:</td>
- <td class="DataTD" align="left"><? printf(_("%s prefers to be contacted in %s"), $user['fname'], L10n::$translations[$userlang]) ?></td>
+ <?
+ $userlang = explode("_", $userlang, 2);
+ if(count($userlang) == 2){
+ $printlang = array_search(strtolower($userlang[0]) . "_" . strtoupper($userlang[1]), L10n::$locales);
+ if($printlang === false){
+ $printlang = $userlang[0];
+ }
+ }else{
+ $printlang = strtolower($userlang[0]);
+ }
+ ?>
+ <td class="DataTD" align="left"><? printf(_("%s prefers to be contacted in %s"), sanitizeHTML($user['fname']), L10n::$translations[$printlang]) ?></td>
</tr>
<? } ?>
<?
- $query = "select * from `addlang` where `userid`='".$user['id']."'";
+ $query = "select * from `addlang` where `userid`='".intval($user['id'])."'";
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
- $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='${row['lang']}'"));
+ $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='".mysql_real_escape_string($row['lang'])."'"));
?>
<tr>
<td class="DataTD"><?=_("Additional Language")?>:</td>
- <td class="DataTD" align="left"><? printf(_("%s will also accept email in %s - %s"), $user['fname'], $lang['lang'], $lang['country']) ?></td>
+ <td class="DataTD" align="left"><? printf(_("%s will also accept email in %s - %s"), sanitizeHTML($user['fname']), $lang['lang'], $lang['country']) ?></td>
</tr>
<? } ?>
<tr>
@@ -79,7 +89,7 @@
</table>
<input type="hidden" name="pageid" value="<?=$_SESSION['_config']['pagehash']?>">
<input type="hidden" name="userid" value="<?=intval($_REQUEST['userid'])?>">
-<input type="hidden" name="oldid" value="<?=$id?>">
+<input type="hidden" name="oldid" value="<?=intval($id)?>">
</form>
<p>[ <a href='javascript:history.go(-1)'><?=_("Go Back")?></a> ]</p>
<? } } ?>
diff --git a/scripts/cron/refresh_stats.php b/scripts/cron/refresh_stats.php
index 2a3d2b5..3b446ba 100755
--- a/scripts/cron/refresh_stats.php
+++ b/scripts/cron/refresh_stats.php
@@ -23,7 +23,7 @@ require_once(dirname(__FILE__).'/../../includes/mysql.php');
/**
* Wrapper around mysql_query() to provide some error handling. Prints an error
* message and dies if query fails
- *
+ *
* @param string $sql
* the SQL statement to execute
* @return resource|boolean
@@ -35,7 +35,7 @@ function sql_query($sql) {
fwrite(STDERR, "MySQL query failed:\n\"$sql\"\n".mysql_error());
die(1);
}
-
+
return $res;
}
@@ -54,7 +54,7 @@ function updateCache($stats) {
$sql = "insert into `statscache` (`timestamp`, `cache`) values
('$timestamp', '".mysql_real_escape_string(serialize($stats))."')";
sql_query($sql);
-
+
// Make sure the new statistic was inserted successfully
$res = sql_query(
"select 1 from `statscache` where `timestamp` = '$timestamp'");
@@ -62,7 +62,7 @@ function updateCache($stats) {
fwrite(STDERR, "Error on inserting the new statistic");
return false;
}
-
+
sql_query("delete from `statscache` where `timestamp` != '$timestamp'");
return true;
}
@@ -74,22 +74,22 @@ function updateCache($stats) {
*/
function getDataFromLive() {
echo "Calculating current statistics\n";
-
+
$stats = array();
$stats['verified_users'] = number_format(tc(
"select count(*) as `count` from `users`
where `verified` = 1
and `deleted` = 0
and `locked` = 0"));
-
+
$stats['verified_emails'] = number_format(tc(
"select count(*) as `count` from `email`
where `hash` = '' and `deleted` = 0"));
-
+
$stats['verified_domains'] = number_format(tc(
"select count(*) as `count` from `domains`
where `hash` = '' and `deleted` = 0"));
-
+
$certs = tc("select count(*) as `count` from `domaincerts`
where `expire` != 0");
$certs += tc("select count(*) as `count` from `emailcerts`
@@ -101,7 +101,7 @@ function getDataFromLive() {
$certs += tc("select count(*) as `count` from `orgemailcerts`
where `expire` != 0");
$stats['verified_certificates'] = number_format($certs);
-
+
$certs = tc("select count(*) as `count` from `domaincerts`
where `revoked` = 0 and `expire` > NOW()");
$certs += tc("select count(*) as `count` from `emailcerts`
@@ -113,11 +113,12 @@ function getDataFromLive() {
$certs += tc("select count(*) as `count` from `orgemailcerts`
where `revoked` = 0 and `expire` > NOW()");
$stats['valid_certificates'] = number_format($certs);
-
+
$stats['assurances_made'] = number_format(tc(
"select count(*) as `count` from `notary`
- where `method` = '' or `method` = 'Face to Face Meeting'"));
-
+ where (`method` = '' or `method` = 'Face to Face Meeting')
+ and `deleted` = 0"));
+
$stats['users_1to49'] = number_format(tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -125,7 +126,7 @@ function getDataFromLive() {
group by `to`
having sum(`points`) > 0 and sum(`points`) < 50
) as `low_points`"));
-
+
$stats['users_50to99'] = number_format(tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -133,7 +134,7 @@ function getDataFromLive() {
group by `to`
having sum(`points`) >= 50 and sum(`points`) < 100
) as `high_points`"));
-
+
$stats['assurer_candidates'] = number_format(tc(
"select count(*) as `count` from `users`
where (
@@ -148,7 +149,7 @@ function getDataFromLive() {
and `cv`.`type_id`=1
)"
));
-
+
$stats['aussurers_with_test'] = number_format(tc(
"select count(*) as `count` from `users`
where (
@@ -163,7 +164,7 @@ function getDataFromLive() {
and `cv`.`type_id`=1
)"
));
-
+
$stats['points_issued'] = number_format(tc(
"select sum(greatest(`points`, `awarded`)) as `count` from `notary`
where `deleted` = 0
@@ -177,16 +178,16 @@ function getDataFromLive() {
$next_month_ts = mktime(0, 0, 0, date("m") - $i + 1, 1, date("Y"));
$first = date("Y-m-d", $first_ts);
$next_month = date("Y-m-d", $next_month_ts);
-
+
echo "Calculating statistics for month $first\n";
-
+
$totalusers += $users = tc(
- "select count(*) as `count` from `users`
+ "select count(*) as `count` from `users`
where `created` >= '$first' and `created` < '$next_month'
and `verified` = 1
and `deleted` = 0
and `locked` = 0");
-
+
$totassurers += $assurers = tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -195,7 +196,7 @@ function getDataFromLive() {
and `deleted` = 0
group by `to` having sum(`points`) >= 100
) as `assurer_candidates`");
-
+
$certs = tc(
"select count(*) as `count` from `domaincerts`
where `created` >= '$first' and `created` < '$next_month'
@@ -240,16 +241,16 @@ function getDataFromLive() {
$next_year_ts = mktime(0, 0, 0, 1, 1, $i + 1);
$first = date("Y-m-d", $first_ts);
$next_year = date("Y-m-d", $next_year_ts);
-
+
echo "Calculating statistics for year $i\n";
-
+
$totalusers += $users = tc(
- "select count(*) as `count` from `users`
+ "select count(*) as `count` from `users`
where `created` >= '$first' and `created` < '$next_year'
and `verified` = 1
and `deleted` = 0
and `locked` = 0");
-
+
$totassurers += $assurers = tc(
"select count(*) as `count` from (
select 1 from `notary`
@@ -258,7 +259,7 @@ function getDataFromLive() {
and `deleted` = 0
group by `to` having sum(`points`) >= 100
) as `assurer_candidates`");
-
+
$certs = tc(
"select count(*) as `count` from `domaincerts`
where `created` >= '$first' and `created` < '$next_year'
@@ -286,7 +287,7 @@ function getDataFromLive() {
$tmp_arr['new_users'] = number_format($users);
$tmp_arr['new_assurers'] = number_format($assurers);
$tmp_arr['new_certificates'] = number_format($certs);
-
+
$stats['growth_last_years'][] = $tmp_arr;
}
$stats['growth_last_years_total'] = array(
diff --git a/scripts/cron/warning.php b/scripts/cron/warning.php
index 0c97ba2..3022ffb 100755
--- a/scripts/cron/warning.php
+++ b/scripts/cron/warning.php
@@ -18,6 +18,7 @@
*/
require_once(dirname(__FILE__).'/../../includes/mysql.php');
+ require_once(dirname(__FILE__).'/../../includes/lib/l10n.php');
$days = array("1" => "3", "15" => "2", "30" => "1", "45" => "0");
@@ -34,11 +35,13 @@
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
+ L10n::set_recipient_language(intval($row['id']));
if($row['subject'] == "")
{
$row['crt_name'] = str_replace("../", "www/", $row['crt_name']);
$row['crt_name'] = "/home/cacert/".$row['crt_name'];
- $subject = `openssl x509 -in '$row[crt_name]' -text -noout|grep Subject:`;
+ $crt_name = escapeshellarg($row['crt_name']);
+ $subject = `openssl x509 -in $crt_name -text -noout|grep Subject:`;
$bits = explode("/", $subject);
foreach($bits as $val)
{
@@ -106,6 +109,7 @@ echo $row['fname']." ".$row['lname']." <".$row['email']."> (memid: ".$row['memid
$res = mysql_query($query);
while($row = mysql_fetch_assoc($res))
{
+ L10n::set_recipient_language(intval($row['memid']));
if($row['subject'] == "")
$row['subject'] = $row['CN'];
diff --git a/scripts/db_migrations/version5.sh b/scripts/db_migrations/version5.sh
new file mode 100755
index 0000000..f18f8c6
--- /dev/null
+++ b/scripts/db_migrations/version5.sh
@@ -0,0 +1,249 @@
+#!/bin/sh
+# LibreSSL - CAcert web application
+# Copyright (C) 2004-2011 CAcert Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+
+
+# script to do database migrations
+
+set -e # script fails if any command fails
+
+STDIN=0
+STDOUT=1
+STDERR=2
+
+if [ "$1" = "--help" ]; then
+ cat >&$STDERR <<- USAGE
+ Usage: $0 [MYSQL_OPTIONS]
+ You have to specify all options needed by "mysql" as if you had started
+ the MySQL command line client directly (including the name of the
+ database to operate on). The MySQL user used has to have enough
+ privileges to do all necessary operations (among others CREATE, ALTER,
+ DROP, UPDATE, INSERT, DELETE).
+ You might need to enter the mysql password multiple times if you
+ specify the -p option.
+ USAGE
+ exit 1
+fi
+
+mysql_opt=" --batch --skip-column-names $@"
+
+schema_version=$( mysql $mysql_opt <<- 'SQL'
+
+ SELECT MAX(`version`) FROM `schema_version`;
+SQL
+)
+if [ $schema_version != 4 ]; then
+ cat >&$STDERR <<- ERROR
+ Error: database schema is not in the right version to do the migration!
+ Expected version: 4
+ ERROR
+ exit 2
+fi
+
+mysql $mysql_opt <<- 'SQL'
+
+-- Move myISAM to InnoDB bug #1172
+
+ALTER TABLE `abusereports` ENGINE=INNODB;
+system echo "table abusereports altered to InnoDB"
+
+
+ALTER TABLE `addlang` ENGINE=INNODB;
+system echo "table addlang altered to InnoDB"
+
+
+ALTER TABLE `adminlog` ENGINE=INNODB;
+system echo "table adminlog altered to InnoDB"
+
+
+ALTER TABLE `advertising` ENGINE=INNODB;
+system echo "table advertising altered to InnoDB"
+
+
+ALTER TABLE `alerts` ENGINE=INNODB;
+system echo "table alerts altered to InnoDB"
+
+
+ALTER TABLE `baddomains` ENGINE=INNODB;
+system echo "table baddomains altered to InnoDB"
+
+
+ALTER TABLE `cats_passed` ENGINE=INNODB;
+system echo "table cats_passed altered to InnoDB"
+
+
+ALTER TABLE `cats_type` ENGINE=INNODB;
+system echo "table cats_type altered to InnoDB"
+
+
+ALTER TABLE `cats_variant` ENGINE=INNODB;
+system echo "table cats_variant altered to InnoDB"
+
+
+ALTER TABLE `countries` ENGINE=INNODB;
+system echo "table countries altered to InnoDB"
+
+
+ALTER TABLE `disputedomain` ENGINE=INNODB;
+system echo "table disputedomain altered to InnoDB"
+
+
+ALTER TABLE `disputeemail` ENGINE=INNODB;
+system echo "table disputeemail altered to InnoDB"
+
+ALTER TABLE `domaincerts` ENGINE=INNODB;
+system echo "table domainderts altered to InnoDB"
+
+
+ALTER TABLE `domains` ENGINE=INNODB;
+system echo "table domains altered to InnoDB"
+
+
+ALTER TABLE `domlink` ENGINE=INNODB;
+system echo "table domlink altered to InnoDB"
+
+
+ALTER TABLE `email` ENGINE=INNODB;
+system echo "table email altered to InnoDB"
+
+
+ALTER TABLE `emailcerts` ENGINE=INNODB;
+system echo "table emailcerts altered to InnoDB"
+
+
+ALTER TABLE `emaillink` ENGINE=INNODB;
+system echo "table emaillink altered to InnoDB"
+
+
+ALTER TABLE `gpg` ENGINE=INNODB;
+system echo "table gpg altered to InnoDB"
+
+
+ALTER TABLE `languages` ENGINE=INNODB;
+system echo "table languages altered to InnoDB"
+
+
+ALTER TABLE `localias` ENGINE=INNODB;
+system echo "table localias altered to InnoDB"
+
+
+ALTER TABLE `locations` ENGINE=INNODB;
+system echo "table locations altered to InnoDB"
+
+
+ALTER TABLE `news` ENGINE=INNODB;
+system echo "table news altered to InnoDB"
+
+
+ALTER TABLE `notary` ENGINE=INNODB;
+system echo "table notary altered to InnoDB"
+
+
+ALTER TABLE `org` ENGINE=INNODB;
+system echo "table org altered to InnoDB"
+
+
+ALTER TABLE `orgadminlog` ENGINE=INNODB;
+system echo "table orgadminlog altered to InnoDB"
+
+
+ALTER TABLE `orgdomaincerts` ENGINE=INNODB;
+system echo "table orgdomaincerts altered to InnoDB"
+
+
+ALTER TABLE `orgdomains` ENGINE=INNODB;
+system echo "table orgdomains altered to InnoDB"
+
+
+ALTER TABLE `orgdomlink` ENGINE=INNODB;
+system echo "table orgdomlink altered to InnoDB"
+
+
+ALTER TABLE `orgemailcerts` ENGINE=INNODB;
+system echo "table orgemailcerts altered to InnoDB"
+
+
+ALTER TABLE `orgemaillink` ENGINE=INNODB;
+system echo "table orgemaillink altered to InnoDB"
+
+
+ALTER TABLE `orginfo` ENGINE=INNODB;
+system echo "table orginfo altered to InnoDB"
+
+
+ALTER TABLE `otphashes` ENGINE=INNODB;
+system echo "table otphashes altered to InnoDB"
+
+
+ALTER TABLE `pinglog` ENGINE=INNODB;
+system echo "table pinglog altered to InnoDB"
+
+
+ALTER TABLE `regions` ENGINE=INNODB;
+system echo "table regions altered to InnoDB"
+
+
+ALTER TABLE `root_certs` ENGINE=INNODB;
+system echo "table root_certs altered to InnoDB"
+
+
+ALTER TABLE `schema_version` ENGINE=INNODB;
+system echo "table schema_version altered to InnoDB"
+
+
+ALTER TABLE `stampcache` ENGINE=INNODB;
+system echo "table stampcache altered to InnoDB"
+
+
+ALTER TABLE `statscache` ENGINE=INNODB;
+system echo "table statscache altered to InnoDB"
+
+
+ALTER TABLE `tickets` ENGINE=INNODB;
+system echo "table tickets altered to InnoDB"
+
+
+ALTER TABLE `tverify` ENGINE=INNODB;
+system echo "table tverify altered to InnoDB"
+
+
+ALTER TABLE `tverify-vote` ENGINE=INNODB;
+system echo "table tverify-vote altered to InnoDB"
+
+
+ALTER TABLE `user_agreements` ENGINE=INNODB;
+system echo "table user_agreements altered to InnoDB"
+
+
+ALTER TABLE `userlocations` ENGINE=INNODB;
+system echo "table userlocations altered to InnoDB"
+
+
+ALTER TABLE `users` ENGINE=INNODB;
+system echo "table users altered to InnoDB"
+
+
+ -- Update schema version number
+ INSERT INTO `schema_version`
+ (`version`, `when`) VALUES
+ ('5' , NOW() );
+SQL
+
+
+echo "Database successfully migrated to version 5"
+exit 0
+
diff --git a/scripts/gpgfillmissingemail.php b/scripts/gpgfillmissingemail.php
index f328876..39f9d8f 100644
--- a/scripts/gpgfillmissingemail.php
+++ b/scripts/gpgfillmissingemail.php
@@ -18,7 +18,7 @@
require_once("../includes/mysql.php"); //general.php");
//include "../includes/general.php";
-function hex2bin($data)
+function gpg_hex2bin($data)
{
while(strstr($data, "\\x"))
{
@@ -69,7 +69,7 @@ echo "Found:\n";
if (preg_match("/<([\w.-]*\@[\w.-]*)>/", $bits[9],$match))
{
//echo "Found: ".$match[1];
- $mail = trim(hex2bin($match[1]));
+ $mail = trim(gpg_hex2bin($match[1]));
echo "EMail: *$mail**\n";
diff --git a/scripts/scanforexponents.php b/scripts/scanforexponents.php
index 7136723..388fe1e 100755
--- a/scripts/scanforexponents.php
+++ b/scripts/scanforexponents.php
@@ -29,10 +29,11 @@
if(!is_file($file))
continue;
+ $file_esc = escapeshellarg($file);
if(substr($file, -3) == "der")
- $do = trim(`openssl x509 -inform der -in $file -text -noout 2>&1 |grep 'Exponent'`);
+ $do = trim(`openssl x509 -inform der -in $file_esc -text -noout 2>&1 |grep 'Exponent'`);
else
- $do = trim(`openssl x509 -in $file -text -noout 2>&1 |grep 'Exponent'`);
+ $do = trim(`openssl x509 -in $file_esc -text -noout 2>&1 |grep 'Exponent'`);
if($do == "")
continue;
diff --git a/scripts/send_heartbleed.php b/scripts/send_heartbleed.php
new file mode 100755
index 0000000..6bf0f5f
--- /dev/null
+++ b/scripts/send_heartbleed.php
@@ -0,0 +1,248 @@
+#!/usr/bin/php -q
+<?php
+/*
+ LibreSSL - CAcert web application
+ Copyright (C) 2004-2009 CAcert Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+*/
+include_once("../includes/mysql.php");
+
+// read texts
+
+$lines_EN = <<<EOF
+
+there are news [1] about a bug in OpenSSL that may allow an attacker to leak arbitrary information from any process using OpenSSL. [2]
+
+We contacted you, because you have subscribed to get general announcements, or you have had a server certificate since the bug was introduced into the OpenSSL releases and are especially likely to be affected by it.
+
+CAcert is not responsible for this issue. But we want to inform members about it, who are especially likely to be vulnerable or otherwise affected.
+
+
+Good news:
+==========
+Certificates issued by CAcert are not broken and our central systems did not leak your keys.
+
+
+Bad news:
+=========
+Even then you may be affected.
+
+Although your keys were not leaked by CAcert your keys on your own systems might have been compromised if you were or are running a vulnerable version of OpenSSL.
+
+
+To elaborate on this:
+=====================
+The central systems of CAcert and our root certificates are not affected by this issue. Regrettably some of our infrastructure systems were affected by the bug. We are working to fix them and already completed work for the most critical ones. If you logged into those systems, within the last two years, (see list in the blog post) you might be affected!
+
+But unfortunately given the nature of this bug we have to assume that the certificates of our members may be affected, if they were used in an environment with a publicly accessible OpenSSL connection (e.g. Apache web server, mail server, Jabber server, ...). The bug has been open in OpenSSL for two years - from December 2011 and was introduced in stable releases starting with OpenSSL 1.0.1.
+
+When an attacker can reach a vulnerable service he can abuse the TLS heartbeat extension to retrieve arbitrary chunks of memory by exploiting a missing bounds check. This can lead to disclosure of your private keys, resident session keys and other key material as well as all volatile memory contents of the server process like passwords, transmitted user data (e.g. web content) as well as other potentially confidential information.
+
+Exploiting this bug does not leave any noticeable traces, thus for any system which is (or has been) running a vulnerable version of OpenSSL you must assume that at least your used server keys are compromised and therefore must be replaced by newly generated ones. Simply renewing existing certificates is not sufficient! - Please generate NEW keys with at least 2048 bit RSA or stronger!
+
+As mentioned above this bug can be used to leak passwords and thus you should consider changing your login credentials to potentially compromised systems as well as any other system where those credentials might have been used as soon as possible.
+
+An (incomplete) list of commonly used software which include or link to OpenSSL can be found at [5].
+
+
+What to do?
+===========
+- Ensure that you upgrade your system to a fixed OpenSSL version (1.0.1g or above).
+- Only then create new keys for your certificates.
+- Revoke all certificates, which may be affected.
+- Check what services you have used that may have been affected within the last two years.
+- Wait until you think that those environments got fixed.
+- Then (and only then) change your credentials for those services. If you do it too early, i.e. before the sites got fixed, your data may be leaked, again. So be careful when you do this.
+
+
+CAcert's response to the bug:
+=============================
+- We updated most of the affected infrastructure systems and created new certificates for them. The remaining will follow, soon.
+- We used this opportunity to upgrade to 4096 bit RSA keys signed with SHA-512. The new fingerprints can be found in the list in the blog post. ;-)
+- With this email we contact all members, who had active server certificates within the last two years.
+- We will keep you updated, in the blog.
+
+A list of affected and fixed infrastructure systems and new information can be found at:
+
+https://blog.cacert.org/2014/04/openssl-heartbleed-bug/
+
+
+Links:
+[1] http://heartbleed.com/
+[2] https://www.openssl.org/news/secadv_20140407.txt
+[3] https://security-tracker.debian.org/tracker/CVE-2014-0160
+[4] http://www.golem.de/news/sicherheitsluecke-keys-auslesen-mit-openssl-1404-105685.html
+[5] https://www.openssl.org/related/apps.html
+EOF;
+
+$lines_EN = wordwrap($lines_EN, 75, "\n");
+$lines_EN = mb_convert_encoding($lines_EN, "HTML-ENTITIES", "UTF-8");
+
+
+$lines_DE = <<<EOF
+---
+German Translation / Deutsche Übersetzung:
+
+
+Liebes CAcert-Mitglied,
+
+es wurde ein Bug in OpenSSL gefunden [4], der es einem Angreifer erlaubt beliebige Informationen jedes Prozesses zu erlangen, der OpenSSL nutzt. [2]
+
+Wir schicken diese Mail an alle Mitglieder, die entweder die "Allgemeinen Ankündigungen" abonniert haben, oder von dem Bug besonders betroffen sein können, da sie Server-Zertifikate in der Zeit besessen haben, seitdem der Bug in die Releases von OpenSSL integriert wurde.
+
+Diese Gefahr geht nicht von CAcert aus, wir möchten aber gefährdete Mitglieder entsprechend informieren.
+
+
+Die gute Nachricht:
+===================
+Die von CAcert ausgestellten Zertifikate sind nicht kaputt und unsere zentralen Systeme waren auch nicht angreifbar und haben auch keine Schlüssel verraten.
+
+
+Die schlechte Nachricht:
+========================
+Dennoch kann jeder betroffen sein!
+
+Auch wenn keine Schlüssel durch CAcert preisgegeben wurden, können sie dennoch später kompromittiert worden sein, wenn auf Ihren Systemen eine angreifbaren Version von OpenSSL lief und die Schlüssel dort verwendet wurden.
+
+
+Um ins Detail zu gehen:
+=======================
+Die zentralen Systeme und die Stammzertifikate von CAcert sind von diesem Problem nicht betroffen. Leider sind einige unserer Infrastruktur-Systeme durch den Fehler betroffen. Wir arbeiten daran diese zu beheben und haben dies auch schon für die meisten erledigt. Jeder, der sich auf diese Systeme in den letzten zwei Jahren eingeloggt hat kann betroffen sein!
+
+Aufgrund der Art des Fehlers, müssen wir leider davon ausgehen, dass die Zertifikate unserer Mitglieder betroffen sind, wenn sie sich in eine Umgebung eingeloggt haben, die über öffentliche OpenSSL-Verbindungen zugänglich war (z.B. Apache Webserver, Mail-Server, Jabber-Server, ...). Dieser Fehler war zwei Jahre lang in OpenSSL - seit Dezember 2011 - und kam beginnend mit Version 1.0.1 in die stabilen Versionen.
+
+Angreifer, die einen verwundbaren Service erreichen können, können die TLS-Erweiterung "heartbeat" ausnutzen, um beliebige Speicherbereiche zu auslesen, indem sie eine fehlende Bereichsprüfung ausnutzen. Das kann zur Offenlegung von privaten Schlüsseln, im Speicher abgelegten Sitzungsschlüsseln, sonstige Schlüssel genauso wie jeglicher weiterer Speicherinhalt des Server-Prozesses wie Passwörter oder übermittelte Benutzerdaten (z.B. Webinhalte) oder anderer vertrauliche Informationen führen.
+
+Die Ausnutzung dieses Fehlers hinterlässt keine merklichen Spuren. Daher muss für jedes System, auf dem eine angreifbare Version von OpenSSL läuft (oder lief), angenommen werden, dass zumindest die verwendeten Server-Zertifikate kompromittiert sind und deswegen durch NEU generierte ersetzt werden müssen. Einfach die alten Zertifikate zu erneuern, reicht nicht aus! - Bitte NEUE Schlüssel mit 2048 Bit RSA oder stärker generieren!
+
+Wie oben erwähnt kann dieser Fehler ausgenutzt werden, um Passwörter zu entwenden. Daher sollte jeder überlegen, alle Zugangsdaten zu möglicherweise betroffenen Systemen und allen Systemen bei denen diese sonst noch verwendet worden sein könnten, so bald wie möglich auszutauschen.
+
+Eine (unvollständige) Liste an weit verbreiteter Software die OpenSSL verwendet kann z.B. unter folgendem Link gefunden werden. [5]
+
+
+Was ist zu tun?
+===============
+- Als erstes müssen die eigenen Systeme auf eine fehlerbereinigte Version von OpenSSL aktualisiert werden (Version 1.0.1g oder neuer).
+- Danach neue Schlüssel für die Zertifikate erstellen. Jetzt ist es sicher das zu tun.
+- Alle möglicherweise betroffenen Zertifikate widerrufen.
+- Überprüfen, welche fremden Dienste in den letzten zwei Jahren besucht worden sind.
+- Warten, bis dort wahrscheinlich der Fehler behoben wurde.
+- Dann (und erst dann) die Login-Daten für diese Dienste erneuern. Vorsicht: Wenn das zu früh getan wird, also wenn der Dienst noch nicht bereinigt wurde, können die Daten wieder abgegriffen werden.
+
+
+CAcerts Maßnahmen als Antwort auf den Bug:
+==========================================
+- Wir haben so gut wie alle Infrastruktur-Systeme auf den neuesten OpenSSL-Stand gebracht und für diese neue Zertifikate zu generiert, die restlichen folgen so schnell wie möglich.
+- Wir haben die Gelegenheit genutzt, um dabei auf 4096 Bit RSA-Schlüssel, die mit SHA-512 signiert sind, aufzurüsten.
+- Mit dieser E-Mail kontaktieren wir alle Mitglieder, die in den letzten zwei Jahren aktive Server-Zertifikate hatten.
+- Wir werden neue Informationen im Blog veröffentlichen.
+
+Eine Liste der betroffenen und reparierten Infrastruktur-Systeme befindet sich unter:
+
+https://blog.cacert.org/2014/04/openssl-heartbleed-bug/
+
+Links:
+[1] http://heartbleed.com/
+[2] https://www.openssl.org/news/secadv_20140407.txt
+[3] https://security-tracker.debian.org/tracker/CVE-2014-0160
+[4] http://www.golem.de/news/sicherheitsluecke-keys-auslesen-mit-openssl-1404-105685.html
+[5] https://www.openssl.org/related/apps.html
+EOF;
+
+$lines_DE = wordwrap($lines_DE, 75, "\n");
+$lines_DE = mb_convert_encoding($lines_DE, "HTML-ENTITIES", "UTF-8");
+
+
+// read last used id
+$lastid = 0;
+if (file_exists("send_heartbleed_lastid.txt"))
+{
+ $fp = fopen("send_heartbleed_lastid.txt", "r");
+ $lastid = trim(fgets($fp, 4096));
+ fclose($fp);
+}
+
+echo "ID now: $lastid\n";
+
+
+$count = 0;
+
+$query = "
+ (
+ select u.`id`, u.`fname`, u.`lname`, u.`email`, u.`language`
+ from `users` as u, `alerts` as a
+ where u.`deleted` = 0 and u.`id` > '$lastid'
+ and a.`memid` = u.`id`
+ and a.`general` = 1
+ )
+ union distinct
+ (
+ select u.`id`, u.`fname`, u.`lname`, u.`email`, u.`language`
+ from `users` as u, `domains` as d, `domaincerts` as dc
+ where u.`deleted` = 0 and u.`id` > '$lastid'
+ and dc.`domid` = d.`id` and d.`memid` = u.`id`
+ and dc.`expire` >= '2011-12-01'
+ )
+ union distinct
+ (
+ select u.`id`, u.`fname`, u.`lname`, u.`email`, u.`language`
+ from `users` as u, `domains` as d, `domlink` as dl, `domaincerts` as dc
+ where u.`deleted` = 0 and u.`id` > '$lastid'
+ and dc.`id` = dl.`certid` and dl.`domid` = d.`id` and d.`memid` = u.`id`
+ and dc.`expire` >= '2011-12-01'
+ )
+ union distinct
+ (
+ select u.`id`, u.`fname`, u.`lname`, u.`email`, u.`language`
+ from `users` as u, `org` as o, `orgdomaincerts` as dc
+ where u.`deleted` = 0 and u.`id` > '$lastid'
+ and dc.`orgid` = o.`orgid` and o.`memid` = u.`id`
+ and dc.`expire` >= '2011-12-01'
+ )
+ union distinct
+ (
+ select u.`id`, u.`fname`, u.`lname`, u.`email`, u.`language`
+ from `users` as u, `org` as o, `orgdomains` as d, `orgdomlink` as dl, `orgdomaincerts` as dc
+ where u.`deleted` = 0 and u.`id` > '$lastid'
+ and dc.`id` = dl.`orgcertid` and dl.`orgdomid` = d.`id`
+ and d.`orgid` = o.`orgid` and o.`memid` = u.`id`
+ and dc.`expire` >= '2011-12-01'
+ )
+ order by `id`";
+
+$res = mysql_query($query);
+
+while($row = mysql_fetch_assoc($res))
+{
+ $mailtxt = "Dear ${row["fname"]} ${row["lname"]},\n".$lines_EN."\n\n";
+ switch ($row["language"])
+ {
+ case "de_DE":
+ case "de":
+ $mailtxt .= $lines_DE;
+ break;
+ }
+
+ sendmail($row['email'], "[CAcert.org] Information about Heartbleed bug in OpenSSL 1.0.1 up to 1.0.1f", $mailtxt, "support@cacert.org", "", "", "CAcert", "returns@cacert.org", "");
+
+ $fp = fopen("send_heartbleed_lastid.txt", "w");
+ fputs($fp, $row["id"]."\n");
+ fclose($fp);
+
+ $count++;
+ echo "Sent ${count}th mail. User ID: ${row["id"]}\n";
+
+ sleep (1);
+}
diff --git a/stamp/common.php b/stamp/common.php
index ff814dd..d99a23a 100644
--- a/stamp/common.php
+++ b/stamp/common.php
@@ -41,9 +41,9 @@
if($row['certid'] > 0)
{
if($row['org'] == 0)
- $query = "select * from `domaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0";
+ $query = "select * from `domaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0";
else
- $query = "select * from `orgdomaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0";
+ $query = "select * from `orgdomaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0";
if($_REQUEST['debug'] == 1)
echo $query."<br>\n";
$res = mysql_query($query);
@@ -117,7 +117,7 @@
if($org == 0)
{
$query = "SELECT *, sum(`points`) AS `total` FROM `users`, `notary` WHERE `users`.`id` = '$cert[memid]' AND
- `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' GROUP BY `notary`.`to`";
+ `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' and `notary`.`deleted`=0 GROUP BY `notary`.`to`";
$user = mysql_fetch_assoc(mysql_query($query));
} else {
$query = "select * from `orginfo` where `id`='$cert[orgid]'";
diff --git a/tverify/index.php b/tverify/index.php
index 8976341..d3a0fd5 100644
--- a/tverify/index.php
+++ b/tverify/index.php
@@ -49,10 +49,10 @@
if($id == 1)
{
- $email = mysql_escape_string(trim($_REQUEST["email"]));
- $password = mysql_escape_string(stripslashes(trim($_REQUEST["pword"])));
- $URL = mysql_escape_string(trim($_REQUEST["notaryURL"]));
- $CN = mysql_escape_string($_SESSION['_config']['CN']);
+ $email = mysql_real_escape_string(trim($_REQUEST["email"]));
+ $password = mysql_real_escape_string(stripslashes(trim($_REQUEST["pword"])));
+ $URL = mysql_real_escape_string(trim($_REQUEST["notaryURL"]));
+ $CN = mysql_real_escape_string($_SESSION['_config']['CN']);
$memid = intval($_SESSION['_config']['uid']);
$user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$memid'"));
$tmp = mysql_fetch_assoc(mysql_query("select sum(`points`) as `points` from `notary` where `to`='$memid'"));
@@ -99,7 +99,7 @@
if($nofile == 0)
{
$filename = $photoid['tmp_name'];
- $newfile = mysql_escape_string('/www/photoid/'.$tverify.".".$ext);
+ $newfile = mysql_real_escape_string('/www/photoid/'.$tverify.".".$ext);
move_uploaded_file($filename, $newfile);
$query = "update `tverify` set `photoid`='$newfile' where `id`='$tverify'";
mysql_query($query);
diff --git a/www/.gitignore b/www/.gitignore
new file mode 100644
index 0000000..faca589
--- /dev/null
+++ b/www/.gitignore
@@ -0,0 +1,5 @@
+# Ignore CRLs autogenerated by the CommModule
+/class3-revoke.crl
+/class3-revoke.crl.patch
+/revoke.crl
+/revoke.crl.patch
diff --git a/www/.htaccess b/www/.htaccess
index bd01047..cc48170 100644
--- a/www/.htaccess
+++ b/www/.htaccess
@@ -4,4 +4,4 @@ errordocument 404 /error404.php
errordocument 403 /error403.php
errordocument 401 /error401.php
-RedirectPermanent /cps.php http://www.cacert.org/policy/CertificationPracticeStatement.php
+RedirectPermanent /cps.php http://www.cacert.org/policy/CertificationPracticeStatement.html
diff --git a/www/alert_hash_collision.php b/www/alert_hash_collision.php
index bad60e8..f5eaa9c 100644
--- a/www/alert_hash_collision.php
+++ b/www/alert_hash_collision.php
@@ -14,13 +14,13 @@ if (!preg_match('/^(mem|org)-[0-9]+$/', @$_POST['usernym']))
if (preg_match('/^mem-[0-9]+$/', @$_POST['usernym']))
{
- mysql_query("update emailcerts set coll_found=1 where memid='".mysql_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
- mysql_query("update domaincerts set coll_found=1 where memid='".mysql_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+ mysql_query("update emailcerts set coll_found=1 where memid='".mysql_real_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+ mysql_query("update domaincerts set coll_found=1 where memid='".mysql_real_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
}
else
{
- mysql_query("update orgemailcerts set coll_found=1 where memid='".mysql_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
- mysql_query("update orgdomaincerts set coll_found=1 where memid='".mysql_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+ mysql_query("update orgemailcerts set coll_found=1 where memid='".mysql_real_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
+ mysql_query("update orgdomaincerts set coll_found=1 where memid='".mysql_real_escape_string(substr(@$_POST['usernym'],4))."' and pkhash!='' and pkhash='".$_POST['pkhash']."';");
}
//exec(REPORT_WEAK . ' ' . $_POST['usernym'] . ' ' . lower($_POST['pkhash']));
diff --git a/www/api/ccsr.php b/www/api/ccsr.php
index 7efdf8d..3bfe55a 100644
--- a/www/api/ccsr.php
+++ b/www/api/ccsr.php
@@ -31,7 +31,7 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($_REQUEST['email'] as $email)
{
$email = mysql_real_escape_string(trim($email));
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0 and `email`='$email'";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0 and `email`='$email'";
$res = mysql_query($query);
if(mysql_num_rows($res) > 0)
{
@@ -42,7 +42,7 @@ require_once '../../includes/lib/check_weak_key.php';
}
if(count($emails) <= 0)
die("404,Wasn't able to match any emails sent against your account");
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
@@ -62,18 +62,20 @@ require_once '../../includes/lib/check_weak_key.php';
$codesign = 1;
$CSR = trim($_REQUEST['optionalCSR']);
-
+
if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
{
die("403, $weakKey");
}
-
+
$incsr = tempnam("/tmp", "ccsrIn");
$checkedcsr = tempnam("/tmp", "ccsrOut");
$fp = fopen($incsr, "w");
fputs($fp, $CSR);
fclose($fp);
- $do = `/usr/bin/openssl req -in $incsr -out $checkedcsr`;
+ $incsr_esc = escapeshellarg($incsr);
+ $checkedcsr_esc = escapeshellarg($checkedcsr);
+ $do = shell_exec("/usr/bin/openssl req -in $incsr_esc -out $checkedcsr_esc");
@unlink($incsr);
if(filesize($checkedcsr) <= 0)
die("404,Invalid or missing CSR");
@@ -82,9 +84,9 @@ require_once '../../includes/lib/check_weak_key.php';
foreach($emails as $id => $email)
$csrsubject .= "/emailAddress=".$email;
- $query = "insert into `emailcerts` set `CN`='".$user['email']."', `keytype`='MS',
- `memid`='".$user['id']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
- `subject`='$csrsubject', `codesign`='$codesign'";
+ $query = "insert into `emailcerts` set `CN`='".mysql_real_escape_string($user['email'])."', `keytype`='MS',
+ `memid`='".intval($user['id'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
+ `subject`='".mysql_real_escape_string($csrsubject)."', `codesign`='".intval($codesign)."'";
mysql_query($query);
$certid = mysql_insert_id();
$CSRname = generatecertpath("csr","client",$certid);
@@ -93,14 +95,14 @@ require_once '../../includes/lib/check_weak_key.php';
mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='$certid'");
foreach($emails as $emailid => $email)
- mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='$emailid'");
+ mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='".intval($emailid)."'");
- $do = `../../scripts/runclient`;
+ $do = shell_exec("../../scripts/runclient");
sleep(10); // THIS IS BROKEN AND SHOULD BE FIXED
$query = "select * from `emailcerts` where `id`='$certid' and `crt_name` != ''";
$res = mysql_query($query);
if(mysql_num_rows($res) <= 0)
- die("404,Your certificate request has failed. ID: $certid");
+ die("404,Your certificate request has failed. ID: ".intval($certid));
$cert = mysql_fetch_assoc($res);
echo "200,Authentication Ok\n";
readfile("../".$cert['crt_name']);
diff --git a/www/api/cemails.php b/www/api/cemails.php
index 0d067ea..6fceb04 100644
--- a/www/api/cemails.php
+++ b/www/api/cemails.php
@@ -15,8 +15,8 @@
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
- $username = mysql_escape_string($_REQUEST['username']);
- $password = mysql_escape_string($_REQUEST['password']);
+ $username = mysql_real_escape_string($_REQUEST['username']);
+ $password = mysql_real_escape_string($_REQUEST['password']);
$query = "select * from `users` where `email`='$username' and (`password`=old_password('$password') or `password`=sha1('$password'))";
$res = mysql_query($query);
@@ -25,7 +25,7 @@
echo "200,Authentication Ok\n";
$user = mysql_fetch_assoc($res);
$memid = $user['id'];
- $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`";
+ $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`";
$row = mysql_fetch_assoc(mysql_query($query));
$points = $row['points'];
echo "CS=".intval($user['codesign'])."\n";
@@ -40,8 +40,9 @@
if($user['mname'] != "" && $user['suffix'] != "")
echo "NAME=".sanitizeHTML($user['fname'])." ".sanitizeHTML($user['mname'])." ".sanitizeHTML($user['lname'])." ".sanitizeHTML($user['suffix'])."\n";
}
- $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0";
+ $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0";
$res = mysql_query($query);
- while($row = mysql_fetch_assoc($res))
- echo "EMAIL=".$row['email']."\n";
+ while($row = mysql_fetch_assoc($res)) {
+ echo "EMAIL=".sanitizeHTML($row['email'])."\n";
+ }
?>
diff --git a/www/api/edu.php b/www/api/edu.php
index 27b7b1b..80a4e79 100644
--- a/www/api/edu.php
+++ b/www/api/edu.php
@@ -20,7 +20,7 @@
if ($ipadress=='72.36.220.19' && $_SERVER['HTTPS']=="on")
{
- $serial=mysql_escape_string($_REQUEST["serial"]);
+ $serial=mysql_real_escape_string($_REQUEST["serial"]);
$root=intval($_REQUEST["root"]);
$sql="select memid from emailcerts where serial='$serial' and rootcert='$root'";
diff --git a/www/cacert1-class3-revoke.crl b/www/cacert1-class3-revoke.crl
new file mode 120000
index 0000000..3bcd255
--- /dev/null
+++ b/www/cacert1-class3-revoke.crl
@@ -0,0 +1 @@
+class3-revoke.crl \ No newline at end of file
diff --git a/www/cacert1-revoke.crl b/www/cacert1-revoke.crl
new file mode 120000
index 0000000..e7b822f
--- /dev/null
+++ b/www/cacert1-revoke.crl
@@ -0,0 +1 @@
+revoke.crl \ No newline at end of file
diff --git a/www/cap.html.php b/www/cap.html.php
index cc3fad6..8e5fe01 100644
--- a/www/cap.html.php
+++ b/www/cap.html.php
@@ -146,7 +146,7 @@
echo '<tbody>', "\n";
echo '<tr>', "\n";
echo ' <td colspan="3">'._("Make sure you have read and agreed with the CAcert Community Agreement");
- echo '(<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php">CCA</a>)<br>', "\n";
+ echo '(<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.html">CCA</a>)<br>', "\n";
echo '</td>', " \n", '</tr>', "\n";
/*
echo '</tbody>', "\n";
@@ -158,7 +158,7 @@
echo '</td>', "\n".'</tr>', "\n";
echo '<tr>', "\n". ' <td colspan="3"><input type="checkbox" checked name="checked" value="2"> ';
echo _("I agree to the CAcert Community Agreement.").' (';
- echo '<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php">CCA</a>)</dd>', "\n";
+ echo '<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.html">CCA</a>)</dd>', "\n";
echo '</td>', "\n".'</tr>', "\n";
/*
echo '</tbody>', "\n";
diff --git a/www/cap.php b/www/cap.php
index dc283fb..40b269a 100644
--- a/www/cap.php
+++ b/www/cap.php
@@ -146,7 +146,7 @@
$this->SetFont("Arial", "", "9");
if($_SESSION['_config']['language'] == "ja")
$this->SetFont('SJIS','',9);
- $this->MultiCell($this->w - 29, 3, recode($_SESSION['_config']['recode'], _("I agree to the CAcert Community Agreement.")." ( http://www.cacert.org/policy/CAcertCommunityAgreement.php )"));
+ $this->MultiCell($this->w - 29, 3, recode($_SESSION['_config']['recode'], _("I agree to the CAcert Community Agreement.")." ( http://www.cacert.org/policy/CAcertCommunityAgreement.html )"));
// new da end
$this->SetXY(13, $top + 55); //45->55
$this->Write(0, recode($_SESSION['_config']['recode'], _("Applicant's signature")).": __________________________________");
@@ -265,7 +265,7 @@
$this->Write(0, str_pad($date, 13, " "));
}
- }
+ }
}
$format = array_key_exists('format',$_REQUEST)?$_REQUEST['format']:"";
@@ -283,7 +283,7 @@
$pdf->AddPage();
$pdf->Body(array_key_exists('name',$_REQUEST)?$_REQUEST['name']:"", array_key_exists('dob',$_REQUEST)?$_REQUEST['dob']:"", array_key_exists('email',$_REQUEST)?$_REQUEST['email']:"", array_key_exists('assurer',$_REQUEST)?$_REQUEST['assurer']:"", array_key_exists('date',$_REQUEST)?$_REQUEST['date']:"", $maxpoints, array_key_exists('document1',$_REQUEST)?$_REQUEST['document1']:"", array_key_exists('document2',$_REQUEST)?$_REQUEST['document2']:"", array_key_exists('location',$_REQUEST)?$_REQUEST['location']:"");
header("Expires: ".gmdate("D, j M Y G:i:s \G\M\T", time()+10800));
- header("Content-Disposition: attachment; filename=cap.pdf");
+ header("Content-Disposition: attachment; filename=cap.pdf");
header("Cache-Control: public, max-age=10800");
header("Pragma: cache");
$pdf->output();
diff --git a/www/capnew.php b/www/capnew.php
index 41a0894..273b0e6 100644
--- a/www/capnew.php
+++ b/www/capnew.php
@@ -68,7 +68,7 @@ define('REV', '$Revision: 1.4 $');
** On transliteration and abbreviation of a name:
** if shoes a std way show accepted conversion as pdf comment
** Orientation: on landscape (dflt) print 2-up
-** PDF URL links are used to web, wiki, and faq for more info search
+** PDF URL links are used to web, wiki, and faq for more info search
** Only on non-ascii chars in a name the utf8 routines are loaded
** PDF reader has wiki info url's and easy email feedback
** ENABLED:
@@ -92,7 +92,7 @@ define('REV', '$Revision: 1.4 $');
** recode(), recode_string(0 is said to have too many (japanese) defeats
** recode_string() is only used on GET[] input (html->utf-8),
** UTF-8 use routines from http://www.sourceforge.net/projects/phputf8
-** which replaces php recode() package.
+** which replaces php recode() package.
** on many places own utf-8 handling code exists and is loaded (tcpdf problem)
** _() translation routine. The returned HTML string is translated to utf-8 string.
** the GET() routines expects utf-8 code (see test defs) but might be changed
@@ -196,7 +196,7 @@ define('REV', '$Revision: 1.4 $');
** Form Revision string is generated from RCS revision string.
** More info on PDF fields:
** http://www.adobe.com/devnet/acrobat/pdfs/js_developer_guide.pdf
-**
+**
*/
// use next define if you test this code
@@ -235,7 +235,7 @@ if( defined( 'TEST' ) ) {
//$_GET['orientation'] = 'portrait'; // default 2 pages, or portrait
}
$_GET['nocca'] = isset($_SERVER['CCA']) ? $_SERVER['CCA'] : '';
- //$_GET['policy1'] = 'policy/PolicyOnPolicy.php';
+ //$_GET['policy1'] = 'policy/PolicyOnPolicy.html';
if( isset($_SERVER['FORM']) AND $_SERVER['FORM'] == 'noform' )
$_GET['noform'] = 'true';
@@ -310,7 +310,7 @@ define('ARBIT', WIKI.'/ArbitrationForum');
// CAcert Community Agreement
define('CCA', 'CAcertCommunityAgreement'); // default policy to print
define('POLICY','policy/'); // default polciy doc directory
-define('EXT','.php'); // default polciy doc extention, should be html
+define('EXT','.html'); // default polciy doc extention, should be html
/* finger print CAcert Root Key */ // should obtain this automatically
define('CLASS1_SHA1','135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33');
define('CLASS3_SHA1','AD7C 3F64 FC44 39FE F4E9 0BE8 F47C 6CFA 8AAD FDCE');
@@ -484,16 +484,16 @@ class CAPPDF extends TCPDF {
//number of colums
/*protected*/ var $ncols=1;
-
+
// columns width
/*protected*/ var $colwidth=0;
// space between columns
/*protected*/ var $column_space = 0;
-
+
//Current column
/*protected*/ var $col=0;
-
+
//Ordinate of column start
/*protected*/ var $y0;
@@ -535,7 +535,7 @@ class CAPPDF extends TCPDF {
$this->SetDisplayMode(intval($this->scale), 'SinglePage', 'UseOC');
return( $format );
}
-
+
//Set position at a given column
/*private*/ function SetCol($col = -1) {
static $pagecolwidth = 1.0;
@@ -576,7 +576,7 @@ class CAPPDF extends TCPDF {
$this->myFooter(); // print footer msg if defined
}
if( $col >= $this->ncols ) {
- $this->addPage(); $col = 0;
+ $this->addPage(); $col = 0;
$this->ScaleXY($this->scale,0,0);
$this->y0 = 0; //no header/footer done...
} elseif ( $col > 0 AND $col < $this->ncols) {
@@ -599,7 +599,7 @@ class CAPPDF extends TCPDF {
$this->PrintTable('', 0); // if in table reprint title table
$this->InFooter = false;
}
-
+
//Method accepting or not automatic page break
/*public*/ function AcceptPageBreak() {
$this->SetCol();
@@ -688,7 +688,7 @@ class CAPPDF extends TCPDF {
elseif( preg_match('/\./', $nm ) ) {
if( $first_name < 0 ) $first_name = $j;
if( $first_name >= 0 ) $success = TRUE; // was abbreviated
- continue; // title
+ continue; // title
}
if( $first_name < 0 ) $first_name = $j;
if( $married == 0 ) $fam = $j;
@@ -710,7 +710,7 @@ class CAPPDF extends TCPDF {
elseif( preg_match('/\./', $nm ) ) $name .= $nm;
elseif( $j < $fam ) { // need to abbreviate
// not utf8
- // and abbreviate
+ // and abbreviate
if( $j == $first_name )
$abr = '('. $substr( $nm, 1 ) . ')';
else $abr = '.';
@@ -724,7 +724,7 @@ class CAPPDF extends TCPDF {
$nm = $tk[0];
if( $ext < 0 AND preg_match('/(^[^A-Z]|\.)/', $nm ) ) continue;
if( $ext < 0 ) $ext = $j+1;
- if( preg_match('/\./', $nm ) ) { $success = TRUE; break; }
+ if( preg_match('/\./', $nm ) ) { $success = TRUE; break; }
}
return( $success? $name : '' ); // and return abbriviated name
}
@@ -841,7 +841,7 @@ class CAPPDF extends TCPDF {
$this->StatementAssuree( $assuree['date']);
$this->StatementAssurer( $assurer, $assurance );
}
-
+
//Add form and/or CCA (on duplex only when more as one page is printed)
/*public*/ function PrintForm( $assuree = NULL, $assurer = NULL, $assurance = NULL, $page = NULL ) {
@@ -1033,7 +1033,7 @@ class CAPPDF extends TCPDF {
$this->Line($this->lMargin,$tSide+$height,$this->lMargin+$this->colwidth,$tSide+$height);
$this->Line($this->lMargin+$this->colwidth,$tSide-1, $this->lMargin+$this->colwidth, $tSide+$height);
$this->SetDrawColor(0);
- $this->SetY($tSide + $height + 1); // set Y ordinate to plus 7
+ $this->SetY($tSide + $height + 1); // set Y ordinate to plus 7
$tSide = -1; $title = '';
return($this->GetY());
}
@@ -1045,7 +1045,7 @@ class CAPPDF extends TCPDF {
$id_type = $names == NULL ? '' : $names['idtype'];
// store current margin values
static $nr = 0;
- static $idtypes = NULL;
+ static $idtypes = NULL;
static $listpoints = NULL;
static $ComboProps = array( 'fillColor'=> LBLUE, 'strokeColor'=> LLBLUE, 'editable'=> 'true', 'textSize' => 9, 'rotate'=> '0');
static $TextProps = array('strokeColor'=> LLBLUE, 'value' => ' ', 'fillColor'=> LBLUE, 'doNotScrole'=> 'false', 'textSize' => 12, 'rotate'=> '0');
@@ -1146,7 +1146,7 @@ class CAPPDF extends TCPDF {
$this->SetFont(FONT, 'B', (F_SIZE+1)/6*H);
$this->Cell($this->colwidth-37, 2, '('.$id_type .')', 0, 0, 'R');
// hide id type print on screen with the formfields, just nicety
- // one could extend the name field, but this has more drawbacks
+ // one could extend the name field, but this has more drawbacks
$this->TextField(sprintf('AssureeNames_%d_None',$nr), $this->SetFieldXY($this->lMargin+$this->colwidth-38,$savey+0.5,20), 7/6*H, $TextBlankProps);
$this->SetFieldXY();
}
@@ -1200,7 +1200,7 @@ class CAPPDF extends TCPDF {
// all (max) three names with ID type right aligned.
$cnt = $assuree['namecnt'];
$space = $this->getPageHeight()/$this->scale*100.0 -MINH ; // margin
- for( $i = 0; $i < $cnt; $i++ ) { // names to be printed
+ for( $i = 0; $i < $cnt; $i++ ) { // names to be printed
$this->PrintName( $assuree['names'][$i], $assurer['maxpoints'] < 0? 35: $assurer['maxpoints'] );
if( $space < $this->getY() ) break;
}
@@ -1390,7 +1390,7 @@ class CAPPDF extends TCPDF {
$this->SetFieldXY();
$TextProps['value'] = $assurer['email'] ? $assurer['email'] : $this->unhtmlentities( _('email') ) . '?';
$TextProps['userName'] = $this->unhtmlentities( _('On mutual assurance provide email address of Assurer.') );
- $this->TextField('AssurerEmail', $this->SetFieldXY($this->lMargin+68.5, $savey+1, 35), 5, $TextProps );
+ $this->TextField('AssurerEmail', $this->SetFieldXY($this->lMargin+68.5, $savey+1, 35), 5, $TextProps );
$this->SetFieldXY();
$this->SetXY($this->lMargin+2, $savey+5);
@@ -1457,7 +1457,7 @@ class CAPPDF extends TCPDF {
// get $form, $orientation, $assuree, $assurer, $assurance info
// FONT and BW are set already
-// import info
+// import info
function GET( $key = '' ) {
return ( array_key_exists( $key, $_GET) ? $_GET[$key] : '');
}
@@ -1532,7 +1532,7 @@ for( $i = 1; $i <= 9 AND $j < 2; $i++) { // max 9 names we only print 4 max...
$assuree[ 'namecnt' ]++;
$assuree[ 'names' ] [] = array (
'name' => $name ? $name : '',
- 'idtype' => my_recode(GET(Dstr('ID',$i)))? my_recode(GET(Dstr('ID',$i))) : '',
+ 'idtype' => my_recode(GET(Dstr('ID',$i)))? my_recode(GET(Dstr('ID',$i))) : '',
'points' => my_recode(GET(Dstr('Pnts',$i))) != '' ? intval(my_recode(GET(Dstr('Pnts',$i)))) : -1
);
if( $name != '' AND
@@ -1565,7 +1565,7 @@ unset( $document ); unset( $i ); unset( $j); // unset($_GET);
PDF_UNIT /* mm */,
/* PDF_PAGE_FORMAT */ $page['format'],
true
- );
+ );
$pdf->SetFormat( $page['format'] ); // set paper size scaling
// protection is encryption and this will cause 3.5 times performance loss
@@ -1588,10 +1588,10 @@ unset( $document ); unset( $i ); unset( $j); // unset($_GET);
$pdf->SetAutoPageBreak(TRUE, MARGIN*0.707);
//set image scale factor
- $pdf->setImageScale(PDF_IMAGE_SCALE_RATIO);
+ $pdf->setImageScale(PDF_IMAGE_SCALE_RATIO);
//set some language-dependent strings
- $pdf->setLanguageArray($l);
+ $pdf->setLanguageArray($l);
//initialize document
$pdf->AliasNbPages();
@@ -1608,6 +1608,6 @@ unset( $document ); unset( $i ); unset( $j); // unset($_GET);
$pdf->Output('CAcert CAP.pdf', 'I');
//============================================================+
-// END OF FILE
+// END OF FILE
//============================================================+
?>
diff --git a/www/cats/cats_import.php b/www/cats/cats_import.php
index feb92d4..eefbb85 100644
--- a/www/cats/cats_import.php
+++ b/www/cats/cats_import.php
@@ -31,8 +31,10 @@ function sanitize_string($buffer) {
}
define ('UNDEFINED', 'nd');
-define ('ALLOWED_IP', '213.154.225.243');
-define ('ALLOWED_IP2', '172.16.2.27');
+// Specific for testserver: Accept Test-CATS-Server
+define ('ALLOWED_IP', '192.109.159.27');
+//define ('ALLOWED_IP', '213.154.225.243');
+define ('ALLOWED_IP2', '192.109.159.28');
define ('CONFIG_FILEPATH', '/www/');
$remote_addr = (isset($_SERVER['REMOTE_ADDR']))?$_SERVER['REMOTE_ADDR']:UNDEFINED;
diff --git a/www/certs/cacert.asc b/www/certs/cacert.asc
index 120f516..e526392 100644
--- a/www/certs/cacert.asc
+++ b/www/certs/cacert.asc
@@ -1,30 +1,31 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.2.2 (GNU/Linux)
+Version: GnuPG v1.4.9 (GNU/Linux)
-mQGiBD8OdRwRBACEr0/NPA88qp8f6KyIMMveLQ1FOuLi0aDQDPybG7u1nrBoi3VI
-tSRyfYcdExVxWQjTGd9qbShzXBw2DsxjA6YjiGzWKpVcqtj9uUDpSlylBaoadUzu
-Sf3r3IkOHR2QJeC+9v2il30xy5XLMxDRbQYaSmf4uwTlIOUWNn118KpdawCgoNny
-p4DR9EvRgCmY5z6IKHA2WscD/AhAKDVHCIAoZHzSB/puNOuVUSKRbIWNAqUAYosz
-GRzYWb8O/3Ja4fNb3IMQ1gIsEcnUJFHnzID3pTjqWyiCId/NSX3fLuQxZHZE9n8P
-PqlZIvqMrOfCT0RJQa0zTFcrgepnmnHLj7qmtXQZm+YkTvlihOZNtVA4JNzrxDrQ
-egkqA/4hr0LezNJfkUhWnbW604p7AmmKK7Hi/ZixAfnxN0adgnV7oC3Q4VM8aB2i
-gReSuifluHiaJmf/WsA3KH4bdyLRbagz6dOPkXY8bQKy9yRxQz9oYwudlluYoZXe
-gSQI2Jle9U2ENefa9ouvVlsB0he1qzF6VzHXAXpLsANt5smDh7Q0Q0EgQ2VydCBT
-aWduaW5nIEF1dGhvcml0eSAoUm9vdCBDQSkgPGdwZ0BjYWNlcnQub3JnPohfBBMR
-AgAfBQI/DnUcBQk4ZAkABAsHAwIDFQIDAxYCAQIeAQIXgAAKCRDSuw0BZdD9WEFX
-AJ9C6WBcYfTYw1uvZ+N85TPGG5PMKQCcCM1tyULC5J6pfwevywS6cEwfagW5Ag0E
-Pw51MBAIANUbl1u0j+mnVJk1fKbJ+Ul6SAYpNtordfgrgrmlnOhMCFcROrCzsaaI
-1ehohxMbTnIj0RP0g/KotahAurqB98qzHIxXZMEJSzBE2OCNvlIXqUyT1jwhAUN6
-e71s084Lml84gD4cIr7+2YtwIu+6zrE+YdjfMT1NibM3vmiXaknrk4aADb02ZS5U
-iDeRstUO5PG7qVg4umR0HZJ1Ck2U7Kdjaekzzlm0q/vYMZKTYX37NkZRUU0QFLsM
-tACEaZnwKf9hMAWJwG1OFyJeLVH8xvzCkI4I+fpAvAQj6LVAh41SHl7EivH6SiTp
-/+61idoz/CGqeLBxuex6Z+Y53U54FmcAAwUH/2chzBs1YWFX5LuLGEW3R3UW/wDb
-RnYpsSR+pnMBVh18WS0nF08R/SXtb12RsqN5H+GtELOZng6IWL5hhgNaYvF1F4sW
-Ezm2nyVmTsu7/DtHLmXtzz1oNLQ9pzJkoqP2pGtPYQKvmiuoNbt+l1prwjt5zn1D
-slLn8w0+9/PP1YdKpuZ/189yQP6iYsLHxBxg/50MbSzoFwiT22aJCdF+OJ7zRwDy
-GhjnfV7HVwdEDV5rvb7aRolRmZZF2UADSPu52BWT4PI0nVnewAgivyELqVU3Zc3P
-aWqmH5BAh22MjbsbXrWZXK/WOfZCNlPVdfHxwFGxnlwsHgmyrkPAs3szJGiITAQY
-EQIADAUCPw51MAUJOGQJAAAKCRDSuw0BZdD9WMw8AJwIVUzB2WQJGAbf/aXzCABn
-QWdKwACdEWUSf69RZiJgp4oMfXMx0fDEh2I=
-=OaPO
+mQGiBE3TAtQRBACuFhUNT3BOIXflZx8ENFN2hf0KHDgReWMW5+hcx8M2C9mueAST
+89x0QxtdWUbsrMFSr3UvDIKjoPFVzV+WT/dez5aADSrnR4OxYPfzcNIWPjm8su/9
+HrH6+ivaH+iOoBOuhYrHthun+1fsqLedhTMNqb+tt6OfzqIuyFkmpm+FqwCg5ECF
+s53E7j6BJuKYLeWqFDqFOH0D/1pnXyBF78YurXcwwA7eSQWoc3f1g5lwyqOWwcLv
+ynI/dcPV5BosEUcqEjaNEyBR0LFRZC7tnw2VLPzr65aLA6SrFqEJ2bEdWkO9vM5g
+8InhmcqTz7Yg/QGnyGT0iNBMG8zg4Ajz20Ty6GE887HMao6qpYKXSbujMRWVjVLn
+VjpgA/9i1gsBjpGwr5rJ67dyDLVkJ5XMEP2ivgAhzKQ/inyLk2N3Nbm0YKWgrZRE
++pEcZVsLn2jHqd5yu1zVr3Cm44HHaB/A4ew+hRio9vbhJy7cfanfZpAL8Rg8wZbQ
+t4x6zvrs0fXXNuD1BiSucOK4qGZ2vWukggmhAlHu5x5hws5qtbRLQ0FjZXJ0IFRl
+c3QgU2VydmVyIFNpZ25pbmcgQXV0aG9yaXR5IChmb3IgdGVzdGluZyBvbmx5ISEh
+KSA8Z3BnQGNhY2VydC5vcmc+iGYEExECACYFAk3TAtQCGwMFCSWYBgAGCwkIBwMC
+BBUCCAMEFgIDAQIeAQIXgAAKCRBL5zSBd/dRrLxrAJ9kaSLRAlcy9e57yuAAxoZy
+weX20ACg44B1AA26G0OePf9o3YBdUTjPsES5Ag0ETdMC1BAIAI9UEZ2NKbJfVWc+
+CBb5kKhO6qazLDnRsRkMY5WE1PTBP09ieAaQ7cv424e6fKdZxSO5vUQ27tLmcQXo
+ICoREsDuSyESvEPbyBOro5LIY+z52TihqEHLPUN7OxlbPLX81AIKOCgEIUtpcYoX
+MiwXPVO50Swo3PCCQiOQ7ewvkd32ZbSPl50B+/59JiDsQsnx1o+Ls7WkALzQ6w7T
+UxLIVYWuFd9Hg/VOXBH67e81p/O7SDy6pMkDQaA9F22rA5Vv5TBJ2BAKWYfYK47i
+HxtUhw2/WBUzhcw2AGqCnCy9nrYELLAqljnlCdWLyvhuWyUAG87D/1/5qD0+9idh
+jcFWH/MAAwUH/2R7AWSZzbomxTcO5Q7/WxzTDtgUEy7eRbjqFMAusiQlTYDdeHz8
+PfWok6mGhUapJaGnA05hy6aYBIzl4idmQgz39xD47O0qeDWve6YwrDuLYju6JIwv
+YfNiNAOjrZcRW4PCYeJfIK0WHV3+3kkneOX4Mql9QNKWs5W2LReMnHyq6POWasuf
+EgDu0TfqaJTeK3IXKrEJI8G4R4xdHXmZ16Is5T49w09mvMan+TTGczzjWn0aWD3D
+DOlTKK7h+82MSNCTiCi7aNoEyMTfeadSsrbqiaqtF0P/fyBDpGWFj3/A4foAcgtx
+KVt0UHf1Va1g8M+czG3pCOne6dyafZGAe7qITwQYEQIADwUCTdMC1AIbDAUJJZgG
+AAAKCRBL5zSBd/dRrAC5AKDdxp26zp4Km3jItBdeMD/gv8qxMgCgmmH1kizLe5Rk
+yYchS2oleEWXIqM=
+=9tD2
-----END PGP PUBLIC KEY BLOCK-----
diff --git a/www/certs/class3.crt b/www/certs/class3.crt
index 087ca0e..1899afb 100644
--- a/www/certs/class3.crt
+++ b/www/certs/class3.crt
@@ -1,42 +1,43 @@
-----BEGIN CERTIFICATE-----
-MIIHWTCCBUGgAwIBAgIDCkGKMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv
-b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ
-Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y
-dEBjYWNlcnQub3JnMB4XDTExMDUyMzE3NDgwMloXDTIxMDUyMDE3NDgwMlowVDEU
-MBIGA1UEChMLQ0FjZXJ0IEluYy4xHjAcBgNVBAsTFWh0dHA6Ly93d3cuQ0FjZXJ0
-Lm9yZzEcMBoGA1UEAxMTQ0FjZXJ0IENsYXNzIDMgUm9vdDCCAiIwDQYJKoZIhvcN
-AQEBBQADggIPADCCAgoCggIBAKtJNRFIfNImflOUz0Op3SjXQiqL84d4GVh8D57a
-iX3h++tykA10oZZkq5+gJJlz2uJVdscXe/UErEa4w75/ZI0QbCTzYZzA8pD6Ueb1
-aQFjww9W4kpCz+JEjCUoqMV5CX1GuYrz6fM0KQhF5Byfy5QEHIGoFLOYZcRD7E6C
-jQnRvapbjZLQ7N6QxX8KwuPr5jFaXnQ+lzNZ6MMDPWAzv/fRb0fEze5ig1JuLgia
-pNkVGJGmhZJHsK5I6223IeyFGmhyNav/8BBdwPSUp2rVO5J+TJAFfpPBLIukjmJ0
-FXFuC3ED6q8VOJrU0gVyb4z5K+taciX5OUbjchs+BMNkJyIQKopPWKcDrb60LhPt
-XapI19V91Cp7XPpGBFDkzA5CW4zt2/LP/JaT4NsRNlRiNDiPDGCbO5dWOK3z0luL
-oFvqTpa4fNfVoIZwQNORKbeiPK31jLvPGpKK5DR7wNhsX+kKwsOnIJpa3yxdUly6
-R9Wb7yQocDggL9V/KcCyQQNokszgnMyXS0XvOhAKq3A6mJVwrTWx6oUrpByAITGp
-rmB6gCZIALgBwJNjVSKRPFbnr9s6JfOPMVTqJouBWfmh0VMRxXudA/Z0EeBtsSw/
-LIaRmXGapneLNGDRFLQsrJ2vjBDTn8Rq+G8T/HNZ92ZCdB6K4/jc0m+YnMtHmJVA
-BfvpAgMBAAGjggINMIICCTAdBgNVHQ4EFgQUdahxYEyIE/B42Yl3tW3Fid+8sXow
-gaMGA1UdIwSBmzCBmIAUFrUyG9TH8+DmjvO90rA67rI5GNGhfaR7MHkxEDAOBgNV
-BAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAG
-A1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS
-c3VwcG9ydEBjYWNlcnQub3JnggEAMA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUH
-AQEEUTBPMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggr
-BgEFBQcwAoYcaHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBKBgNVHSAEQzBB
-MD8GCCsGAQQBgZBKMDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9y
-Zy9pbmRleC5waHA/aWQ9MTAwNAYJYIZIAYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0Fj
-ZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAwUAYJYIZIAYb4QgENBEMWQVRvIGdldCB5
-b3VyIG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSwgZ28gdG8gaHR0cDovL3d3dy5D
-QWNlcnQub3JnMA0GCSqGSIb3DQEBCwUAA4ICAQApKIWuRKm5r6R5E/CooyuXYPNc
-7uMvwfbiZqARrjY3OnYVBFPqQvX56sAV2KaC2eRhrnILKVyQQ+hBsuF32wITRHhH
-Va9Y/MyY9kW50SD42CEH/m2qc9SzxgfpCYXMO/K2viwcJdVxjDm1Luq+GIG6sJO4
-D+Pm1yaMMVpyA4RS5qb1MyJFCsgLDYq4Nm+QCaGrvdfVTi5xotSu+qdUK+s1jVq3
-VIgv7nSf7UgWyg1I0JTTrKSi9iTfkuO960NAkW4cGI5WtIIS86mTn9S8nK2cde5a
-lxuV53QtHA+wLJef+6kzOXrnAzqSjiL2jA3k2X4Ndhj3AfnvlpaiVXPAPHG0HRpW
-Q7fDCo1y/OIQCQtBzoyUoPkD/XFzS4pXM+WOdH4VAQDmzEoc53+VGS3FpQyLu7Xt
-hbNc09+4ufLKxw0BFKxwWMWMjTPUnWajGlCVI/xI4AZDEtnNp4Y5LzZyo4AQ5OHz
-0ctbGsDkgJp8E3MGT9ujayQKurMcvEp4u+XjdTilSKeiHq921F73OIZWWonO1sOn
-ebJSoMbxhbQljPI/lrMQ2Y1sVzufb4Y6GIIiNsiwkTjbKqGTqoQ/9SdlrnPVyNXT
-d+pLncdBu8fA46A/5H2kjXPmEkvfoXNzczqA6NXLji/L6hOn1kGLrPo8idck9U60
-4GGSt/M3mMS+lqO3ig==
+MIIHgjCCBWqgAwIBAgICEBswDQYJKoZIhvcNAQELBQAwgYcxCzAJBgNVBAYTAkFV
+MRgwFgYDVQQIEw9OZXcgU291dGggV2FsZXMxGjAYBgNVBAoTEUNBY2VydCBUZXN0
+c2VydmVyMSEwHwYDVQQLExhodHRwOi8vY2FjZXJ0MS5pdC1zbHMuZGUxHzAdBgNV
+BAMTFkNBY2VydCBUZXN0c2VydmVyIFJvb3QwHhcNMTEwNTAxMTgyNTA5WhcNMjEw
+NDI4MTgyNTA5WjBiMRkwFwYDVQQKExBDQWNlcnQgVGVzdHNldmVyMSEwHwYDVQQL
+ExhodHRwOi8vY2FjZXJ0MS5pdC1zbHMuZGUxIjAgBgNVBAMTGUNBY2VydCBUZXN0
+c2VydmVyIENsYXNzIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDI
+576JQukwI58zuNidaS0HUYVCBmy4mpV7VhydDtW07hDu5lYGmbcuBW+SfjPCjMMR
+QVEiNrWv3tLclBKah/ubOmgP1HenQxRfGiJkuPk7dwlM7qqPfRn/H1Pm1w1bj/e1
+yZkeNc0UzMPdRbD9InR3/hwHQ1hfLHKGbbYc6uTb+0UOgGAsMwb/WVb+8mSrgERZ
+9pFhw8uK5+BFgJwSdsTsN68h5ZDL4VIf9Zq8z8jNGcXK0DSoZ0vT0y6EyVdXiXNS
+PF/zAPTbBBQcBGmhKBlcTLwcPHLeHIEfwRGf72wqBYNNrT0J37yTci31x+xC0/iQ
+wjPD4rRhYFxm/UW9sFtEJVtIf9o/oj2Mh2FGRa0DDk0oX+jewZEnTy+MUd0k4LFy
+Md6Ucn4lJsb3uHnjZ8ayz5DEMDQ/3Mzjf6CjhOc4oXm5UXuE2gsZyno93fLtTXAc
+4w0KzMcZ2diAp5Tdpq0w3pMJUAFoehFScBRK7Kb9xuXVPxoSvGCVPNXXUsEioIlf
+T2StKvDVBPBTtWRnE0BLYTJaWQAnWp64QgWiVn+JmdGkIm4sHpB1FweN4msdkgic
+6JAlYJRp71tSjuEnJwVtgqLqpUtLPTpJ64/0lDlazCJ5NaduTpAA+MSqXlHSA/Rb
+Q1VSaKdRadqLYOUoqGFwHdldeyZpAwp0ibM62GmVrQIDAQABo4ICGjCCAhYwHQYD
+VR0OBBYEFISE4B0WSV6xxeXnzy2oVnRL6JKUMIG0BgNVHSMEgawwgamAFIXXBQrW
+j/IELV7ry/32aYsfTgb+oYGNpIGKMIGHMQswCQYDVQQGEwJBVTEYMBYGA1UECBMP
+TmV3IFNvdXRoIFdhbGVzMRowGAYDVQQKExFDQWNlcnQgVGVzdHNlcnZlcjEhMB8G
+A1UECxMYaHR0cDovL2NhY2VydDEuaXQtc2xzLmRlMR8wHQYDVQQDExZDQWNlcnQg
+VGVzdHNlcnZlciBSb290ggEAMA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUHAQEE
+UTBPMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggrBgEF
+BQcwAoYcaHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBGBgNVHSAEPzA9MDsG
+BCsGAQUwMzAxBggrBgEFBQcCARYlaHR0cDovL3d3dy5DQWNlcnQub3JnL2luZGV4
+LnBocD9pZD0xMDA0BglghkgBhvhCAQgEJxYlaHR0cDovL3d3dy5DQWNlcnQub3Jn
+L2luZGV4LnBocD9pZD0xMDBQBglghkgBhvhCAQ0EQxZBVG8gZ2V0IHlvdXIgb3du
+IGNlcnRpZmljYXRlIGZvciBGUkVFLCBnbyB0byBodHRwOi8vd3d3LkNBY2VydC5v
+cmcwDQYJKoZIhvcNAQELBQADggIBAFWedxYAhAD+hiOxIqMoynyAdMaBbmCg7zJc
+Eq6pgbP7cHL+4zzIP4Zc/tPsmbL7il3cILb0+ETwmXRnC6c9E2xWke6jv9qzQ0Aj
+QI7FQdD/0cJgKagMTn+aBgyiGG6U0zTKU7cK3Ae3zSjtdaibEJyQoQlLuEzZzDYO
+LBXJXDEInhrZ+gqWRnWDOJwdr/19alqgF8nvxKQ136vV8Lqmsrzcs0O+6v53YeVj
+9AYyeCLK2XPCyhGpia2t7uPIN1zolCgJLXQcJEg3dGRqsmAeuB7PylOz9xuxXjYR
+Sq6fcOP31CxhSeHwTqTxzkuz/u+l4RBq/0LkMS/QBBmnjaqPy3TbEwner/xMWxyL
+i9DPLPrXnJXrxczV5ScUt+0cMYWDY+A+pnxwd0s/TzfDIChidSTKSbY9kPcbxCVO
+W+Pz6muoYWrPuj02rZDIN29rIQAe73vh3C++zvAB6SfbfTTMij97K86fc9Rs6amK
+CwdhKWKFibL6z0FhxAvjpxo3Fugm4q9sDAzx3GHUJ1vzq3ZJAbY1CiPglUb9rAi+
+cpFkrnSP9paa/w5iYrSTOBduGdBp8kcrHXB9RuSLndL+J41xexIBb+tSTQ8H8pzk
+iRTOfmYoGiizERHM1OUl9BPW/2+UZ9o4KUl7sPakniMkpm1dBKhvXj9rcA8+SUpp
+Raog64+T
-----END CERTIFICATE-----
diff --git a/www/certs/class3.der b/www/certs/class3.der
index 56f8c88..e13d2b9 100644
--- a/www/certs/class3.der
+++ b/www/certs/class3.der
Binary files differ
diff --git a/www/certs/class3.txt b/www/certs/class3.txt
index a77aa14..68533d8 100644
--- a/www/certs/class3.txt
+++ b/www/certs/class3.txt
@@ -1,59 +1,59 @@
Certificate:
Data:
Version: 3 (0x2)
- Serial Number: 672138 (0xa418a)
+ Serial Number: 4123 (0x101b)
Signature Algorithm: sha256WithRSAEncryption
- Issuer: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+ Issuer: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1.it-sls.de, CN=CAcert Testserver Root
Validity
- Not Before: May 23 17:48:02 2011 GMT
- Not After : May 20 17:48:02 2021 GMT
- Subject: O=CAcert Inc., OU=http://www.CAcert.org, CN=CAcert Class 3 Root
+ Not Before: May 1 18:25:09 2011 GMT
+ Not After : Apr 28 18:25:09 2021 GMT
+ Subject: O=CAcert Testsever, OU=http://cacert1.it-sls.de, CN=CAcert Testserver Class 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (4096 bit)
Modulus (4096 bit):
- 00:ab:49:35:11:48:7c:d2:26:7e:53:94:cf:43:a9:
- dd:28:d7:42:2a:8b:f3:87:78:19:58:7c:0f:9e:da:
- 89:7d:e1:fb:eb:72:90:0d:74:a1:96:64:ab:9f:a0:
- 24:99:73:da:e2:55:76:c7:17:7b:f5:04:ac:46:b8:
- c3:be:7f:64:8d:10:6c:24:f3:61:9c:c0:f2:90:fa:
- 51:e6:f5:69:01:63:c3:0f:56:e2:4a:42:cf:e2:44:
- 8c:25:28:a8:c5:79:09:7d:46:b9:8a:f3:e9:f3:34:
- 29:08:45:e4:1c:9f:cb:94:04:1c:81:a8:14:b3:98:
- 65:c4:43:ec:4e:82:8d:09:d1:bd:aa:5b:8d:92:d0:
- ec:de:90:c5:7f:0a:c2:e3:eb:e6:31:5a:5e:74:3e:
- 97:33:59:e8:c3:03:3d:60:33:bf:f7:d1:6f:47:c4:
- cd:ee:62:83:52:6e:2e:08:9a:a4:d9:15:18:91:a6:
- 85:92:47:b0:ae:48:eb:6d:b7:21:ec:85:1a:68:72:
- 35:ab:ff:f0:10:5d:c0:f4:94:a7:6a:d5:3b:92:7e:
- 4c:90:05:7e:93:c1:2c:8b:a4:8e:62:74:15:71:6e:
- 0b:71:03:ea:af:15:38:9a:d4:d2:05:72:6f:8c:f9:
- 2b:eb:5a:72:25:f9:39:46:e3:72:1b:3e:04:c3:64:
- 27:22:10:2a:8a:4f:58:a7:03:ad:be:b4:2e:13:ed:
- 5d:aa:48:d7:d5:7d:d4:2a:7b:5c:fa:46:04:50:e4:
- cc:0e:42:5b:8c:ed:db:f2:cf:fc:96:93:e0:db:11:
- 36:54:62:34:38:8f:0c:60:9b:3b:97:56:38:ad:f3:
- d2:5b:8b:a0:5b:ea:4e:96:b8:7c:d7:d5:a0:86:70:
- 40:d3:91:29:b7:a2:3c:ad:f5:8c:bb:cf:1a:92:8a:
- e4:34:7b:c0:d8:6c:5f:e9:0a:c2:c3:a7:20:9a:5a:
- df:2c:5d:52:5c:ba:47:d5:9b:ef:24:28:70:38:20:
- 2f:d5:7f:29:c0:b2:41:03:68:92:cc:e0:9c:cc:97:
- 4b:45:ef:3a:10:0a:ab:70:3a:98:95:70:ad:35:b1:
- ea:85:2b:a4:1c:80:21:31:a9:ae:60:7a:80:26:48:
- 00:b8:01:c0:93:63:55:22:91:3c:56:e7:af:db:3a:
- 25:f3:8f:31:54:ea:26:8b:81:59:f9:a1:d1:53:11:
- c5:7b:9d:03:f6:74:11:e0:6d:b1:2c:3f:2c:86:91:
- 99:71:9a:a6:77:8b:34:60:d1:14:b4:2c:ac:9d:af:
- 8c:10:d3:9f:c4:6a:f8:6f:13:fc:73:59:f7:66:42:
- 74:1e:8a:e3:f8:dc:d2:6f:98:9c:cb:47:98:95:40:
- 05:fb:e9
+ 00:c8:e7:be:89:42:e9:30:23:9f:33:b8:d8:9d:69:
+ 2d:07:51:85:42:06:6c:b8:9a:95:7b:56:1c:9d:0e:
+ d5:b4:ee:10:ee:e6:56:06:99:b7:2e:05:6f:92:7e:
+ 33:c2:8c:c3:11:41:51:22:36:b5:af:de:d2:dc:94:
+ 12:9a:87:fb:9b:3a:68:0f:d4:77:a7:43:14:5f:1a:
+ 22:64:b8:f9:3b:77:09:4c:ee:aa:8f:7d:19:ff:1f:
+ 53:e6:d7:0d:5b:8f:f7:b5:c9:99:1e:35:cd:14:cc:
+ c3:dd:45:b0:fd:22:74:77:fe:1c:07:43:58:5f:2c:
+ 72:86:6d:b6:1c:ea:e4:db:fb:45:0e:80:60:2c:33:
+ 06:ff:59:56:fe:f2:64:ab:80:44:59:f6:91:61:c3:
+ cb:8a:e7:e0:45:80:9c:12:76:c4:ec:37:af:21:e5:
+ 90:cb:e1:52:1f:f5:9a:bc:cf:c8:cd:19:c5:ca:d0:
+ 34:a8:67:4b:d3:d3:2e:84:c9:57:57:89:73:52:3c:
+ 5f:f3:00:f4:db:04:14:1c:04:69:a1:28:19:5c:4c:
+ bc:1c:3c:72:de:1c:81:1f:c1:11:9f:ef:6c:2a:05:
+ 83:4d:ad:3d:09:df:bc:93:72:2d:f5:c7:ec:42:d3:
+ f8:90:c2:33:c3:e2:b4:61:60:5c:66:fd:45:bd:b0:
+ 5b:44:25:5b:48:7f:da:3f:a2:3d:8c:87:61:46:45:
+ ad:03:0e:4d:28:5f:e8:de:c1:91:27:4f:2f:8c:51:
+ dd:24:e0:b1:72:31:de:94:72:7e:25:26:c6:f7:b8:
+ 79:e3:67:c6:b2:cf:90:c4:30:34:3f:dc:cc:e3:7f:
+ a0:a3:84:e7:38:a1:79:b9:51:7b:84:da:0b:19:ca:
+ 7a:3d:dd:f2:ed:4d:70:1c:e3:0d:0a:cc:c7:19:d9:
+ d8:80:a7:94:dd:a6:ad:30:de:93:09:50:01:68:7a:
+ 11:52:70:14:4a:ec:a6:fd:c6:e5:d5:3f:1a:12:bc:
+ 60:95:3c:d5:d7:52:c1:22:a0:89:5f:4f:64:ad:2a:
+ f0:d5:04:f0:53:b5:64:67:13:40:4b:61:32:5a:59:
+ 00:27:5a:9e:b8:42:05:a2:56:7f:89:99:d1:a4:22:
+ 6e:2c:1e:90:75:17:07:8d:e2:6b:1d:92:08:9c:e8:
+ 90:25:60:94:69:ef:5b:52:8e:e1:27:27:05:6d:82:
+ a2:ea:a5:4b:4b:3d:3a:49:eb:8f:f4:94:39:5a:cc:
+ 22:79:35:a7:6e:4e:90:00:f8:c4:aa:5e:51:d2:03:
+ f4:5b:43:55:52:68:a7:51:69:da:8b:60:e5:28:a8:
+ 61:70:1d:d9:5d:7b:26:69:03:0a:74:89:b3:3a:d8:
+ 69:95:ad
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
- 75:A8:71:60:4C:88:13:F0:78:D9:89:77:B5:6D:C5:89:DF:BC:B1:7A
+ 84:84:E0:1D:16:49:5E:B1:C5:E5:E7:CF:2D:A8:56:74:4B:E8:92:94
X509v3 Authority Key Identifier:
- keyid:16:B5:32:1B:D4:C7:F3:E0:E6:8E:F3:BD:D2:B0:3A:EE:B2:39:18:D1
- DirName:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+ keyid:85:D7:05:0A:D6:8F:F2:04:2D:5E:EB:CB:FD:F6:69:8B:1F:4E:06:FE
+ DirName:/C=AU/ST=New South Wales/O=CAcert Testserver/OU=http://cacert1.it-sls.de/CN=CAcert Testserver Root
serial:00
X509v3 Basic Constraints: critical
@@ -63,7 +63,7 @@ Certificate:
CA Issuers - URI:http://www.CAcert.org/ca.crt
X509v3 Certificate Policies:
- Policy: 1.3.6.1.4.1.18506
+ Policy: Security
CPS: http://www.CAcert.org/index.php?id=10
Netscape CA Policy Url:
@@ -71,74 +71,75 @@ Certificate:
Netscape Comment:
To get your own certificate for FREE, go to http://www.CAcert.org
Signature Algorithm: sha256WithRSAEncryption
- 29:28:85:ae:44:a9:b9:af:a4:79:13:f0:a8:a3:2b:97:60:f3:
- 5c:ee:e3:2f:c1:f6:e2:66:a0:11:ae:36:37:3a:76:15:04:53:
- ea:42:f5:f9:ea:c0:15:d8:a6:82:d9:e4:61:ae:72:0b:29:5c:
- 90:43:e8:41:b2:e1:77:db:02:13:44:78:47:55:af:58:fc:cc:
- 98:f6:45:b9:d1:20:f8:d8:21:07:fe:6d:aa:73:d4:b3:c6:07:
- e9:09:85:cc:3b:f2:b6:be:2c:1c:25:d5:71:8c:39:b5:2e:ea:
- be:18:81:ba:b0:93:b8:0f:e3:e6:d7:26:8c:31:5a:72:03:84:
- 52:e6:a6:f5:33:22:45:0a:c8:0b:0d:8a:b8:36:6f:90:09:a1:
- ab:bd:d7:d5:4e:2e:71:a2:d4:ae:fa:a7:54:2b:eb:35:8d:5a:
- b7:54:88:2f:ee:74:9f:ed:48:16:ca:0d:48:d0:94:d3:ac:a4:
- a2:f6:24:df:92:e3:bd:eb:43:40:91:6e:1c:18:8e:56:b4:82:
- 12:f3:a9:93:9f:d4:bc:9c:ad:9c:75:ee:5a:97:1b:95:e7:74:
- 2d:1c:0f:b0:2c:97:9f:fb:a9:33:39:7a:e7:03:3a:92:8e:22:
- f6:8c:0d:e4:d9:7e:0d:76:18:f7:01:f9:ef:96:96:a2:55:73:
- c0:3c:71:b4:1d:1a:56:43:b7:c3:0a:8d:72:fc:e2:10:09:0b:
- 41:ce:8c:94:a0:f9:03:fd:71:73:4b:8a:57:33:e5:8e:74:7e:
- 15:01:00:e6:cc:4a:1c:e7:7f:95:19:2d:c5:a5:0c:8b:bb:b5:
- ed:85:b3:5c:d3:df:b8:b9:f2:ca:c7:0d:01:14:ac:70:58:c5:
- 8c:8d:33:d4:9d:66:a3:1a:50:95:23:fc:48:e0:06:43:12:d9:
- cd:a7:86:39:2f:36:72:a3:80:10:e4:e1:f3:d1:cb:5b:1a:c0:
- e4:80:9a:7c:13:73:06:4f:db:a3:6b:24:0a:ba:b3:1c:bc:4a:
- 78:bb:e5:e3:75:38:a5:48:a7:a2:1e:af:76:d4:5e:f7:38:86:
- 56:5a:89:ce:d6:c3:a7:79:b2:52:a0:c6:f1:85:b4:25:8c:f2:
- 3f:96:b3:10:d9:8d:6c:57:3b:9f:6f:86:3a:18:82:22:36:c8:
- b0:91:38:db:2a:a1:93:aa:84:3f:f5:27:65:ae:73:d5:c8:d5:
- d3:77:ea:4b:9d:c7:41:bb:c7:c0:e3:a0:3f:e4:7d:a4:8d:73:
- e6:12:4b:df:a1:73:73:73:3a:80:e8:d5:cb:8e:2f:cb:ea:13:
- a7:d6:41:8b:ac:fa:3c:89:d7:24:f5:4e:b4:e0:61:92:b7:f3:
- 37:98:c4:be:96:a3:b7:8a
+ 55:9e:77:16:00:84:00:fe:86:23:b1:22:a3:28:ca:7c:80:74:
+ c6:81:6e:60:a0:ef:32:5c:12:ae:a9:81:b3:fb:70:72:fe:e3:
+ 3c:c8:3f:86:5c:fe:d3:ec:99:b2:fb:8a:5d:dc:20:b6:f4:f8:
+ 44:f0:99:74:67:0b:a7:3d:13:6c:56:91:ee:a3:bf:da:b3:43:
+ 40:23:40:8e:c5:41:d0:ff:d1:c2:60:29:a8:0c:4e:7f:9a:06:
+ 0c:a2:18:6e:94:d3:34:ca:53:b7:0a:dc:07:b7:cd:28:ed:75:
+ a8:9b:10:9c:90:a1:09:4b:b8:4c:d9:cc:36:0e:2c:15:c9:5c:
+ 31:08:9e:1a:d9:fa:0a:96:46:75:83:38:9c:1d:af:fd:7d:6a:
+ 5a:a0:17:c9:ef:c4:a4:35:df:ab:d5:f0:ba:a6:b2:bc:dc:b3:
+ 43:be:ea:fe:77:61:e5:63:f4:06:32:78:22:ca:d9:73:c2:ca:
+ 11:a9:89:ad:ad:ee:e3:c8:37:5c:e8:94:28:09:2d:74:1c:24:
+ 48:37:74:64:6a:b2:60:1e:b8:1e:cf:ca:53:b3:f7:1b:b1:5e:
+ 36:11:4a:ae:9f:70:e3:f7:d4:2c:61:49:e1:f0:4e:a4:f1:ce:
+ 4b:b3:fe:ef:a5:e1:10:6a:ff:42:e4:31:2f:d0:04:19:a7:8d:
+ aa:8f:cb:74:db:13:09:de:af:fc:4c:5b:1c:8b:8b:d0:cf:2c:
+ fa:d7:9c:95:eb:c5:cc:d5:e5:27:14:b7:ed:1c:31:85:83:63:
+ e0:3e:a6:7c:70:77:4b:3f:4f:37:c3:20:28:62:75:24:ca:49:
+ b6:3d:90:f7:1b:c4:25:4e:5b:e3:f3:ea:6b:a8:61:6a:cf:ba:
+ 3d:36:ad:90:c8:37:6f:6b:21:00:1e:ef:7b:e1:dc:2f:be:ce:
+ f0:01:e9:27:db:7d:34:cc:8a:3f:7b:2b:ce:9f:73:d4:6c:e9:
+ a9:8a:0b:07:61:29:62:85:89:b2:fa:cf:41:61:c4:0b:e3:a7:
+ 1a:37:16:e8:26:e2:af:6c:0c:0c:f1:dc:61:d4:27:5b:f3:ab:
+ 76:49:01:b6:35:0a:23:e0:95:46:fd:ac:08:be:72:91:64:ae:
+ 74:8f:f6:96:9a:ff:0e:62:62:b4:93:38:17:6e:19:d0:69:f2:
+ 47:2b:1d:70:7d:46:e4:8b:9d:d2:fe:27:8d:71:7b:12:01:6f:
+ eb:52:4d:0f:07:f2:9c:e4:89:14:ce:7e:66:28:1a:28:b3:11:
+ 11:cc:d4:e5:25:f4:13:d6:ff:6f:94:67:da:38:29:49:7b:b0:
+ f6:a4:9e:23:24:a6:6d:5d:04:a8:6f:5e:3f:6b:70:0f:3e:49:
+ 4a:69:45:aa:20:eb:8f:93
-----BEGIN CERTIFICATE-----
-MIIHWTCCBUGgAwIBAgIDCkGKMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv
-b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ
-Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y
-dEBjYWNlcnQub3JnMB4XDTExMDUyMzE3NDgwMloXDTIxMDUyMDE3NDgwMlowVDEU
-MBIGA1UEChMLQ0FjZXJ0IEluYy4xHjAcBgNVBAsTFWh0dHA6Ly93d3cuQ0FjZXJ0
-Lm9yZzEcMBoGA1UEAxMTQ0FjZXJ0IENsYXNzIDMgUm9vdDCCAiIwDQYJKoZIhvcN
-AQEBBQADggIPADCCAgoCggIBAKtJNRFIfNImflOUz0Op3SjXQiqL84d4GVh8D57a
-iX3h++tykA10oZZkq5+gJJlz2uJVdscXe/UErEa4w75/ZI0QbCTzYZzA8pD6Ueb1
-aQFjww9W4kpCz+JEjCUoqMV5CX1GuYrz6fM0KQhF5Byfy5QEHIGoFLOYZcRD7E6C
-jQnRvapbjZLQ7N6QxX8KwuPr5jFaXnQ+lzNZ6MMDPWAzv/fRb0fEze5ig1JuLgia
-pNkVGJGmhZJHsK5I6223IeyFGmhyNav/8BBdwPSUp2rVO5J+TJAFfpPBLIukjmJ0
-FXFuC3ED6q8VOJrU0gVyb4z5K+taciX5OUbjchs+BMNkJyIQKopPWKcDrb60LhPt
-XapI19V91Cp7XPpGBFDkzA5CW4zt2/LP/JaT4NsRNlRiNDiPDGCbO5dWOK3z0luL
-oFvqTpa4fNfVoIZwQNORKbeiPK31jLvPGpKK5DR7wNhsX+kKwsOnIJpa3yxdUly6
-R9Wb7yQocDggL9V/KcCyQQNokszgnMyXS0XvOhAKq3A6mJVwrTWx6oUrpByAITGp
-rmB6gCZIALgBwJNjVSKRPFbnr9s6JfOPMVTqJouBWfmh0VMRxXudA/Z0EeBtsSw/
-LIaRmXGapneLNGDRFLQsrJ2vjBDTn8Rq+G8T/HNZ92ZCdB6K4/jc0m+YnMtHmJVA
-BfvpAgMBAAGjggINMIICCTAdBgNVHQ4EFgQUdahxYEyIE/B42Yl3tW3Fid+8sXow
-gaMGA1UdIwSBmzCBmIAUFrUyG9TH8+DmjvO90rA67rI5GNGhfaR7MHkxEDAOBgNV
-BAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAG
-A1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS
-c3VwcG9ydEBjYWNlcnQub3JnggEAMA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUH
-AQEEUTBPMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggr
-BgEFBQcwAoYcaHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBKBgNVHSAEQzBB
-MD8GCCsGAQQBgZBKMDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9y
-Zy9pbmRleC5waHA/aWQ9MTAwNAYJYIZIAYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0Fj
-ZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAwUAYJYIZIAYb4QgENBEMWQVRvIGdldCB5
-b3VyIG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSwgZ28gdG8gaHR0cDovL3d3dy5D
-QWNlcnQub3JnMA0GCSqGSIb3DQEBCwUAA4ICAQApKIWuRKm5r6R5E/CooyuXYPNc
-7uMvwfbiZqARrjY3OnYVBFPqQvX56sAV2KaC2eRhrnILKVyQQ+hBsuF32wITRHhH
-Va9Y/MyY9kW50SD42CEH/m2qc9SzxgfpCYXMO/K2viwcJdVxjDm1Luq+GIG6sJO4
-D+Pm1yaMMVpyA4RS5qb1MyJFCsgLDYq4Nm+QCaGrvdfVTi5xotSu+qdUK+s1jVq3
-VIgv7nSf7UgWyg1I0JTTrKSi9iTfkuO960NAkW4cGI5WtIIS86mTn9S8nK2cde5a
-lxuV53QtHA+wLJef+6kzOXrnAzqSjiL2jA3k2X4Ndhj3AfnvlpaiVXPAPHG0HRpW
-Q7fDCo1y/OIQCQtBzoyUoPkD/XFzS4pXM+WOdH4VAQDmzEoc53+VGS3FpQyLu7Xt
-hbNc09+4ufLKxw0BFKxwWMWMjTPUnWajGlCVI/xI4AZDEtnNp4Y5LzZyo4AQ5OHz
-0ctbGsDkgJp8E3MGT9ujayQKurMcvEp4u+XjdTilSKeiHq921F73OIZWWonO1sOn
-ebJSoMbxhbQljPI/lrMQ2Y1sVzufb4Y6GIIiNsiwkTjbKqGTqoQ/9SdlrnPVyNXT
-d+pLncdBu8fA46A/5H2kjXPmEkvfoXNzczqA6NXLji/L6hOn1kGLrPo8idck9U60
-4GGSt/M3mMS+lqO3ig==
+MIIHgjCCBWqgAwIBAgICEBswDQYJKoZIhvcNAQELBQAwgYcxCzAJBgNVBAYTAkFV
+MRgwFgYDVQQIEw9OZXcgU291dGggV2FsZXMxGjAYBgNVBAoTEUNBY2VydCBUZXN0
+c2VydmVyMSEwHwYDVQQLExhodHRwOi8vY2FjZXJ0MS5pdC1zbHMuZGUxHzAdBgNV
+BAMTFkNBY2VydCBUZXN0c2VydmVyIFJvb3QwHhcNMTEwNTAxMTgyNTA5WhcNMjEw
+NDI4MTgyNTA5WjBiMRkwFwYDVQQKExBDQWNlcnQgVGVzdHNldmVyMSEwHwYDVQQL
+ExhodHRwOi8vY2FjZXJ0MS5pdC1zbHMuZGUxIjAgBgNVBAMTGUNBY2VydCBUZXN0
+c2VydmVyIENsYXNzIDMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDI
+576JQukwI58zuNidaS0HUYVCBmy4mpV7VhydDtW07hDu5lYGmbcuBW+SfjPCjMMR
+QVEiNrWv3tLclBKah/ubOmgP1HenQxRfGiJkuPk7dwlM7qqPfRn/H1Pm1w1bj/e1
+yZkeNc0UzMPdRbD9InR3/hwHQ1hfLHKGbbYc6uTb+0UOgGAsMwb/WVb+8mSrgERZ
+9pFhw8uK5+BFgJwSdsTsN68h5ZDL4VIf9Zq8z8jNGcXK0DSoZ0vT0y6EyVdXiXNS
+PF/zAPTbBBQcBGmhKBlcTLwcPHLeHIEfwRGf72wqBYNNrT0J37yTci31x+xC0/iQ
+wjPD4rRhYFxm/UW9sFtEJVtIf9o/oj2Mh2FGRa0DDk0oX+jewZEnTy+MUd0k4LFy
+Md6Ucn4lJsb3uHnjZ8ayz5DEMDQ/3Mzjf6CjhOc4oXm5UXuE2gsZyno93fLtTXAc
+4w0KzMcZ2diAp5Tdpq0w3pMJUAFoehFScBRK7Kb9xuXVPxoSvGCVPNXXUsEioIlf
+T2StKvDVBPBTtWRnE0BLYTJaWQAnWp64QgWiVn+JmdGkIm4sHpB1FweN4msdkgic
+6JAlYJRp71tSjuEnJwVtgqLqpUtLPTpJ64/0lDlazCJ5NaduTpAA+MSqXlHSA/Rb
+Q1VSaKdRadqLYOUoqGFwHdldeyZpAwp0ibM62GmVrQIDAQABo4ICGjCCAhYwHQYD
+VR0OBBYEFISE4B0WSV6xxeXnzy2oVnRL6JKUMIG0BgNVHSMEgawwgamAFIXXBQrW
+j/IELV7ry/32aYsfTgb+oYGNpIGKMIGHMQswCQYDVQQGEwJBVTEYMBYGA1UECBMP
+TmV3IFNvdXRoIFdhbGVzMRowGAYDVQQKExFDQWNlcnQgVGVzdHNlcnZlcjEhMB8G
+A1UECxMYaHR0cDovL2NhY2VydDEuaXQtc2xzLmRlMR8wHQYDVQQDExZDQWNlcnQg
+VGVzdHNlcnZlciBSb290ggEAMA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUHAQEE
+UTBPMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggrBgEF
+BQcwAoYcaHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBGBgNVHSAEPzA9MDsG
+BCsGAQUwMzAxBggrBgEFBQcCARYlaHR0cDovL3d3dy5DQWNlcnQub3JnL2luZGV4
+LnBocD9pZD0xMDA0BglghkgBhvhCAQgEJxYlaHR0cDovL3d3dy5DQWNlcnQub3Jn
+L2luZGV4LnBocD9pZD0xMDBQBglghkgBhvhCAQ0EQxZBVG8gZ2V0IHlvdXIgb3du
+IGNlcnRpZmljYXRlIGZvciBGUkVFLCBnbyB0byBodHRwOi8vd3d3LkNBY2VydC5v
+cmcwDQYJKoZIhvcNAQELBQADggIBAFWedxYAhAD+hiOxIqMoynyAdMaBbmCg7zJc
+Eq6pgbP7cHL+4zzIP4Zc/tPsmbL7il3cILb0+ETwmXRnC6c9E2xWke6jv9qzQ0Aj
+QI7FQdD/0cJgKagMTn+aBgyiGG6U0zTKU7cK3Ae3zSjtdaibEJyQoQlLuEzZzDYO
+LBXJXDEInhrZ+gqWRnWDOJwdr/19alqgF8nvxKQ136vV8Lqmsrzcs0O+6v53YeVj
+9AYyeCLK2XPCyhGpia2t7uPIN1zolCgJLXQcJEg3dGRqsmAeuB7PylOz9xuxXjYR
+Sq6fcOP31CxhSeHwTqTxzkuz/u+l4RBq/0LkMS/QBBmnjaqPy3TbEwner/xMWxyL
+i9DPLPrXnJXrxczV5ScUt+0cMYWDY+A+pnxwd0s/TzfDIChidSTKSbY9kPcbxCVO
+W+Pz6muoYWrPuj02rZDIN29rIQAe73vh3C++zvAB6SfbfTTMij97K86fc9Rs6amK
+CwdhKWKFibL6z0FhxAvjpxo3Fugm4q9sDAzx3GHUJ1vzq3ZJAbY1CiPglUb9rAi+
+cpFkrnSP9paa/w5iYrSTOBduGdBp8kcrHXB9RuSLndL+J41xexIBb+tSTQ8H8pzk
+iRTOfmYoGiizERHM1OUl9BPW/2+UZ9o4KUl7sPakniMkpm1dBKhvXj9rcA8+SUpp
+Raog64+T
-----END CERTIFICATE-----
diff --git a/www/certs/root.crt b/www/certs/root.crt
index e7dfc82..fa9d766 100644
--- a/www/certs/root.crt
+++ b/www/certs/root.crt
@@ -1,41 +1,43 @@
-----BEGIN CERTIFICATE-----
-MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290
-IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
-IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
-Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
-BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
-MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
-ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
-CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
-8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
-zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
-fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
-w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
-G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
-epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
-laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
-QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
-fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
-YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w
-ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY
-gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe
-MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0
-IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy
-dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw
-czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0
-dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl
-aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC
-AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg
-b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB
-ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc
-nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg
-18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c
-gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl
-Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY
-sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T
-SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF
-CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum
-GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk
-zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW
-omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD
+MIIHpzCCBY+gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBhzELMAkGA1UEBhMCQVUx
+GDAWBgNVBAgTD05ldyBTb3V0aCBXYWxlczEaMBgGA1UEChMRQ0FjZXJ0IFRlc3Rz
+ZXJ2ZXIxITAfBgNVBAsTGGh0dHA6Ly9jYWNlcnQxLml0LXNscy5kZTEfMB0GA1UE
+AxMWQ0FjZXJ0IFRlc3RzZXJ2ZXIgUm9vdDAeFw0xMTAzMjkyMDQ1MjBaFw0yMTAz
+MjYyMDQ1MjBaMIGHMQswCQYDVQQGEwJBVTEYMBYGA1UECBMPTmV3IFNvdXRoIFdh
+bGVzMRowGAYDVQQKExFDQWNlcnQgVGVzdHNlcnZlcjEhMB8GA1UECxMYaHR0cDov
+L2NhY2VydDEuaXQtc2xzLmRlMR8wHQYDVQQDExZDQWNlcnQgVGVzdHNlcnZlciBS
+b290MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5fvQIrtzGpSbyWam
+2kHfXMCXgRuTHSuQwbvkqdLAqtiI4ZQkF4jTy+7D6LVnDd3kw/hC1EAhcV79WuTn
+PrrpjM1JdliOOOvb5sh9SQrdT4w1IO2JBmHrykcHCcvh7tLcm8iKA3iIIxO76SXZ
+Pd7buDEQQrP8z6AXBgCRIdtS9uA5WxAmmbj2ToL8UaViijB062zVO9euOuMdN5Qk
+pCVOj9tfzotJDHw3sNvP65G/C63ZJ0ysUhohncXe+e6UIPHVS+V54nBENz+4HY/d
+zchFFHhnhuCSyhPfSz975IlnBSgMqhVPEYuFpAkDUSUpc8kXoe+cVVSjPBw0exUJ
+X4OUjEUf3HgdPyaoeeAPbkQ2pd118vMHzTzAX7t/GzVxROkYSzFvuSljI7ivFx9Y
+lPRsMW5L9TRIjxCPBLoqTNKgQQOfZiib+T4PY/ii+qU17lMZK9L9hnAMjW8L2dzx
+Z6/qrhM58vKqt6Rd9bsUt109WWflKY39YenlGaCJU+0qgsUcbl2qHjgbkz8rvJJM
+10BkVROvVvqnPjkSc8ZPD+1Si9pP0pztAl7vXsDM30jtL6Jv/DyTFKUljpb0tqA9
+22SyOxUu0kkKBYXY1HrqL6Ahvjeorv5aDzrUqAYTYB6Z82ykx0bG5FsAK4ShoTv1
+3ir9ejhln4JPGiyQTdMXgRaHX/kCAwEAAaOCAhowggIWMB0GA1UdDgQWBBSF1wUK
+1o/yBC1e68v99mmLH04G/jCBtAYDVR0jBIGsMIGpgBSF1wUK1o/yBC1e68v99mmL
+H04G/qGBjaSBijCBhzELMAkGA1UEBhMCQVUxGDAWBgNVBAgTD05ldyBTb3V0aCBX
+YWxlczEaMBgGA1UEChMRQ0FjZXJ0IFRlc3RzZXJ2ZXIxITAfBgNVBAsTGGh0dHA6
+Ly9jYWNlcnQxLml0LXNscy5kZTEfMB0GA1UEAxMWQ0FjZXJ0IFRlc3RzZXJ2ZXIg
+Um9vdIIBADAPBgNVHRMBAf8EBTADAQH/MF0GCCsGAQUFBwEBBFEwTzAjBggrBgEF
+BQcwAYYXaHR0cDovL29jc3AuQ0FjZXJ0Lm9yZy8wKAYIKwYBBQUHMAKGHGh0dHA6
+Ly93d3cuQ0FjZXJ0Lm9yZy9jYS5jcnQwRgYDVR0gBD8wPTA7BgQrBgEFMDMwMQYI
+KwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAw
+NAYJYIZIAYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/
+aWQ9MTAwUAYJYIZIAYb4QgENBEMWQVRvIGdldCB5b3VyIG93biBjZXJ0aWZpY2F0
+ZSBmb3IgRlJFRSwgZ28gdG8gaHR0cDovL3d3dy5DQWNlcnQub3JnMA0GCSqGSIb3
+DQEBBQUAA4ICAQDQjXJDogH/NiU53JEUaw7jEF7qgp8vLjO2AXkwwpdKOWKS6lm9
+BQXiKs6HUdVYwsdST30kSvF1dD9Y9gCgFVyN662Tk2LwaPyKRq9cxlUXwqKEczfE
+4yFPhYXS1giIGL8aSUx0lok6KWRXNgspgBIZ+0tFV+9GLNTP5y+ofU2ME1xw6+zM
+tN/rgN2Xt6oVO24tJlKWVvodIgfq8QPscxZHwFqyHWh8hsL8q4mSDZZ0B7wHy51F
+gliDzcq+WG8tk29WV++7uHRnN2rqJSoGc91IAHN2YmBW/mCeiqPH0Ms1x7Oo1DuZ
+C5pc1GGyxGun252NxRM9jEz7UsWqHRCCyyA6Tyo2E6b3gdiatmohW1JIUTk+WONZ
+41+Htgz+vhGFzTOnAWUQLapPllNeYjs/b1Ub8vpycx2O0FU3ZPtC+41GriPHQ2rJ
+/ToQVI4ZAHUp7O6n4+r7Onhf5qylVeux+Qzy+IV2Db7rj0KXBoHjW3S0hIfIJE0x
+1T5Ldj+YBFvCLvd6RrcNgoS/HaKAV/42AENy1V1eBBP6TJ8kmXWVbyRpzRFgZmmB
+z6jLle2M0/kaPER2s5QFvxu+Y6mwrQ237im9oPHzY4kGv8eeF+AMUOmSC+M5jb3m
++IafDexcFnjchflKWV/RRHSj28kJ3ops1lgpkx4+TJo3M62Udepphw0ItA==
-----END CERTIFICATE-----
diff --git a/www/certs/root.der b/www/certs/root.der
index 719b0ff..9166696 100644
--- a/www/certs/root.der
+++ b/www/certs/root.der
Binary files differ
diff --git a/www/certs/root.txt b/www/certs/root.txt
index 96bb2cd..26c1593 100644
--- a/www/certs/root.txt
+++ b/www/certs/root.txt
@@ -2,139 +2,144 @@ Certificate:
Data:
Version: 3 (0x2)
Serial Number: 0 (0x0)
- Signature Algorithm: md5WithRSAEncryption
- Issuer: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1.it-sls.de, CN=CAcert Testserver Root
Validity
- Not Before: Mar 30 12:29:49 2003 GMT
- Not After : Mar 29 12:29:49 2033 GMT
- Subject: O=Root CA, OU=http://www.cacert.org, CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+ Not Before: Mar 29 20:45:20 2011 GMT
+ Not After : Mar 26 20:45:20 2021 GMT
+ Subject: C=AU, ST=New South Wales, O=CAcert Testserver, OU=http://cacert1.it-sls.de, CN=CAcert Testserver Root
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (4096 bit)
Modulus (4096 bit):
- 00:ce:22:c0:e2:46:7d:ec:36:28:07:50:96:f2:a0:
- 33:40:8c:4b:f1:3b:66:3f:31:e5:6b:02:36:db:d6:
- 7c:f6:f1:88:8f:4e:77:36:05:41:95:f9:09:f0:12:
- cf:46:86:73:60:b7:6e:7e:e8:c0:58:64:ae:cd:b0:
- ad:45:17:0c:63:fa:67:0a:e8:d6:d2:bf:3e:e7:98:
- c4:f0:4c:fa:e0:03:bb:35:5d:6c:21:de:9e:20:d9:
- ba:cd:66:32:37:72:fa:f7:08:f5:c7:cd:58:c9:8e:
- e7:0e:5e:ea:3e:fe:1c:a1:14:0a:15:6c:86:84:5b:
- 64:66:2a:7a:a9:4b:53:79:f5:88:a2:7b:ee:2f:0a:
- 61:2b:8d:b2:7e:4d:56:a5:13:ec:ea:da:92:9e:ac:
- 44:41:1e:58:60:65:05:66:f8:c0:44:bd:cb:94:f7:
- 42:7e:0b:f7:65:68:98:51:05:f0:f3:05:91:04:1d:
- 1b:17:82:ec:c8:57:bb:c3:6b:7a:88:f1:b0:72:cc:
- 25:5b:20:91:ec:16:02:12:8f:32:e9:17:18:48:d0:
- c7:05:2e:02:30:42:b8:25:9c:05:6b:3f:aa:3a:a7:
- eb:53:48:f7:e8:d2:b6:07:98:dc:1b:c6:34:7f:7f:
- c9:1c:82:7a:05:58:2b:08:5b:f3:38:a2:ab:17:5d:
- 66:c9:98:d7:9e:10:8b:a2:d2:dd:74:9a:f7:71:0c:
- 72:60:df:cd:6f:98:33:9d:96:34:76:3e:24:7a:92:
- b0:0e:95:1e:6f:e6:a0:45:38:47:aa:d7:41:ed:4a:
- b7:12:f6:d7:1b:83:8a:0f:2e:d8:09:b6:59:d7:aa:
- 04:ff:d2:93:7d:68:2e:dd:8b:4b:ab:58:ba:2f:8d:
- ea:95:a7:a0:c3:54:89:a5:fb:db:8b:51:22:9d:b2:
- c3:be:11:be:2c:91:86:8b:96:78:ad:20:d3:8a:2f:
- 1a:3f:c6:d0:51:65:87:21:b1:19:01:65:7f:45:1c:
- 87:f5:7c:d0:41:4c:4f:29:98:21:fd:33:1f:75:0c:
- 04:51:fa:19:77:db:d4:14:1c:ee:81:c3:1d:f5:98:
- b7:69:06:91:22:dd:00:50:cc:81:31:ac:12:07:7b:
- 38:da:68:5b:e6:2b:d4:7e:c9:5f:ad:e8:eb:72:4c:
- f3:01:e5:4b:20:bf:9a:a6:57:ca:91:00:01:8b:a1:
- 75:21:37:b5:63:0d:67:3e:46:4f:70:20:67:ce:c5:
- d6:59:db:02:e0:f0:d2:cb:cd:ba:62:b7:90:41:e8:
- dd:20:e4:29:bc:64:29:42:c8:22:dc:78:9a:ff:43:
- ec:98:1b:09:51:4b:5a:5a:c2:71:f1:c4:cb:73:a9:
- e5:a1:0b
+ 00:e5:fb:d0:22:bb:73:1a:94:9b:c9:66:a6:da:41:
+ df:5c:c0:97:81:1b:93:1d:2b:90:c1:bb:e4:a9:d2:
+ c0:aa:d8:88:e1:94:24:17:88:d3:cb:ee:c3:e8:b5:
+ 67:0d:dd:e4:c3:f8:42:d4:40:21:71:5e:fd:5a:e4:
+ e7:3e:ba:e9:8c:cd:49:76:58:8e:38:eb:db:e6:c8:
+ 7d:49:0a:dd:4f:8c:35:20:ed:89:06:61:eb:ca:47:
+ 07:09:cb:e1:ee:d2:dc:9b:c8:8a:03:78:88:23:13:
+ bb:e9:25:d9:3d:de:db:b8:31:10:42:b3:fc:cf:a0:
+ 17:06:00:91:21:db:52:f6:e0:39:5b:10:26:99:b8:
+ f6:4e:82:fc:51:a5:62:8a:30:74:eb:6c:d5:3b:d7:
+ ae:3a:e3:1d:37:94:24:a4:25:4e:8f:db:5f:ce:8b:
+ 49:0c:7c:37:b0:db:cf:eb:91:bf:0b:ad:d9:27:4c:
+ ac:52:1a:21:9d:c5:de:f9:ee:94:20:f1:d5:4b:e5:
+ 79:e2:70:44:37:3f:b8:1d:8f:dd:cd:c8:45:14:78:
+ 67:86:e0:92:ca:13:df:4b:3f:7b:e4:89:67:05:28:
+ 0c:aa:15:4f:11:8b:85:a4:09:03:51:25:29:73:c9:
+ 17:a1:ef:9c:55:54:a3:3c:1c:34:7b:15:09:5f:83:
+ 94:8c:45:1f:dc:78:1d:3f:26:a8:79:e0:0f:6e:44:
+ 36:a5:dd:75:f2:f3:07:cd:3c:c0:5f:bb:7f:1b:35:
+ 71:44:e9:18:4b:31:6f:b9:29:63:23:b8:af:17:1f:
+ 58:94:f4:6c:31:6e:4b:f5:34:48:8f:10:8f:04:ba:
+ 2a:4c:d2:a0:41:03:9f:66:28:9b:f9:3e:0f:63:f8:
+ a2:fa:a5:35:ee:53:19:2b:d2:fd:86:70:0c:8d:6f:
+ 0b:d9:dc:f1:67:af:ea:ae:13:39:f2:f2:aa:b7:a4:
+ 5d:f5:bb:14:b7:5d:3d:59:67:e5:29:8d:fd:61:e9:
+ e5:19:a0:89:53:ed:2a:82:c5:1c:6e:5d:aa:1e:38:
+ 1b:93:3f:2b:bc:92:4c:d7:40:64:55:13:af:56:fa:
+ a7:3e:39:12:73:c6:4f:0f:ed:52:8b:da:4f:d2:9c:
+ ed:02:5e:ef:5e:c0:cc:df:48:ed:2f:a2:6f:fc:3c:
+ 93:14:a5:25:8e:96:f4:b6:a0:3d:db:64:b2:3b:15:
+ 2e:d2:49:0a:05:85:d8:d4:7a:ea:2f:a0:21:be:37:
+ a8:ae:fe:5a:0f:3a:d4:a8:06:13:60:1e:99:f3:6c:
+ a4:c7:46:c6:e4:5b:00:2b:84:a1:a1:3b:f5:de:2a:
+ fd:7a:38:65:9f:82:4f:1a:2c:90:4d:d3:17:81:16:
+ 87:5f:f9
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
- 16:B5:32:1B:D4:C7:F3:E0:E6:8E:F3:BD:D2:B0:3A:EE:B2:39:18:D1
+ 85:D7:05:0A:D6:8F:F2:04:2D:5E:EB:CB:FD:F6:69:8B:1F:4E:06:FE
X509v3 Authority Key Identifier:
- keyid:16:B5:32:1B:D4:C7:F3:E0:E6:8E:F3:BD:D2:B0:3A:EE:B2:39:18:D1
- DirName:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org
+ keyid:85:D7:05:0A:D6:8F:F2:04:2D:5E:EB:CB:FD:F6:69:8B:1F:4E:06:FE
+ DirName:/C=AU/ST=New South Wales/O=CAcert Testserver/OU=http://cacert1.it-sls.de/CN=CAcert Testserver Root
serial:00
X509v3 Basic Constraints: critical
CA:TRUE
- X509v3 CRL Distribution Points:
- URI:https://www.cacert.org/revoke.crl
+ Authority Information Access:
+ OCSP - URI:http://ocsp.CAcert.org/
+ CA Issuers - URI:http://www.CAcert.org/ca.crt
+
+ X509v3 Certificate Policies:
+ Policy: Security
+ CPS: http://www.CAcert.org/index.php?id=10
- Netscape CA Revocation Url:
- https://www.cacert.org/revoke.crl
Netscape CA Policy Url:
- http://www.cacert.org/index.php?id=10
+ http://www.CAcert.org/index.php?id=10
Netscape Comment:
- To get your own certificate for FREE head over to http://www.cacert.org
- Signature Algorithm: md5WithRSAEncryption
- 28:c7:ee:9c:82:02:ba:5c:80:12:ca:35:0a:1d:81:6f:89:6a:
- 99:cc:f2:68:0f:7f:a7:e1:8d:58:95:3e:bd:f2:06:c3:90:5a:
- ac:b5:60:f6:99:43:01:a3:88:70:9c:9d:62:9d:a4:87:af:67:
- 58:0d:30:36:3b:e6:ad:48:d3:cb:74:02:86:71:3e:e2:2b:03:
- 68:f1:34:62:40:46:3b:53:ea:28:f4:ac:fb:66:95:53:8a:4d:
- 5d:fd:3b:d9:60:d7:ca:79:69:3b:b1:65:92:a6:c6:81:82:5c:
- 9c:cd:eb:4d:01:8a:a5:df:11:55:aa:15:ca:1f:37:c0:82:98:
- 70:61:db:6a:7c:96:a3:8e:2e:54:3e:4f:21:a9:90:ef:dc:82:
- bf:dc:e8:45:ad:4d:90:73:08:3c:94:65:b0:04:99:76:7f:e2:
- bc:c2:6a:15:aa:97:04:37:24:d8:1e:94:4e:6d:0e:51:be:d6:
- c4:8f:ca:96:6d:f7:43:df:e8:30:65:27:3b:7b:bb:43:43:63:
- c4:43:f7:b2:ec:68:cc:e1:19:8e:22:fb:98:e1:7b:5a:3e:01:
- 37:3b:8b:08:b0:a2:f3:95:4e:1a:cb:9b:cd:9a:b1:db:b2:70:
- f0:2d:4a:db:d8:b0:e3:6f:45:48:33:12:ff:fe:3c:32:2a:54:
- f7:c4:f7:8a:f0:88:23:c2:47:fe:64:7a:71:c0:d1:1e:a6:63:
- b0:07:7e:a4:2f:d3:01:8f:dc:9f:2b:b6:c6:08:a9:0f:93:48:
- 25:fc:12:fd:9f:42:dc:f3:c4:3e:f6:57:b0:d7:dd:69:d1:06:
- 77:34:0a:4b:d2:ca:a0:ff:1c:c6:8c:c9:16:be:c4:cc:32:37:
- 68:73:5f:08:fb:51:f7:49:53:36:05:0a:95:02:4c:f2:79:1a:
- 10:f6:d8:3a:75:9c:f3:1d:f1:a2:0d:70:67:86:1b:b3:16:f5:
- 2f:e5:a4:eb:79:86:f9:3d:0b:c2:73:0b:a5:99:ac:6f:fc:67:
- b8:e5:2f:0b:a6:18:24:8d:7b:d1:48:35:29:18:40:ac:93:60:
- e1:96:86:50:b4:7a:59:d8:8f:21:0b:9f:cf:82:91:c6:3b:bf:
- 6b:dc:07:91:b9:97:56:23:aa:b6:6c:94:c6:48:06:3c:e4:ce:
- 4e:aa:e4:f6:2f:09:dc:53:6f:2e:fc:74:eb:3a:63:99:c2:a6:
- ac:89:bc:a7:b2:44:a0:0d:8a:10:e3:6c:f2:24:cb:fa:9b:9f:
- 70:47:2e:de:14:8b:d4:b2:20:09:96:a2:64:f1:24:1c:dc:a1:
- 35:9c:15:b2:d4:bc:55:2e:7d:06:f5:9c:0e:55:f4:5a:d6:93:
- da:76:ad:25:73:4c:c5:43
+ To get your own certificate for FREE, go to http://www.CAcert.org
+ Signature Algorithm: sha1WithRSAEncryption
+ d0:8d:72:43:a2:01:ff:36:25:39:dc:91:14:6b:0e:e3:10:5e:
+ ea:82:9f:2f:2e:33:b6:01:79:30:c2:97:4a:39:62:92:ea:59:
+ bd:05:05:e2:2a:ce:87:51:d5:58:c2:c7:52:4f:7d:24:4a:f1:
+ 75:74:3f:58:f6:00:a0:15:5c:8d:eb:ad:93:93:62:f0:68:fc:
+ 8a:46:af:5c:c6:55:17:c2:a2:84:73:37:c4:e3:21:4f:85:85:
+ d2:d6:08:88:18:bf:1a:49:4c:74:96:89:3a:29:64:57:36:0b:
+ 29:80:12:19:fb:4b:45:57:ef:46:2c:d4:cf:e7:2f:a8:7d:4d:
+ 8c:13:5c:70:eb:ec:cc:b4:df:eb:80:dd:97:b7:aa:15:3b:6e:
+ 2d:26:52:96:56:fa:1d:22:07:ea:f1:03:ec:73:16:47:c0:5a:
+ b2:1d:68:7c:86:c2:fc:ab:89:92:0d:96:74:07:bc:07:cb:9d:
+ 45:82:58:83:cd:ca:be:58:6f:2d:93:6f:56:57:ef:bb:b8:74:
+ 67:37:6a:ea:25:2a:06:73:dd:48:00:73:76:62:60:56:fe:60:
+ 9e:8a:a3:c7:d0:cb:35:c7:b3:a8:d4:3b:99:0b:9a:5c:d4:61:
+ b2:c4:6b:a7:db:9d:8d:c5:13:3d:8c:4c:fb:52:c5:aa:1d:10:
+ 82:cb:20:3a:4f:2a:36:13:a6:f7:81:d8:9a:b6:6a:21:5b:52:
+ 48:51:39:3e:58:e3:59:e3:5f:87:b6:0c:fe:be:11:85:cd:33:
+ a7:01:65:10:2d:aa:4f:96:53:5e:62:3b:3f:6f:55:1b:f2:fa:
+ 72:73:1d:8e:d0:55:37:64:fb:42:fb:8d:46:ae:23:c7:43:6a:
+ c9:fd:3a:10:54:8e:19:00:75:29:ec:ee:a7:e3:ea:fb:3a:78:
+ 5f:e6:ac:a5:55:eb:b1:f9:0c:f2:f8:85:76:0d:be:eb:8f:42:
+ 97:06:81:e3:5b:74:b4:84:87:c8:24:4d:31:d5:3e:4b:76:3f:
+ 98:04:5b:c2:2e:f7:7a:46:b7:0d:82:84:bf:1d:a2:80:57:fe:
+ 36:00:43:72:d5:5d:5e:04:13:fa:4c:9f:24:99:75:95:6f:24:
+ 69:cd:11:60:66:69:81:cf:a8:cb:95:ed:8c:d3:f9:1a:3c:44:
+ 76:b3:94:05:bf:1b:be:63:a9:b0:ad:0d:b7:ee:29:bd:a0:f1:
+ f3:63:89:06:bf:c7:9e:17:e0:0c:50:e9:92:0b:e3:39:8d:bd:
+ e6:f8:86:9f:0d:ec:5c:16:78:dc:85:f9:4a:59:5f:d1:44:74:
+ a3:db:c9:09:de:8a:6c:d6:58:29:93:1e:3e:4c:9a:37:33:ad:
+ 94:75:ea:69:87:0d:08:b4
-----BEGIN CERTIFICATE-----
-MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290
-IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
-IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
-Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
-BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
-MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
-ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
-CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
-8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
-zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
-fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
-w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
-G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
-epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
-laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
-QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
-fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
-YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w
-ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY
-gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe
-MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0
-IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy
-dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw
-czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0
-dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl
-aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC
-AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg
-b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB
-ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc
-nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg
-18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c
-gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl
-Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY
-sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T
-SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF
-CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum
-GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk
-zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW
-omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD
+MIIHpzCCBY+gAwIBAgIBADANBgkqhkiG9w0BAQUFADCBhzELMAkGA1UEBhMCQVUx
+GDAWBgNVBAgTD05ldyBTb3V0aCBXYWxlczEaMBgGA1UEChMRQ0FjZXJ0IFRlc3Rz
+ZXJ2ZXIxITAfBgNVBAsTGGh0dHA6Ly9jYWNlcnQxLml0LXNscy5kZTEfMB0GA1UE
+AxMWQ0FjZXJ0IFRlc3RzZXJ2ZXIgUm9vdDAeFw0xMTAzMjkyMDQ1MjBaFw0yMTAz
+MjYyMDQ1MjBaMIGHMQswCQYDVQQGEwJBVTEYMBYGA1UECBMPTmV3IFNvdXRoIFdh
+bGVzMRowGAYDVQQKExFDQWNlcnQgVGVzdHNlcnZlcjEhMB8GA1UECxMYaHR0cDov
+L2NhY2VydDEuaXQtc2xzLmRlMR8wHQYDVQQDExZDQWNlcnQgVGVzdHNlcnZlciBS
+b290MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5fvQIrtzGpSbyWam
+2kHfXMCXgRuTHSuQwbvkqdLAqtiI4ZQkF4jTy+7D6LVnDd3kw/hC1EAhcV79WuTn
+PrrpjM1JdliOOOvb5sh9SQrdT4w1IO2JBmHrykcHCcvh7tLcm8iKA3iIIxO76SXZ
+Pd7buDEQQrP8z6AXBgCRIdtS9uA5WxAmmbj2ToL8UaViijB062zVO9euOuMdN5Qk
+pCVOj9tfzotJDHw3sNvP65G/C63ZJ0ysUhohncXe+e6UIPHVS+V54nBENz+4HY/d
+zchFFHhnhuCSyhPfSz975IlnBSgMqhVPEYuFpAkDUSUpc8kXoe+cVVSjPBw0exUJ
+X4OUjEUf3HgdPyaoeeAPbkQ2pd118vMHzTzAX7t/GzVxROkYSzFvuSljI7ivFx9Y
+lPRsMW5L9TRIjxCPBLoqTNKgQQOfZiib+T4PY/ii+qU17lMZK9L9hnAMjW8L2dzx
+Z6/qrhM58vKqt6Rd9bsUt109WWflKY39YenlGaCJU+0qgsUcbl2qHjgbkz8rvJJM
+10BkVROvVvqnPjkSc8ZPD+1Si9pP0pztAl7vXsDM30jtL6Jv/DyTFKUljpb0tqA9
+22SyOxUu0kkKBYXY1HrqL6Ahvjeorv5aDzrUqAYTYB6Z82ykx0bG5FsAK4ShoTv1
+3ir9ejhln4JPGiyQTdMXgRaHX/kCAwEAAaOCAhowggIWMB0GA1UdDgQWBBSF1wUK
+1o/yBC1e68v99mmLH04G/jCBtAYDVR0jBIGsMIGpgBSF1wUK1o/yBC1e68v99mmL
+H04G/qGBjaSBijCBhzELMAkGA1UEBhMCQVUxGDAWBgNVBAgTD05ldyBTb3V0aCBX
+YWxlczEaMBgGA1UEChMRQ0FjZXJ0IFRlc3RzZXJ2ZXIxITAfBgNVBAsTGGh0dHA6
+Ly9jYWNlcnQxLml0LXNscy5kZTEfMB0GA1UEAxMWQ0FjZXJ0IFRlc3RzZXJ2ZXIg
+Um9vdIIBADAPBgNVHRMBAf8EBTADAQH/MF0GCCsGAQUFBwEBBFEwTzAjBggrBgEF
+BQcwAYYXaHR0cDovL29jc3AuQ0FjZXJ0Lm9yZy8wKAYIKwYBBQUHMAKGHGh0dHA6
+Ly93d3cuQ0FjZXJ0Lm9yZy9jYS5jcnQwRgYDVR0gBD8wPTA7BgQrBgEFMDMwMQYI
+KwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAw
+NAYJYIZIAYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZy9pbmRleC5waHA/
+aWQ9MTAwUAYJYIZIAYb4QgENBEMWQVRvIGdldCB5b3VyIG93biBjZXJ0aWZpY2F0
+ZSBmb3IgRlJFRSwgZ28gdG8gaHR0cDovL3d3dy5DQWNlcnQub3JnMA0GCSqGSIb3
+DQEBBQUAA4ICAQDQjXJDogH/NiU53JEUaw7jEF7qgp8vLjO2AXkwwpdKOWKS6lm9
+BQXiKs6HUdVYwsdST30kSvF1dD9Y9gCgFVyN662Tk2LwaPyKRq9cxlUXwqKEczfE
+4yFPhYXS1giIGL8aSUx0lok6KWRXNgspgBIZ+0tFV+9GLNTP5y+ofU2ME1xw6+zM
+tN/rgN2Xt6oVO24tJlKWVvodIgfq8QPscxZHwFqyHWh8hsL8q4mSDZZ0B7wHy51F
+gliDzcq+WG8tk29WV++7uHRnN2rqJSoGc91IAHN2YmBW/mCeiqPH0Ms1x7Oo1DuZ
+C5pc1GGyxGun252NxRM9jEz7UsWqHRCCyyA6Tyo2E6b3gdiatmohW1JIUTk+WONZ
+41+Htgz+vhGFzTOnAWUQLapPllNeYjs/b1Ub8vpycx2O0FU3ZPtC+41GriPHQ2rJ
+/ToQVI4ZAHUp7O6n4+r7Onhf5qylVeux+Qzy+IV2Db7rj0KXBoHjW3S0hIfIJE0x
+1T5Ldj+YBFvCLvd6RrcNgoS/HaKAV/42AENy1V1eBBP6TJ8kmXWVbyRpzRFgZmmB
+z6jLle2M0/kaPER2s5QFvxu+Y6mwrQ237im9oPHzY4kGv8eeF+AMUOmSC+M5jb3m
++IafDexcFnjchflKWV/RRHSj28kJ3ops1lgpkx4+TJo3M62Udepphw0ItA==
-----END CERTIFICATE-----
diff --git a/www/coap.html.php b/www/coap.html.php
index 8c2479c..6291ea2 100644
--- a/www/coap.html.php
+++ b/www/coap.html.php
@@ -29,7 +29,7 @@
<body>
-<style type="text/css">
+<style type="text/css">
table#TAB1 {border-color: rgb(173,197,215); border-top: solid 5px rgb(173,197,215); border-left: solid 5px rgb(173,197,215);}
table#TAB1 td { border: 0 }
</style>
@@ -121,7 +121,7 @@ table#TAB1 td { border: 0 }
<?php
for ( $i = 0; $i < 2; $i++ ) {
echo '<tr>', "\n", ' <td>';
- if ( $i < 1 ) { echo _("Registered Trade Names");}
+ if ( $i < 1 ) { echo _("Registered Trade Names");}
echo '</td>', "\n";
for ( $j = 1; $j <= 3; $j++ ) {
printf(" <td align=\"%s\"><input size=\"25\" maxlength=\"80\" name=\"dba%d\"></td>\n", $j > 2 ? "right" : ($j > 2 ? "center" : "left") , $i * 3 + $j);
@@ -189,7 +189,7 @@ table#TAB1 td { border: 0 }
<?php
echo _("Make sure you have read and agreed with the CAcert Community Agreement");
?>
- (<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php">CCA</a>)</i><br></td>
+ (<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.html">CCA</a>)</i><br></td>
</tr>
<tr><td colspan=2><p></td></tr>
<tr>
@@ -210,7 +210,7 @@ table#TAB1 td { border: 0 }
<?php
echo ' '. _("I agree to the CAcert Community Agreement.").' (';
?>
-<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php">CCA</a>)</dd></td>
+<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.html">CCA</a>)</dd></td>
</tr>
<tr>
<td colspan="2"><input type="checkbox" checked name="checked" value="2">
@@ -281,7 +281,7 @@ table#TAB1 td { border: 0 }
<tr><td colspan="2"></td><tr>
</tbody>
</table>
-<div style="text-align: right;"><small><small><span>&copy;
+<div style="text-align: right;"><small><small><span>&copy;
<?php
echo date('Y').' CAcert Inc., V2, '.date('Y-n-j');
?>
@@ -327,7 +327,7 @@ table#TAB1 td { border: 0 }
'http://svn.cacert.org/CAcert/Policies/OrganisationAssurancePolicy/OrganisationAssuranceSubPolicyEurope.html',
'Organisation Assurance Subpolicy for the United States' =>
'http://svn.cacert.org/CAcert/Policies/OrganisationAssurancePolicy/OrganizationAssuranceSubPolicyUnitedStates.html',
- );
+ );
$cnt = 0;
while( list($key, $ref) = each($policies) ) {
$cnt++;
@@ -338,7 +338,7 @@ table#TAB1 td { border: 0 }
}
if( $cnt > 0 ) {
echo "</dd>\n";
- }
+ }
echo "</dl>\n";
echo _("Submit the form").': <button type="submit" style="background-color: rgb(112, 154, 186); color: white;"> '._("generate PDF file");
echo "</button>\n";
diff --git a/www/coapnew.php b/www/coapnew.php
index 4f69247..5a161b4 100644
--- a/www/coapnew.php
+++ b/www/coapnew.php
@@ -70,7 +70,7 @@ define('REV', '$Revision: 1.4 $');
** On transliteration and abbreviation of a name:
** if shoes a std way show accepted conversion as pdf comment
** Orientation: on landscape (dflt) print 2-up
-** PDF URL links are used to web, wiki, and faq for more info search
+** PDF URL links are used to web, wiki, and faq for more info search
** Only on non-ascii chars in a name the utf8 routines are loaded
** PDF reader has wiki info url's and easy email feedback
** ENABLED:
@@ -94,7 +94,7 @@ define('REV', '$Revision: 1.4 $');
** recode(), recode_string(0 is said to have too many (japanese) defeats
** recode_string() is only used on GET[] input (html->utf-8),
** UTF-8 use routines from http://www.sourceforge.net/projects/phputf8
-** which replaces php recode() package.
+** which replaces php recode() package.
** on many places own utf-8 handling code exists and is loaded (tcpdf problem)
** _() translation routine. The returned HTML string is translated to utf-8 string.
** the GET() routines expects utf-8 code (see test defs) but might be changed
@@ -221,7 +221,7 @@ define('REV', '$Revision: 1.4 $');
** Form Revision string is generated from RCS revision string.
** More info on PDF fields:
** http://www.adobe.com/devnet/acrobat/pdfs/js_developer_guide.pdf
-**
+**
*/
// use next define if you test this code
@@ -281,7 +281,7 @@ if( defined( 'TEST' ) ) {
// trade office information
$_GET['identifier'] = "NL-238603-AA02";
$_GET['tor'] = "Kamer van Koophandel";
- $_GET['torregion'] = "Amsterdam";
+ $_GET['torregion'] = "Amsterdam";
//$_GET['tordate'] = "2008-04-03";
// contact name(s)
$_GET['domain1'] = "oophaga.org, oophaga.nl";
@@ -345,7 +345,7 @@ define('ARBIT', WIKI."/ArbitrationForum");
// CAcert Community Agreement
define('CCA', "CAcertCommunityAgreement"); // default policy to print
define('POLICY','policy/'); // default polciy doc directory
-define('EXT','.php'); // default polciy doc extention, should be html
+define('EXT','.html'); // default polciy doc extention, should be html
/* finger print CAcert Root Key */ // should obtain this automatically
define('CLASS1_SHA1','135C EC36 F49C B8E9 3B1A B270 CD80 8846 76CE 8F33');
define('CLASS3_SHA1','AD7C 3F64 FC44 39FE F4E9 0BE8 F47C 6CFA 8AAD FDCE');
@@ -427,7 +427,7 @@ class COAPPDF extends TCPDF {
strtok(REV, " ");
return(strtok(" "));
}
-
+
/*public*/ function myHeader( $msg = NULL, $url = NULL )
{
static $my_url = NULL;
@@ -450,7 +450,7 @@ class COAPPDF extends TCPDF {
$this->setXY($this->lMargin, MARGIN+3);
$this->y0 = $this->getY();
}
-
+
// undefine default header and footer handling
// default routines do not handle columns
function Footer() { }
@@ -458,7 +458,7 @@ class COAPPDF extends TCPDF {
function Mark( $string = "" ) {
return array( $string, 1+substr_count($string,'.') );
}
-
+
/*public*/ function myFooter( $msg = NULL, $url = NULL )
{
static $my_url = NULL;
@@ -501,7 +501,7 @@ class COAPPDF extends TCPDF {
$this->StopTransform();
$this->SetXY($savex,$savey);
}
-
+
if( !empty($font_fam ) )
$this->SetFont($font_fam,$font_style,$font_size);
$this->InFooter = false;
@@ -519,16 +519,16 @@ class COAPPDF extends TCPDF {
//number of colums
/*protected*/ var $ncols=1;
-
+
// columns width
/*protected*/ var $colwidth=0;
// space between columns
/*protected*/ var $column_space = 0;
-
+
//Current column
/*protected*/ var $col=0;
-
+
//Ordinate of column start
/*protected*/ var $y0;
@@ -570,7 +570,7 @@ class COAPPDF extends TCPDF {
$this->SetDisplayMode(intval($this->scale), 'SinglePage', 'UseOC');
return( $format );
}
-
+
//Set position at a given column
/*private*/ function SetCol($col = -1) {
static $pagecolwidth = 1.0;
@@ -610,7 +610,7 @@ class COAPPDF extends TCPDF {
$this->myFooter(); // print footer msg if defined
}
if( $col >= $this->ncols ) {
- $this->addPage(); $col = 0;
+ $this->addPage(); $col = 0;
$this->ScaleXY($this->scale,0,0);
$this->y0 = 0; //no header/footer done...
} elseif ( $col > 0 AND $col < $this->ncols) {
@@ -710,7 +710,7 @@ class COAPPDF extends TCPDF {
elseif( preg_match('/\./', $nm ) ) {
if( $first_name < 0 ) $first_name = $j;
if( $first_name >= 0 ) $success = TRUE; // was abbreviated
- continue; // title
+ continue; // title
}
if( $first_name < 0 ) $first_name = $j;
if( $married == 0 ) $fam = $j;
@@ -732,7 +732,7 @@ class COAPPDF extends TCPDF {
elseif( preg_match('/\./', $nm ) ) $name .= $nm;
elseif( $j < $fam ) { // need to abbreviate
// not utf8
- // and abbreviate
+ // and abbreviate
if( $j == $first_name )
$abr = "(". $substr( $nm, 1 ) . ")";
else $abr = ".";
@@ -746,7 +746,7 @@ class COAPPDF extends TCPDF {
$nm = $tk[0];
if( $ext < 0 AND preg_match('/(^[^A-Z]|\.)/', $nm ) ) continue;
if( $ext < 0 ) $ext = $j+1;
- if( preg_match('/\./', $nm ) ) { $success = TRUE; break; }
+ if( preg_match('/\./', $nm ) ) { $success = TRUE; break; }
}
return( $success? $name : "" ); // and return abbriviated name
}
@@ -859,7 +859,7 @@ class COAPPDF extends TCPDF {
$this->StatementOrganisation($organisation);
$this->StatementAssurer( $assurer, $assurance );
}
-
+
//Add form and/or CCA (on duplex only when more as one page is printed)
/*public*/ function PrintForm( $organisation = NULL, $registry = NULL, $assurer = NULL, $page = NULL ) {
@@ -1045,7 +1045,7 @@ class COAPPDF extends TCPDF {
$this->Line($this->lMargin,$tSide+$height,$this->lMargin+$this->colwidth,$tSide+$height);
$this->Line($this->lMargin+$this->colwidth,$tSide-1, $this->lMargin+$this->colwidth, $tSide+$height);
$this->SetDrawColor(0);
- $this->SetY($tSide + $height + 1); // set Y ordinate to plus 7
+ $this->SetY($tSide + $height + 1); // set Y ordinate to plus 7
$tSide = -1; $title = "";
return($this->GetY());
}
@@ -1078,7 +1078,7 @@ class COAPPDF extends TCPDF {
if ( BW ) {
$this->SetFillColor(241);
} else {
- //$this->SetFillColor(173,197,215);
+ //$this->SetFillColor(173,197,215);
$this->SetFillColor(234, 241, 246);
}
$this->Rect($this->lMargin+37.5,$this->GetY()+0.1,
@@ -1141,7 +1141,7 @@ class COAPPDF extends TCPDF {
if( $phone ) {
$TextProps['value'] = $phone ? $phone : $this->unhtmlentities( _('phone nr') ) . "?";
$TextProps['userName'] = $this->unhtmlentities( _('For organisation administrators and assurer: provide email address and optionally your phone number.') );
- $this->TextField($field.'Phone', $this->SetFieldXY($this->lMargin+$this->colwidth-25, $savey, 24), 4.5, $TextProps );
+ $this->TextField($field.'Phone', $this->SetFieldXY($this->lMargin+$this->colwidth-25, $savey, 24), 4.5, $TextProps );
$this->SetFieldXY();
}
$savey += 3;
@@ -1156,7 +1156,7 @@ class COAPPDF extends TCPDF {
if( $email ) {
$TextProps['value'] = $email ? $email : $this->unhtmlentities( _('email') ) . "?";
$TextProps['userName'] = $this->unhtmlentities( _('For organisation administrators and assurer: provide email address and optionally your phone number.') );
- $this->TextField($field.'Email', $this->SetFieldXY($this->lMargin+2+$l, $savey, $this->colwidth-$l-28), 4.5, $TextProps);
+ $this->TextField($field.'Email', $this->SetFieldXY($this->lMargin+2+$l, $savey, $this->colwidth-$l-28), 4.5, $TextProps);
$this->SetFieldXY(); $savey += 3;
}
// phone number
@@ -1166,7 +1166,7 @@ class COAPPDF extends TCPDF {
}
// All information of Applicant goes in one table
-/*public*/ function InfoOrganisation( $organisation = NULL, $registry = NULL ){
+/*public*/ function InfoOrganisation( $organisation = NULL, $registry = NULL ){
// Applicant Identity information part
$tSide = $this->PrintTable($this->unhtmlentities( _('Organisation Identity Information') ))+1;
@@ -1220,7 +1220,7 @@ class COAPPDF extends TCPDF {
$strg,
NULL, NULL, true);
$this->Ln(0.4);
- $strg = ""; foreach( $organisation['domains'] as $i )
+ $strg = ""; foreach( $organisation['domains'] as $i )
$strg .= ($strg != "" ? ", " : "") . $i;
$this->PrintName(
$this->unhtmlentities( _('The internet domain name(s) the organisation controls and owns. The names will be checked with WHOIS with e.g. the DNS official top domain registrar e.g. the country ccTLD .<country code> registrar.') ),
@@ -1233,7 +1233,7 @@ class COAPPDF extends TCPDF {
// contact info o-admin address assuree
$cnt = $organisation['admincnt'];
$space = $this->getPageHeight()/$this->scale*100.0 -MINH ; // margin
- for( $i = 0; $i < $cnt; $i++ ) { // names to be printed
+ for( $i = 0; $i < $cnt; $i++ ) { // names to be printed
$this->PrintName(
$this->unhtmlentities( _('The organisation administrator (CAcert Assurer) contact information. The administrator is appointed by the organisation director to administer the organisation domain certificates, secure the certificates and maintain them.') ),
$this->unhtmlentities( _('Organisation Administrator') ),
@@ -1400,7 +1400,7 @@ class COAPPDF extends TCPDF {
// get $form, $orientation, $assuree, $assurer, $assurance info
// FONT and BW are set already
-// import info
+// import info
$utf8 = false;
function GET( $key = "" ) {
global $utf8;
@@ -1457,7 +1457,7 @@ $registry = array (
$organisation = array (
'names' => array( ), // [0] full name, [>0] DBA's
'namecnt' => 0,
- 'date' => my_recode(GET('date')) == "now" ? date("Y-m-d") :
+ 'date' => my_recode(GET('date')) == "now" ? date("Y-m-d") :
my_recode(GET('date')),
'address' => my_recode(GET('address')),
'state' => my_recode(GET('state')),
@@ -1507,7 +1507,7 @@ for( $i = 0; $i <= 25 AND $j < 2; $i++ ) {
if( $domains != "" ) $domains .= ",";
$domains .= strtolower($name);
} else $j ++;
-}
+}
$i = 0;
if( $domains ) { // csv list to array and trim white spaces
$domains = strtok($domains,',');
@@ -1547,7 +1547,7 @@ unset( $i ); unset( $j); unset( $utf8 ); // unset($_GET);
PDF_UNIT /* mm */,
/* PDF_PAGE_FORMAT */ $page['format'],
true
- );
+ );
$pdf->SetFormat( $page['format'] ); // set paper size scaling
// protection is encryption and this will cause 3.5 times performance loss
@@ -1570,10 +1570,10 @@ unset( $i ); unset( $j); unset( $utf8 ); // unset($_GET);
$pdf->SetAutoPageBreak(TRUE, MARGIN*0.707);
//set image scale factor
- $pdf->setImageScale(PDF_IMAGE_SCALE_RATIO);
+ $pdf->setImageScale(PDF_IMAGE_SCALE_RATIO);
//set some language-dependent strings
- $pdf->setLanguageArray($l);
+ $pdf->setLanguageArray($l);
//initialize document
$pdf->AliasNbPages();
@@ -1589,6 +1589,6 @@ unset( $i ); unset( $j); unset( $utf8 ); // unset($_GET);
$pdf->Output("CAcert COAP.pdf", "I");
//============================================================+
-// END OF FILE
+// END OF FILE
//============================================================+
?>
diff --git a/www/disputes.php b/www/disputes.php
index 34a447a..eab3d68 100644
--- a/www/disputes.php
+++ b/www/disputes.php
@@ -17,6 +17,7 @@
*/ ?>
<?
require_once("../includes/loggedin.php");
+ require_once("../includes/lib/l10n.php");
require_once("../includes/notary.inc.php");
loadem("account");
@@ -27,7 +28,7 @@
if($type == "reallyemail")
{
$emailid = intval($_SESSION['_config']['emailid']);
- $hash = mysql_escape_string(trim($_SESSION['_config']['hash']));
+ $hash = mysql_real_escape_string(trim($_SESSION['_config']['hash']));
$res = mysql_query("select * from `disputeemail` where `id`='$emailid' and `hash`='$hash'");
if(mysql_num_rows($res) <= 0)
@@ -80,7 +81,7 @@
if($type == "email")
{
$emailid = intval($_REQUEST['emailid']);
- $hash = trim(mysql_escape_string(stripslashes($_REQUEST['hash'])));
+ $hash = trim(mysql_real_escape_string(stripslashes($_REQUEST['hash'])));
if($emailid <= 0 || $hash == "")
{
showheader(_("Email Dispute"));
@@ -126,7 +127,7 @@
if($type == "reallydomain")
{
$domainid = intval($_SESSION['_config']['domainid']);
- $hash = mysql_escape_string(trim($_SESSION['_config']['hash']));
+ $hash = mysql_real_escape_string(trim($_SESSION['_config']['hash']));
$res = mysql_query("select * from `disputedomain` where `id`='$domainid' and `hash`='$hash'");
if(mysql_num_rows($res) <= 0)
@@ -167,7 +168,7 @@
if($type == "domain")
{
$domainid = intval($_REQUEST['domainid']);
- $hash = trim(mysql_escape_string(stripslashes($_REQUEST['hash'])));
+ $hash = trim(mysql_real_escape_string(stripslashes($_REQUEST['hash'])));
if($domainid <= 0 || $hash == "")
{
showheader(_("Domain Dispute"));
@@ -213,7 +214,7 @@
if($oldid == "1")
{
csrf_check('emaildispute');
- $email = trim(mysql_escape_string(stripslashes($_REQUEST['dispute'])));
+ $email = trim(mysql_real_escape_string(stripslashes($_REQUEST['dispute'])));
if($email == "")
{
showheader(_("Email Dispute"));
@@ -287,11 +288,15 @@
`IP`='".$_SERVER['REMOTE_ADDR']."'";
mysql_query($query);
+ $my_translation = L10n::get_translation();
+ L10n::set_recipient_language($oldmemid);
+
$body = sprintf(_("You have been sent this email as the email address '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $email)."\n\n";
$body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=email&emailid=$emailid&hash=$hash\n\n";
$body .= _("Best regards")."\n"._("CAcert.org Support!");
sendmail($email, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "", "", "CAcert Support");
+ L10n::set_translation($my_translation);
showheader(_("Email Dispute"));
printf(_("The email address '%s' has been entered into the dispute system, the email address will now be sent an email which will give the recipent the option of accepting or rejecting the request, if after 2 days we haven't received a valid response for or against we will discard the request."), sanitizeHTML($email));
@@ -302,7 +307,7 @@
if($oldid == "2")
{
csrf_check('domaindispute');
- $domain = trim(mysql_escape_string(stripslashes($_REQUEST['dispute'])));
+ $domain = trim(mysql_real_escape_string(stripslashes($_REQUEST['dispute'])));
if($domain == "")
{
showheader(_("Domain Dispute"));
@@ -384,7 +389,7 @@
$bits = explode(":", $line, 2);
$line = trim($bits[1]);
if(!in_array($line, $addy) && $line != "")
- $addy[] = trim(mysql_escape_string(stripslashes($line)));
+ $addy[] = trim(mysql_real_escape_string(stripslashes($line)));
}
} else {
if(is_array($adds))
@@ -401,7 +406,7 @@
$line = $bit;
}
if(!in_array($line, $addy) && $line != "")
- $addy[] = trim(mysql_escape_string(stripslashes($line)));
+ $addy[] = trim(mysql_real_escape_string(stripslashes($line)));
}
}
@@ -418,7 +423,7 @@
if($oldid == "5")
{
- $authaddy = trim(mysql_escape_string(stripslashes($_REQUEST['authaddy'])));
+ $authaddy = trim(mysql_real_escape_string(stripslashes($_REQUEST['authaddy'])));
if(!in_array($authaddy, $_SESSION['_config']['addy']) || $authaddy == "")
{
@@ -441,16 +446,19 @@
$domainid = intval($_SESSION['_config']['domainid']);
$memid = intval($_SESSION['_config']['memid']);
$oldmemid = intval($_SESSION['_config']['oldmemid']);
- $domain = mysql_escape_string($_SESSION['_config']['domain']);
+ $domain = mysql_real_escape_string($_SESSION['_config']['domain']);
$hash = make_hash();
$query = "insert into `disputedomain` set `domain`='$domain',`memid`='".$_SESSION['profile']['id']."',
`oldmemid`='$oldmemid',`created`=NOW(),`hash`='$hash',`id`='$domainid'";
mysql_query($query);
+ $my_translation = L10n::get_translation();
+ L10n::set_recipient_language($oldmemid);
$body = sprintf(_("You have been sent this email as the domain '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $domain)."\n\n";
$body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=domain&domainid=$domainid&hash=$hash\n\n";
$body .= _("Best regards")."\n"._("CAcert.org Support!");
+ L10n::set_recipient_language($my_translation);
sendmail($authaddy, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "", "", "CAcert Support");
diff --git a/www/gpg.php b/www/gpg.php
index 829bbcf..cb72475 100644
--- a/www/gpg.php
+++ b/www/gpg.php
@@ -63,12 +63,18 @@ if(0)
function verifyName($name)
{
if($name == "") return 0;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']) return 1;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']) return 1;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1;
- if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1;
- return 0;
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname'])) return 1; // John Doe
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname'])) return 1; // John Joseph Doe
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0]." ".$_SESSION['profile']['lname'])) return 1; // John J Doe
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0].". ".$_SESSION['profile']['lname'])) return 1; // John J. Doe
+
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; // John Doe Jr.
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John Joseph Doe Jr.
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0]." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John J Doe Jr.
+ if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0].". ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John J. Doe Jr.
+
+ return 0;
}
function verifyEmail($email)
@@ -106,7 +112,7 @@ function verifyEmail($email)
clean_gpgcsr($CSR),
$gpg);
- `rm -r $tmpdir`;
+ shell_exec("rm -r $tmpdir");
}
if ($err)
@@ -187,18 +193,18 @@ function verifyEmail($email)
// Name (Comment) <Email>
if(preg_match("/^([^\(\)\[@<>]+) \(([^\(\)@<>]*)\) <([\w=\/%.-]*\@[\w.-]*|[\w.-]*\![\w=\/%.-]*)>/",$bits[9],$matches))
{
- $name=trim(hex2bin($matches[1]));
+ $name=trim(gpg_hex2bin($matches[1]));
$nocomment=0;
- $comm=trim(hex2bin($matches[2]));
- $mail=trim(hex2bin($matches[3]));
+ $comm=trim(gpg_hex2bin($matches[2]));
+ $mail=trim(gpg_hex2bin($matches[3]));
}
// Name <EMail>
elseif(preg_match("/^([^\(\)\[@<>]+) <([\w=\/%.-]*\@[\w.-]*|[\w.-]*\![\w=\/%.-]*)>/",$bits[9],$matches))
{
- $name=trim(hex2bin($matches[1]));
+ $name=trim(gpg_hex2bin($matches[1]));
$nocomment=1;
$comm="";
- $mail=trim(hex2bin($matches[2]));
+ $mail=trim(gpg_hex2bin($matches[2]));
}
// Unrecognized format
else
@@ -334,7 +340,7 @@ function verifyEmail($email)
$cmd_keyid = escapeshellarg($keyid);
- $gpg = trim(`gpg --homedir $cwd --with-colons --fixed-list-mode --list-keys $cmd_keyid 2>&1`);
+ $gpg = trim(shell_exec("gpg --homedir $cwd --with-colons --fixed-list-mode --list-keys $cmd_keyid 2>&1"));
$lines = "";
$gpgarr = explode("\n", $gpg);
foreach($gpgarr as $line)
@@ -357,13 +363,13 @@ function verifyEmail($email)
$pos = strlen($bits[9]);
}
- $name = trim(hex2bin(trim(substr($bits[9], 0, $pos))));
+ $name = trim(gpg_hex2bin(trim(substr($bits[9], 0, $pos))));
$nameok=verifyName($name);
if($nocomment == 0)
{
$pos += 2;
$pos2 = strpos($bits[9], ")");
- $comm = trim(hex2bin(trim(substr($bits[9], $pos, $pos2 - $pos))));
+ $comm = trim(gpg_hex2bin(trim(substr($bits[9], $pos, $pos2 - $pos))));
if($comm != "")
$comment[] = $comm;
$pos = $pos2 + 3;
@@ -374,7 +380,7 @@ function verifyEmail($email)
$mail="";
if (preg_match("/<([\w.-]*\@[\w.-]*)>/", $bits[9],$match)) {
//echo "Found: ".$match[1];
- $mail = trim(hex2bin($match[1]));
+ $mail = trim(gpg_hex2bin($match[1]));
}
else
{
@@ -519,7 +525,7 @@ function verifyEmail($email)
$csrname=generatecertpath("csr","gpg",$insert_id);
$cmd_keyid = escapeshellarg($keyid);
- $do=`gpg --homedir $cwd --batch --export-options export-minimal --export $cmd_keyid >$csrname`;
+ $do=shell_exec("gpg --homedir $cwd --batch --export-options export-minimal --export $cmd_keyid >$csrname");
mysql_query("update `gpg` set `csr`='$csrname' where `id`='$insert_id'");
waitForResult('gpg', $insert_id);
diff --git a/www/images/cacert4.png b/www/images/cacert4.png
index e4650a0..9da24c2 100644
--- a/www/images/cacert4.png
+++ b/www/images/cacert4.png
Binary files differ
diff --git a/www/index.php b/www/index.php
index c7cc03e..3f76009 100644
--- a/www/index.php
+++ b/www/index.php
@@ -17,7 +17,7 @@
*/
require_once('../includes/lib/l10n.php');
-
+require_once('../includes/notary.inc.php');
$id = 0; if(array_key_exists("id",$_REQUEST)) $id=intval($_REQUEST['id']);
$oldid = 0; if(array_key_exists("oldid",$_REQUEST)) $oldid=intval($_REQUEST['oldid']);
@@ -53,7 +53,7 @@ require_once('../includes/lib/l10n.php');
$oldid = 0;
if(array_key_exists('Q1',$_REQUEST) && $_REQUEST['Q1'])
{
- $_SESSION['lostpw']['A1'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A1']))));
+ $_SESSION['lostpw']['A1'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A1']))));
if(stripslashes(strtolower($_SESSION['lostpw']['A1'])) == strtolower($_SESSION['lostpw']['user']['A1']))
$answers++;
@@ -61,7 +61,7 @@ require_once('../includes/lib/l10n.php');
}
if(array_key_exists('Q2',$_REQUEST) && $_REQUEST['Q2'])
{
- $_SESSION['lostpw']['A2'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A2']))));
+ $_SESSION['lostpw']['A2'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A2']))));
if(stripslashes(strtolower($_SESSION['lostpw']['A2'])) == strtolower($_SESSION['lostpw']['user']['A2']))
$answers++;
@@ -69,7 +69,7 @@ require_once('../includes/lib/l10n.php');
}
if(array_key_exists('Q3',$_REQUEST) && $_REQUEST['Q3'])
{
- $_SESSION['lostpw']['A3'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A3']))));
+ $_SESSION['lostpw']['A3'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A3']))));
if(stripslashes(strtolower($_SESSION['lostpw']['A3'])) == strtolower($_SESSION['lostpw']['user']['A3']))
$answers++;
@@ -77,7 +77,7 @@ require_once('../includes/lib/l10n.php');
}
if(array_key_exists('Q4',$_REQUEST) && $_REQUEST['Q4'])
{
- $_SESSION['lostpw']['A4'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A4']))));
+ $_SESSION['lostpw']['A4'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A4']))));
if(stripslashes(strtolower($_SESSION['lostpw']['A4'])) == strtolower($_SESSION['lostpw']['user']['A4']))
$answers++;
@@ -85,15 +85,15 @@ require_once('../includes/lib/l10n.php');
}
if(array_key_exists('Q5',$_REQUEST) && $_REQUEST['Q5'])
{
- $_SESSION['lostpw']['A5'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A5']))));
+ $_SESSION['lostpw']['A5'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A5']))));
if(stripslashes(strtolower($_SESSION['lostpw']['A5'])) == strtolower($_SESSION['lostpw']['user']['A5']))
$answers++;
$body .= "System: ".$_SESSION['lostpw']['user']['A5']."\nEntered: ".stripslashes(strip_tags($_SESSION['lostpw']['A5']))."\n";
}
- $_SESSION['lostpw']['pw1'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['newpass1']))));
- $_SESSION['lostpw']['pw2'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['newpass2']))));
+ $_SESSION['lostpw']['pw1'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['newpass1']))));
+ $_SESSION['lostpw']['pw2'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['newpass2']))));
if($answers < $_SESSION['lostpw']['total'] || $answers < 3)
{
@@ -125,12 +125,12 @@ require_once('../includes/lib/l10n.php');
showfooter();
exit;
}
- }
+ }
}
if($oldid == 5 && $process != "")
{
- $email = $_SESSION['lostpw']['email'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['email']))));
+ $email = $_SESSION['lostpw']['email'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['email']))));
$_SESSION['lostpw']['day'] = intval($_REQUEST['day']);
$_SESSION['lostpw']['month'] = intval($_REQUEST['month']);
$_SESSION['lostpw']['year'] = intval($_REQUEST['year']);
@@ -141,25 +141,33 @@ require_once('../includes/lib/l10n.php');
{
$id = $oldid;
$oldid = 0;
- $_SESSION['_config']['errmsg'] = _("Unable to match your details with any user accounts on file");
+ $_SESSION['_config']['errmsg'] = _('Unable to match your details with any user accounts on file');
} else {
- $id = 6;
$_SESSION['lostpw']['user'] = mysql_fetch_assoc($res);
+ //check wether account is locked or deleted
+ if ($_SESSION['lostpw']['user']['locked'] == 1 || $_SESSION['lostpw']['user']['deleted'] != 0) {
+ $id = $oldid;
+ $oldid = 0;
+ $_SESSION['_config']['errmsg'] = printf(_('The account is not available, please get in contact with support(%s).'),'support@cacert.org');
+ } else {
+ $id = 6;
+ }
}
}
+ //client login
if($id == 4 && $_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'])
{
include_once("../includes/lib/general.php");
$user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'],
$_SERVER['SSL_CLIENT_I_DN_CN']);
-
+
if($user_id >= 0)
{
$_SESSION['profile'] = mysql_fetch_assoc(mysql_query(
- "select * from `users` where
+ "select * from `users` where
`id`='$user_id' and `deleted`=0 and `locked`=0"));
-
+
if($_SESSION['profile']['id'] != 0)
{
$_SESSION['profile']['loggedin'] = 1;
@@ -171,6 +179,7 @@ require_once('../includes/lib/l10n.php');
}
}
+
if($id == 4 && array_key_exists('profile',$_SESSION) && array_key_exists('loggedin',array($_SESSION['profile'])) && $_SESSION['profile']['loggedin'] == 1)
{
header("location: https://".$_SERVER['HTTP_HOST']."/account.php");
@@ -251,8 +260,8 @@ require_once('../includes/lib/l10n.php');
$_SESSION['_config']['errmsg'] = "";
- $email = mysql_escape_string(stripslashes(strip_tags(trim($_REQUEST['email']))));
- $pword = mysql_escape_string(stripslashes(trim($_REQUEST['pword'])));
+ $email = mysql_real_escape_string(stripslashes(strip_tags(trim($_REQUEST['email']))));
+ $pword = mysql_real_escape_string(stripslashes(trim($_REQUEST['pword'])));
$query = "select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or
`password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0";
$res = mysql_query($query);
@@ -307,19 +316,19 @@ require_once('../includes/lib/l10n.php');
$_SESSION['profile'] = "";
unset($_SESSION['profile']);
$_SESSION['profile'] = mysql_fetch_assoc($res);
- $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".$_SESSION['profile']['id']."'";
+ $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
if($_SESSION['profile']['language'] == "")
{
$query = "update `users` set `language`='".L10n::get_translation()."'
- where `id`='".$_SESSION['profile']['id']."'";
+ where `id`='".intval($_SESSION['profile']['id'])."'";
mysql_query($query);
} else {
L10n::set_translation($_SESSION['profile']['language']);
L10n::init_gettext();
}
- $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
+ $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0 group by `to`";
$res = mysql_query($query);
$row = mysql_fetch_assoc($res);
$_SESSION['profile']['points'] = $row['total'];
@@ -331,12 +340,16 @@ require_once('../includes/lib/l10n.php');
$_SESSION['_config']['errmsg'] .= _("For your own security you must enter 5 lost password questions and answers.")."<br>";
$_SESSION['_config']['oldlocation'] = "account.php?id=13";
}
+ if (!isset($_SESSION['_config']['oldlocation'])){
+ $_SESSION['_config']['oldlocation']='';
+ }
if (checkpwlight($pword) < 3)
$_SESSION['_config']['oldlocation'] = "account.php?id=14&force=1";
- if($_SESSION['_config']['oldlocation'] != "")
+ if($_SESSION['_config']['oldlocation'] != ""){
header("location: https://".$_SERVER['HTTP_HOST']."/".$_SESSION['_config']['oldlocation']);
- else
+ }else{
header("location: https://".$_SERVER['HTTP_HOST']."/account.php");
+ }
exit;
}
@@ -351,6 +364,40 @@ require_once('../includes/lib/l10n.php');
}
}
+// check for CCA acceptance prior to login
+if ($oldid == 52 )
+{
+ // Check if the user is already authenticated
+ if (!array_key_exists('profile',$_SESSION)
+ || !array_key_exists('loggedin',$_SESSION['profile'])
+ || $_SESSION['profile']['loggedin'] != 1)
+ {
+ header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4");
+ exit;
+ }
+
+ if (array_key_exists('agree',$_REQUEST) && $_REQUEST['agree'] != "")
+ {
+ write_user_agreement($_SESSION['profile']['id'], "CCA", "Login acception", "", 1);
+ $_SESSION['profile']['ccaagreement']=get_user_agreement_status($_SESSION['profile']['id'],'CCA');
+
+ if (array_key_exists("oldlocation",$_SESSION['_config'])
+ && $_SESSION['_config']['oldlocation']!="")
+ {
+ header("Location: https://{$_SERVER['HTTP_HOST']}/{$_SESSION['_config']['oldlocation']}");
+ exit;
+ } else {
+ header("Location: https://{$_SERVER['HTTP_HOST']}/account.php");
+ exit;
+ }
+ }
+
+ // User didn't agree
+ header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4");
+ exit;
+}
+
+
if($process && $oldid == 1)
{
$id = 2;
@@ -358,26 +405,26 @@ require_once('../includes/lib/l10n.php');
$_SESSION['_config']['errmsg'] = "";
- $_SESSION['signup']['email'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['email']))));
- $_SESSION['signup']['fname'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['fname']))));
- $_SESSION['signup']['mname'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['mname']))));
- $_SESSION['signup']['lname'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['lname']))));
- $_SESSION['signup']['suffix'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['suffix']))));
+ $_SESSION['signup']['email'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['email']))));
+ $_SESSION['signup']['fname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['fname']))));
+ $_SESSION['signup']['mname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['mname']))));
+ $_SESSION['signup']['lname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['lname']))));
+ $_SESSION['signup']['suffix'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['suffix']))));
$_SESSION['signup']['day'] = intval($_REQUEST['day']);
$_SESSION['signup']['month'] = intval($_REQUEST['month']);
$_SESSION['signup']['year'] = intval($_REQUEST['year']);
- $_SESSION['signup']['pword1'] = trim(mysql_escape_string(stripslashes($_REQUEST['pword1'])));
- $_SESSION['signup']['pword2'] = trim(mysql_escape_string(stripslashes($_REQUEST['pword2'])));
- $_SESSION['signup']['Q1'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['Q1']))));
- $_SESSION['signup']['Q2'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['Q2']))));
- $_SESSION['signup']['Q3'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['Q3']))));
- $_SESSION['signup']['Q4'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['Q4']))));
- $_SESSION['signup']['Q5'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['Q5']))));
- $_SESSION['signup']['A1'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A1']))));
- $_SESSION['signup']['A2'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A2']))));
- $_SESSION['signup']['A3'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A3']))));
- $_SESSION['signup']['A4'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A4']))));
- $_SESSION['signup']['A5'] = trim(mysql_escape_string(stripslashes(strip_tags($_REQUEST['A5']))));
+ $_SESSION['signup']['pword1'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['pword1'])));
+ $_SESSION['signup']['pword2'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['pword2'])));
+ $_SESSION['signup']['Q1'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q1']))));
+ $_SESSION['signup']['Q2'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q2']))));
+ $_SESSION['signup']['Q3'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q3']))));
+ $_SESSION['signup']['Q4'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q4']))));
+ $_SESSION['signup']['Q5'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q5']))));
+ $_SESSION['signup']['A1'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A1']))));
+ $_SESSION['signup']['A2'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A2']))));
+ $_SESSION['signup']['A3'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A3']))));
+ $_SESSION['signup']['A4'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A4']))));
+ $_SESSION['signup']['A5'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A5']))));
$_SESSION['signup']['general'] = intval(array_key_exists('general',$_REQUEST)?$_REQUEST['general']:0);
$_SESSION['signup']['country'] = intval(array_key_exists('country',$_REQUEST)?$_REQUEST['country']:0);
$_SESSION['signup']['regional'] = intval(array_key_exists('regional',$_REQUEST)?$_REQUEST['regional']:0);
@@ -466,7 +513,7 @@ require_once('../includes/lib/l10n.php');
if($score < 3)
{
$id = 1;
- $_SESSION['_config']['errmsg'] = _("The Pass Phrase you submitted failed to contain enough differing characters and/or contained words from your name and/or email address. Only scored $score points out of 6.");
+ $_SESSION['_config']['errmsg'] = sprintf(_("The Pass Phrase you submitted failed to contain enough differing characters and/or contained words from your name and/or email address. Only scored %s points out of 6."), $score);
}
if($id == 2)
@@ -499,7 +546,7 @@ require_once('../includes/lib/l10n.php');
if($checkemail != "OK")
{
$id = 1;
- if (substr($checkemail, 0, 1) == "4")
+ if (substr($checkemail, 0, 1) == "4")
{
$_SESSION['_config']['errmsg'] .= _("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.");
} else {
@@ -545,7 +592,6 @@ require_once('../includes/lib/l10n.php');
`regional`='".$_SESSION['signup']['regional']."',
`radius`='".$_SESSION['signup']['radius']."'";
mysql_query($query);
- include_once("../includes/notary.inc.php");
write_user_agreement($memid, "CCA", "account creation", "", 1);
$body = _("Thanks for signing up with CAcert.org, below is the link you need to open to verify your account. Once your account is verified you will be able to start issuing certificates till your hearts' content!")."\n\n";
@@ -566,9 +612,9 @@ require_once('../includes/lib/l10n.php');
$subject = stripslashes($_REQUEST['subject']);
$message = stripslashes($_REQUEST['message']);
$secrethash = $_REQUEST['secrethash2'];
-
+
//check for spam via honeypot
- if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
+ if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){
echo _("Form could not be sent.");
showfooter();
exit;
@@ -641,7 +687,7 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/FAQ/AboutUs';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
if ($id == 19)
{
$protocol = $_SERVER['HTTPS'] ? 'https' : 'http';
@@ -655,7 +701,8 @@ require_once('../includes/lib/l10n.php');
$newUrl = $protocol . '://wiki.cacert.org/Board';
header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved
}
-
+
+
showheader(_("Welcome to CAcert.org"));
includeit($id);
showfooter();
diff --git a/www/policy/AssurancePolicy.html b/www/policy/AssurancePolicy.html
new file mode 100644
index 0000000..ef72454
--- /dev/null
+++ b/www/policy/AssurancePolicy.html
@@ -0,0 +1,750 @@
+<!DOCTYPE html>
+<html><head>
+ <meta http-equiv="CONTENT-TYPE" content="text/html; charset=utf-8">
+<title>Assurance Policy</title>
+
+<!--meta name="CREATED" content="20080530;0" -->
+<!--meta name="CHANGEDBY" content="Teus Hagen" -->
+<!--meta name="CHANGED" content="20080709;12381800" -->
+<!--meta name="CREATEDBY" content="Ian Grigg" -->
+<!--meta name="CHANGEDBY" content="Teus Hagen" -->
+<!--meta name="CHANGEDBY" content="Robert Cruikshank" -->
+<!--meta name="CHANGEDBY" content="Teus Hagen" -->
+<style type="text/css">
+
+P { color: #000000 }
+TD P { color: #000000 }
+H1 { color: #000000 }
+H2 { color: #000000 }
+DT { color: #000000; font-style: italic; }
+DD { color: #000000 }
+H3 { color: #000000 }
+TH P { color: #000000 }
+.r{ text-align: right; }
+.l{ text-align: left; }
+.c{ text-align : center; }
+.vTop{ vertical-align: top; }
+.size075{font-size: .75em;}
+.size1{font-size: 1.1em;}
+.size2{font-size: 1.5em;}
+.size3{font-size: 2em;}
+.parentC {margin-left:auto; margin-right:auto;}
+.padding5 td{padding: 5px;}
+.padding2 td{padding: 2px;}
+.margin0 {margin: 0px;}
+
+</style></head>
+<body style="direction: ltr; color: rgb(0, 0, 0);" lang="en-GB">
+
+<div class="comment">
+<table style="width: 100%;">
+
+<tr>
+<td>
+ Name: AP <a style="color: steelblue" href="https://svn.cacert.org/CAcert/Policies/ControlledDocumentList.html">COD13</a><br>
+ Status: POLICY <a style="color: steelblue" href="https://wiki.cacert.org/PolicyDecisions#p20090105.2">p20090105.2</a><br>
+Editor: <a style="color: steelblue" href="https://wiki.cacert.org/TeusHagen">Teus Hagen</a><br>
+Creation date: 2008-05-30<br>
+Last change by: Iang<br>
+Last change date: 2009-01-08<br>
+ Licence: <a style="color: steelblue" href="https://wiki.cacert.org/Policy#Licence" title="this document is Copyright &copy; CAcert Inc., licensed openly under CC-by-sa with all disputes resolved under DRP. More at wiki.cacert.org/Policy" > CC-by-sa+DRP </a><br>
+
+</td>
+<td class="r vTop">
+ <a href="https://www.cacert.org/policy/PolicyOnPolicy.html"><img src="images/cacert-policy.png" alt="AP Status - POLICY" height="31" width="88" style="border-style: none;"></a>
+
+</td>
+</tr>
+</table>
+</div>
+
+
+<h1>Assurance Policy for CAcert Community Members</h1>
+
+<h2 id="s0">0. Preamble</h2>
+<h3 id="s0.1">0.1. Definition of Terms</h3>
+<dl>
+<dt>Member</dt>
+<dd> A Member is an individual who has agreed to the CAcert
+Community Agreement
+(<a href="https://www.cacert.org/policy/CAcertCommunityAgreement.html" target="_blank">CCA</a>)
+and has created successfully
+a CAcert login account on the CAcert web site. </dd>
+<dt>Assurance</dt>
+<dd> Assurance is the process by which a Member of CAcert
+Community (Assurer) identifies an individual (<span lang="en-US">Assuree</span>).
+</dd>
+<dt>Prospective Member</dt>
+<dd> An individual who participates in the process of Assurance,
+but has not yet created a CAcert login account. </dd>
+<dt>Name</dt>
+<dd> A Name is the full name of an individual.
+</dd>
+<dt>Secondary Distinguishing Feature</dt>
+<dd> An additional personal data item of the Member
+that assists discrimination from Members with similar full names.
+(Currently this is the Date of Birth (DoB).)
+</dd>
+</dl>
+
+<h3 id="s0.2">0.2. The CAcert Web of Trust</h3>
+<p>
+In face-to-face meetings,
+an Assurer allocates a number of Assurance Points
+to the Member being Assured.
+CAcert combines the Assurance Points
+into a global <i>Web-of-Trust</i> (or "WoT").
+</p>
+<p>
+CAcert explicitly chooses to meet its various goals by
+construction of a Web-of-Trust of all Members.
+</p>
+
+<h3 id="s0.3">0.3. Related Documentation</h3>
+<p>
+Documentation on Assurance is split between this
+Assurance Policy (AP) and the
+<a href="https://wiki.cacert.org/AssuranceHandbook2" target="_blank">Assurance
+Handbook</a>. The policy is controlled by Configuration Control
+Specification
+(<a href="https://svn.cacert.org/CAcert/Policies/ConfigurationControlSpecification.html" target="_blank">CCS</a>)
+under Policy on Policy
+(<a href="https://www.cacert.org/policy/PolicyOnPolicy.html" target="_blank">PoP</a>)
+policy document regime. Because Assurance is an active area, much
+of the practice is handed over to the Assurance Handbook, which is
+not a controlled policy document, and can more easily respond to
+experience and circumstances. It is also more readable.
+</p>
+<p>
+See also Organisation Assurance Policy (<a href="https://www.cacert.org/policy/OrganisationAssurancePolicy.html" target="_blank">OAP</a>)
+and CAcert Policy Statement (<a href="https://www.cacert.org/policy/CertificationPracticeStatement.html" target="_blank">CPS</a>).
+</p>
+
+<h2 id="s1">1. Assurance Purpose</h2>
+<p>The purpose of Assurance is to add confidence
+in the Assurance Statement made by the CAcert Community of a Member. </p>
+<p>With sufficient assurances, a Member may: (a) issue certificates
+with their assured Name included, (b) participate in assuring others,
+and (c) other related activities. The strength of these activities is
+based on the strength of the assurance. </p>
+
+<h3 id="s1.1">1.1. The Assurance Statement</h3>
+<p>
+The Assurance Statement makes the following claims
+about a person:
+</p>
+<ol>
+<li>
+<p>The person is a bona fide Member. In other words, the
+person is a member of the CAcert Community as defined by the CAcert
+Community Agreement (<a href="https://www.cacert.org/policy/CAcertCommunityAgreement.html" target="_blank">CCA</a>); </p>
+</li>
+<li>
+<p>The Member has a (login) account with CAcert's on-line
+registration and service system; </p>
+</li>
+<li>
+<p>The Member can be determined from any CAcert certificate
+issued by the Account; </p>
+</li>
+<li>
+<p>The Member is bound into CAcert's Arbitration as defined
+by the CAcert Community Agreement; </p>
+</li>
+<li>
+<p>Some personal details of the Member are known to CAcert:
+the individual Name(s), primary and other listed individual email
+address(es), secondary distinguishing feature (e.g. DoB). </p>
+</li>
+</ol>
+<p>The confidence level of the Assurance Statement is expressed by
+the Assurance Points. </p>
+<h3 id="s1.2">1.2. Relying Party Statement</h3>
+<p>The primary goal of the Assurance Statement is for the express
+purpose of certificates to meet the needs of the <em>Relying Party
+Statement</em>, which latter is found in the Certification Practice
+Statement (<a href="https://www.cacert.org/policy/CertificationPracticeStatement.html" target="_blank">CPS</a>).
+</p>
+<p>When a certificate is issued, some of the Assurance Statement may
+be incorporated, e.g. Name. Other parts may be implied, e.g.
+Membership, exact account and status. They all are part of the
+<em>Relying Party Statement</em>. In short, this means that other
+Members of the Community may rely on the information verified by
+Assurance and found in the certificate.</p>
+<p>In particular, certificates are sometimes considered to provide
+reliable indications of e.g. the Member's Name and email address. The
+nature of Assurance, the number of Assurance Points, and other
+policies and processes should be understood as limitations on any
+reliance. </p>
+<h2 id="s2">2. The Member</h2>
+<h3 id="s2.1">2.1. The Member's Name </h3>
+<p>
+At least one individual Name is recorded in the Member's
+CAcert login account. The general standard of a Name is:
+</p>
+<ul>
+<li>
+<p>
+The Name should be recorded as written in a
+government-issued photo identity document (ID).
+</p>
+</li>
+<li>
+<p>
+The Name should be recorded as completely as possible.
+That is, including all middle names, any titles and extensions,
+without abbreviations, and without transliteration of characters.
+</p>
+</li>
+<li>
+<p>The Name is recorded as a string of characters,
+encoded in unicode
+transformation format.</p>
+</li>
+</ul>
+<h3 id="s2.2">2.2. Multiple Names and variations</h3>
+<p>
+In order to handle the contradictions in the above general standard,
+a Member may record multiple Names or multiple variations of a Name
+in her CAcert online Account.
+Examples of variations include married names,
+variations of initials of first or middle names,
+abbreviations of a first name,
+different language or country variations,
+and transliterations of characters in a name.
+</p>
+
+<h3 id="s2.3">2.3. Status and Capabilities</h3>
+<p>
+A Name which has reached
+the level of 50 Assurance Points is defined as an Assured
+Name. An Assured Name can be used in a certificate issued by CAcert.
+A Member with at least one Assured Name has reached the Assured
+Member status.
+Additional capabilities are described in Table 1.
+</p>
+
+<blockquote>
+<p class="l size075"><em>Table 1:
+Assurance Capability</em></p>
+<table class="padding5 margin0" border="1">
+<tbody>
+<tr>
+<td style="width: 10%;">
+<p class="l"><em>Minimum Assurance Points</em></p>
+</td>
+<td style="width: 15%;">
+<p class="l"><em>Capability</em></p>
+</td>
+<td style="width: 15%;">
+<p class="l"><em>Status</em></p>
+</td>
+<td style="width: 60%;">
+<p class="l"><em>Comment</em></p>
+</td>
+</tr>
+<tr class="vTop">
+<td>
+<p class="c">0</p>
+</td>
+<td>
+<p class="l">Request Assurance</p>
+</td>
+<td>
+<p class="l">Prospective Member</p>
+</td>
+<td>
+<p class="l">Individual taking part of an
+Assurance, who does not have created a CAcert login account (yet). The
+allocation of Assurance Points is awaiting login account creation.</p>
+</td>
+</tr>
+<tr class="vTop">
+<td>
+<p class="c">0</p>
+</td>
+<td>
+<p class="l">Request unnamed certificates</p>
+</td>
+<td>
+<p class="l">Member</p>
+</td>
+<td>
+<p class="l">Although the Member's details are
+recorded in the account, they are not highly assured.</p>
+</td>
+</tr>
+<tr class="vTop">
+<td>
+<p class="c">50</p>
+</td>
+<td>
+<p class="l">Request named certificates</p>
+</td>
+<td>
+<p class="l">Assured Member</p>
+</td>
+<td>
+<p class="l">Statements of Assurance: the Name is
+assured to 50 Assurance Points or more</p>
+</td>
+</tr>
+<tr class="vTop">
+<td>
+<p class="c">100</p>
+</td>
+<td>
+<p class="l">Become an Assurer</p>
+</td>
+<td>
+<p class="l">Prospective Assurer</p>
+</td>
+<td>
+<p class="l">Assured to 100 Assurance Points (or
+more) on at least one Name, and passing the Assurer Challenge.</p>
+</td>
+</tr>
+</tbody>
+</table>
+</blockquote>
+
+
+<p>
+A Member may check the status of another Member, especially
+for an assurance process.
+Status may be implied from information in a certificate.
+The number of Assurance Points for each Member is not published.
+</p>
+
+<p>
+The CAcert Policy Statement
+(<a href="https://www.cacert.org/policy/CertificationPracticeStatement.html" target="_blank">CPS</a>)
+and other policies may list other capabilities that rely on Assurance
+Points.
+</p>
+
+<h2 id="s3">3. The Assurer</h2>
+<p>An Assurer is a Member with the following: </p>
+<ul>
+<li>
+<p>Is assured to a minimum of 100 Assurance Points; </p>
+</li>
+<li>
+<p>Has passed the CAcert Assurer Challenge. </p>
+</li>
+</ul>
+<p>The Assurer Challenge is administered by the Education Team on
+behalf of the Assurance Officer. </p>
+<h3 id="s3.1">3.1. The Obligations of the Assurer</h3>
+<p>The Assurer is obliged to: </p>
+<ul>
+<li>
+<p>Follow this Assurance Policy; </p>
+</li>
+<li>
+<p>Follow any additional rules of detail laid out by the
+CAcert Assurance Officer; </p>
+</li>
+<li>
+<p>Be guided by the CAcert <a href="https://wiki.cacert.org/AssuranceHandbook2" target="_blank">Assurance Handbook</a> in their
+judgement; </p>
+</li>
+<li>
+<p>Make a good faith effort at identifying and verifying
+Members; </p>
+</li>
+<li>
+<p>Maintain the documentation on each Assurance; </p>
+</li>
+<li>
+<p>Deliver documentation to Arbitration, or as otherwise
+directed by the Arbitrator; </p>
+</li>
+<li>
+<p>Keep up-to-date with developments within the CAcert
+Community. </p>
+</li>
+</ul>
+<h2 id="s4">4. The Assurance</h2>
+<h3 id="s4.1">4.1. The Assurance Process</h3>
+<p>The Assurer conducts the process of Assurance with each
+Member. </p>
+<p>The process consists of: </p>
+<ol>
+<li>
+<p>Voluntary agreement by both Assurer and Member or
+Prospective Member to conduct the Assurance; </p>
+</li>
+<li>
+<p>Personal meeting of Assurer and Member or Prospective
+Member; </p>
+</li>
+<li>
+<p>Recording of essential details on CAcert Assurance
+Programme form; </p>
+</li>
+<li>
+<p>Examination of Identity documents by Assurer and
+verification of recorded details (the Name(s) and Secondary
+Distinguishing Feature, e.g., DoB); </p>
+</li>
+<li>
+<p>Allocation of Assurance Points by Assurer; </p>
+</li>
+<li>
+<p>Optional: supervision of reciprocal Assurance made by
+Assuree (Mutual Assurance); </p>
+</li>
+<li>
+<p>Safekeeping of the CAcert Assurance Programme (<a href="https://www.cacert.org/cap.php" target="_blank">CAP</a>)
+forms by Assurer. </p>
+</li>
+</ol>
+<h3 id="s4.2">4.2. Mutual Assurance</h3>
+<p>Mutual Assurance follows the principle of reciprocity. This
+means
+that the Assurance may be two-way, and that each member participating
+in the Assurance procedure should be able to show evidence of their
+identity to the other. </p>
+<p>In the event that an Assurer is assured by a Member who is not
+certified as an Assurer, the Assurer supervises the Assurance
+procedure and process, and is responsible for the results. </p>
+<p>Reciprocity maintains a balance between the (new) member and
+the
+Assurer, and reduces any sense of power. It is also an important aid
+to the assurance training for future Assurers. </p>
+
+<h3 id="s4.3">4.3. Assurance Points</h3>
+<p>The Assurance applies Assurance Points to each Member which
+measure the increase of confidence in the Statement (above).
+Assurance Points should not be interpreted for any other purpose.
+Note that, even though they are sometimes referred to as <em>Web-of-Trust</em>
+(Assurance) Points, or <em>Trust</em> Points, the meaning
+of the word
+'Trust' is not well defined. </p>
+<p><em>Assurance Points Allocation</em><br>
+An Assurer can allocate a
+number of Assurance Points to the Member according to the Assurer's
+experience (Experience Point system, see below). The allocation of
+the maximum means that the Assurer is 100% confident in the
+information presented: </p>
+<ul>
+<li>
+<p>Detail on form, system, documents, person in accordance; </p>
+</li>
+<li>
+<p>Sufficient quality identity documents have been checked; </p>
+</li>
+<li>
+<p>Assurer's familiarity with identity documents; </p>
+</li>
+<li>
+<p>The Assurance Statement is confirmed. </p>
+</li>
+</ul>
+<p>
+Any lesser confidence should result in less Assurance Points for a
+Name. If the Assurer has no confidence in the information presented,
+then <em>zero</em> Assurance Points may be allocated by the Assurer.
+For example, this may happen if the identity documents are totally
+unfamiliar to the Assurer. The number of Assurance Points from <em>zero</em>
+to <em>maximum</em> is guided by the Assurance Handbook
+and the judgement of the Assurer.
+If there is negative confidence the Assurer should consider
+filing a dispute.
+</p>
+<p>Multiple Names should be allocated Assurance Points
+independently within a single Assurance. </p>
+<p>
+A Member who is not an Assurer may award an Assurer in a
+reciprocal process a maximum of 2 Assurance Points, according to
+her judgement. The Assurer should strive to have the Member allocate
+according to the Member's judgement, and stay on the cautious side;
+the Member new to the assurance process
+should allocate <em>zero</em> Assurance Points
+until she gains some confidence in what is happening.
+</p>
+<p>
+In general, for a Member to reach 50 Assurance Points, the Member must
+have participated in at least two assurances, and
+at least one Name will have been assured to that level.
+</p>
+<p>
+To reach 100 Assurance
+Points, at least one Name of the Assured Member must have been
+assured at least three times.
+</p>
+<p>
+The maximum number of Assurance
+Points which can be allocated for an Assurance under this policy
+and under any act under any
+Subsidiary Policy (below) is 50 Assurance Points.
+</p>
+
+<h3 id="s4.4">4.4. Experience Points</h3>
+<p>The maximum number of Assurance Points that may be awarded by
+an
+Assurer is determined by the Experience Points of the Assurer. </p>
+<blockquote>
+<p class="l size075" ><em>Table 2:
+Maximum of Assurance Points </em>
+</p>
+<table class="padding margin0" border="1" style="width: 15%;">
+<tbody>
+<tr>
+<td>
+<p><em>Assurer's Experience Points</em></p>
+</td>
+<td>
+<p><em>Allocatable Assurance Points</em></p>
+</td>
+</tr>
+<tr>
+<td>
+<p class="c">0</p>
+</td>
+<td>
+<p class="c">10</p>
+</td>
+</tr>
+<tr>
+<td>
+<p class="c">10</p>
+</td>
+<td>
+<p class="c">15</p>
+</td>
+</tr>
+<tr>
+<td>
+<p class="c">20</p>
+</td>
+<td>
+<p class="c">20</p>
+</td>
+</tr>
+<tr>
+<td>
+<p class="c">30</p>
+</td>
+<td>
+<p class="c">25</p>
+</td>
+</tr>
+<tr>
+<td>
+<p class="c">40</p>
+</td>
+<td>
+<p class="c">30</p>
+</td>
+</tr>
+<tr>
+<td>
+<p class="c">&gt;=50</p>
+</td>
+<td>
+<p class="c">35</p>
+</td>
+</tr>
+</tbody>
+</table>
+</blockquote>
+<p>An Assurer is given a maximum of 2 Experience Points for every
+completed Assurance. On reaching Assurer status, the Experience
+Points start at 0 (zero). </p>
+<p>Less Experience Points (1) may be given for mass Assurance
+events,
+where each Assurance is quicker. </p>
+<p>Additional Experience Points may be granted temporarily or
+permanently to an Assurer by CAcert Inc.'s Committee (board), on
+recommendation from the Assurance Officer. </p>
+<p>Experience Points are not to be confused with Assurance
+Points. </p>
+<h3 id="s4.5">4.5. CAcert Assurance Programme (CAP) form</h3>
+<p>The CAcert Assurance Programme (<a href="https://www.cacert.org/cap.php" target="_blank">CAP</a>)
+form requests the following details of each Member or Prospective
+Member: </p>
+<ul>
+<li>
+<p>Name(s), as recorded in the on-line account; </p>
+</li>
+<li>
+<p>Primary email address, as recorded in the on-line account;
+</p>
+</li>
+<li>
+<p>Secondary Distinguishing Feature, as recorded in the
+on-line account (normally, date of birth); </p>
+</li>
+<li>
+<p>Statement of agreement with the CAcert Community
+Agreement; </p>
+</li>
+<li>
+<p>Permission to the Assurer to conduct the Assurance
+(required for privacy reasons); </p>
+</li>
+<li>
+<p>Date and signature of the Assuree. </p>
+</li>
+</ul>
+<p>The CAP form requests the following details of the Assurer: </p>
+<ul>
+<li>
+<p>At least one Name as recorded in the on-line account of
+the Assurer; </p>
+</li>
+<li>
+<p>Assurance Points for each Name in the identity
+document(s); </p>
+</li>
+<li>
+<p>Statement of Assurance; </p>
+</li>
+<li>
+<p>Optional: If the Assurance is reciprocal, then the
+Assurer's email address and Secondary Distinguishing Feature are
+required as well; </p>
+</li>
+<li>
+<p>Date, location of Assurance and signature of Assurer. </p>
+</li>
+</ul>
+<p>The CAP forms are to be kept at least for 7 years by the
+Assurer. </p>
+<h2 id="s5">5. The Assurance Officer</h2>
+<p>The Committee (board) of CAcert Inc. appoints an Assurance
+Officer
+with the following responsibilities: </p>
+<ul>
+<li>
+<p>Reporting to the Committee and advising on all matters to
+do with Assurance; </p>
+</li>
+<li>
+<p>Training and testing of Assurers, in association with the
+Education Team; </p>
+</li>
+<li>
+<p>Updating this Assurance Policy, under the process
+established by Policy on Policy (<a href="https://www.cacert.org/policy/PolicyOnPolicy.html" target="_blank">PoP</a>); </p>
+</li>
+<li>
+<p>Management of all Subsidiary Policies (see below) for
+Assurances, under Policy on Policy; </p>
+</li>
+<li>
+<p>Managing and creating rules of detail or procedure where
+inappropriate for policies; </p>
+</li>
+<li>
+<p>Incorporating rulings from Arbitration into policies,
+procedures or guidelines; </p>
+</li>
+<li>
+<p>Assisting the Arbitrator in any requests; </p>
+</li>
+<li>
+<p>Managing the Assurer Handbook; </p>
+</li>
+<li>
+<p>Maintaining a sufficient strength in the Assurance process
+(web-of-trust) to meet the agreed needs of the Community. </p>
+</li>
+</ul>
+<h2 id="s6">6. Subsidiary Policies</h2>
+<p>The Assurance Officer manages various exceptions and additional
+processes. Each must be covered by an approved Subsidiary Policy
+(refer to <a href="https://www.cacert.org/policy/PolicyOnPolicy.html" target="_blank">Policy on Policy</a> =&gt; CAcert Official Document COD1).
+Subsidiary Policies specify any additional tests of knowledge
+required and variations to process and documentation, within the
+general standard stated here. </p>
+<h3 id="s6.1">6.1. Standard</h3>
+<p>Each Subsidiary Policy must augment and improve the general
+standards in this Assurance Policy. It is the responsibility of each
+Subsidiary Policy to describe how it maintains and improves the
+specific and overall goals. It must describe exceptions and potential
+areas of risk. </p>
+
+<h3 id="s6.2">6.2. High Risk Applications</h3>
+<p>In addition to the Assurance or Experience Points ratings set
+here and in other subsidiary policies, the Assurance Officer or policies can
+designate certain applications as high risk. If so, additional
+measures may be added to the Assurance process that specifically
+address the risks.</p>
+<p>Additional measures may include:
+</p>
+<ul>
+<li>
+<p>Additional information can be required in process of assurance: </p>
+<ul>
+<li>unique numbers of identity documents,</li>
+<li>photocopy of identity documents,</li>
+<li>photo of User,</li>
+<li>address of User.</li>
+</ul>
+<p>Additional Information is to be kept by Assurer, attached to
+CAcert Assurance Programme (<a href="https://www.cacert.org/cap.php" target="_blank">CAP</a>)
+form. Assurance Points allocation by this assurance is unchanged.
+User's CAcert login account should be annotated to record type of
+additional information;</p>
+</li>
+<li>
+<p>Arbitration: </p>
+<ul>
+<li> Member to participate in Arbitration. This confirms
+their acceptance of the forum as well as trains in the process and
+import,
+</li>
+<li> Member to file Arbitration to present case. This
+allows Arbitrator as final authority;
+</li>
+</ul>
+</li>
+<li>
+<p>Additional training; </p>
+</li>
+<li>
+<p>Member to be Assurer (at least 100 Assurance Points and
+passed Assurer Challenge); </p>
+</li>
+<li>
+<p>Member agrees to additional specific agreement(s); </p>
+</li>
+<li>
+<p>Additional checking/auditing of systems data by CAcert
+support administrators. </p>
+</li>
+</ul>
+<p>Applications that might attract additional measures include
+code-signing certificates and administration roles. </p>
+<h2 id="s7">7. Privacy</h2>
+<p>CAcert is a "privacy" organisation, and takes the
+privacy of its Members seriously. The process maintains the security
+and privacy of both parties. </p>
+<p>Information is collected primarily to make claims within the
+certificates requested by users and to contact the Members. It is
+used secondarily for training, testing, administration and other
+internal purposes. </p>
+<p>The Member's information can be accessed under these
+circumstances: </p>
+<ul>
+<li>
+<p>Under Arbitrator ruling, in a duly filed dispute (<a href="https://www.cacert.org/policy/DisputeResolutionPolicy.html" target="_blank">Dispute Resolution Policy</a>
+=&gt; COD7); </p>
+</li>
+<li>
+<p>An Assurer in the process of an Assurance, as permitted on
+the CAcert Assurance Programme (<a href="https://www.cacert.org/cap.php" target="_blank">CAP</a>)
+form; </p>
+</li>
+<li>
+<p>CAcert support administration and CAcert systems
+administration when operating under the authority of Arbitrator or
+under CAcert policy. </p>
+</li>
+</ul>
+<p><a href="http://validator.w3.org/check?uri=referer"><img src="images/valid-html50-blue.png" alt="Valid HTML 5" height="31" width="88"></a></p>
+</body></html>
+
diff --git a/www/policy/AssurancePolicy.php b/www/policy/AssurancePolicy.php
index 4998de5..025d37b 100644
--- a/www/policy/AssurancePolicy.php
+++ b/www/policy/AssurancePolicy.php
@@ -1,723 +1,4 @@
-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
-<html><head>
-<title>Assurance Policy</title>
-
-<meta name="CREATED" content="20080530;0">
-<meta name="CHANGEDBY" content="Teus Hagen">
-<meta name="CHANGED" content="20080709;12381800">
-<meta name="CREATEDBY" content="Ian Grigg">
-<meta name="CHANGEDBY" content="Teus Hagen">
-<meta name="CHANGEDBY" content="Robert Cruikshank">
-<meta name="CHANGEDBY" content="Teus Hagen">
-<style type="text/css">
-<!--
-P { color: #000000 }
-TD P { color: #000000 }
-H1 { color: #000000 }
-H2 { color: #000000 }
-DT { color: #000000 }
-DD { color: #000000 }
-H3 { color: #000000 }
-TH P { color: #000000 }
--->
-</style></head>
-<body style="direction: ltr; color: rgb(0, 0, 0);" lang="en-GB">
-<h1>Assurance Policy for CAcert Community Members</h1>
-<p><a href="PolicyOnPolicy.php"><img src="/images/cacert-policy.png" id="graphics1" alt="CAcert Policy Status == POLICY" align="bottom" border="0" height="33" width="90"></a>
-<br>
-Editor: Teus Hagen<br>
-Creation date: 2008-05-30<br>
-Last change by: Iang<br>
-Last change date: 2009-01-08<br>
-Status: POLICY p20090105.2
-</p>
-
-<h2><a name="0">0.</a> Preamble</h2>
-<h3><a name="0.1">0.1.</a> Definition of Terms</h3>
-<dl>
-<dt><i>Member</i> </dt>
-<dd> A Member is an individual who has agreed to the CAcert
-Community Agreement
-(<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php" target="_blank">CCA</a>)
-and has created successfully
-a CAcert login account on the CAcert web site. </dd>
-<dt> <i>Assurance</i> </dt>
-<dd> Assurance is the process by which a Member of CAcert
-Community (Assurer) identifies an individual (<span lang="en-US">Assuree</span>).
-</dd>
-<dt> <i>Prospective Member</i> </dt>
-<dd> An individual who participates in the process of Assurance,
-but has not yet created a CAcert login account. </dd>
-<dt> <i>Name</i> </dt>
-<dd> A Name is the full name of an individual.
-</dd>
-<dt> <i>Secondary Distinguishing Feature</i>
-</dt>
-<dd> An additional personal data item of the Member
-that assists discrimination from Members with similar full names.
-(Currently this is the Date of Birth (DoB).)
-</dd>
-</dl>
-
-<h3><a name="0.2">0.2.</a> The CAcert Web of Trust</h3>
-<p>
-In face-to-face meetings,
-an Assurer allocates a number of Assurance Points
-to the Member being Assured.
-CAcert combines the Assurance Points
-into a global <i>Web-of-Trust</i> (or "WoT").
-</p>
-<p>
-CAcert explicitly chooses to meet its various goals by
-construction of a Web-of-Trust of all Members.
-</p>
-
-<h3><a name="0.3">0.3.</a> Related Documentation</h3>
-<p>
-Documentation on Assurance is split between this
-Assurance Policy (AP) and the
-<a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance
-Handbook</a>. The policy is controlled by Configuration Control
-Specification
-(<a href="http://wiki.cacert.org/wiki/PolicyDrafts/ConfigurationControlSpecification" target="_blank">CCS</a>)
-under Policy on Policy
-(<a href="http://www.cacert.org/policy/PolicyOnPolicy.php" target="_blank">PoP</a>)
-policy document regime. Because Assurance is an active area, much
-of the practice is handed over to the Assurance Handbook, which is
-not a controlled policy document, and can more easily respond to
-experience and circumstances. It is also more readable.
-</p>
-<p>
-See also Organisation Assurance Policy (<a href="http://www.cacert.org/policy/OrganisationAssurancePolicy.php" target="_blank">OAP</a>)
-and CAcert Policy Statement (<a href="http://www.cacert.org/policy/CertificationPracticeStatement.php" target="_blank">CPS</a>).
-</p>
-
-<h2><a name="1">1.</a> Assurance Purpose</h2>
-<p>The purpose of Assurance is to add confidence
-in the Assurance Statement made by the CAcert Community of a Member. </p>
-<p>With sufficient assurances, a Member may: (a) issue certificates
-with their assured Name included, (b) participate in assuring others,
-and (c) other related activities. The strength of these activities is
-based on the strength of the assurance. </p>
-
-<h3><a name="1.1">1.1.</a>The Assurance Statement</h3>
-<p>
-The Assurance Statement makes the following claims
-about a person:
-</p>
-<ol>
-<li>
-<p>The person is a bona fide Member. In other words, the
-person is a member of the CAcert Community as defined by the CAcert
-Community Agreement (<a href="http://www.cacert.org/policy/CAcertCommunityAgreement.php" target="_blank">CCA</a>); </p>
-</li>
-<li>
-<p>The Member has a (login) account with CAcert's on-line
-registration and service system; </p>
-</li>
-<li>
-<p>The Member can be determined from any CAcert certificate
-issued by the Account; </p>
-</li>
-<li>
-<p>The Member is bound into CAcert's Arbitration as defined
-by the CAcert Community Agreement; </p>
-</li>
-<li>
-<p>Some personal details of the Member are known to CAcert:
-the individual Name(s), primary and other listed individual email
-address(es), secondary distinguishing feature (e.g. DoB). </p>
-</li>
-</ol>
-<p>The confidence level of the Assurance Statement is expressed by
-the Assurance Points. </p>
-<h3><a name="1.2">1.2.</a>Relying Party Statement</h3>
-<p>The primary goal of the Assurance Statement is for the express
-purpose of certificates to meet the needs of the <i>Relying Party
-Statement</i>, which latter is found in the Certification Practice
-Statement (<a href="http://www.cacert.org/policy/CertificationPracticeStatement.php" target="_blank">CPS</a>).
-</p>
-<p>When a certificate is issued, some of the Assurance Statement may
-be incorporated, e.g. Name. Other parts may be implied, e.g.
-Membership, exact account and status. They all are part of the
-<i>Relying Party Statement</i>. In short, this means that other
-Members of the Community may rely on the information verified by
-Assurance and found in the certificate.</p>
-<p>In particular, certificates are sometimes considered to provide
-reliable indications of e.g. the Member's Name and email address. The
-nature of Assurance, the number of Assurance Points, and other
-policies and processes should be understood as limitations on any
-reliance. </p>
-<h2><a name="2">2.</a> The Member</h2>
-<h3><a name="2.1">2.1.</a> The Member's Name </h3>
-<p>
-At least one individual Name is recorded in the Member's
-CAcert login account. The general standard of a Name is:
-</p>
-<ul>
-<li>
-<p>
-The Name should be recorded as written in a
-government-issued photo identity document (ID).
-</p>
-</li>
-<li>
-<p>
-The Name should be recorded as completely as possible.
-That is, including all middle names, any titles and extensions,
-without abbreviations, and without transliteration of characters.
-</p>
-</li>
-<li>
-<p>The Name is recorded as a string of characters,
-encoded in <span lang="en-US">unicode</span>
-transformation format.</p>
-</li>
-</ul>
-<h3><a name="2.2">2.2.</a> Multiple Names and variations</h3>
-<p>
-In order to handle the contradictions in the above general standard,
-a Member may record multiple Names or multiple variations of a Name
-in her CAcert online Account.
-Examples of variations include married names,
-variations of initials of first or middle names,
-abbreviations of a first name,
-different language or country variations,
-and transliterations of characters in a name.
-</p>
-
-<h3><a name="2.3">2.3.</a> Status and Capabilities</h3>
-<p>
-A Name which has reached
-the level of 50 Assurance Points is defined as an Assured
-Name. An Assured Name can be used in a certificate issued by CAcert.
-A Member with at least one Assured Name has reached the Assured
-Member status.
-Additional capabilities are described in Table 1.
-</p>
-
-<blockquote>
-<p align="left"><font size="2"><i>Table 1:
-Assurance Capability</i></font></p>
-<table border="1" cellpadding="5" cellspacing="0">
-<tbody>
-<tr>
-<td width="10%">
-<p align="left"><i>Minimum Assurance Points</i></p>
-</td>
-<td width="15%">
-<p align="left"><i>Capability</i></p>
-</td>
-<td width="15%">
-<p align="left"><i>Status</i></p>
-</td>
-<td width="60%">
-<p align="left"><i>Comment</i></p>
-</td>
-</tr>
-<tr valign="top">
-<td>
-<p align="center">0</p>
-</td>
-<td>
-<p align="left">Request Assurance</p>
-</td>
-<td>
-<p align="left">Prospective Member</p>
-</td>
-<td>
-<p align="left">Individual taking part of an
-Assurance, who does not have created a CAcert login account (yet). The
-allocation of Assurance Points is awaiting login account creation.</p>
-</td>
-</tr>
-<tr valign="top">
-<td>
-<p align="center">0</p>
-</td>
-<td>
-<p align="left">Request unnamed certificates</p>
-</td>
-<td>
-<p align="left">Member</p>
-</td>
-<td>
-<p align="left">Although the Member's details are
-recorded in the account, they are not highly assured.</p>
-</td>
-</tr>
-<tr valign="top">
-<td>
-<p align="center">50</p>
-</td>
-<td>
-<p align="left">Request named certificates</p>
-</td>
-<td>
-<p align="left">Assured Member</p>
-</td>
-<td>
-<p align="left">Statements of Assurance: the Name is
-assured to 50 Assurance Points or more</p>
-</td>
-</tr>
-<tr valign="top">
-<td>
-<p align="center">100</p>
-</td>
-<td>
-<p align="left">Become an Assurer</p>
-</td>
-<td>
-<p align="left">Prospective Assurer</p>
-</td>
-<td>
-<p align="left">Assured to 100 Assurance Points (or
-more) on at least one Name, and passing the Assurer Challenge.</p>
-</td>
-</tr>
-</tbody>
-</table>
-</blockquote>
-
-
-<p>
-A Member may check the status of another Member, especially
-for an assurance process.
-Status may be implied from information in a certificate.
-The number of Assurance Points for each Member is not published.
-</p>
-
-<p>
-The CAcert Policy Statement
-(<a href="http://www.cacert.org/policy/CertificationPracticeStatement.php" target="_blank">CPS</a>)
-and other policies may list other capabilities that rely on Assurance
-Points.
-</p>
-
-<h2><a name="3">3.</a> The Assurer</h2>
-<p>An Assurer is a Member with the following: </p>
-<ul>
-<li>
-<p>Is assured to a minimum of 100 Assurance Points; </p>
-</li>
-<li>
-<p>Has passed the CAcert Assurer Challenge. </p>
-</li>
-</ul>
-<p>The Assurer Challenge is administered by the Education Team on
-behalf of the Assurance Officer. </p>
-<h3><a name="3.1">3.1.</a> The Obligations of the Assurer</h3>
-<p>The Assurer is obliged to: </p>
-<ul>
-<li>
-<p>Follow this Assurance Policy; </p>
-</li>
-<li>
-<p>Follow any additional rules of detail laid out by the
-CAcert Assurance Officer; </p>
-</li>
-<li>
-<p>Be guided by the CAcert <a href="http://wiki.cacert.org/wiki/AssuranceHandbook2" target="_blank">Assurance Handbook</a> in their
-judgement; </p>
-</li>
-<li>
-<p>Make a good faith effort at identifying and verifying
-Members; </p>
-</li>
-<li>
-<p>Maintain the documentation on each Assurance; </p>
-</li>
-<li>
-<p>Deliver documentation to Arbitration, or as otherwise
-directed by the Arbitrator; </p>
-</li>
-<li>
-<p>Keep up-to-date with developments within the CAcert
-Community. </p>
-</li>
-</ul>
-<h2><a name="4">4.</a> The Assurance</h2>
-<h3><a name="4.1">4.1.</a> The Assurance Process</h3>
-<p>The Assurer conducts the process of Assurance with each
-Member. </p>
-<p>The process consists of: </p>
-<ol>
-<li>
-<p>Voluntary agreement by both Assurer and Member or
-Prospective Member to conduct the Assurance; </p>
-</li>
-<li>
-<p>Personal meeting of Assurer and Member or Prospective
-Member; </p>
-</li>
-<li>
-<p>Recording of essential details on CAcert Assurance
-Programme form; </p>
-</li>
-<li>
-<p>Examination of Identity documents by Assurer and
-verification of recorded details (the Name(s) and Secondary
-Distinguishing Feature, e.g., DoB); </p>
-</li>
-<li>
-<p>Allocation of Assurance Points by Assurer; </p>
-</li>
-<li>
-<p>Optional: supervision of reciprocal Assurance made by
-Assuree (Mutual Assurance); </p>
-</li>
-<li>
-<p>Safekeeping of the CAcert Assurance Programme (<a href="http://www.cacert.org/cap.php" target="_blank">CAP</a>)
-forms by Assurer. </p>
-</li>
-</ol>
-<h3><a name="4.2">4.2.</a> Mutual Assurance</h3>
-<p>Mutual Assurance follows the principle of reciprocity. This
-means
-that the Assurance may be two-way, and that each member participating
-in the Assurance procedure should be able to show evidence of their
-identity to the other. </p>
-<p>In the event that an Assurer is assured by a Member who is not
-certified as an Assurer, the Assurer supervises the Assurance
-procedure and process, and is responsible for the results. </p>
-<p>Reciprocity maintains a balance between the (new) member and
-the
-Assurer, and reduces any sense of power. It is also an important aid
-to the assurance training for future Assurers. </p>
-
-<h3><a name="4.3">4.3.</a> Assurance Points</h3>
-<p>The Assurance applies Assurance Points to each Member which
-measure the increase of confidence in the Statement (above).
-Assurance Points should not be interpreted for any other purpose.
-Note that, even though they are sometimes referred to as <i>Web-of-Trust</i>
-(Assurance) Points, or <i>Trust</i> Points, the meaning
-of the word
-'Trust' is not well defined. </p>
-<p><i>Assurance Points Allocation</i><br>
-An Assurer can allocate a
-number of Assurance Points to the Member according to the Assurer's
-experience (Experience Point system, see below). The allocation of
-the maximum means that the Assurer is 100% confident in the
-information presented: </p>
-<ul>
-<li>
-<p>Detail on form, system, documents, person in accordance; </p>
-</li>
-<li>
-<p>Sufficient quality identity documents have been checked; </p>
-</li>
-<li>
-<p>Assurer's familiarity with identity documents; </p>
-</li>
-<li>
-<p>The Assurance Statement is confirmed. </p>
-</li>
-</ul>
-<p>
-Any lesser confidence should result in less Assurance Points for a
-Name. If the Assurer has no confidence in the information presented,
-then <i>zero</i> Assurance Points may be allocated by the Assurer.
-For example, this may happen if the identity documents are totally
-unfamiliar to the Assurer. The number of Assurance Points from <i>zero</i>
-to <i>maximum</i> is guided by the Assurance Handbook
-and the judgement of the Assurer.
-If there is negative confidence the Assurer should consider
-filing a dispute.
-</p>
-<p>Multiple Names should be allocated Assurance Points
-independently within a single Assurance. </p>
-<p>
-A Member who is not an Assurer may award an Assurer in a
-reciprocal process a maximum of 2 Assurance Points, according to
-her judgement. The Assurer should strive to have the Member allocate
-according to the Member's judgement, and stay on the cautious side;
-the Member new to the assurance process
-should allocate <i>zero</i> Assurance Points
-until she gains some confidence in what is happening.
-</p>
-<p>
-In general, for a Member to reach 50 Assurance Points, the Member must
-have participated in at least two assurances, and
-at least one Name will have been assured to that level.
-</p>
-<p>
-To reach 100 Assurance
-Points, at least one Name of the Assured Member must have been
-assured at least three times.
-</p>
-<p>
-The maximum number of Assurance
-Points which can be allocated for an Assurance under this policy
-and under any act under any
-Subsidiary Policy (below) is 50 Assurance Points.
-</p>
-
-<h3><a name="4.4">4.4.</a> Experience Points</h3>
-<p>The maximum number of Assurance Points that may be awarded by
-an
-Assurer is determined by the Experience Points of the Assurer. </p>
-<blockquote>
-<p align="left"><font size="2"><i>Table 2:
-Maximum of Assurance Points </i></font>
-</p>
-<table border="1" cellpadding="2" cellspacing="0" width="15%">
-<tbody>
-<tr>
-<td>
-<p><i>Assurer's Experience Points</i></p>
-</td>
-<td>
-<p><i>Allocatable Assurance Points</i></p>
-</td>
-</tr>
-<tr>
-<td>
-<p align="center">0</p>
-</td>
-<td>
-<p align="center">10</p>
-</td>
-</tr>
-<tr>
-<td>
-<p align="center">10</p>
-</td>
-<td>
-<p align="center">15</p>
-</td>
-</tr>
-<tr>
-<td>
-<p align="center">20</p>
-</td>
-<td>
-<p align="center">20</p>
-</td>
-</tr>
-<t