From ce4bfbaf0c2babb5bba2568d3b8712e1615aa651 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michael=20T=C3=A4nzer?= Date: Sun, 21 Aug 2011 02:07:40 +0200 Subject: Source code taken from cacert-20110820.tar.bz2 --- includes/account.php | 9 + includes/general.php | 29 ++- includes/lib/account.php | 51 +++++ includes/loggedin.php | 3 +- includes/wot.inc.php | 509 +++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 584 insertions(+), 17 deletions(-) create mode 100644 includes/lib/account.php create mode 100644 includes/wot.inc.php (limited to 'includes') diff --git a/includes/account.php b/includes/account.php index 14702b9..24c61d8 100644 --- a/includes/account.php +++ b/includes/account.php @@ -1290,6 +1290,8 @@ showheader(_("My CAcert.org Account!")); if($_SESSION['_config']['user']['pword1'] == "" || $_SESSION['_config']['user']['pword1'] != $_SESSION['_config']['user']['pword2']) { + echo '

', _("Failure: Pass Phrase not Changed"), + '

', "\n"; echo _("New Pass Phrases specified don't match or were blank."); } else { $score = checkpw($_SESSION['_config']['user']['pword1'], $_SESSION['profile']['email'], $_SESSION['profile']['fname'], @@ -1306,14 +1308,21 @@ } if(strlen($_SESSION['_config']['user']['pword1']) < 6) { + echo '

', + _("Failure: Pass Phrase not Changed"), '

', "\n"; echo _("The Pass Phrase you submitted was too short."); } else if($score < 3) { + echo '

', + _("Failure: Pass Phrase not Changed"), '

', "\n"; printf(_("The Pass Phrase you submitted failed to contain enough differing characters and/or contained words from your name and/or email address. Only scored %s points out of 6."), $score); } else if($rc <= 0) { + echo '

', + _("Failure: Pass Phrase not Changed"), '

', "\n"; echo _("You failed to correctly enter your current Pass Phrase."); } else { mysql_query("update `users` set `password`=sha1('".$_SESSION['_config']['user']['pword1']."') where `id`='".$_SESSION['profile']['id']."'"); + echo '

', _("Pass Phrase Changed Successfully"), '

', "\n"; echo _("Your Pass Phrase has been updated and your primary email account has been notified of the change."); $body = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n"; $body .= _("You are receiving this email because you or someone else")."\n"; diff --git a/includes/general.php b/includes/general.php index 16b75e4..ebdf20e 100644 --- a/includes/general.php +++ b/includes/general.php @@ -38,6 +38,7 @@ $_SESSION['_config']['filepath'] = "/www"; require_once($_SESSION['_config']['filepath']."/includes/mysql.php"); + require_once($_SESSION['_config']['filepath'].'/includes/lib/account.php'); if(array_key_exists('HTTP_HOST',$_SERVER) && $_SERVER['HTTP_HOST'] != $_SESSION['_config']['normalhostname'] && @@ -248,8 +249,7 @@ } } - function checkpw($pwd, $email, $fname, $mname, $lname, $suffix) - { + function checkpwlight($pwd) { $points = 0; if(strlen($pwd) > 15) @@ -279,7 +279,19 @@ $points++; //echo "Points due to length and charset: $points
"; + + // check for historical password proposal + if ($pwd === "Fr3d Sm|7h") { + return 0; + } + + return $points; + } + function checkpw($pwd, $email, $fname, $mname, $lname, $suffix) + { + $points = checkpwlight($pwd); + if(@strstr(strtolower($pwd), strtolower($email))) $points--; @@ -836,19 +848,6 @@ $text=preg_replace("/[^\w-.@]/","",$text); return($text); } - - function fix_assurer_flag($userID) - { - // Update Assurer-Flag on users table if 100 points. Should the number of points be SUM(points) or SUM(awarded)? - $query = mysql_query('UPDATE `users` AS `u` SET `assurer` = 1 WHERE `u`.`id` = \''.(int)intval($userID). - '\' AND EXISTS(SELECT 1 FROM `cats_passed` AS `tp`, `cats_variant` AS `cv` WHERE `tp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 AND `tp`.`user_id` = `u`.`id`)'. - ' AND (SELECT SUM(`points`) FROM `notary` AS `n` WHERE `n`.`to` = `u`.`id` AND `expire` < now()) >= 100'); // Challenge has been passed and non-expired points >= 100 - - // Reset flag if requirements are not met - $query = mysql_query('UPDATE `users` AS `u` SET `assurer` = 0 WHERE `u`.`id` = \''.(int)intval($userID). - '\' AND (NOT EXISTS(SELECT 1 FROM `cats_passed` AS `tp`, `cats_variant` AS `cv` WHERE `tp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 AND `tp`.`user_id` = `u`.`id`)'. - ' OR (SELECT SUM(`points`) FROM `notary` AS `n` WHERE `n`.`to` = `u`.`id` AND `n`.`expire` < now()) < 100)'); - } // returns 0 if $userID is an Assurer // Otherwise : diff --git a/includes/lib/account.php b/includes/lib/account.php new file mode 100644 index 0000000..f7a24fa --- /dev/null +++ b/includes/lib/account.php @@ -0,0 +1,51 @@ + now() OR `n`.`expire` IS NULL)) >= 100'); + // Challenge has been passed and non-expired points >= 100 + + if (!$query) { + return false; + } + + // Reset flag if requirements are not met + $query = mysql_query('UPDATE `users` AS `u` SET `assurer` = 0 WHERE '. + '`u`.`id` = \''.(int)intval($userID).'\' AND '. + '(NOT EXISTS(SELECT 1 FROM `cats_passed` AS `cp`, `cats_variant` AS '. + '`cv` WHERE `cp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 '. + 'AND `cp`.`user_id` = `u`.`id`) OR '. + '(SELECT SUM(`points`) FROM `notary` AS `n` WHERE `n`.`to` = `u`.`id` '. + 'AND (`n`.`expire` > now() OR `n`.`expire` IS NULL)) < 100)'); + + if (!$query) { + return false; + } + + return true; +} \ No newline at end of file diff --git a/includes/loggedin.php b/includes/loggedin.php index 355527f..640bc6c 100644 --- a/includes/loggedin.php +++ b/includes/loggedin.php @@ -131,13 +131,12 @@ $normalhost=$_SESSION['_config']['normalhostname']; $_SESSION['profile']['loggedin'] = 0; $_SESSION['profile'] = ""; - foreach($_SESSION as $key) + foreach($_SESSION as $key => $value) { unset($_SESSION[$key]); unset($$key); session_unregister($key); } - unset($_SESSION); header("location: https://".$normalhost."/index.php"); exit; diff --git a/includes/wot.inc.php b/includes/wot.inc.php new file mode 100644 index 0000000..ce35ed6 --- /dev/null +++ b/includes/wot.inc.php @@ -0,0 +1,509 @@ + '".intval($no_of_assurances)."'"); + return intval(query_get_number_of_rows($res)+1); + } + + function get_top_assuree_position ($no_of_assurees) + { + $res = query_init ("SELECT count(*) AS `list` FROM `notary` + GROUP BY `notary`.`to` HAVING count(*) > '".intval($no_of_assurees)."'"); + return intval(query_get_number_of_rows($res)+1); + } + + function get_given_assurances ($userid) + { + $res = query_init ("select * from `notary` where `notary`.`from`='".intval($userid)."' and `notary`.`from` != `to` order by `notary`.`id` asc"); + return $res; + } + + function get_received_assurances ($userid) + { + $res = query_init ("select * from `notary` where `notary`.`to`='".intval($userid)."' and `notary`.`from` != `notary`.`to` order by `notary`.`id` asc "); + return $res; + } + + function get_given_assurances_summary ($userid) + { + $res = query_init ("select count(*) as number,points,awarded,method from notary where `notary`.`from`='".intval($userid)."' group by points,awarded,method"); + return $res; + } + + function get_received_assurances_summary ($userid) + { + $res = query_init ("select count(*) as number,points,awarded,method from notary where `notary`.`to`='".intval($userid)."' group by points,awarded,method"); + return $res; + } + + function get_user ($userid) + { + $res = query_init ("select * from `users` where `id`='".intval($userid)."'"); + return mysql_fetch_assoc($res); + } + + function get_cats_state ($userid) + { + + $res = query_init ("select * from `cats_passed` inner join `cats_variant` on `cats_passed`.`variant_id` = `cats_variant`.`id` and `cats_variant`.`type_id` = 1 + WHERE `cats_passed`.`user_id` = '".intval($userid)."'"); + return mysql_num_rows($res); + } + + function calc_experience ($row,&$points,&$experience,&$sum_experience) + { + $points += $row['awarded']; + $experience = " "; + if ($row['method'] == "Face to Face Meeting") + { + $sum_experience = $sum_experience +2; + $experience = "2"; + } + return $row['awarded']; + } + + function calc_assurances ($row,&$points,&$experience,&$sumexperience,&$awarded) + { + $awarded = calc_points($row); + + if ($awarded > 100) + { + $experience = $awarded - 100; // needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100) + $awarded = 100; + } + else + $experience = 0; + + switch ($row['method']) + { + case 'Thawte Points Transfer': + case 'CT Magazine - Germany': + case 'Temporary Increase': // Current usage of 'Temporary Increase' may break audit aspects, needs to be reimplemented + $awarded=sprintf("%s",_("Revoked")); + $experience=0; + break; + default: + $points += $awarded; + } + $sumexperience = $sumexperience + $experience; + } + + + function show_user_link ($name,$userid) + { + $name = trim($name); + if($name == "") + $name = _("Deleted before Verification"); + else + $name = "$name"; + return $name; + } + + function get_assurer_ranking($userid,&$num_of_assurances,&$rank_of_assurer) + { + $num_of_assurances = get_number_of_assurances (intval($userid)); + $rank_of_assurer = get_top_assurer_position($num_of_assurances); + } + + function get_assuree_ranking($userid,&$num_of_assurees,&$rank_of_assuree) + { + $num_of_assurees = get_number_of_assurees (intval($userid)); + $rank_of_assuree = get_top_assuree_position($num_of_assurees); + } + + +// ************* html table definitions ****************** + + function output_ranking($userid) + { + get_assurer_ranking($userid,$num_of_assurances,$rank_of_assurer); + get_assuree_ranking($userid,$num_of_assurees,$rank_of_assuree); + +?> + + + + + + + + + + +
+
+ + + + + + + + + + + + + + + + + + + + + + +
: :
+
+ + + + + + + + + + + + + + + + + + + + + + +
+
+ + + + + + + + + + + + 100, awarded shows correct value + else + $points = intval($row['points']); // on very old assurances, awarded is '0' instead of correct value + switch ($row['method']) + { + case 'Thawte Points Transfer': // revoke all Thawte-points (as per arbitration) + case 'CT Magazine - Germany': // revoke c't (only one test-entry) + case 'Temporary Increase': // revoke 'temporary increase' (Current usage breaks audit aspects, needs to be reimplemented) + $points = 0; + break; + case 'Administrative Increase': // ignore AI with 2 points or less (historical for experiance points, now other calculation) + if ($points <= 2) // maybe limit to 35/50 pts in the future? + $points = 0; + break; + case 'unknown': // to be revoked in the future? limit to max 50 pts? + case 'Trusted 3rd Parties': // to be revoked in the future? limit to max 35 pts? + case '': // to be revoked in the future? limit to max 50 pts? + case 'Face to Face Meeting': // normal assurances, limit to 35/50 pts in the future? + break; + default: // should never happen ... ;-) + $points = 0; + } + if ($points < 0) // ignore negative points (bug needs to be fixed) + $points = 0; + return $points; + } + + function max_points($userid) + { + return output_summary_content ($userid,0); + } + + function output_summary_content($userid,$display_output) + { + $sum_points = 0; + $sum_experience = 0; + $sum_experience_other = 0; + $max_points = 100; + $max_experience = 50; + + $experience_limit_reached_txt = _("Limit reached"); + + if (check_date_limit($userid,18) != 1) + { + $max_experience = 10; + $experience_limit_reached_txt = _("Limit given by PoJAM reached"); + } + if (check_date_limit($userid,14) != 1) + { + $max_experience = 0; + $experience_limit_reached_txt = _("Limit given by PoJAM reached"); + } + + $res = get_received_assurances_summary($userid); + while($row = mysql_fetch_assoc($res)) + { + $points = calc_points ($row); + + if ($points > $max_points) // limit to 100 points, above is experience (needs to be fixed) + { + $sum_experience_other = $sum_experience_other+($points-$max_points)*intval($row['number']); + $points = $max_points; + } + $sum_points += $points*intval($row['number']); + } + + $res = get_given_assurances_summary($userid); + while($row = mysql_fetch_assoc($res)) + { + switch ($row['method']) + { + case 'Face to Face Meeting': // count Face to Face only + $sum_experience += 2*intval($row['number']); + break; + } + + } + + if ($sum_points > $max_points) + { + $sum_points_countable = $max_points; + $remark_points = _("Limit reached"); + } + else + { + $sum_points_countable = $sum_points; + $remark_points = " "; + } + if ($sum_experience > $max_experience) + { + $sum_experience_countable = $max_experience; + $remark_experience = $experience_limit_reached_txt; + } + else + { + $sum_experience_countable = $sum_experience; + $remark_experience = " "; + } + + if ($sum_experience_countable + $sum_experience_other > $max_experience) + { + $sum_experience_other_countable = $max_experience-$sum_experience_countable; + $remark_experience_other = $experience_limit_reached_txt; + } + else + { + $sum_experience_other_countable = $sum_experience_other; + $remark_experience_other = " "; + } + + if ($sum_points_countable < $max_points) + { + if ($sum_experience_countable != 0) + $remark_experience = $points_on_hold_txt;_("Points on hold due to less assurance points"); + $sum_experience_countable = 0; + if ($sum_experience_other_countable != 0) + $remark_experience_other = _("Points on hold due to less assurance points"); + $sum_experience_other_countable = 0; + } + + $issue_points = 0; + $cats_test_passed = get_cats_state ($userid); + if ($cats_test_passed == 0) + $issue_points_txt = ""._("You have to pass the CAcert Assurer Challenge (CATS-Test) to be an Assurer").""; + else + { + $experience_total = $sum_experience_countable+$sum_experience_other_countable; + $issue_points_txt = ""; + if ($sum_points_countable == $max_points) + $issue_points = 10; + if ($experience_total >= 10) + $issue_points = 15; + if ($experience_total >= 20) + $issue_points = 20; + if ($experience_total >= 30) + $issue_points = 25; + if ($experience_total >= 40) + $issue_points = 30; + if ($experience_total >= 50) + $issue_points = 35; + if ($issue_points != 0) + $issue_points_txt = sprintf(_("You may issue up to %s points"),$issue_points); + } + if ($display_output) + { + output_summary_row (_("Assurance Points you received"),$sum_points,$sum_points_countable,$remark_points); + output_summary_row (_("Total Experience Points by Assurance"),$sum_experience,$sum_experience_countable,$remark_experience); + output_summary_row (_("Total Experience Points (other ways)"),$sum_experience_other,$sum_experience_other_countable,$remark_experience_other); + output_summary_row (_("Total Points")," ",$sum_points_countable + $sum_experience_countable + $sum_experience_other_countable,$issue_points_txt); + } + return $issue_points; + } + + function output_given_assurances($userid) + { + output_assurances_header(_("Assurance Points You Issued")); + output_given_assurances_content($userid,$points,$sum_experience); + output_assurances_footer(_("Total Points Issued"),$points,_("Total Experience Points"),$sum_experience); + } + + function output_received_assurances($userid) + { + output_assurances_header(_("Your Assurance Points")); + output_received_assurances_content($userid,$points,$sum_experience); + output_assurances_footer(_("Total Assurance Points"),$points,_("Total Experience Points"),$sum_experience); + } + + function output_summary($userid) + { + output_summary_header(); + output_summary_content($userid,1); + output_summary_footer(); + } + + function output_end_of_page() + { +?> +

[ ]

+ -- cgit v1.2.1