diff options
65 files changed, 6219 insertions, 2705 deletions
diff --git a/CommModule/client.pl b/CommModule/client.pl index bd3eb02..25e6a73 100755 --- a/CommModule/client.pl +++ b/CommModule/client.pl @@ -31,7 +31,7 @@ use DBI; use Locale::gettext; use IO::Socket; use MIME::Base64; -use Digest::SHA1 qw(sha1_hex); +use Digest::SHA qw(sha1_hex); #Protocol version: my $ver=1; @@ -441,7 +441,7 @@ sub calculateDays($) { if($_[0]) { - my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' group by `to`"); + my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' and `deleted`=0 group by `to`"); SysLog("Summe: $sum[0]\n") if($debug); return ($sum[0]>=50)?730:180; diff --git a/CommModule/usbclient.pl b/CommModule/usbclient.pl index 3cbe2c3..6cbc111 100755 --- a/CommModule/usbclient.pl +++ b/CommModule/usbclient.pl @@ -425,7 +425,7 @@ sub calculateDays($) { if($_[0]) { - my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' group by `to`"); + my @sum = $dbh->selectrow_array("select sum(`points`) as `total` from `notary` where `to`='".$_[0]."' and `deleted`=0 group by `to`"); SysLog("Summe: $sum[0]\n") if($debug); return ($sum[0]>=50)?730:180; diff --git a/includes/account.php b/includes/account.php index 7e9ee2a..26845cd 100644 --- a/includes/account.php +++ b/includes/account.php @@ -84,6 +84,11 @@ function buildSubjectFromSession() { $memid = array_key_exists('memid',$_REQUEST) ? intval($_REQUEST['memid']) : 0; $domid = array_key_exists('domid',$_REQUEST) ? intval($_REQUEST['domid']) : 0; + $actionrequest = array_key_exists('action',$_REQUEST) ? $_REQUEST['action'] : ""; + + $ticketno = array_key_exists('ticketno',$_REQUEST) ? $_REQUEST['ticketno'] : ""; + $ticketvalidation = FALSE; + if(!$_SESSION['mconn']) { @@ -146,7 +151,7 @@ function buildSubjectFromSession() { exit; } $hash = make_hash(); - $query = "insert into `email` set `email`='".$_REQUEST['email']."',`memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'"; + $query = "insert into `email` set `email`='".$_REQUEST['email']."',`memid`='".intval($_SESSION['profile']['id'])."',`created`=NOW(),`hash`='$hash'"; mysql_query($query); $emailid = mysql_insert_id(); @@ -166,7 +171,7 @@ function buildSubjectFromSession() { { $id = 2; $emailid = intval($_REQUEST['emailid']); - $query = "select * from `email` where `id`='$emailid' and `memid`='".$_SESSION['profile']['id']."' and `hash` = '' and `deleted`=0"; + $query = "select * from `email` where `id`='$emailid' and `memid`='".intval($_SESSION['profile']['id'])."' and `hash` = '' and `deleted`=0"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -186,7 +191,7 @@ function buildSubjectFromSession() { "support@cacert.org", "", "", "CAcert Support"); $_SESSION['profile']['email'] = $row['email']; - $query = "update `users` set `email`='".$row['email']."' where `id`='".$_SESSION['profile']['id']."'"; + $query = "update `users` set `email`='".mysql_real_escape_string($row['email'])."' where `id`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); showheader(_("My CAcert.org Account!")); printf(_("Your default email address has been updated to '%s'."), sanitizeHTML($row['email'])); @@ -211,7 +216,7 @@ function buildSubjectFromSession() { } $id = intval($id); $query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and - `email`!='".$_SESSION['profile']['email']."'"; + `email`!='".mysql_real_escape_string($_SESSION['profile']['email'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) > 0) { @@ -284,6 +289,9 @@ function buildSubjectFromSession() { if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2) $_SESSION['_config']['rootcert'] = 1; } + + $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']); + $csr = ""; if(trim($_REQUEST['optionalCSR']) == "") { @@ -293,11 +301,8 @@ function buildSubjectFromSession() { $_REQUEST['keytype'] = "MS"; $csr = clean_csr($_REQUEST['optionalCSR']); } - if(trim($_REQUEST['description']) != ""){ - $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description']))); - }else{ - $_SESSION['_config']['description']= ""; - } + + $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description'])); } if($oldid == 4) @@ -321,7 +326,7 @@ function buildSubjectFromSession() { if(is_array($_SESSION['_config']['addid'])) foreach($_SESSION['_config']['addid'] as $id) { - $res = mysql_query("select * from `email` where `memid`='".$_SESSION['profile']['id']."' and `id`='".intval($id)."'"); + $res = mysql_query("select * from `email` where `memid`='".intval($_SESSION['profile']['id'])."' and `id`='".intval($id)."'"); if(mysql_num_rows($res) > 0) { $row = mysql_fetch_assoc($res); @@ -340,7 +345,7 @@ function buildSubjectFromSession() { showfooter(); exit; } - $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'")); + $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'")); if($_SESSION['_config']['SSO'] == 1) $emails .= "$count.emailAddress = ".$user['uniqueID']."\n"; @@ -384,7 +389,8 @@ function buildSubjectFromSession() { `codesign`='".intval($_SESSION['_config']['codesign'])."', `disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."', `rootcert`='".intval($_SESSION['_config']['rootcert'])."', - `description`='".$_SESSION['_config']['description']."'"; + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; mysql_query($query); $emailid = mysql_insert_id(); if(is_array($addys)) @@ -396,7 +402,7 @@ function buildSubjectFromSession() { fclose($fp); $challenge=$_SESSION['spkac_hash']; $CSRname_esc = escapeshellarg($CSRname); - $res=`openssl spkac -verify -in $CSRname_esc`; + $res=shell_exec("openssl spkac -verify -in $CSRname_esc"); if(!strstr($res,"Challenge String: ".$challenge)) { $id = $oldid; @@ -460,7 +466,7 @@ function buildSubjectFromSession() { $tmpname = tempnam("/tmp", "id4csr"); $tmpfname_esc = escapeshellarg($tmpfname); $tmpname_esc = escapeshellarg($tmpname); - $do = `/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc`; // -subj "$csr"`; + $do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc"); // -subj "$csr"; @unlink($tmpfname); $csr = ""; $fp = fopen($tmpname, "r"); @@ -482,13 +488,14 @@ function buildSubjectFromSession() { $query = "insert into emailcerts set `CN`='$defaultemail', `keytype`='".sanitizeHTML($_REQUEST['keytype'])."', - `memid`='".$_SESSION['profile']['id']."', + `memid`='".intval($_SESSION['profile']['id'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), `subject`='".mysql_real_escape_string($csrsubject)."', - `codesign`='".$_SESSION['_config']['codesign']."', + `codesign`='".intval($_SESSION['_config']['codesign'])."', `disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."', - `rootcert`='".$_SESSION['_config']['rootcert']."', - `description`='".$_SESSION['_config']['description']."'"; + `rootcert`='".intval($_SESSION['_config']['rootcert'])."', + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; mysql_query($query); $emailid = mysql_insert_id(); if(is_array($addys)) @@ -563,7 +570,7 @@ function buildSubjectFromSession() { $addy = array(); $adds = array(); if(strtolower(substr($newdom, -4, 3)) != ".jp") - $adds = explode("\n", trim(`/usr/bin/whois $newdom|grep "@"`)); + $adds = explode("\n", trim(shell_exec("/usr/bin/whois $newdom|grep \"@\""))); if(substr($newdomain, -4) == ".org" || substr($newdomain, -5) == ".info") { if(is_array($adds)) @@ -653,7 +660,7 @@ function buildSubjectFromSession() { $hash = make_hash(); $query = "insert into `domains` set `domain`='".mysql_real_escape_string($_SESSION['_config']['domain'])."', - `memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'"; + `memid`='".intval($_SESSION['profile']['id'])."',`created`=NOW(),`hash`='$hash'"; mysql_query($query); $domainid = mysql_insert_id(); @@ -681,7 +688,7 @@ function buildSubjectFromSession() { foreach($_REQUEST['delid'] as $id) { $id = intval($id); - $query = "select * from `domains` where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'"; + $query = "select * from `domains` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) > 0) { @@ -726,19 +733,15 @@ function buildSubjectFromSession() { exit; } - if(trim($_REQUEST['description']) != ""){ - $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description']))); - }else{ - $_SESSION['_config']['description']= ""; - } + $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description'])); $_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id10CSR"); $fp = fopen($_SESSION['_config']['tmpfname'], "w"); fputs($fp, $CSR); fclose($fp); $CSR = escapeshellarg($_SESSION['_config']['tmpfname']); - $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep "Subject:"`); - $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`)); + $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\"")); + $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:"))); foreach($bits as $val) { $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val); @@ -765,6 +768,8 @@ function buildSubjectFromSession() { if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2) $_SESSION['_config']['rootcert'] = 1; } + + $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']); } if($process != "" && $oldid == 11) @@ -809,14 +814,16 @@ function buildSubjectFromSession() { `domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."', `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."', `rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."', - `description`='".$_SESSION['_config']['description']."'"; + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; } elseif(array_key_exists('0',$_SESSION['_config']['altid']) && $_SESSION['_config']['altid']['0'] > 0) { $query = "insert into `domaincerts` set `CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."', `domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."', `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."', `rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."', - `description`='".$_SESSION['_config']['description']."'"; + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; } else { showheader(_("My CAcert.org Account!")); echo _("Domain not verified."); @@ -870,7 +877,7 @@ function buildSubjectFromSession() { $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains` where `domaincerts`.`id`='$id' and `domaincerts`.`domid`=`domains`.`id` and - `domains`.`memid`='".$_SESSION['profile']['id']."'"; + `domains`.`memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -904,8 +911,8 @@ function buildSubjectFromSession() { $newfile=generatecertpath("csr","server",$newid); copy($row['csr_name'], $newfile); $newfile_esc = escapeshellarg($newfile); - $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d "\\0"|grep "Subject:"`); - $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`)); + $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep \"Subject:\"")); + $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $newfile_esc |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:"))); foreach($bits as $val) { $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val); @@ -935,7 +942,7 @@ function buildSubjectFromSession() { } else { $drow = mysql_fetch_assoc($res); $crt_name = escapeshellarg($drow['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crt_name`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crt_name"); echo "<pre>\n$cert\n</pre>\n"; } } @@ -963,7 +970,7 @@ function buildSubjectFromSession() { $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains` where `domaincerts`.`id`='$id' and `domaincerts`.`domid`=`domains`.`id` and - `domains`.`memid`='".$_SESSION['profile']['id']."'"; + `domains`.`memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -998,7 +1005,7 @@ function buildSubjectFromSession() { $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains` where `domaincerts`.`id`='$id' and `domaincerts`.`domid`=`domains`.`id` and - `domains`.`memid`='".$_SESSION['profile']['id']."'"; + `domains`.`memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -1049,7 +1056,7 @@ function buildSubjectFromSession() { { $id = intval($id); $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` - where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'"; + where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -1123,7 +1130,7 @@ function buildSubjectFromSession() { { $id = intval($id); $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts` - where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'"; + where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -1155,7 +1162,7 @@ function buildSubjectFromSession() { { $id = intval($id); $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts` - where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'"; + where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -1187,14 +1194,14 @@ function buildSubjectFromSession() { { $cid = intval(substr($id,5)); $dis=(array_key_exists('disablelogin_'.$cid,$_REQUEST) && $_REQUEST['disablelogin_'.$cid]=="1")?"0":"1"; - mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'"); + mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$cid' and `memid`='".intval($_SESSION['profile']['id'])."'"); } if(substr($id,0,14)=="check_comment_") { $cid = intval(substr($id,14)); if(!empty($_REQUEST['check_comment_'.$cid])) { $comment=trim(mysql_real_escape_string(stripslashes($_REQUEST['comment_'.$cid]))); - mysql_query("update `emailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".$_SESSION['profile']['id']."'"); + mysql_query("update `emailcerts` set `description`='$comment' where `id`='$cid' and `memid`='".intval($_SESSION['profile']['id'])."'"); } } } @@ -1268,7 +1275,7 @@ function buildSubjectFromSession() { if($oldid == 13 && $process != "") { - $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`"; + $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`"; $ddres = mysql_query($ddquery); $ddrow = mysql_fetch_assoc($ddres); $_SESSION['profile']['points'] = $ddrow['total']; @@ -1308,7 +1315,7 @@ function buildSubjectFromSession() { `lname`='".$_SESSION['_config']['user']['lname']."', `suffix`='".$_SESSION['_config']['user']['suffix']."', `dob`='".$_SESSION['_config']['user']['year']."-".$_SESSION['_config']['user']['month']."-".$_SESSION['_config']['user']['day']."' - where `id`='".$_SESSION['profile']['id']."'"; + where `id`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); } if ($showdetails!="") { @@ -1322,25 +1329,15 @@ function buildSubjectFromSession() { `A3`='".$_SESSION['_config']['user']['A3']."', `A4`='".$_SESSION['_config']['user']['A4']."', `A5`='".$_SESSION['_config']['user']['A5']."' - where `id`='".$_SESSION['profile']['id']."'"; - mysql_query($query); - } - - //!!!Should be rewritten - $_SESSION['_config']['user']['otphash'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otphash'])))); - $_SESSION['_config']['user']['otppin'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otppin'])))); - if($_SESSION['_config']['user']['otphash'] != "" && $_SESSION['_config']['user']['otppin'] != "") - { - $query = "update `users` set `otphash`='".$_SESSION['_config']['user']['otphash']."', - `otppin`='".$_SESSION['_config']['user']['otppin']."' where `id`='".$_SESSION['profile']['id']."'"; + where `id`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); } $_SESSION['_config']['user']['set'] = 0; - $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'")); + $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'")); $_SESSION['profile']['loggedin'] = 1; - $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`"; + $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`"; $ddres = mysql_query($ddquery); $ddrow = mysql_fetch_assoc($ddres); $_SESSION['profile']['points'] = $ddrow['total']; @@ -1374,7 +1371,7 @@ function buildSubjectFromSession() { if($_SESSION['_config']['hostname'] != $_SESSION['_config']['securehostname']) { - $match = mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."' and + $match = mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."' and (`password`=old_password('".$_SESSION['_config']['user']['oldpass']."') or `password`=sha1('".$_SESSION['_config']['user']['oldpass']."'))"); $rc = mysql_num_rows($match); @@ -1396,7 +1393,7 @@ function buildSubjectFromSession() { echo _("You failed to correctly enter your current Pass Phrase."); } else { mysql_query("update `users` set `password`=sha1('".$_SESSION['_config']['user']['pword1']."') - where `id`='".$_SESSION['profile']['id']."'"); + where `id`='".intval($_SESSION['profile']['id'])."'"); echo '<h3>', _("Pass Phrase Changed Successfully"), '</h3>', "\n"; echo _("Your Pass Phrase has been updated and your primary email account has been notified of the change."); $body = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n\n"; @@ -1438,14 +1435,9 @@ function buildSubjectFromSession() { $_SESSION['_config']['emails'][] = $val; } $_SESSION['_config']['name'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['name']))); - $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU']))); - + $_SESSION['_config']['OU'] = stripslashes(trim($_REQUEST['OU'])); - if(trim($_REQUEST['description']) != ""){ - $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description']))); - }else{ - $_SESSION['_config']['description']= ""; - } + $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description'])); } if($oldid == 16 && (intval(count($_SESSION['_config']['emails'])) + 0) <= 0) @@ -1474,11 +1466,9 @@ function buildSubjectFromSession() { if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2) $_SESSION['_config']['rootcert'] = 1; - if(trim($_REQUEST['description']) != ""){ - $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description']))); - }else{ - $_SESSION['_config']['description']= ""; - } + $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']); + + $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description'])); if(@count($_SESSION['_config']['emails']) > 0) $id = 17; @@ -1514,7 +1504,7 @@ function buildSubjectFromSession() { if($_SESSION['_config']['name'] != "") $emails .= "commonName = ".$_SESSION['_config']['name']."\n"; if($_SESSION['_config']['OU']) - $emails .= "organizationalUnitName = ".$_SESSION['_config']['OU']."\n"; + $emails .= "organizationalUnitName = ".mysql_real_escape_string($_SESSION['_config']['OU'])."\n"; if($org['O']) $emails .= "organizationName = ".$org['O']."\n"; if($org['L']) @@ -1539,13 +1529,14 @@ function buildSubjectFromSession() { $query = "insert into `orgemailcerts` set `CN`='$defaultemail', - `ou`='".$_SESSION['_config']['OU']."', + `ou`='".mysql_real_escape_string($_SESSION['_config']['OU'])."', `keytype`='NS', - `orgid`='".$org['orgid']."', + `orgid`='".intval($org['orgid'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), - `codesign`='".$_SESSION['_config']['codesign']."', - `rootcert`='".$_SESSION['_config']['rootcert']."', - `description`='".$_SESSION['_config']['description']."'"; + `codesign`='".intval($_SESSION['_config']['codesign'])."', + `rootcert`='".intval($_SESSION['_config']['rootcert'])."', + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; mysql_query($query); $emailid = mysql_insert_id(); @@ -1558,7 +1549,7 @@ function buildSubjectFromSession() { fclose($fp); $challenge=$_SESSION['spkac_hash']; $CSRname_esc = escapeshellarg($CSRname); - $res=`openssl spkac -verify -in $CSRname_esc`; + $res=shell_exec("openssl spkac -verify -in $CSRname_esc"); if(!strstr($res,"Challenge String: ".$challenge)) { $id = $oldid; @@ -1612,7 +1603,7 @@ function buildSubjectFromSession() { $tmpname = tempnam("/tmp", "id17csr"); $tmpfname_esc = escapeshellarg($tmpfname); $tmpname_esc = escapeshellarg($tmpname); - $do = `/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc`; + $do = shell_exec("/usr/bin/openssl req -in $tmpfname_esc -out $tmpname_esc"); @unlink($tmpfname); $csr = ""; $fp = fopen($tmpname, "r"); @@ -1633,14 +1624,15 @@ function buildSubjectFromSession() { $query = "insert into `orgemailcerts` set `CN`='$defaultemail', - `ou`='".$_SESSION['_config']['OU']."', + `ou`='".mysql_real_escape_string($_SESSION['_config']['OU'])."', `keytype`='" . sanitizeHTML($_REQUEST['keytype']) . "', - `orgid`='".$org['orgid']."', + `orgid`='".intval($org['orgid'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), - `subject`='$csrsubject', - `codesign`='".$_SESSION['_config']['codesign']."', - `rootcert`='".$_SESSION['_config']['rootcert']."', - `description`='".$_SESSION['_config']['description']."'"; + `subject`='".mysql_real_escape_string($csrsubject)."', + `codesign`='".intval($_SESSION['_config']['codesign'])."', + `rootcert`='".intval($_SESSION['_config']['rootcert'])."', + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; mysql_query($query); $emailid = mysql_insert_id(); @@ -1682,7 +1674,7 @@ function buildSubjectFromSession() { echo "Renewing certificate #$id ...\n<br/>"; $id = intval($id); $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org` - where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and + where `orgemailcerts`.`id`='$id' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `org`.`orgid`=`orgemailcerts`.`orgid`"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -1755,7 +1747,7 @@ function buildSubjectFromSession() { { $id = intval($id); $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org` - where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and + where `orgemailcerts`.`id`='".intval($id)."' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `org`.`orgid`=`orgemailcerts`.`orgid`"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -1788,7 +1780,7 @@ function buildSubjectFromSession() { { $id = intval($id); $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `orgemailcerts`, `org` - where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and + where `orgemailcerts`.`id`='".intval($id)."' and `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `org`.`orgid`=`orgemailcerts`.`orgid`"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -1858,19 +1850,15 @@ function buildSubjectFromSession() { exit; } - if(trim($_REQUEST['description']) != ""){ - $_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description']))); - }else{ - $_SESSION['_config']['description']= ""; - } + $_SESSION['_config']['description']= trim(stripslashes($_REQUEST['description'])); $_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id20CSR"); $fp = fopen($_SESSION['_config']['tmpfname'], "w"); fputs($fp, $CSR); fclose($fp); $CSR = escapeshellarg($_SESSION['_config']['tmpfname']); - $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep "Subject:"`); - $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in $CSR |tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`)); + $_SESSION['_config']['subject'] = trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep \"Subject:\"")); + $bits = explode(",", trim(shell_exec("/usr/bin/openssl req -text -noout -in $CSR |tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:"))); foreach($bits as $val) { $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val); @@ -1883,16 +1871,16 @@ function buildSubjectFromSession() { getalt2(); $query = "select * from `orginfo`,`org`,`orgdomains` where - `org`.`memid`='".$_SESSION['profile']['id']."' and + `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `org`.`orgid`=`orginfo`.`id` and `org`.`orgid`=`orgdomains`.`orgid` and - `orgdomains`.`domain`='".$_SESSION['_config']['0.CN']."'"; + `orgdomains`.`domain`='".mysql_real_escape_string($_SESSION['_config']['0.CN'])."'"; $_SESSION['_config']['CNorg'] = mysql_fetch_assoc(mysql_query($query)); $query = "select * from `orginfo`,`org`,`orgdomains` where - `org`.`memid`='".$_SESSION['profile']['id']."' and + `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `org`.`orgid`=`orginfo`.`id` and `org`.`orgid`=`orgdomains`.`orgid` and - `orgdomains`.`domain`='".$_SESSION['_config']['0.subjectAltName']."'"; + `orgdomains`.`domain`='".mysql_real_escape_string($_SESSION['_config']['0.subjectAltName'])."'"; $_SESSION['_config']['SANorg'] = mysql_fetch_assoc(mysql_query($query)); //echo "<pre>"; print_r($_SESSION['_config']); die; @@ -1908,6 +1896,8 @@ function buildSubjectFromSession() { $_SESSION['_config']['rootcert'] = intval($_REQUEST['rootcert']); if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2) $_SESSION['_config']['rootcert'] = 1; + + $_SESSION['_config']['hash_alg'] = HashAlgorithms::clean($_REQUEST['hash_alg']); } if($process != "" && $oldid == 21) @@ -1942,14 +1932,14 @@ function buildSubjectFromSession() { if($_SESSION['_config']['rowid']['0'] > 0) { $query = "select * from `org`,`orginfo` where - `orginfo`.`id`='".$_SESSION['_config']['rowid']['0']."' and + `orginfo`.`id`='".intval($_SESSION['_config']['rowid']['0'])."' and `orginfo`.`id`=`org`.`orgid` and - `org`.`memid`='".$_SESSION['profile']['id']."'"; + `org`.`memid`='".intval($_SESSION['profile']['id'])."'"; } else { $query = "select * from `org`,`orginfo` where - `orginfo`.`id`='".$_SESSION['_config']['altid']['0']."' and + `orginfo`.`id`='".intval($_SESSION['_config']['altid']['0'])."' and `orginfo`.`id`=`org`.`orgid` and - `org`.`memid`='".$_SESSION['profile']['id']."'"; + `org`.`memid`='".intval($_SESSION['profile']['id'])."'"; } $org = mysql_fetch_assoc(mysql_query($query)); $csrsubject = ""; @@ -1977,22 +1967,24 @@ function buildSubjectFromSession() { if($_SESSION['_config']['rowid']['0'] > 0) { $query = "insert into `orgdomaincerts` set - `CN`='".$_SESSION['_config']['rows']['0']."', - `orgid`='".$org['id']."', + `CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."', + `orgid`='".intval($org['id'])."', `created`=NOW(), - `subject`='$csrsubject', - `rootcert`='".$_SESSION['_config']['rootcert']."', - `type`='$type', - `description`='".$_SESSION['_config']['description']."'"; + `subject`='".mysql_real_escape_string($csrsubject)."', + `rootcert`='".intval($_SESSION['_config']['rootcert'])."', + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `type`='".$type."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; } else { $query = "insert into `orgdomaincerts` set - `CN`='".$_SESSION['_config']['altrows']['0']."', - `orgid`='".$org['id']."', + `CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."', + `orgid`='".intval($org['id'])."', `created`=NOW(), - `subject`='$csrsubject', - `rootcert`='".$_SESSION['_config']['rootcert']."', - `type`='$type', - `description`='".$_SESSION['_config']['description']."'"; + `subject`='".mysql_real_escape_string($csrsubject)."', + `rootcert`='".intval($_SESSION['_config']['rootcert'])."', + `md`='".mysql_real_escape_string($_SESSION['_config']['hash_alg'])."', + `type`='".$type."', + `description`='".mysql_real_escape_string($_SESSION['_config']['description'])."'"; } mysql_query($query); $CSRid = mysql_insert_id(); @@ -2003,10 +1995,10 @@ function buildSubjectFromSession() { mysql_query("update `orgdomaincerts` set `CSR_name`='$CSRname' where `id`='$CSRid'"); if(is_array($_SESSION['_config']['rowid'])) foreach($_SESSION['_config']['rowid'] as $id) - mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'"); + mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($id)."', `orgcertid`='$CSRid'"); if(is_array($_SESSION['_config']['altid'])) foreach($_SESSION['_config']['altid'] as $id) - mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'"); + mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($id)."', `orgcertid`='$CSRid'"); waitForResult("orgdomaincerts", $CSRid,$oldid); $query = "select * from `orgdomaincerts` where `id`='$CSRid' and `crt_name` != ''"; $res = mysql_query($query); @@ -2037,7 +2029,7 @@ function buildSubjectFromSession() { `orgdomaincerts`,`org` where `orgdomaincerts`.`id`='$id' and `orgdomaincerts`.`orgid`=`org`.`orgid` and - `org`.`memid`='".$_SESSION['profile']['id']."'"; + `org`.`memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -2079,7 +2071,7 @@ function buildSubjectFromSession() { echo _("Renewing").": ".$row['CN']."<br>\n"; $res = mysql_query("select * from `orgdomlink` where `orgcertid`='".$row['id']."'"); while($r2 = mysql_fetch_assoc($res)) - mysql_query("insert into `orgdomlink` set `orgdomid`='".$r2['id']."', `orgcertid`='$newid'"); + mysql_query("insert into `orgdomlink` set `orgdomid`='".intval($r2['orgdomid'])."', `orgcertid`='$newid'"); waitForResult("orgdomaincerts", $newid,$oldid,0); $query = "select * from `orgdomaincerts` where `id`='$newid' and `crt_name` != ''"; $res = mysql_query($query); @@ -2089,7 +2081,7 @@ function buildSubjectFromSession() { } else { $drow = mysql_fetch_assoc($res); $crtname = escapeshellarg($drow['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crtname`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crtname"); echo "<pre>\n$cert\n</pre>\n"; } } @@ -2116,7 +2108,7 @@ function buildSubjectFromSession() { `orgdomaincerts`,`org` where `orgdomaincerts`.`id`='$id' and `orgdomaincerts`.`orgid`=`org`.`orgid` and - `org`.`memid`='".$_SESSION['profile']['id']."'"; + `org`.`memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -2151,7 +2143,7 @@ function buildSubjectFromSession() { `orgdomaincerts`,`org` where `orgdomaincerts`.`id`='$id' and `orgdomaincerts`.`orgid`=`org`.`orgid` and - `org`.`memid`='".$_SESSION['profile']['id']."'"; + `org`.`memid`='".intval($_SESSION['profile']['id'])."'"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { @@ -2267,7 +2259,7 @@ function buildSubjectFromSession() { `ST`='".$_SESSION['_config']['ST']."', `C`='".$_SESSION['_config']['C']."', `comments`='".$_SESSION['_config']['comments']."' - where `id`='".$_SESSION['_config']['orgid']."'"); + where `id`='".intval($_SESSION['_config']['orgid'])."'"); showheader(_("My CAcert.org Account!")); printf(_("'%s' has just been successfully updated in the database."), sanitizeHTML($_SESSION['_config']['O'])); showfooter(); @@ -2447,11 +2439,11 @@ function buildSubjectFromSession() { { csrf_check('orgadmadd'); if($_SESSION['profile']['orgadmin'] == 1) - $masteracc = $_SESSION['_config'][masteracc] = intval($_REQUEST['masteracc']); + $masteracc = $_SESSION['_config']['masteracc'] = intval($_REQUEST['masteracc']); else - $masteracc = $_SESSION['_config'][masteracc] = 0; + $masteracc = $_SESSION['_config']['masteracc'] = 0; $_REQUEST['email'] = $_SESSION['_config']['email'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['email']))); - $OU = $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU']))); + $_SESSION['_config']['OU'] = stripslashes(trim($_REQUEST['OU'])); $comments = $_SESSION['_config']['comments'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['comments']))); $res = mysql_query("select * from `users` where `email`='".$_REQUEST['email']."' and `deleted`=0"); if(mysql_num_rows($res) <= 0) @@ -2473,7 +2465,7 @@ function buildSubjectFromSession() { set `memid`='".intval($row['id'])."', `orgid`='".intval($_SESSION['_config']['orgid'])."', `masteracc`='$masteracc', - `OU`='$OU', + `OU`='".mysql_real_escape_string($_SESSION['_config']['OU'])."', `comments`='$comments'"); } } @@ -2482,7 +2474,7 @@ function buildSubjectFromSession() { if(($oldid == 34 || $id == 34) && $_SESSION['profile']['orgadmin'] != 1) { $orgid = intval($_SESSION['_config']['orgid']); - $res = mysql_query("select * from `org` where `orgid`='$orgid' and `memid`='".$_SESSION['profile']['id']."' and `masteracc`='1'"); + $res = mysql_query("select * from `org` where `orgid`='$orgid' and `memid`='".intval($_SESSION['profile']['id'])."' and `masteracc`='1'"); if(mysql_num_rows($res) <= 0) $id = 32; } @@ -2541,7 +2533,7 @@ function buildSubjectFromSession() { { if($key == $lang) { - mysql_query("update `users` set `language`='$lang' where `id`='".$_SESSION['profile']['id']."'"); + mysql_query("update `users` set `language`='$lang' where `id`='".intval($_SESSION['profile']['id'])."'"); $_SESSION['profile']['language'] = $lang; showheader(_("My CAcert.org Account!")); echo _("Your language setting has been updated."); @@ -2696,10 +2688,27 @@ function buildSubjectFromSession() { $oldid=0; } - if($oldid == 43 && $_REQUEST['action'] == "updatedob") + //check if ticket number was entered + if ( $id == 43 || $oldid == 43 || $id == 44 || $oldid == 44 ) { + if ($ticketno != "" ) { + $ticketno = trim($_REQUEST['ticketno']); + $ticketvalidation = valid_ticket_number($ticketno); + } + + $_SESSION['ticketno'] = $ticketno; + } + + if($oldid == 43 && $actionrequest == "updatedob" && $ticketvalidation == TRUE) { $id = 43; $oldid=0; + $userid = intval($_REQUEST['userid']); + if (!write_se_log($userid, $_SESSION['profile']['id'],'SE Name/DOB Change',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $fname = mysql_real_escape_string($_REQUEST['fname']); $mname = mysql_real_escape_string($_REQUEST['mname']); $lname = mysql_real_escape_string($_REQUEST['lname']); @@ -2707,21 +2716,29 @@ function buildSubjectFromSession() { $day = intval($_REQUEST['day']); $month = intval($_REQUEST['month']); $year = intval($_REQUEST['year']); - $userid = intval($_REQUEST['userid']); - $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'"; - $details = mysql_fetch_assoc(mysql_query($query)); - $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}', - `new-lname`='$lname',`new-dob`='$year-$month-$day',`uid`='$userid',`adminid`='".$_SESSION['profile']['id']."'"; - mysql_query($query); $query = "update `users` set `fname`='$fname',`mname`='$mname',`lname`='$lname',`suffix`='$suffix',`dob`='$year-$month-$day' where `id`='$userid'"; mysql_query($query); + }elseif($oldid == 43 && $actionrequest == "updatedob" && $ticketvalidation == FALSE){ + $id = 43; + $oldid=0; + $_SESSION['ticketmsg']='No action (name/dob change) taken. Ticket number is missing!'; } - if($oldid == 43 && $_REQUEST['action'] == 'revokecert') + if($oldid == 43 && $actionrequest == 'revokecert' && $ticketvalidation == TRUE) { $userid = intval($_REQUEST['userid']); + if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE Revoke all certificates',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } revoke_all_private_cert($userid); $id=43; + }elseif($oldid == 43 && $actionrequest == "revokecert" && $ticketvalidation == FALSE){ + $id = 43; + $oldid=0; + $_SESSION['ticketmsg']='No certificates revokes. Ticket number is missing!'; } if($oldid == 48 && $_REQUEST['domain'] == "") @@ -2738,8 +2755,7 @@ function buildSubjectFromSession() { if($id == 44) { - if($_REQUEST['userid'] != "") - $_REQUEST['userid'] = intval($_REQUEST['userid']); + $_REQUEST['userid'] = intval($_REQUEST['userid']); $row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'")); if($row['email'] == "") $id = 42; @@ -2747,18 +2763,25 @@ function buildSubjectFromSession() { $_REQUEST['email'] = $row['email']; } - if($oldid == 44) + if($oldid == 44 && $ticketvalidation == TRUE) { showheader(_("My CAcert.org Account!")); if(intval($_REQUEST['userid']) <= 0) { echo _("No such user found."); } else { + if (!write_se_log(intval($_REQUEST['userid']), $_SESSION['profile']['id'],'SE reset password',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } mysql_query("update `users` set `password`=sha1('".mysql_real_escape_string(stripslashes($_REQUEST['newpass']))."') where `id`='".intval($_REQUEST['userid'])."'"); $row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'")); printf(_("The password for %s has been updated successfully in the system."), sanitizeHTML($row['email'])); - + $my_translation = L10n::get_translation(); + L10n::set_recipient_language(intval($_REQUEST['userid'])); $body = sprintf(_("Hi %s,"),$row['fname'])."\n\n"; $body .= _("You are receiving this email because a CAcert administrator ". "has changed the password on your account.")."\n\n"; @@ -2767,18 +2790,24 @@ function buildSubjectFromSession() { sendmail($row['email'], "[CAcert.org] "._("Password Update Notification"), $body, "support@cacert.org", "", "", "CAcert Support"); + L10n::set_translation($my_translation); } showfooter(); exit; + }elseif($oldid == 44 && $ticketvalidation == FALSE){ + $_SESSION['ticketmsg']='No password reset taken. Ticket number is missing!'; } + if($process != "" && $oldid == 45) { $CSR = clean_csr($CSR); $_SESSION['_config']['CSR'] = $CSR; - $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`); - $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`)); + runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\"", $CSR, $CSRSubjects); + runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:", $CSR, $CSRAlts); + $_SESSION['_config']['subject'] = trim($CSRSubjects); + $bits = explode(",", trim($CSRAlts)); foreach($bits as $val) { $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val); @@ -2802,8 +2831,11 @@ function buildSubjectFromSession() { if($process != "" && $oldid == 46) { $CSR = clean_csr($_SESSION['_config']['CSR']); - $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`); - $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`)); + runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep \"Subject:\"", $CSR, $CSRSubjects); + runCommand("/usr/bin/openssl req -text -noout|tr -d \"\\0\"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:", $CSR, $CSRAlts); + + $_SESSION['_config']['subject'] = trim($CSRSubjects); + $bits = explode(",", trim($CSRAlts)); foreach($bits as $val) { $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val); @@ -2839,10 +2871,10 @@ function buildSubjectFromSession() { $CSRid = mysql_insert_id(); foreach($_SESSION['_config']['rowid'] as $dom) - mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'"); + mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='".intval($dom)."'"); if(is_array($_SESSION['_config']['altid'])) foreach($_SESSION['_config']['altid'] as $dom) - mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'"); + mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='".intval($dom)."'"); $CSRname=generatecertpath("csr","server",$CSRid); $fp = fopen($CSRname, "w"); @@ -2865,150 +2897,279 @@ function buildSubjectFromSession() { } } - if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0) + /* presently not needed + if($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0 && $ticketvalidation==TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['tverify']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change tverify status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['tverify']; mysql_query("update `users` set `tverify`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('tverify',$_REQUEST) && $_REQUEST['tverify'] > 0 && $ticketvalidation==FALSE){ + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } + */ - if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0) + if($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0 && $ticketvalidation == TRUE) { csrf_check('admsetassuret'); $memid = $_REQUEST['userid'] = intval($_REQUEST['assurer']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change assurer status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['assurer']; mysql_query("update `users` set `assurer`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('assurer',$_REQUEST) && $_REQUEST['assurer'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['assurer']); + $_SESSION['ticketmsg']='No action (Change assurer status) taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0) + if($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0 && $ticketvalidation == TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change assurer blocked status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['assurer_blocked']; mysql_query("update `users` set `assurer_blocked`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('assurer_blocked',$_REQUEST) && $_REQUEST['assurer_blocked'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['assurer_blocked']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0) + if($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0 && $ticketvalidation == TRUE) { csrf_check('admactlock'); $memid = $_REQUEST['userid'] = intval($_REQUEST['locked']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change locked status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['locked']; mysql_query("update `users` set `locked`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('locked',$_REQUEST) && $_REQUEST['locked'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['locked']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0) + if($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0 && $ticketvalidation == TRUE) { csrf_check('admcodesign'); $memid = $_REQUEST['userid'] = intval($_REQUEST['codesign']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change codesign status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['codesign']; mysql_query("update `users` set `codesign`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['codesign']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0) + if($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0 && $ticketvalidation == TRUE) { csrf_check('admorgadmin'); $memid = $_REQUEST['userid'] = intval($_REQUEST['orgadmin']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change org assuer status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['orgadmin']; mysql_query("update `users` set `orgadmin`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('orgadmin',$_REQUEST) && $_REQUEST['orgadmin'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['orgadmin']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0) + if($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0 && $ticketvalidation == TRUE) { csrf_check('admttpadmin'); $memid = $_REQUEST['userid'] = intval($_REQUEST['ttpadmin']); + if(!write_se_log($memid, $_SESSION['profile']['id'],'SE Change ttp admin status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['ttpadmin']; mysql_query("update `users` set `ttpadmin`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('ttpadmin',$_REQUEST) && $_REQUEST['ttpadmin'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['ttpadmin']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0) + if($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0 && $ticketvalidation == TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['adadmin']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change advertising admin status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = $row['adadmin'] + 1; if($ver > 2) $ver = 0; mysql_query("update `users` set `adadmin`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('adadmin',$_REQUEST) && $_REQUEST['adadmin'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['adadmin']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0) + if($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0 && $ticketvalidation == TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['locadmin']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change location admin status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['locadmin']; mysql_query("update `users` set `locadmin`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('locadmin',$_REQUEST) && $_REQUEST['locadmin'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['locadmin']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0) + if($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0 && $ticketvalidation == TRUE) { csrf_check('admsetadmin'); $memid = $_REQUEST['userid'] = intval($_REQUEST['admin']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change SE status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `users` where `id`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['admin']; mysql_query("update `users` set `admin`='$ver' where `id`='$memid'"); + }elseif($id == 43 && array_key_exists('admin',$_REQUEST) && $_REQUEST['admin'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['admin']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0) + if($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0 && $ticketvalidation == TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['general']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change general status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `alerts` where `memid`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['general']; mysql_query("update `alerts` set `general`='$ver' where `memid`='$memid'"); + }elseif($id == 43 && array_key_exists('general',$_REQUEST) && $_REQUEST['general'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['general']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0) + if($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0 && $ticketvalidation == TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['country']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change country status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `alerts` where `memid`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['country']; mysql_query("update `alerts` set `country`='$ver' where `memid`='$memid'"); + }elseif($id == 43 && array_key_exists('country',$_REQUEST) && $_REQUEST['country'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['country']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0) + if($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0 && $ticketvalidation == TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['regional']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change regional status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `alerts` where `memid`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['regional']; mysql_query("update `alerts` set `regional`='$ver' where `memid`='$memid'"); + }elseif($id == 43 && array_key_exists('regional',$_REQUEST) && $_REQUEST['regional'] > 0 && $ticketvalidation == FALSE){ + $_REQUEST['userid'] = intval($_REQUEST['regional']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } - if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0) + if($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0 && $ticketvalidation == TRUE) { $memid = $_REQUEST['userid'] = intval($_REQUEST['radius']); + if (!write_se_log($memid, $_SESSION['profile']['id'],'SE Change radius status',$ticketno)) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + showfooter(); + exit; + } $query = "select * from `alerts` where `memid`='$memid'"; $row = mysql_fetch_assoc(mysql_query($query)); $ver = !$row['radius']; mysql_query("update `alerts` set `radius`='$ver' where `memid`='$memid'"); + }elseif($id == 43 && array_key_exists('radius',$_REQUEST) && $_REQUEST['radius'] > 0 && $ticketvalidation == false){ + $_REQUEST['userid'] = intval($_REQUEST['radius']); + $_SESSION['ticketmsg']='No action taken. Ticket number is missing!'; } if($id == 50) { - if(array_key_exists('userid',$_REQUEST) && $_REQUEST['userid'] != "") + if(array_key_exists('userid',$_REQUEST) && $_REQUEST['userid'] !== "") { $_REQUEST['userid'] = intval($_REQUEST['userid']); + } $row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'")); - if($row['email'] == "") + if($row['email'] == "") { $id = 42; - else + } else { $_REQUEST['email'] = $row['email']; + } } if($oldid == 50) @@ -3023,151 +3184,69 @@ function buildSubjectFromSession() { if (trim($_REQUEST['arbitrationno'])==""){ showheader(_("My CAcert.org Account!")); echo _("You did not enter an arbitration number entry."); + printf('<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>'); showfooter(); exit; } if ( 1 !== preg_match('/^[a-z]\d{8}\.\d+\.\d+$/i',trim($_REQUEST['arbitrationno'])) ) { showheader(_("My CAcert.org Account!")); printf(_("'%s' is not a valid arbitration number entry."), sanitizeHTML(trim($_REQUEST['arbitrationno']))); + printf('<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>'); showfooter(); exit; } if (check_email_exists(trim($_REQUEST['arbitrationno']).'@cacert.org')) { showheader(_("My CAcert.org Account!")); printf(_("The email address '%s' is already in a different account. Can't continue."), sanitizeHTML($_REQUEST['arbitrationno'].'@cacert.org')); + printf('<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>'); showfooter(); exit; - } - if (check_client_cert_running($_REQUEST['userid'],1) || - check_server_cert_running($_REQUEST['userid'],1) || - check_gpg_cert_running($_REQUEST['userid'],1)) { + } + if (check_client_cert_running(intval($_REQUEST['userid']),1) || + check_server_cert_running(intval($_REQUEST['userid']),1) || + check_gpg_cert_running(intval($_REQUEST['userid']),1)) { showheader(_("My CAcert.org Account!")); printf(_("The CCA retention time for at least one certificate is not over. Can't continue.")); + printf('<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>'); showfooter(); exit; } - if (check_is_orgadmin($_REQUEST['userid'],1)) { + if (check_is_orgadmin(intval($_REQUEST['userid']),1)) { showheader(_("My CAcert.org Account!")); printf(_("The user is listed as Organisation Administrator. Can't continue.")); + printf('<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>'); showfooter(); exit; } - account_delete($_REQUEST['userid'], trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']); + if (!write_se_log(intval($_REQUEST['userid']), $_SESSION['profile']['id'], 'SE Account delete', trim($_REQUEST['arbitrationno']))) { + showheader(_("Something went wrong")); + echo _("Writing to the admin log failed. Can't continue."); + printf('<br/><a href="account.php?id=43&userid=' . intval($_REQUEST['userid']) . '">' . _('Back to previous page.') .'</a>'); + showfooter(); + exit; + } + account_delete(intval($_REQUEST['userid']), trim($_REQUEST['arbitrationno']), $_SESSION['profile']['id']); } - if(($id == 51 || $id == 52 || $oldid == 52) && $_SESSION['profile']['tverify'] <= 0) + if(($id == 51 || $id == 52 || $oldid == 52)) { showheader(_("My CAcert.org Account!")); - echo _("You don't have access to this area."); + echo _("You don't have access to this area.\nThe Tverify programme is terminated as of 16th November 2010" ); showfooter(); exit; } - if($oldid == 52) - { - $uid = intval($_REQUEST['uid']); - $query = "select * from `tverify` where `id`='$uid' and `modified`=0"; - $rc = mysql_num_rows(mysql_query($query)); - if($rc <= 0) + if($id == 59){ + if (!($oldid == 43 && $_SESSION['profile']['admin'] == 1) && + !($oldid == 13 && intval($_REQUEST['userid']) == $_SESSION['profile']['id'])) { showheader(_("My CAcert.org Account!")); - echo _("Unable to find a valid tverify request for this ID."); + echo _("You do not have access to this page."); showfooter(); exit; } } - if($oldid == 52) - { - $query = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".$_SESSION['profile']['id']."'"; - $rc = mysql_num_rows(mysql_query($query)); - if($rc > 0) - { - showheader(_("My CAcert.org Account!")); - echo _("You have already voted on this request."); - showfooter(); - exit; - } - } - - if($oldid == 52 && ($_REQUEST['agree'] != "" || $_REQUEST['disagree'] != "")) - { - $vote = -1; - if($_REQUEST['agree'] != "") - $vote = 1; - - $query = "insert into `tverify-vote` set - `tverify`='$uid', - `memid`='".$_SESSION['profile']['id']."', - `when`=NOW(), `vote`='$vote', - `comment`='".mysql_real_escape_string($_REQUEST['comment'])."'"; - mysql_query($query); - - $rc = mysql_num_rows(mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='1'")); - if($rc >= 8) - { - mysql_query("update `tverify` set `modified`=NOW() where `id`='$uid'"); - $tverify = mysql_fetch_assoc(mysql_query("select * from `tverify` where `id`='$uid'")); - $memid = $tverify['memid']; - $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$memid'")); - $tmp = mysql_fetch_assoc(mysql_query("select sum(`points`) as `points` from `notary` where `to`='$memid'")); - - $points = 0; - if($tverify['URL'] != "" && $tverify['photoid'] != "") - $points = 150 - intval($tmp['points']); - if($tverify['URL'] != "" && $tverify['photoid'] == "") - $points = 90 - intval($tmp['points']); - if($tverify['URL'] == "" && $tverify['photoid'] == "") - $points = 50 - intval($tmp['points']); - - if($points < 0) - $points = 0; - - if($points > 0) - { - mysql_query("insert into `notary` set `from`='0', `to`='$memid', `points`='$points', - `method`='Thawte Points Transfer', `when`=NOW()"); - fix_assurer_flag($memid); - } - $totalpoints = intval($tmp['points']) + $points; - - $body = _("Your request to have points transfered was successful. You were issued $points points as a result, and you now have $totalpoints in total")."\n\n"._("The following comments were made by reviewers")."\n\n"; - $res = mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='1'"); - while($row = mysql_fetch_assoc($res)) - $body .= $row['comment']."\n"; - $body .= "\n"; - - $body .= _("Best regards")."\n"; - $body .= _("CAcert Support Team"); - sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify"); - } - - $rc = mysql_num_rows(mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='-1'")); - if($rc >= 4) - { - mysql_query("update `tverify` set `modified`=NOW() where `id`='$uid'"); - $tverify = mysql_fetch_assoc(mysql_query("select * from `tverify` where `id`='$uid'")); - $memid = $tverify['memid']; - $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$memid'")); - - $body = _("Unfortunately your request for a points increase has been denied, below is the comments from people that reviewed your request as to why they rejected your application.")."\n\n"; - $res = mysql_query("select * from `tverify-vote` where `tverify`='$uid' and `vote`='-1'"); - while($row = mysql_fetch_assoc($res)) - $body .= $row['comment']."\n"; - $body .= "\n"; - - $body .= _("You are welcome to try submitting another request at any time in the future, please make sure you take the reviewer comments into consideration or you risk having your application rejected again.")."\n\n"; - - $body .= _("Best regards")."\n"; - $body .= _("CAcert Support Team"); - sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify"); - } - - showheader(_("My CAcert.org Account!")); - echo _("Your vote has been accepted."); - showfooter(); - exit; - } if(intval($cert) > 0) $_SESSION['_config']['cert'] = intval($cert); diff --git a/includes/account_stuff.php b/includes/account_stuff.php index dbebf6a..0fda2f1 100644 --- a/includes/account_stuff.php +++ b/includes/account_stuff.php @@ -22,6 +22,7 @@ function showheader($title = "CAcert.org", $title2 = "") { global $id, $PHP_SELF; + $PHP_SELF = &$_SERVER['PHP_SELF']; $expand=""; $tmpid = $id; if($PHP_SELF == "/wot.php") @@ -35,46 +36,51 @@ switch($tmpid) { - case 1: - case 2: $expand = " explode('emailacc');"; break; - case 3: - case 4: - case 5: - case 6: $expand = " explode('clicerts');"; break; - case 7: - case 8: - case 9: $expand = " explode('domains');"; break; - case 10: - case 11: - case 12: - case 15: $expand = " explode('servercert');"; break; - case 13: - case 14: - case 36: - case 41: + case 1: // Add email address + case 2: $expand = " explode('emailacc');"; break; // View email addresses + case 3: // Add Client certificate + case 4: // Confirm Client Certificate Request + case 5: // View Client Certificates + case 6: $expand = " explode('clicerts');"; break; // Client Certificate page + case 7: // Add new domain + case 8: // Confirm Domain page + case 9: $expand = " explode('domains');"; break; // View Domains + case 10: // Add Server Certifiacte + case 11: // Confirm Server Certificate Rewust + case 12: // View Server Cerificate + case 15: $expand = " explode('servercert');"; break; // Server Certificate page + case 13: // ViewEdit + case 14: // Change password + case 36: // My Alert settings + case 41: // Language Settings + case 55: // Trainings + case 59: // Account History case 507: - case 508: - case 513: $expand = " explode('mydetails');"; break; - case 16: - case 17: - case 18: - case 19: $expand = " explode('clientorg');"; break; - case 20: - case 21: - case 22: - case 23: $expand = " explode('serverorg');"; break; - case 24: - case 25: - case 26: - case 27: - case 28: - case 29: - case 30: + case 508: // My Listing + case 510: // Old points calculation + case 515: // New points calculation + case 513: $expand = " explode('mydetails');"; break; // My Location + case 16: // Add Org Client Cert + case 17: // Confirm Org Client Certificate Request + case 18: // View Org Client Certificate + case 19: $expand = " explode('clientorg');"; break; // Org Cleint Cert page + case 20: // Add Org Server Cert + case 21: // Conform Org Server Cert Request + case 22: // View Org Server Certs + case 23: $expand = " explode('serverorg');"; break; // Org Server Certificate page + case 24: // Add new Organisation + case 25: // View Organisation List + case 26: // View Organisation Domains + case 27: // Edit Org Account + case 28: // View Add Org Domain + case 29: // Edit Org Domain + case 30: // Delete Org Domain case 31: - case 32: - case 33: - case 34: - case 35: $expand = " explode('orgadmin');"; break; + case 32: // View Org Admin + case 33: // Add Org Admin + case 34: // Delete Org Admin + case 60: // View Organisation Account History + case 35: $expand = " explode('orgadmin');"; break; // View Org Admin Organisation List case 42: case 43: case 44: @@ -86,20 +92,19 @@ case 50: case 54: case 53: $expand = " explode('sysadmin');"; break; - case 500: + case 500: // CAcert Web of Trust case 501: - case 502: - case 503: - case 504: - case 505: + case 502: // Become an Assurer + case 503: // CAcert Web of Trust Roles + case 504: // TTP + case 505: // Assurer Some one case 506: case 509: - case 510: case 511: - case 512: $expand = " explode('WoT');"; break; + case 512: $expand = " explode('WoT');"; break; // Find Assurer case 1000: case 1001: - case 1002: + case 1002: // View GPG key case 1003: case 1004: case 1005: @@ -108,9 +113,9 @@ case 1008: case 1009: case 1010: $expand = " explode('gpg');"; break; - case 1500: - case 1501: - case 1502: + case 1500: // Dipute + case 1501: // Dispute Email Request + case 1502: // ViewEdit case 1503: case 1504: case 1505: @@ -172,9 +177,11 @@ function hideall() { </div> <div class="relatedLinks"> <h3 class="pointer" onclick="explode('mydetails')">+ <?=_("My Details")?></h3> - <ul class="menu" id="mydetails"><li><a href="account.php?id=13"><?=_("View/Edit")?></a></li><li><a href="account.php?id=14"><?=_("Change Password")?></a></li><li><a href="account.php?id=41"><?=_("Default Language")?></a></li><li><a href="wot.php?id=8"><?=_("My Listing")?></a></li><li><a href="wot.php?id=13"><?=_("My Location")?></a></li><li><a href="account.php?id=36"><?=_("My Alert Settings")?></a></li><li><a href="wot.php?id=10"><?=_("My Points")?></a></li><? + <ul class="menu" id="mydetails"><li><a href="account.php?id=13"><?=_("View/Edit")?></a></li><li><a href="account.php?id=14"><?=_("Change Password")?></a></li><li><a href="account.php?id=41"><?=_("Default Language")?></a></li><li><a href="wot.php?id=8"><?=_("My Listing")?></a></li><li><a href="wot.php?id=13"><?=_("My Location")?></a></li><li><a href="account.php?id=36"><?=_("My Alert Settings")?></a></li><li><a href="account.php?id=55"><?=_("My Trainings")?></a></li><li><a href="wot.php?id=10"><?=_("My Points")?></a></li><? +/* to delete if($_SESSION['profile']['id'] == 1 || $_SESSION['profile']['id'] == 5897) echo "<li><a href='sqldump.php'>SQL Dump</a></li>"; +*/ ?></ul> </div> <div class="relatedLinks"> @@ -217,7 +224,7 @@ function hideall() { <? } ?> <div class="relatedLinks"> <h3 class="pointer" onclick="explode('WoT')">+ <?=_("CAcert Web of Trust")?></h3> - <ul class="menu" id="WoT"><li><a href="wot.php?id=0"><?=_("About")?></a></li><li><a href="wot.php?id=12"><?=_("Find an Assurer")?></a></li><li><a href="wot.php?id=3"><?=_("Rules")?></a></li><li><? if($_SESSION['profile']['assurer'] != 1) { ?><a href="wot.php?id=2"><?=_("Becoming an Assurer")?></a><? } else { ?><a href="wot.php?id=5"><?=_("Assure Someone")?></a><? } ?></li><li><a href="wot.php?id=4"><?=_("Trusted ThirdParties")?></a></li><? if($_SESSION['profile']['points'] >= 500) { ?><li><a href="wot.php?id=11"><div style="white-space:nowrap"><?=_("Organisation Assurance")?></div></a></li><? } ?><li><a href="account.php?id=55"><?=_("Training")?></a></li></ul> + <ul class="menu" id="WoT"><li><a href="wot.php?id=0"><?=_("About")?></a></li><li><a href="wot.php?id=12"><?=_("Find an Assurer")?></a></li><li><a href="wot.php?id=3"><?=_("Rules")?></a></li><li><? if($_SESSION['profile']['assurer'] != 1) { ?><a href="wot.php?id=2"><?=_("Becoming an Assurer")?></a><? } else { ?><a href="wot.php?id=5"><?=_("Assure Someone")?></a><? } ?></li><li><a href="wot.php?id=4"><?=_("Trusted ThirdParties")?></a></li><? if($_SESSION['profile']['points'] >= 500) { ?><li><a href="wot.php?id=11"><div style="white-space:nowrap"><?=_("Organisation Assurance")?></div></a></li><? } ?></ul> </div> <div class="relatedLinks"> <h3 class="pointer" onclick="explode('WoTForms')">+ <?=_("CAP Forms")?></h3><? diff --git a/includes/general.php b/includes/general.php index f36ccdf..596cc49 100644 --- a/includes/general.php +++ b/includes/general.php @@ -57,7 +57,7 @@ exit; } - if(array_key_exists('HTTP_HOST',$_SERVER) && + if(array_key_exists('HTTP_HOST',$_SERVER) && ($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] || $_SERVER['HTTP_HOST'] == $_SESSION['_config']['tverify'])) { @@ -77,12 +77,12 @@ L10n::detect_language(); L10n::init_gettext(); - if(array_key_exists('profile',$_SESSION) && is_array($_SESSION['profile']) && array_key_exists('id',$_SESSION['profile']) && $_SESSION['profile']['id'] > 0) + if(array_key_exists('profile',$_SESSION) && is_array($_SESSION['profile']) && array_key_exists('id',$_SESSION['profile']) && $_SESSION['profile']['id'] > 0) { - $locked = mysql_fetch_assoc(mysql_query("select `locked` from `users` where `id`='".$_SESSION['profile']['id']."'")); + $locked = mysql_fetch_assoc(mysql_query("select `locked` from `users` where `id`='".intval($_SESSION['profile']['id'])."'")); if($locked['locked'] == 0) { - $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`"; + $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`"; $res = mysql_query($query); $row = mysql_fetch_assoc($res); $_SESSION['profile']['points'] = $row['total']; @@ -169,19 +169,19 @@ $points++; //echo "Points due to length and charset: $points<br/>"; - + // check for historical password proposal if ($pwd === "Fr3d Sm|7h") { return 0; } - + return $points; } function checkpw($pwd, $email, $fname, $mname, $lname, $suffix) { $points = checkpwlight($pwd); - + if(@strstr(strtolower($pwd), strtolower($email))) $points--; @@ -219,7 +219,7 @@ //echo "Points due to name matches: $points<br/>"; $shellpwd = escapeshellarg($pwd); - $do = `grep -F -- $shellpwd /usr/share/dict/american-english`; + $do = shell_exec("grep -F -- $shellpwd /usr/share/dict/american-english"); if($do) $points--; @@ -232,7 +232,7 @@ { $bits = explode(": ", $_SESSION['_config']['subject'], 2); $bits = str_replace(", ", "|", str_replace("/", "|", array_key_exists('1',$bits)?$bits['1']:"")); - $bits = explode("|", $bits); + $bits = explode("|", $bits); $_SESSION['_config']['cnc'] = $_SESSION['_config']['subaltc'] = 0; $_SESSION['_config']['OU'] = ""; @@ -287,7 +287,7 @@ $dom = $bits[$i]; $_SESSION['_config']['row'] = ""; $dom = mysql_real_escape_string($dom); - $query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''"; + $query = "select * from domains where `memid`='".intval($_SESSION['profile']['id'])."' and `domain` like '$dom' and `deleted`=0 and `hash`=''"; $res = mysql_query($query); if(mysql_num_rows($res) > 0) { @@ -339,7 +339,7 @@ $dom = $bits[$i]; $_SESSION['_config']['altrow'] = ""; $dom = mysql_real_escape_string($dom); - $query = "select * from domains where `memid`='".$_SESSION['profile']['id']."' and `domain` like '$dom' and `deleted`=0 and `hash`=''"; + $query = "select * from domains where `memid`='".intval($_SESSION['profile']['id'])."' and `domain` like '$dom' and `deleted`=0 and `hash`=''"; $res = mysql_query($query); if(mysql_num_rows($res) > 0) { @@ -378,7 +378,7 @@ $_SESSION['_config']['row'] = ""; $dom = mysql_real_escape_string($dom); $query = "select *, `orginfo`.`id` as `id` from `orginfo`,`orgdomains`,`org` where - `org`.`memid`='".$_SESSION['profile']['id']."' and + `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `org`.`orgid`=`orginfo`.`id` and `orgdomains`.`orgid`=`orginfo`.`id` and `orgdomains`.`domain`='$dom'"; @@ -426,7 +426,7 @@ $_SESSION['_config']['altrow'] = ""; $dom = mysql_real_escape_string($dom); $query = "select * from `orginfo`,`orgdomains`,`org` where - `org`.`memid`='".$_SESSION['profile']['id']."' and + `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `org`.`orgid`=`orginfo`.`id` and `orgdomains`.`orgid`=`orginfo`.`id` and `orgdomains`.`domain`='$dom'"; @@ -458,7 +458,7 @@ $dom = $bits[$i]; $dom = mysql_real_escape_string($dom); $query = "select * from `org`,`orgdomains`,`orginfo` - where `org`.`memid`='".$_SESSION['profile']['id']."' + where `org`.`memid`='".intval($_SESSION['profile']['id'])."' and `orgdomains`.`orgid`=`org`.`orgid` and `orginfo`.`id`=`org`.`orgid` and `orgdomains`.`domain`='$dom'"; @@ -477,12 +477,12 @@ if($id <= 0) $id = $_SESSION['profile']['id']; - $query = "select sum(`points`) as `points` from `notary` where `to`='$id' group by `to`"; + $query = "select sum(`points`) as `points` from `notary` where `to`='$id' and `deleted` = 0 group by `to`"; $row = mysql_fetch_assoc(mysql_query($query)); $points = $row['points']; $dob = date("Y-m-d", mktime(0,0,0,date("m"),date("d"),date("Y")-18)); - $query = "select * from `users` where `id`='".$_SESSION['profile']['id']."' and `dob` < '$dob'"; + $query = "select * from `users` where `id`='".intval($_SESSION['profile']['id'])."' and `dob` < '$dob'"; if(mysql_num_rows(mysql_query($query)) < 1) { if($points >= 100) @@ -527,7 +527,8 @@ $fp = fopen($tmpfname, "w"); fputs($fp, $message); fclose($fp); - $do = `/usr/bin/gpg --homedir /home/gpg --clearsign "$tmpfname"|/usr/sbin/sendmail "$to"`; + $to_esc = escapeshellarg($to); + $do = shell_exec("/usr/bin/gpg --homedir /home/gpg --clearsign \"$tmpfname\"|/usr/sbin/sendmail ".$to_esc); @unlink($tmpfname); } @@ -538,9 +539,9 @@ { list($username,$domain)=explode('@',$email,2); $dom = escapeshellarg($domain); - $line = trim(`dig +short MX $dom 2>&1`); + $line = trim(shell_exec("dig +short MX $dom 2>&1")); #echo $email."-$dom-$line-\n"; -#echo `dig +short mx heise.de 2>&1`."-<br>\n"; +#echo shell_exec("dig +short mx heise.de 2>&1")."-<br>\n"; $list = explode("\n", $line); foreach($list as $row) { @@ -557,7 +558,7 @@ $fp = @fsockopen($domain,25,$errno,$errstr,5); if($fp) { - + $line = fgets($fp, 4096); while(substr($line, 0, 4) == "220-") $line = fgets($fp, 4096); @@ -581,7 +582,7 @@ $line = mysql_real_escape_string(trim(strip_tags($line))); $query = "insert into `pinglog` set `when`=NOW(), `email`='$myemail', `result`='$line'"; - if(is_array($_SESSION['profile'])) $query.=", `uid`='".$_SESSION['profile']['id']."'"; + if(is_array($_SESSION['profile'])) $query.=", `uid`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); if(substr($line, 0, 3) != "250") @@ -591,7 +592,7 @@ } } } - $query = "insert into `pinglog` set `when`=NOW(), `uid`='".$_SESSION['profile']['id']."', + $query = "insert into `pinglog` set `when`=NOW(), `uid`='".intval($_SESSION['profile']['id'])."', `email`='$myemail', `result`='Failed to make a connection to the mail server'"; mysql_query($query); return _("Failed to make a connection to the mail server"); @@ -662,9 +663,9 @@ return $ticket; } - function sanitizeHTML($input) + function sanitizeHTML($input) { - return htmlentities(strip_tags($input), ENT_QUOTES); + return htmlentities(strip_tags($input), ENT_QUOTES, 'ISO-8859-1'); //In case of problems, please use the following line again: //return htmlentities(strip_tags(utf8_decode($input)), ENT_QUOTES); //return htmlspecialchars(strip_tags($input)); @@ -732,7 +733,7 @@ $text=preg_replace("/[^\w-.@]/","",$text); return($text); } - + // returns text message to be shown to the user given the result of is_no_assurer function no_assurer_text($Status) @@ -775,7 +776,7 @@ $name="../$type/$kind/".intval($id/1000)."/$kind-".intval($id).".$type"; if (!is_dir("../csr")) { mkdir("../csr",0777); } if (!is_dir("../crt")) { mkdir("../crt",0777); } - + if (!is_dir("../csr/$kind")) { mkdir("../csr/$kind",0777); } if (!is_dir("../crt/$kind")) { mkdir("../crt/$kind",0777); } if (!is_dir("../csr/$kind/".intval($id/1000))) { mkdir("../csr/$kind/".intval($id/1000)); } diff --git a/includes/lib/account.php b/includes/lib/account.php index e311668..dd8afd3 100644 --- a/includes/lib/account.php +++ b/includes/lib/account.php @@ -19,10 +19,10 @@ /** * Function to recalculate the cached Assurer status - * + * * @param int $userID * if the user ID is not given the flag will be recalculated for all users - * + * * @return bool * false if there was an error on fixing the flag. This does NOT return the * new value of the flag @@ -30,7 +30,7 @@ function fix_assurer_flag($userID = NULL) { // Update Assurer-Flag on users table if 100 points and CATS passed. - // + // // We may have some performance issues here if no userID is given // there are ~150k assurances and ~220k users currently // but the exists-clause on cats_passed should be a good filter @@ -46,20 +46,21 @@ function fix_assurer_flag($userID = NULL) WHERE `cp`.`variant_id` = `cv`.`id` AND `cv`.`type_id` = 1 AND `cp`.`user_id` = `u`.`id` - ) + ) AND ( SELECT SUM(`points`) FROM `notary` AS `n` WHERE `n`.`to` = `u`.`id` AND (`n`.`expire` > now() - OR `n`.`expire` IS NULL) + OR `n`.`expire` IS NULL) + AND `n`.`deleted` = 0 ) >= 100'; - + $query = mysql_query($sql); if (!$query) { return false; } // Challenge has been passed and non-expired points >= 100 - + // Reset flag if requirements are not met // // Also a bit performance critical but assurer flag is only set on @@ -86,13 +87,64 @@ function fix_assurer_flag($userID = NULL) `n`.`expire` > now() OR `n`.`expire` IS NULL ) + AND `n`.`deleted` = 0 ) < 100 )'; - + $query = mysql_query($sql); if (!$query) { return false; } - + return true; -}
\ No newline at end of file +} + +/** + * Supported hash algorithms for signing certificates + */ +class HashAlgorithms { + /** + * Default hash algorithm identifier for signing + * @var string + */ + public static $default = 'sha256'; + + /** + * Get display strings for the supported hash algorithms + * @return array(string=>array('name'=>string, 'info'=>string)) + * - [$hash_identifier]['name'] = Name that should be displayed in UI + * - [$hash_identifier]['info'] = Additional information that can help + * with the selection of a suitable algorithm + */ + public static function getInfo() { + return array( + 'sha256' => array( + 'name' => 'SHA-256', + 'info' => _('Currently recommended, because the other algorithms might break on some older versions of the GnuTLS library (older than 3.x) still shipped in Debian for example.'), + ), + 'sha384' => array( + 'name' => 'SHA-384', + 'info' => '', + ), + 'sha512' => array( + 'name' => 'SHA-512', + 'info' => _('Highest protection against hash collision attacks of the algorithms offered here.'), + ), + ); + } + + /** + * Check if the input is a supported hash algorithm identifier otherwise + * return the identifier of the default hash algorithm + * + * @param string $hash_identifier + * @return string The cleaned identifier + */ + public static function clean($hash_identifier) { + if (array_key_exists($hash_identifier, self::getInfo() )) { + return $hash_identifier; + } else { + return self::$default; + } + } +} diff --git a/includes/lib/check_weak_key.php b/includes/lib/check_weak_key.php index 8ad2ccf..dd4f3a5 100644 --- a/includes/lib/check_weak_key.php +++ b/includes/lib/check_weak_key.php @@ -128,7 +128,7 @@ function checkWeakKeyText($text) if ($algorithm === "rsaEncryption") { - if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text, $keysize)) + if (!preg_match('/^\s*Public-Key: \((\d+) bit\)$/m', $text, $keysize)) { return failWithId("checkWeakKeyText(): Couldn't parse the RSA ". "key size.\nData:\n$text"); @@ -173,7 +173,7 @@ function checkWeakKeyText($text) $exponent = $exponent[1]; // exponent might be very big => //handle as string using bc*() - if (bccomp($exponent, "3") === 0) + if (bccomp($exponent, "65537") < 0) { return sprintf(_("The keys you use might be insecure. ". "Although there is currently no known attack for ". @@ -308,7 +308,7 @@ function checkDebianVulnerability($text, $keysize = 0) if ($algorithm !== "rsaEncryption") return false; /* Extract public key size */ - if (!preg_match('/^\s*RSA Public Key: \((\d+) bit\)$/m', $text, + if (!preg_match('/^\s*Public-Key: \((\d+) bit\)$/m', $text, $keysize)) { trigger_error("checkDebianVulnerability(): Couldn't parse the ". @@ -338,7 +338,7 @@ function checkDebianVulnerability($text, $keysize = 0) /* Extract RSA modulus */ - if (!preg_match('/^\s*Modulus \(\d+ bit\):\n'. + if (!preg_match('/^\s*Modulus:\n'. '((?:\s*[0-9a-f][0-9a-f]:(?:\n)?)+[0-9a-f][0-9a-f])$/m', $text, $modulus)) { diff --git a/includes/lib/general.php b/includes/lib/general.php index 85b132d..127c6b7 100644 --- a/includes/lib/general.php +++ b/includes/lib/general.php @@ -18,10 +18,10 @@ /** * Checks if the user may log in and retrieve the user id - * + * * Usually called with $_SERVER['SSL_CLIENT_M_SERIAL'] and * $_SERVER['SSL_CLIENT_I_DN_CN'] - * + * * @param $serial string * usually $_SERVER['SSL_CLIENT_M_SERIAL'] * @param $issuer_cn string @@ -43,7 +43,7 @@ function get_user_id_from_cert($serial, $issuer_cn) $row = mysql_fetch_assoc($res); return intval($row['memid']); } - + return -1; } @@ -71,7 +71,7 @@ function failWithId($errormessage) { /** * Runs a command on the shell and return it's exit code and output - * + * * @param string $command * The command to run. Make sure that you escapeshellarg() any non-constant * parts as this is executed on a shell! @@ -85,7 +85,7 @@ function failWithId($errormessage) { * @param string|bool $errors * The output the command wrote to STDERR (this is passed as reference), * if true (default) the output will be written to the real STDERR - * + * * @return int|bool * The exit code of the command, true if the execution of the command * failed (true because then @@ -93,38 +93,38 @@ function failWithId($errormessage) { */ function runCommand($command, $input = "", &$output = null, &$errors = true) { $descriptorspec = array(); - + if ($input !== true) { $descriptorspec[0] = array("pipe", "r"); // STDIN for child } - + if ($output !== true) { $descriptorspec[1] = array("pipe", "w"); // STDOUT for child } - + if ($errors !== true) { $descriptorspec[2] = array("pipe", "w"); // STDERR for child } - + $proc = proc_open($command, $descriptorspec, $pipes); - + if (is_resource($proc)) { if ($input !== true) { fwrite($pipes[0], $input); fclose($pipes[0]); } - + if ($output !== true) { $output = stream_get_contents($pipes[1]); } - + if ($errors !== true) { $errors = stream_get_contents($pipes[2]); } - + return proc_close($proc); - + } else { return true; } @@ -145,19 +145,18 @@ function runCommand($command, $input = "", &$output = null, &$errors = true) { { $Result |= 5; } - - $query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now()'); + + $query = mysql_query('SELECT SUM(`points`) AS `points` FROM `notary` AS `n` WHERE `n`.`to` = \''.(int)intval($userID).'\' AND `n`.`expire` < now() and `deleted` = 0'); $row = mysql_fetch_assoc($query); if ($row['points'] < 100) { $Result |= 3; } - + $query = mysql_query('SELECT `assurer_blocked` FROM `users` WHERE `id` = \''.(int)intval($userID).'\''); $row = mysql_fetch_assoc($query); if ($row['assurer_blocked'] > 0) { $Result |= 9; } - + return $Result; } -
\ No newline at end of file diff --git a/includes/lib/l10n.php b/includes/lib/l10n.php index 85b7aff..4859946 100644 --- a/includes/lib/l10n.php +++ b/includes/lib/l10n.php @@ -22,10 +22,10 @@ class L10n { /** * These are tranlations we currently support. - * + * * If another translation is added, it doesn't suffice to have gettext set * up, you also need to add it here, because it acts as a white list. - * + * * @var array("ISO-language code" => "native name of the language") */ public static $translations = array( @@ -53,15 +53,15 @@ class L10n { "zh-cn" => "中文(简体)", "zh-tw" => "中文(臺灣)", ); - + /** * setlocale needs a language + region code for whatever reason so here's * the mapping from a translation code to locales with the region that * seemed the most common for this language - * + * * You probably never need this. Use {@link set_translation()} to change the * language instead of manually calling setlocale(). - * + * * @var array(string => string) */ private static $locales = array( @@ -101,11 +101,11 @@ class L10n { "zh-cn" => "zh_CN", "zh-tw" => "zh_TW", ); - + /** * Auto-detects the language that should be used and sets it. Only works for * HTTP, not in a command line script. - * + * * Priority: * <ol> * <li>explicit parameter "lang" passed in HTTP (e.g. via GET)</li> @@ -128,10 +128,10 @@ class L10n { return; } } - - + + $languages = array(); - + // parse Accept-Language header if (array_key_exists('HTTP_ACCEPT_LANGUAGE', $_SERVER)) { $bits = explode(",", strtolower( @@ -144,29 +144,29 @@ class L10n { $c = floatval(substr($b[1], 2)); else $c = 1; - + if ($c != 0) { $languages[trim($b[0])] = $c; } } } - + // check if there is an explicit language given as parameter if(array_key_exists("lang",$_REQUEST) && trim($_REQUEST["lang"]) != "") { // higher priority than those values in the header $languages[strtolower(trim($_REQUEST["lang"]))] = 2.0; } - + arsort($languages, SORT_NUMERIC); - + // this is used to be compatible with browsers like internet // explorer which only provide the language code including the // region not without. Also handles the fallback to English (qvalues // may only have three digits after the .) $fallbacks = array("en" => 0.0005); - + foreach($languages as $lang => $qvalue) { // ignore any non-conforming values (that's why we don't need to @@ -179,7 +179,7 @@ class L10n { } $lang_prefix = $matches[1]; // usually two-letter language code $fallbacks[$lang_prefix] = $qvalue; - + $chosen_translation = ""; if ($lang === '*') { // According to the standard '*' matches anything but any @@ -202,7 +202,7 @@ class L10n { } } } - + if ($chosen_translation !== "") { if (self::set_translation($chosen_translation)) { @@ -210,7 +210,7 @@ class L10n { } } } - + // No translation found yet => try the prefixes arsort($fallbacks, SORT_NUMERIC); foreach ($fallbacks as $lang => $qvalue) { @@ -218,16 +218,47 @@ class L10n { return; } } - + // should not get here, as the fallback of "en" is provided and that // should always work => log an error trigger_error("L10n::detect_language(): could not set language", E_USER_WARNING); } - + + /** + * Normalise the translation code (e.g. from the old codes to the new) + * + * @return string + * a translation code or the empty string if it can't be normalised + */ + public static function normalise_translation($translation_code) { + // check $translation_code against whitelist + if (array_key_exists($translation_code, self::$translations) ) { + return $translation_code; + } + + // maybe it's a locale as previously used in the system? e.g. en_AU + if (preg_match('/^([a-z][a-z])_([A-Z][A-Z])$/', $translation_code, $matches) !== 1) { + return ''; + } + + $lang_code = $matches[1]; + $region_code = strtolower($matches[2]); + + if (array_key_exists("${lang_code}-${region_code}", self::$translations)) { + return "${lang_code}-${region_code}"; + } + + if (array_key_exists($lang_code, self::$translations)) { + return $lang_code; + } + + return ''; + } + /** * Get the set translation - * + * * @return string * a translation code or the empty string if not set */ @@ -238,13 +269,13 @@ class L10n { return ""; } } - + /** * Set the translation to use. - * + * * @param string $translation_code * the translation code as specified in the keys of {@link $translations} - * + * * @return bool * <ul> * <li>true if the translation has been set successfully</li> @@ -255,27 +286,11 @@ class L10n { * </ul> */ public static function set_translation($translation_code) { - // check $translation_code against whitelist - if ( !array_key_exists($translation_code, self::$translations) ) { - // maybe it's a locale as previously used in the system? e.g. en_AU - if ( preg_match('/^([a-z][a-z])_([A-Z][A-Z])$/', $translation_code, - $matches) !== 1 ) { - return false; - } - - $lang_code = $matches[1]; - $region_code = strtolower($matches[2]); - - if ( array_key_exists("${lang_code}-${region_code}", - self::$translations) ) { - $translation_code = "${lang_code}-${region_code}"; - } elseif ( array_key_exists($lang_code, self::$translations) ) { - $translation_code = $lang_code; - } else { - return false; - } + $translation_code = self::normalise_translation($translation_code); + if (empty($translation_code)) { + return false; } - + // map translation to locale if ( !array_key_exists($translation_code, self::$locales) ) { // weird. maybe you added a translation but haven't added a @@ -285,7 +300,7 @@ class L10n { return false; } $locale = self::$locales[$translation_code]; - + // set up locale if ( !putenv("LANG=$locale") ) { trigger_error("L10n::set_translation(): could not set the ". @@ -297,42 +312,42 @@ class L10n { "LC_ALL to $locale", E_USER_WARNING); return false; } - - + + // only set if we're running in a server not in a script if (isset($_SESSION)) { // save the setting $_SESSION['_config']['language'] = $translation_code; - - + + // Set up the recode settings needed e.g. in PDF creation $_SESSION['_config']['recode'] = "html..latin-1"; - + if($translation_code === "zh-cn" || $translation_code === "zh-tw") { $_SESSION['_config']['recode'] = "html..gb2312"; - + } else if($translation_code === "pl" || $translation_code === "hu") { $_SESSION['_config']['recode'] = "html..ISO-8859-2"; - + } else if($translation_code === "ja") { $_SESSION['_config']['recode'] = "html..SHIFT-JIS"; - + } else if($translation_code === "ru") { $_SESSION['_config']['recode'] = "html..ISO-8859-5"; - + } else if($translation_code == "lt") { // legacy, keep for reference $_SESSION['_config']['recode'] = "html..ISO-8859-13"; - + } } - + return true; } - + /** * Sets up the text domain used by gettext - * + * * @param string $domain * the gettext domain that should be used, defaults to "messages" */ @@ -340,4 +355,21 @@ class L10n { bindtextdomain($domain, $_SESSION['_config']['filepath'].'/locale'); textdomain($domain); } -}
\ No newline at end of file + + public static function set_recipient_language($accountid) { + //returns the language of a recipient to make sure that the language is correct + //use together with + $query = "select `language` from `users` where `id`='".intval($accountid)."'"; + $res = mysql_query($query); + if (mysql_num_rows($res)>=0) { + $row = mysql_fetch_assoc($res); + if (NULL==$row['language'] || $row['language']=='') { + self::set_translation('en'); + } else { + self::set_translation($row['language']); + } + } else { + self::set_translation('en'); + } + } +} diff --git a/includes/loggedin.php b/includes/loggedin.php index 4f9b8e8..c14f8c2 100644 --- a/includes/loggedin.php +++ b/includes/loggedin.php @@ -19,6 +19,7 @@ include_once("../includes/lib/general.php"); require_once("../includes/lib/l10n.php"); include_once("../includes/mysql.php"); + require_once('../includes/notary.inc.php'); if(!isset($_SESSION['profile']) || !is_array($_SESSION['profile'])) { $_SESSION['profile'] = array( 'id' => 0, 'loggedin' => 0 ); @@ -38,18 +39,18 @@ if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5)) continue; if(is_int($key) || is_string($key)) - unset($_SESSION[$key]); - unset($$key); - //session_unregister($key); + unset($_SESSION[$key]); + unset($$key); + //session_unregister($key); } - $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$uid'")); + $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($uid)."'")); if($_SESSION['profile']['locked'] == 0) $_SESSION['profile']['loggedin'] = 1; else unset($_SESSION['profile']); } - + if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && ($_SESSION['profile']['id'] == 0 || $_SESSION['profile']['loggedin'] == 0)) { $user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'], @@ -64,13 +65,13 @@ if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5)) continue; if(is_int($key) || is_string($key)) - unset($_SESSION[$key]); - unset($$key); - //session_unregister($key); + unset($_SESSION[$key]); + unset($$key); + //session_unregister($key); } $_SESSION['profile'] = mysql_fetch_assoc(mysql_query( - "select * from `users` where `id`='".$user_id."'")); + "select * from `users` where `id`='".intval($user_id)."'")); if($_SESSION['profile']['locked'] == 0) $_SESSION['profile']['loggedin'] = 1; else @@ -82,38 +83,26 @@ { if($key == '_config' || $key == 'mconn' || 'csrf_' == substr($key, 0, 5)) continue; - unset($_SESSION[$key]); - unset($$key); - //session_unregister($key); + unset($_SESSION[$key]); + unset($$key); + //session_unregister($key); } - $_SESSION['_config']['oldlocation'] = ''; - - foreach($_GET as $key => $val) - { - if($_SESSION['_config']['oldlocation']) - $_SESSION['_config']['oldlocation'] .= "&"; - - $key = str_replace(array("\n", "\r"), '', $key); - $val = str_replace(array("\n", "\r"), '', $val); - $_SESSION['_config']['oldlocation'] .= "$key=$val"; - } - $_SESSION['_config']['oldlocation'] = substr($_SERVER['SCRIPT_NAME'], 1)."?".$_SESSION['_config']['oldlocation']; - - header("location: https://".$_SESSION['_config']['securehostname']."/index.php?id=4"); + $_SESSION['_config']['oldlocation'] = $_SERVER['REQUEST_URI']; + header("Location: https://{$_SESSION['_config']['securehostname']}/index.php?id=4"); exit; } } if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && ($_SESSION['profile']['id'] <= 0 || $_SESSION['profile']['loggedin'] == 0)) { - header("location: https://".$_SESSION['_config']['normalhostname']); + header("Location: https://{$_SESSION['_config']['normalhostname']}"); exit; } if($_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname'] && $_SESSION['profile']['id'] > 0 && $_SESSION['profile']['loggedin'] > 0) { - $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`"; + $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted` = 0 group by `to`"; $res = mysql_query($query); $row = mysql_fetch_assoc($res); $_SESSION['profile']['points'] = $row['total']; @@ -121,7 +110,7 @@ if($_SESSION['profile']['language'] == "") { $query = "update `users` set `language`='".L10n::get_translation()."' - where `id`='".$_SESSION['profile']['id']."'"; + where `id`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); } else { L10n::set_translation($_SESSION['profile']['language']); @@ -136,32 +125,28 @@ $_SESSION['profile'] = ""; foreach($_SESSION as $key => $value) { - unset($_SESSION[$key]); - unset($$key); - //session_unregister($key); + unset($_SESSION[$key]); + unset($$key); + //session_unregister($key); } - header("location: https://".$normalhost."/index.php"); + header("Location: https://{$normalhost}/index.php"); exit; } if($_SESSION['profile']['loggedin'] < 1) { - $_SESSION['_config']['oldlocation'] = ''; - - foreach($_REQUEST as $key => $val) - { - if('' != $_SESSION['_config']['oldlocation']) - $_SESSION['_config']['oldlocation'] .= "&"; + $_SESSION['_config']['oldlocation'] = $_SERVER['REQUEST_URI']; + header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4"); + exit; + } - $key = str_replace(array("\n", "\r"), '', $key); - $val = str_replace(array("\n", "\r"), '', $val); - $_SESSION['_config']['oldlocation'] .= "$key=$val"; + if (!isset($_SESSION['profile']['ccaagreement']) || !$_SESSION['profile']['ccaagreement']) { + $_SESSION['profile']['ccaagreement']=get_user_agreement_status($_SESSION['profile']['id'],'CCA'); + if (!$_SESSION['profile']['ccaagreement']) { + $_SESSION['_config']['oldlocation'] = $_SERVER['REQUEST_URI']; + header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=52"); + exit; } - $_SESSION['_config']['oldlocation'] = substr($_SERVER['SCRIPT_NAME'], 1)."?".$_SESSION['_config']['oldlocation']; - $hostname=$_SERVER['HTTP_HOST']; - $hostname = str_replace(array("\n", "\r"), '', $hostname); - header("location: https://".$hostname."/index.php?id=4"); - exit; } ?> diff --git a/includes/notary.inc.php b/includes/notary.inc.php index b34b2f4..3b8e736 100644 --- a/includes/notary.inc.php +++ b/includes/notary.inc.php @@ -16,6 +16,9 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ +define('NULL_DATETIME', '0000-00-00 00:00:00'); +define('THAWTE_REVOCATION_DATETIME', '2010-11-16 00:00:00'); + function query_init ($query) { return mysql_query($query); @@ -35,7 +38,7 @@ function get_number_of_assurances ($userid) { $res = query_init ("SELECT count(*) AS `list` FROM `notary` - WHERE `method` = 'Face to Face Meeting' AND `from`='".intval($userid)."' "); + WHERE `method` = 'Face to Face Meeting' AND `from`='".intval($userid)."' and `deleted` = 0"); $row = query_getnextrow($res); return intval($row['list']); @@ -44,7 +47,7 @@ function get_number_of_ttpassurances ($userid) { $res = query_init ("SELECT count(*) AS `list` FROM `notary` - WHERE (`method`='Trusted Third Parties' or `method`='TTP-Assisted') AND `to`='".intval($userid)."' "); + WHERE (`method`='Trusted Third Parties' or `method`='TTP-Assisted') AND `to`='".intval($userid)."' and `deleted` = 0"); $row = query_getnextrow($res); return intval($row['list']); @@ -53,7 +56,7 @@ function get_number_of_assurees ($userid) { $res = query_init ("SELECT count(*) AS `list` FROM `notary` - WHERE `method` = 'Face to Face Meeting' AND `to`='".intval($userid)."' "); + WHERE `method` = 'Face to Face Meeting' AND `to`='".intval($userid)."' and `deleted` = 0"); $row = query_getnextrow($res); return intval($row['list']); @@ -62,7 +65,7 @@ function get_top_assurer_position ($no_of_assurances) { $res = query_init ("SELECT count(*) AS `list` FROM `notary` - WHERE `method` = 'Face to Face Meeting' + WHERE `method` = 'Face to Face Meeting' and `deleted` = 0 GROUP BY `from` HAVING count(*) > '".intval($no_of_assurances)."'"); return intval(query_get_number_of_rows($res)+1); } @@ -70,32 +73,52 @@ function get_top_assuree_position ($no_of_assurees) { $res = query_init ("SELECT count(*) AS `list` FROM `notary` - WHERE `method` = 'Face to Face Meeting' + WHERE `method` = 'Face to Face Meeting' and `deleted` = 0 GROUP BY `to` HAVING count(*) > '".intval($no_of_assurees)."'"); return intval(query_get_number_of_rows($res)+1); } - function get_given_assurances ($userid) + /** + * Get the list of assurances given by the user + * @param int $userid - id of the assurer + * @param int $log - if set to 1 also includes deleted assurances + * @return resource - a MySQL result set + */ + function get_given_assurances($userid, $log=0) { - $res = query_init ("select * from `notary` where `from`='".intval($userid)."' and `from` != `to` order by `id` asc"); + $deleted=''; + if ($log == 0) { + $deleted = ' and `deleted` = 0 '; + } + $res = query_init("select * from `notary` where `from`='".intval($userid)."' and `from` != `to` $deleted order by `id` asc"); return $res; } - function get_received_assurances ($userid) + /** + * Get the list of assurances received by the user + * @param int $userid - id of the assuree + * @param int $log - if set to 1 also includes deleted assurances + * @return resource - a MySQL result set + */ + function get_received_assurances($userid, $log=0) { - $res = query_init ("select * from `notary` where `to`='".intval($userid)."' and `from` != `to` order by `id` asc "); + $deleted=''; + if ($log == 0) { + $deleted = ' and `deleted` = 0 '; + } + $res = query_init("select * from `notary` where `to`='".intval($userid)."' and `from` != `to` $deleted order by `id` asc "); return $res; } function get_given_assurances_summary ($userid) { - $res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' group by points,awarded,method"); + $res = query_init ("select count(*) as number,points,awarded,method from notary where `from`='".intval($userid)."' and `deleted` = 0 group by points,awarded,method"); return $res; } function get_received_assurances_summary ($userid) { - $res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' group by points,awarded,method"); + $res = query_init ("select count(*) as number,points,awarded,method from notary where `to`='".intval($userid)."' and `deleted` = 0 group by points,awarded,method"); return $res; } @@ -113,69 +136,177 @@ return mysql_num_rows($res); } - function calc_experience ($row,&$points,&$experience,&$sum_experience,&$revoked) + + /** + * Calculate awarded points (corrects some issues like out of range points + * or points that were issued by means that have been deprecated) + * + * @param array $row - associative array containing the data from the + * `notary` table + * @return int - the awarded points for this assurance + */ + function calc_awarded($row) + { + // Back in the old days there was no `awarded` column => is now zero, + // there the `points` column contained that data + $points = max(intval($row['awarded']), intval($row['points'])); + + // Set negative points to zero, yes there are such things in the database + $points = max($points, 0); + + switch ($row['method']) + { + // These programmes have been revoked + case 'Thawte Points Transfer': // revoke all Thawte-points (as per arbitration) + case 'CT Magazine - Germany': // revoke c't (only one test-entry) + case 'Temporary Increase': // revoke 'temporary increase' (Current usage breaks audit aspects, needs to be reimplemented) + $points = 0; + break; + + case 'Administrative Increase': // ignore AI with 2 points or less (historical for experiance points, now other calculation) + if ($points <= 2) // maybe limit to 35/50 pts in the future? + $points = 0; + break; + + // TTP assurances, limit to 35 + case 'TTP-Assisted': + $points = min($points, 35); + break; + + // TTP TOPUP, limit to 30 + case 'TOPUP': + $points = min($points, 30); + + // All these should be preserved for the time being + case 'Unknown': // to be revoked in the future? limit to max 50 pts? + case 'Trusted Third Parties': // to be revoked in the future? limit to max 35 pts? + case '': // to be revoked in the future? limit to max 50 pts? + case 'Face to Face Meeting': // normal assurances (and superassurances?), limit to 35/50 pts in the future? + break; + + default: // should never happen ... ;-) + $points = 0; + } + + return $points; + } + + + /** + * Calculate the experience points from a given Assurance + * @param array $row - [inout] associative array containing the data from + * the `notary` table, the keys 'experience' and 'calc_awarded' will be + * added + * @param int $sum_points - [inout] the sum of already counted assurance + * points the assurer issued + * @param int $sum_experience - [inout] the sum of already counted + * experience points that were awarded to the assurer + */ + function calc_experience(&$row, &$sum_points, &$sum_experience) { - $apoints = max($row['points'], $row['awarded']); - $points += $apoints; - $experience = " "; - $revoked = false; # to be coded later (after DB-upgrade) + $row['calc_awarded'] = calc_awarded($row); + + // Don't count revoked assurances even if we are displaying them + if ($row['deleted'] !== NULL_DATETIME) { + $row['experience'] = 0; + return; + } + + $experience = 0; if ($row['method'] == "Face to Face Meeting") { - $sum_experience = $sum_experience +2; - $experience = "2"; + $experience = 2; } - return $apoints; + $sum_experience += $experience; + $row['experience'] = $experience; + + $sum_points += $row['calc_awarded']; } - function calc_assurances ($row,&$points,&$experience,&$sumexperience,&$awarded,&$revoked) + /** + * Calculate the points received from a received Assurance + * @param array $row - [inout] associative array containing the data from + * the `notary` table, the keys 'experience' and 'calc_awarded' will be + * added + * @param int $sum_points - [inout] the sum of already counted assurance + * points the assuree received + * @param int $sum_experience - [inout] the sum of already counted + * experience points that were awarded to the assurer + */ + function calc_assurances(&$row, &$sum_points, &$sum_experience) { - $awarded = calc_points($row); - $revoked = false; + $row['calc_awarded'] = calc_awarded($row); + $experience = 0; - if ($awarded > 100) + // High point values mean that some of them are experience points + if ($row['calc_awarded'] > 100) { - $experience = $awarded - 100; // needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100) - $awarded = 100; + $experience = $row['calc_awarded'] - 100; // needs to be fixed in the future (limit 50 pts and/or no experience if pts > 100) + $row['calc_awarded'] = 100; } - else - $experience = 0; switch ($row['method']) { case 'Thawte Points Transfer': case 'CT Magazine - Germany': case 'Temporary Increase': // Current usage of 'Temporary Increase' may break audit aspects, needs to be reimplemented - $awarded=sprintf("<strong style='color: red'>%s</strong>",_("Revoked")); - $experience=0; - $revoked=true; + $experience = 0; + $row['deleted'] = THAWTE_REVOCATION_DATETIME; break; - default: - $points += $awarded; } - $sumexperience = $sumexperience + $experience; - } + // Don't count revoked assurances even if we are displaying them + if ($row['deleted'] !== NULL_DATETIME) { + $row['experience'] = 0; + return; + } + + $sum_experience += $experience; + $row['experience'] = $experience; + $sum_points += $row['calc_awarded']; + } - function show_user_link ($name,$userid) + /** + * Generate a link to the support engineer page for the user with the name + * of the user as link text + * @param array $user - associative array containing the data from the + * `user` table + * @return string + */ + function show_user_link($user) { - $name = trim($name); + $name = trim($user['fname'].' '.$user['lname']); + $userid = intval($user['id']); + if($name == "") { - if ($userid == 0) + if ($userid == 0) { $name = _("System"); - else + } else { $name = _("Deleted account"); + } } else - $name = "<a href='wot.php?id=9&userid=".intval($userid)."'>".sanitizeHTML($name)."</a>"; + { + $name = "<a href='wot.php?id=9&userid=".$userid."'>".sanitizeHTML($name)."</a>"; + } + return $name; } - function show_email_link ($email,$userid) + /** + * Generate a link to the support engineer page for the user with the email + * address as link text + * @param array $user - associative array containing the data from the + * `user` table + * @return string + */ + function show_email_link($user) { - $email = trim($email); - if($email != "") - $email = "<a href='account.php?id=43&userid=".intval($userid)."'>".sanitizeHTML($email)."</a>"; + $email = trim($user['email']); + if($email != "") { + $email = "<a href='account.php?id=43&userid=".intval($user['id'])."'>".sanitizeHTML($email)."</a>"; + } return $email; } @@ -215,35 +346,41 @@ <? } - function output_assurances_header($title,$support) + /** + * Render header for the assurance table (same for given/received) + * @param string $title - The title for the table + * @param int $support - set to 1 if the output is for the support interface + * @param int $log - if set to 1 also includes deleted assurances + */ + function output_assurances_header($title, $support, $log) { + if ($support == 1) { + $log = 1; + } + + $colspan = 7; + if ($support == 1) { + $colspan += 2; + } + if ($log == 1) { + $colspan += 1; + } ?> <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> <tr> -<? - if ($support == "1") - { -?> - <td colspan="10" class="title"><?=$title?></td> -<? - } else { -?> - <td colspan="7" class="title"><?=$title?></td> -<? - } -?> + <td colspan="<?=$colspan?>" class="title"><?=$title?></td> </tr> <tr> <td class="DataTD"><strong><?=_("ID")?></strong></td> <td class="DataTD"><strong><?=_("Date")?></strong></td> <? - if ($support == "1") - { + if ($support == 1) + { ?> <td class="DataTD"><strong><?=_("When")?></strong></td> <td class="DataTD"><strong><?=_("Email")?></strong></td> <? - } + } ?> <td class="DataTD"><strong><?=_("Who")?></strong></td> <td class="DataTD"><strong><?=_("Points")?></strong></td> @@ -251,43 +388,88 @@ <td class="DataTD"><strong><?=_("Method")?></strong></td> <td class="DataTD"><strong><?=_("Experience Points")?></strong></td> <? - if ($support == "1") - { + if ($log == 1) + { ?> - <td class="DataTD"><strong><?=_("Revoke")?></strong></td> + <td class="DataTD"><strong><?=_("Revoked")?></strong></td> <? - } + } ?> </tr> <? } - function output_assurances_footer($points_txt,$points,$experience_txt,$sumexperience,$support) + /** + * Render footer for the assurance table (same for given/received) + * @param string $points_txt - Description for sum of assurance points + * @param int $sumpoints - sum of assurance points + * @param string $experience_txt - Description for sum of experience points + * @param int $sumexperience - sum of experience points + * @param int $support - set to 1 if the output is for the support interface + * @param int $log - if set to 1 also includes deleted assurances + */ + function output_assurances_footer( + $points_txt, + $sumpoints, + $experience_txt, + $sumexperience, + $support, + $log) { ?> <tr> - <td<?=($support == "1")?' colspan="5"':' colspan="3"'?> class="DataTD"><strong><?=$points_txt?>:</strong></td> - <td class="DataTD"><?=$points?></td> + <td colspan="<?=($support == 1) ? 5 : 3 ?>" class="DataTD"><strong><?=$points_txt?>:</strong></td> + <td class="DataTD"><?=intval($sumpoints)?></td> <td class="DataTD"> </td> <td class="DataTD"><strong><?=$experience_txt?>:</strong></td> - <td class="DataTD"><?=$sumexperience?></td> + <td class="DataTD"><?=intval($sumexperience)?></td> <? - if ($support == "1") - { + if ($log == 1) + { ?> <td class="DataTD"> </td> <? - } + } ?> - </tr> </table> <br/> <? } - function output_assurances_row($assuranceid,$date,$when,$email,$name,$awarded,$points,$location,$method,$experience,$userid,$support,$revoked) + /** + * Render an assurance for a view + * @param array $assurance - associative array containing the data from the `notary` table + * @param int $userid - Id of the user whichs given/received assurances are displayed + * @param array $other_user - associative array containing the other users data from the `users` table + * @param int $support - set to 1 if the output is for the support interface + * @param string $ticketno - ticket number currently set in the support interface + * @param int $log - if set to 1 also includes deleted assurances + */ + function output_assurances_row( + $assurance, + $userid, + $other_user, + $support, + $ticketno, + $log) { + $assuranceid = intval($assurance['id']); + $date = $assurance['date']; + $when = $assurance['when']; + $awarded = intval($assurance['calc_awarded']); + $points = intval($assurance['points']); + $location = $assurance['location']; + $method = $assurance['method'] ? _($assurance['method']) : ''; + $experience = intval($assurance['experience']); + $revoked = $assurance['deleted'] !== NULL_DATETIME; + + $email = show_email_link($other_user); + $name = show_user_link($other_user); + + if ($support == 1) { + $log = 1; + } $tdstyle=""; $emopen=""; @@ -295,7 +477,7 @@ if ($awarded == $points) { - if ($awarded == "0") + if ($awarded == 0) { if ($when < "2006-09-01") { @@ -310,7 +492,7 @@ <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$assuranceid?><?=$emclose?></td> <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$date?><?=$emclose?></td> <? - if ($support == "1") + if ($support == 1) { ?> <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$when?><?=$emclose?></td> @@ -319,26 +501,30 @@ } ?> <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$name?><?=$emclose?></td> - <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$awarded?><?=$emclose?></td> - <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$location?><?=$emclose?></td> + <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$revoked ? sprintf("<strong style='color: red'>%s</strong>",_("Revoked")) : $awarded?><?=$emclose?></td> + <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=sanitizeHTML($location)?><?=$emclose?></td> <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$method?><?=$emclose?></td> - <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?><?=$emclose?></td> + <td class="DataTD" <?=$tdstyle?>><?=$emopen?><?=$experience?$experience:' '?><?=$emclose?></td> <? - if ($support == "1") + if ($log == 1) { if ($revoked == true) { ?> - <td class="DataTD" <?=$tdstyle?>> </td> + <td class="DataTD" <?=$tdstyle?>><?=$assurance['deleted']?></td> +<? + } elseif ($support == 1) { +?> + <td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&userid=<?=intval($userid)?>&assurance=<?=intval($assuranceid)?>&csrf=<?=make_csrf('admdelassurance')?>&ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$assuranceid)?>');"><?=_("Revoke")?></a><?=$emclose?></td> <? } else { ?> - <td class="DataTD" <?=$tdstyle?>><?=$emopen?><a href="account.php?id=43&userid=<?=intval($userid)?>&assurance=<?=intval($assuranceid)?>&csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$assuranceid)?>');"><?=_("Revoke")?></a><?=$emclose?></td> + <td class="DataTD" <?=$tdstyle?>> </td> <? } } ?> - </tr> + </tr> <? } @@ -381,35 +567,61 @@ // ************* output given assurances ****************** - function output_given_assurances_content($userid,&$points,&$sum_experience,$support) + /** + * Helper function to render assurances given by the user + * @param int $userid + * @param int& $sum_points - [out] sum of given points + * @param int& $sum_experience - [out] sum of experience points gained + * @param int $support - set to 1 if the output is for the support interface + * @param string $ticketno - the ticket number set in the support interface + * @param int $log - if set to 1 also includes deleted assurances + */ + function output_given_assurances_content( + $userid, + &$sum_points, + &$sum_experience, + $support, + $ticketno, + $log) { - $points = 0; + $sum_points = 0; $sumexperience = 0; - $res = get_given_assurances(intval($userid)); + $res = get_given_assurances(intval($userid), $log); while($row = mysql_fetch_assoc($res)) { - $fromuser = get_user (intval($row['to'])); - $apoints = calc_experience ($row,$points,$experience,$sum_experience,$revoked); - $name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['to'])); - $email = show_email_link ($fromuser['email'],intval($row['to'])); - output_assurances_row (intval($row['id']),$row['date'],$row['when'],$email,$name,$apoints,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience,$userid,$support,$revoked); + $assuree = get_user(intval($row['to'])); + calc_experience($row, $sum_points, $sum_experience); + output_assurances_row($row, $userid, $assuree, $support, $ticketno, $log); } } // ************* output received assurances ****************** - function output_received_assurances_content($userid,&$points,&$sum_experience,$support) + /** + * Helper function to render assurances received by the user + * @param int $userid + * @param int& $sum_points - [out] sum of received points + * @param int& $sum_experience - [out] sum of experience points the assurers gained + * @param int $support - set to 1 if the output is for the support interface + * @param string $ticketno - the ticket number set in the support interface + * @param int $log - if set to 1 also includes deleted assurances + */ + function output_received_assurances_content( + $userid, + &$sum_points, + &$sum_experience, + $support, + $ticketno, + $log) { - $points = 0; + $sum_points = 0; $sumexperience = 0; - $res = get_received_assurances(intval($userid)); + $res = get_received_assurances(intval($userid), $log); while($row = mysql_fetch_assoc($res)) { - $fromuser = get_user (intval($row['from'])); - calc_assurances ($row,$points,$experience,$sum_experience,$awarded,$revoked); - $name = show_user_link ($fromuser['fname']." ".$fromuser['lname'],intval($row['from'])); - $email = show_email_link ($fromuser['email'],intval($row['from'])); - output_assurances_row (intval($row['id']),$row['date'],$row['when'],$email,$name,$awarded,intval($row['points']),$row['location'],$row['method']==""?"":_(sprintf("%s", $row['method'])),$experience,$userid,$support,$revoked); + $fromuser = get_user(intval($row['from'])); + calc_assurances($row, $sum_points, $sum_experience); + output_assurances_row($row, $userid, $fromuser, $support, $ticketno, $log); } } @@ -422,41 +634,6 @@ return intval(query_get_number_of_rows($res)); } - function calc_points($row) - { - $awarded = intval($row['awarded']); - if ($awarded == "") - $awarded = 0; - if (intval($row['points']) < $awarded) - $points = $awarded; // if 'sum of added points' > 100, awarded shows correct value - else - $points = intval($row['points']); // on very old assurances, awarded is '0' instead of correct value - switch ($row['method']) - { - case 'Thawte Points Transfer': // revoke all Thawte-points (as per arbitration) - case 'CT Magazine - Germany': // revoke c't (only one test-entry) - case 'Temporary Increase': // revoke 'temporary increase' (Current usage breaks audit aspects, needs to be reimplemented) - $points = 0; - break; - case 'Administrative Increase': // ignore AI with 2 points or less (historical for experiance points, now other calculation) - if ($points <= 2) // maybe limit to 35/50 pts in the future? - $points = 0; - break; - case 'Unknown': // to be revoked in the future? limit to max 50 pts? - case 'Trusted Third Parties': // to be revoked in the future? limit to max 35 pts? - case 'TTP-Assisted': // TTP assurances, limit to 35 - case 'TOPUP': // TOPUP to be delevoped in the future, limit to 30 - case '': // to be revoked in the future? limit to max 50 pts? - case 'Face to Face Meeting': // normal assurances, limit to 35/50 pts in the future? - break; - default: // should never happen ... ;-) - $points = 0; - } - if ($points < 0) // ignore negative points (bug needs to be fixed) - $points = 0; - return $points; - } - function max_points($userid) { return output_summary_content ($userid,0); @@ -486,7 +663,7 @@ $res = get_received_assurances_summary($userid); while($row = mysql_fetch_assoc($res)) { - $points = calc_points ($row); + $points = calc_awarded($row); if ($points > $max_points) // limit to 100 points, above is experience (needs to be fixed) { @@ -591,18 +768,66 @@ return $issue_points; } - function output_given_assurances($userid,$support=0) + /** + * Render assurances given by the user + * @param int $userid + * @param int $support - set to 1 if the output is for the support interface + * @param string $ticketno - the ticket number set in the support interface + * @param int $log - if set to 1 also includes deleted assurances + */ + function output_given_assurances($userid, $support=0, $ticketno='', $log=0) { - output_assurances_header(_("Assurance Points You Issued"),$support); - output_given_assurances_content($userid,$points,$sum_experience,$support); - output_assurances_footer(_("Total Points Issued"),$points,_("Total Experience Points"),$sum_experience,$support); + output_assurances_header( + _("Assurance Points You Issued"), + $support, + $log); + + output_given_assurances_content( + $userid, + $sum_points, + $sum_experience, + $support, + $ticketno, + $log); + + output_assurances_footer( + _("Total Points Issued"), + $sum_points, + _("Total Experience Points"), + $sum_experience, + $support, + $log); } - function output_received_assurances($userid,$support=0) + /** + * Render assurances received by the user + * @param int $userid + * @param int $support - set to 1 if the output is for the support interface + * @param string $ticketno - the ticket number set in the support interface + * @param int $log - if set to 1 also includes deleted assurances + */ + function output_received_assurances($userid, $support=0, $ticketno='', $log=0) { - output_assurances_header(_("Your Assurance Points"),$support); - output_received_assurances_content($userid,$points,$sum_experience,$support); - output_assurances_footer(_("Total Assurance Points"),$points,_("Total Experience Points"),$sum_experience,$support); + output_assurances_header( + _("Assurance Points You Received"), + $support, + $log); + + output_received_assurances_content( + $userid, + $sum_points, + $sum_experience, + $support, + $ticketno, + $log); + + output_assurances_footer( + _("Total Points Received"), + $sum_points, + _("Total Experience Points"), + $sum_experience, + $support, + $log); } function output_summary($userid) @@ -658,18 +883,31 @@ } /** - * get_first_user_agreement() - * returns the first user_agreement entry of the requested type depending on thes status of active of a given user - * @param mixed $memid - * @param integer $active, 0 - passive, 1 -active - * @param string $type - * @return + * Get the first user_agreement entry of the requested type + * @param int $memid + * @param string $type - the type of user agreement, by default all + * agreements are listed + * @param int $active - whether to get active or passive agreements: + * 0 := passive + * 1 := active + * null := both + * @return array(string=>mixed) - an associative array containing + * 'document', 'date', 'method', 'comment', 'active' */ - function get_first_user_agreement($memid, $active=1, $type="CCA"){ - //returns an array (`document`,`date`,`method`, `comment`,`active`) + function get_first_user_agreement($memid, $type=null, $active=null){ + $filter = ''; + if (!is_null($type)) { + $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'"; + } + + if (!is_null($active)) { + $filter .= " AND u.`active` = ".intval($active); + } + $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u - WHERE u.`document` = '" . mysql_real_escape_string($type) . "' AND u.`memid`=" . intval($memid) . " AND u.`active`=" . intval($active) . - " ORDER BY u.`date` Limit 1;"; + WHERE u.`memid`=".intval($memid)." + $filter + ORDER BY u.`date` LIMIT 1"; $res = mysql_query($query); if(mysql_num_rows($res) >0){ $rec = mysql_fetch_assoc($res); @@ -680,15 +918,31 @@ } /** - * get_last_user_agreement() - * returns the last user_agreement entry of a given type and of a given user - * @param mixed $memid - * @param string $type - * @return + * Get the last user_agreement entry of the requested type + * @param int $memid + * @param string $type - the type of user agreement, by default all + * agreements are listed + * @param int $active - whether to get active or passive agreements: + * 0 := passive, + * 1 := active, + * null := both + * @return array(string=>mixed) - an associative array containing + * 'document', 'date', 'method', 'comment', 'active' */ - function get_last_user_agreement($memid, $type="CCA"){ - //returns an array (`document`,`date`,`method`, `comment`,`active`) - $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM user_agreements u WHERE u.`document` = '" . mysql_real_escape_string($type) . "' AND (u.`memid`=" . intval($memid) . " ) order by `date` desc limit 1 " ; + function get_last_user_agreement($memid, $type=null, $active=null){ + $filter = ''; + if (!is_null($type)) { + $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'"; + } + + if (!is_null($active)) { + $filter .= " AND u.`active` = ".intval($active); + } + + $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u + WHERE u.`memid`=".intval($memid)." + $filter + ORDER BY u.`date` DESC LIMIT 1"; $res = mysql_query($query); if(mysql_num_rows($res) >0){ $rec = mysql_fetch_assoc($res); @@ -698,6 +952,34 @@ return $rec; } +/** + * Get the all user_agreement entries of the requested type + * @param int $memid + * @param string $type - the type of user agreement, by default all + * agreements are listed + * @param int $active - whether to get an active or passive agreements: + * 0 := passive, + * 1 := active, + * null := both + * @return resource - a mysql result set containing all agreements + */ +function get_user_agreements($memid, $type=null, $active=null){ + $filter = ''; + if (!is_null($type)) { + $filter .= " AND u.`document` = '".mysql_real_escape_string($type)."'"; + } + + if (!is_null($active)) { + $filter .= " AND u.`active` = ".intval($active); + } + + $query="SELECT u.`document`, u.`date`, u.`method`, u.`comment`, u.`active` FROM `user_agreements` AS u + WHERE u.`memid`=".intval($memid)." + $filter + ORDER BY u.`date`"; + return mysql_query($query); +} + /** * delete_user_agreement() * deletes all entries for a given type from user_agreement of a given user, if type is not given all @@ -706,7 +988,6 @@ * @return */ function delete_user_agreement($memid, $type=false){ - //deletes all entries to an user for the given type of user agreements if ($type === false) { $filter = ''; } else { @@ -774,7 +1055,7 @@ <? } else { ?> - <input type="hidden" name="<?=$val?>" value="<?=$methods[0]?>" /> + <input type="hidden" name="method" value="<?=$methods[0]?>" /> <? } } @@ -909,11 +1190,6 @@ } //change personal information to arbitration number and DOB=1900-01-01 - $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'"; - $details = mysql_fetch_assoc(mysql_query($query)); - $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}', - `new-lname`='$arbno',`new-dob`='1900-01-01',`uid`='$id',`adminid`='".$adminid."'"; - mysql_query($query); $query = "update `users` set `fname`='".$arbno."', `mname`='".$arbno."', `lname`='".$arbno."', @@ -1125,3 +1401,740 @@ function check_date_difference($date, $diff=1){ return (strtotime($date)<=time()+$diff*86400); } + +/** + * Write some information to the adminlog + * + * @param int $uid - id of the user account + * @param int $adminid - id of the admin + * @param string $type - the operation that was performed on the user account + * @param string $info - the ticket / arbitration number or other information + * @return bool - true := success, false := error + */ +function write_se_log($uid, $adminid, $type, $info){ + //records all support engineer actions changing a user account + $uid = intval($uid); + $adminid = intval($adminid); + $type = mysql_real_escape_string($type); + $info = mysql_real_escape_string($info); + $query="insert into `adminlog` (`when`, `uid`, `adminid`,`type`,`information`) values + (Now(), $uid, $adminid, '$type', '$info')"; + return mysql_query($query); +} + +/** + * Check if the entered information is a valid ticket or arbitration number + * @param string $ticketno + * @return bool + */ +function valid_ticket_number($ticketno){ + //a arbitration case + //d dispute action + //s support case + //m board motion + $pattern='/[adsmADSM]\d{8}\.\d+/'; + if (preg_match($pattern, $ticketno)) { + return true; + } + return false; +} + +// function for handling account/43.php +/** + * Get all data of an account given by the id from the `users` table + * @param int $userid - account id + * @param int $deleted - states if deleted data should be visible , default = 0 - not visible + * @return resource - a mysql result set + */ +function get_user_data($userid, $deleted=0){ + $userid = intval($userid); + $filter=''; + if (0==$deleted) { + $filter .=' and `users`.`deleted`=0'; + } + $query = "select * from `users` where `users`.`id`='$userid' ".$filter; + return mysql_query($query); +} + +/** + * Get the alert settings for a user + * @param int $userid for the requested account + * @return array - associative array + */ +function get_alerts($userid){ + return mysql_fetch_assoc(mysql_query("select * from `alerts` where `memid`='".intval($userid)."'")); +} + +/** + * Get all email addresses linked to the account + * @param int $userid + * @param string $exclude - if given the email address will be excluded + * @param int $deleted - states if deleted data should be visible, default = 0 - not visible + * @return resource - a mysql result set + */ +function get_email_addresses($userid, $exclude, $deleted=0){ + //should be entered in account/2.php + $userid = intval($userid); + $filter=''; + if (0==$deleted) { + $filter .= ' and `deleted`=0'; + } + if ($exclude) { + $filter .= " and `email`!='".mysql_real_escape_string($exclude)."'"; + } + $query = "select * from `email` where `memid`='".$userid."' and `hash`='' ".$filter." order by `created`"; + return mysql_query($query); +} + +/** + * Get all domains linked to the account + * @param int $userid + * @param int $deleted - states if deleted data should be visible, default = 0 - not visible + * @return resource - a mysql result set + */ +function get_domains($userid, $deleted=0){ + //should be entered in account/9.php + $userid = intval($userid); + $filter=''; + if (0==$deleted) { + $filter .= ' and `deleted`=0'; + } + $query = "select * from `domains` where `memid`='".$userid."' and `hash`=''".$filter." order by `created`"; + return mysql_query($query); +} + +/** + * Get all training results for the account + * @param int $userid + * @return resource - a mysql result set + */ +function get_training_results($userid){ + //should be entered in account/55.php + $userid = intval($userid); + $query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ". + " FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ". + " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".$userid."'". + " ORDER BY `CP`.`pass_date`"; + return mysql_query($query); +} + +/** + * Get all SE log entries for the account + * @param int $userid + * @return resource - a mysql result set + */ +function get_se_log($userid){ + $userid = intval($userid); + $query = "SELECT `adminlog`.`when`, `adminlog`.`type`, `adminlog`.`information`, `users`.`fname`, `users`.`lname` + FROM `adminlog`, `users` + WHERE `adminlog`.`adminid` = `users`.`id` and `adminlog`.`uid`=".$userid." + ORDER BY `adminlog`.`when`"; + return mysql_query($query); +} + +/** + * Get all client certificates linked to the account + * @param int $userid + * @param int $viewall - states if expired certs should be visible, default = 0 - not visible + * @return resource - a mysql result set + */ +function get_client_certs($userid, $viewall=0){ + //add to account/5.php + $userid = intval($userid); + $query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`, + UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`, + UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`, + `emailcerts`.`expire`, + `emailcerts`.`revoked` as `revoke`, + UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`, + `emailcerts`.`id`, + `emailcerts`.`CN`, + `emailcerts`.`serial`, + `emailcerts`.`disablelogin`, + `emailcerts`.`description` + from `emailcerts` + where `emailcerts`.`memid`='".$userid."'"; + if($viewall == 0) + { + $query .= " AND `emailcerts`.`revoked`=0 AND `emailcerts`.`renewed`=0"; + $query .= " HAVING `timeleft` > 0"; + } + $query .= " ORDER BY `emailcerts`.`modified` desc"; + return mysql_query($query); +} + +/** + * Get all server certs linked to the account + * @param int $userid + * @param int $viewall - states if expired certs should be visible, default = 0 - not visible + * @return resource - a mysql result set + */ +function get_server_certs($userid, $viewall=0){ + //add to account/12.php + $userid = intval($userid); + $query = "select UNIX_TIMESTAMP(`domaincerts`.`created`) as `created`, + UNIX_TIMESTAMP(`domaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`, + UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired`, + `domaincerts`.`expire`, + `domaincerts`.`revoked` as `revoke`, + UNIX_TIMESTAMP(`revoked`) as `revoked`, + `domaincerts`.`CN`, + `domaincerts`.`serial`, + `domaincerts`.`id`, + `domaincerts`.`description` + from `domaincerts`,`domains` + where `domains`.`memid`='".$userid."' and `domaincerts`.`domid`=`domains`.`id`"; + if($viewall == 0) + { + $query .= " AND `domaincerts`.`revoked`=0 AND `domaincerts`.`renewed`=0"; + $query .= " HAVING `timeleft` > 0"; + } + $query .= " ORDER BY `domaincerts`.`modified` desc"; + return mysql_query($query); +} + +/** + * Get all gpg certs linked to the account + * @param int $userid + * @param int $viewall - states if expired certs should be visible, default = 0 - not visible + * @return resource - a mysql result set + */ +function get_gpg_certs($userid, $viewall=0){ + //add to gpg/2.php + $userid = intval($userid); + $query = $query = "select UNIX_TIMESTAMP(`issued`) as `issued`, + UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() as `timeleft`, + UNIX_TIMESTAMP(`expire`) as `expired`, + `expire`, `id`, `level`, `email`, `keyid`, `description` + from `gpg` where `memid`='".$userid."'"; + if ($viewall == 0) { + $query .= " HAVING `timeleft` > 0"; + } + $query .= " ORDER BY `issued` desc"; + return mysql_query($query); +} + + + +/** + * Show the table header to the email table for the admin log + */ +function output_log_email_header(){ + ?> + <tr> + <td class="DataTD bold"><?= _("Email, primary bold") ?></td> + <td class="DataTD bold"><?= _("Created") ?></td> + <td class="DataTD bold"><?= _("Deleted") ?></td> + </tr> + + <? +} +/** + * Show all email data for the admin log + * @param array $row - associative array containing the column data + * @param string $primary - if given the primary address is highlighted + */ +function output_log_email($row, $primary){ + $style = ''; + if ($row['deleted'] !== NULL_DATETIME) { + $style = ' deletedemailaddress'; + } elseif ($primary == $row['email']) { + $style = ' primaryemailaddress'; + } + ?> + <tr> + <td class="DataTD<?=$style?>"><?=$row['email']?></td> + <td class="DataTD<?=$style?>"><?=$row['created']?></td> + <td class="DataTD<?=$style?>"><?=$row['deleted']?></td> + </tr> + <? +} + +/** + * Show the table header to the domains table for the admin log + */ +function output_log_domains_header(){ + ?> + <tr> + <td class="DataTD bold"><?= _("Domain") ?></td> + <td class="DataTD bold"><?= _("Created") ?></td> + <td class="DataTD bold"><?= _("Deleted") ?></td> + </tr> + + <? +} + +/** + * Show the domain data for the admin log + * @param array $row - associative array containing the column data + */ +function output_log_domains($row){ + $italic=''; + if ($row['deleted'] !== NULL_DATETIME) { + $italic=' italic'; + } + ?> + <tr> + <td class="DataTD<?=$italic?>"><?=$row['domain']?></td> + <td class="DataTD<?=$italic?>"><?=$row['created']?></td> + <td class="DataTD<?=$italic?>"><?=$row['deleted']?></td> + </tr> + <? +} + +/** + * Show the table header to the user agreement table for the admin log + */ +function output_log_agreement_header(){ + ?> + <tr> + <td class="DataTD bold"><?= _("Agreement") ?></td> + <td class="DataTD bold"><?= _("Date") ?></td> + <td class="DataTD bold"><?= _("Method") ?></td> + <td class="DataTD bold"><?= _("Active ") ?></td> + </tr> + <? +} + +/** + * Show the agreement data for the admin log + * @param array $row - associative array containing the column data + */ +function output_log_agreement($row){ + ?> + <tr> + <td class="DataTD" ><?=$row['document']?></td> + <td class="DataTD" ><?=$row['date']?></td> + <td class="DataTD" ><?=$row['method']?></td> + <td class="DataTD"><?= ($row['active']==0)? _('passive'):_('active')?></td> + </tr> + <? +} + +/** + * Show the table header to the training table + */ +function output_log_training_header(){ + //should be entered in account/55.php + ?> + <tr> + <td class="DataTD bold"><?= _("Agreement") ?></td> + <td class="DataTD bold"><?= _("Test") ?></td> + <td class="DataTD bold"><?= _("Variant") ?></td> + </tr> + <? +} + +/** + * Show the training data + * @param array $row - associative array containing the column data + */ +function output_log_training($row){ + //should be entered in account/55.php + ?> + <tr> + <td class="DataTD"><?=$row['pass_date']?></td> + <td class="DataTD"><?=$row['type_text']?></td> + <td class="DataTD"><?=$row['test_text']?></td> + </tr> + <? +} + +/** + * Show the table header to the SE log table for the admin log + * @param int $support - if support = 1 more information is visible + */ +function output_log_se_header($support=0){ + ?> + <tr> + <td class="DataTD bold"><?= _("Date") ?></td> + <td class="DataTD bold"><?= _("Type") ?></td> + <? + if (1 == $support) { + ?> + <td class="DataTD bold"><?= _("Information") ?></td> + <td class="DataTD bold"><?= _("Admin") ?></td> + <? + } + ?> + </tr> + <? +} + +/** + * Show the SE log data for the admin log + * @param array $row - associative array containing the column data + * @param int $support - if support = 1 more information is visible + */ +function output_log_se($row, $support=0){ + //should be entered in account/55.php + ?> + <tr> + <td class="DataTD"><?=$row['when']?></td> + <td class="DataTD"><?=$row['type']?></td> + <? + if (1 == $support) { + ?> + <td class="DataTD"><?=$row['information']?></td> + <td class="DataTD"><?=$row['fname'].' '.$row['lname']?></td> + <? + } + ?> + </tr> + <? +} + +/** + * Shows the table header to the client cert table + * @param int $support - if support = 1 some columns ar not visible + * @param bool $readonly - whether elements to modify data should be hidden, default is `true` + */ +function output_client_cert_header($support=0, $readonly=true){ + //should be added to account/5.php + ?> + <tr> + <? + if (!$readonly) { + ?> + <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td> + <? + } + ?> + <td class="DataTD"><?=_("Status")?></td> + <td class="DataTD"><?=_("Email Address")?></td> + <td class="DataTD"><?=_("SerialNumber")?></td> + <td class="DataTD"><?=_("Revoked")?></td> + <td class="DataTD"><?=_("Expires")?></td> + <td class="DataTD"><?=_("Login")?></td> + <? + if (1 != $support) { + ?> + <td colspan="2" class="DataTD"><?=_("Comment *")?></td> + <? + } + ?> + </tr> + <? +} + +/** + * Show the client cert data + * @param array $row - associative array containing the column data + * @param int $support - if support = 1 some columns are not visible + * @param bool $readonly - whether elements to modify data should be hidden, default is `true` + */ +function output_client_cert($row, $support=0, $readonly=true){ + //should be entered in account/5.php + $verified=""; + if ($row['timeleft'] > 0) { + $verified = _("Valid"); + } else { + $verified = _("Expired"); + } + + if ($row['expired'] == 0) { + $verified = _("Pending"); + } + + if ($row['revoked'] == 0) { + $row['revoke'] = _("Not Revoked"); + } else { + $verified = _("Revoked"); + } + + ?> + <tr> + <? + if (!$readonly) { + if ($verified === _("Pending")) { + ?> + <td class="DataTD"> + <input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"> + </td> + <? + + } elseif ($verified === _("Revoked")) { + ?> + <td class="DataTD"> </td> + <? + + } else { + ?> + <td class="DataTD"> + <input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"> + </td> + <? + } + } + + ?> + <td class="DataTD"><?=$verified?></td> + <? + + if ($verified === _("Pending")) { + ?> + <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : htmlspecialchars($row['CN']))?></td> + <? + } else { + ?> + <td class="DataTD"> + <a href="account.php?id=6&cert=<?=intval($row['id'])?>"> + <?=(trim($row['CN'])=="" ? _("empty") : htmlspecialchars($row['CN']))?> + </a> + </td> + <? + } + + ?> + <td class="DataTD"><?=$row['serial']?></td> + <td class="DataTD"><?=$row['revoke']?></td> + <td class="DataTD"><?=$row['expire']?></td> + <td class="DataTD"> + <input type="checkbox" name="disablelogin_<?=intval($row['id'])?>" value="1" <?=$row['disablelogin']?"":"checked='checked'"?> <?=$readonly?'disabled="disabled"':''?>/> + <input type="hidden" name="cert_<?=intval($row['id'])?>" value="1" /> + </td> + <? + + if (1 != $support) { + ?> + <td class="DataTD"> + <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /> + </td> + <? + if (!$readonly) { + ?> + <td class="DataTD"> + <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /> + </td> + <? + } + } + + ?> + </tr> + <? +} + +/** + * Show the table header to the server cert table + * @param int $support - if support = 1 some columns ar not visible + * @param bool $readonly - whether elements to modify data should be hidden, default is `true` + */ +function output_server_certs_header($support=0, $readonly=true){ + //should be entered in account/12.php + ?> + <tr> + <? + if (!$readonly) { + ?> + <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td> + <? + } + ?> + <td class="DataTD"><?=_("Status")?></td> + <td class="DataTD"><?=_("CommonName")?></td> + <td class="DataTD"><?=_("SerialNumber")?></td> + <td class="DataTD"><?=_("Revoked")?></td> + <td class="DataTD"><?=_("Expires")?></td> + <? + if (1 != $support) { + ?> + <td colspan="2" class="DataTD"><?=_("Comment *")?></td> + <? + } + ?> + </tr> + <? +} + +/** + * Show the server cert data + * @param array $row - associative array containing the column data + * @param int $support - if support = 1 some columns are not visible + * @param bool $readonly - whether elements to modify data should be hidden, default is `true` + */ +function output_server_certs($row, $support=0, $readonly=true){ + //should be entered in account/12.php + $verified=""; + if ($row['timeleft'] > 0) { + $verified = _("Valid"); + } else { + $verified = _("Expired"); + } + + if ($row['expired'] == 0) { + $verified = _("Pending"); + } + + if ($row['revoked'] == 0) { + $row['revoke'] = _("Not Revoked"); + } else { + $verified = _("Revoked"); + } + + ?> + <tr> + <? + if (!$readonly) { + if ($verified === _("Pending")) { + ?> + <td class="DataTD"> + <input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"/> + </td> + <? + } elseif($verified === _("Revoked")) { + ?> + <td class="DataTD"> </td> + <? + } else { + ?> + <td class="DataTD"> + <input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"/> + </td> + <? + } + } + + ?> + <td class="DataTD"><?=$verified?></td> + <? + + if ($verified === _("Pending")) { + ?> + <td class="DataTD"><?=htmlspecialchars($row['CN'])?></td> + <? + } else { + ?> + <td class="DataTD"> + <a href="account.php?id=15&cert=<?=intval($row['id'])?>"> + <?=htmlspecialchars($row['CN'])?> + </a> + </td> + <? + } + + ?> + <td class="DataTD"><?=$row['serial']?></td> + <td class="DataTD"><?=$row['revoke']?></td> + <td class="DataTD"><?=$row['expire']?></td> + <? + + if (1 != $support) { + ?> + <td class="DataTD"> + <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /> + </td> + <? + if (!$readonly) { + ?> + <td class="DataTD"> + <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /> + </td> + <? + } + } + + ?> + </tr> + <? +} + +/** + * Show the table header to the gpg cert table + * @param int $support - if support = 1 some columns ar not visible + * @param bool $readonly - whether elements to modify data should be hidden, default is `true` + */ +function output_gpg_certs_header($support=0, $readonly=true){ + // $readonly is currently ignored but kept for consistency + ?> + <tr> + <td class="DataTD"><?=_("Status")?></td> + <td class="DataTD"><?=_("Email Address")?></td> + <td class="DataTD"><?=_("Expires")?></td> + <td class="DataTD"><?=_("Key ID")?></td> + <? + if (1 != $support) { + ?> + <td colspan="2" class="DataTD"><?=_("Comment *")?></td> + <? + } + ?> + </tr> + <? +} + +/** + * Show the gpg cert data + * @param array $row - associative array containing the column data + * @param int $support - if support = 1 some columns are not visible + * @param bool $readonly - whether elements to modify data should be hidden, default is `true` + */ +function output_gpg_certs($row, $support=0, $readonly=true){ + //should be entered in account/55.php + $verified=""; + if ($row['timeleft'] > 0) { + $verified = _("Valid"); + } else { + $verified = _("Expired"); + } + + if ($row['expired'] == 0) { + $verified = _("Pending"); + } + + ?> + <tr> + <td class="DataTD"><?=$verified?></td> + <? + + if($verified == _("Pending")) { + ?> + <td class="DataTD"><?=htmlspecialchars($row['email'])?></td> + <? + } else { + ?> + <td class="DataTD"> + <a href="gpg.php?id=3&cert=<?=intval($row['id'])?>"> + <?=htmlspecialchars($row['email'])?> + </a> + </td> + <? + } + + ?> + <td class="DataTD"><?=$row['expire']?></td> + <? + + if($verified == _("Pending")) { + ?> + <td class="DataTD"><?=htmlspecialchars($row['keyid'])?></td> + <? + } else { + ?> + <td class="DataTD"> + <a href="gpg.php?id=3&cert=<?=intval($row['id'])?>"> + <?=htmlspecialchars($row['keyid'])?> + </a> + </td> + <? + } + + if (1 != $support) { + ?> + <td class="DataTD"> + <input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /> + </td> + <? + if (!$readonly) { + ?> + <td class="DataTD"> + <input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /> + </td> + <? + } + } + + ?> + </tr> + <? +} diff --git a/pages/account/10.php b/pages/account/10.php index 8908400..17999a7 100644 --- a/pages/account/10.php +++ b/pages/account/10.php @@ -30,17 +30,66 @@ <p><?=_("If you are a valid organisation and would like the organisation name in the certificates you can apply for an organisation assurance. Contact us via support@cacert.org for more information.")?></p> <form method="post" action="account.php"> +<p><label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br /> + <input type="text" id="description" name="description" maxlength="80" size="80" /> +</p> +<p><label for="CSR"><?=_("Paste your CSR (Certificate Signing Request) below...")?></label><br /> + <textarea id="CSR" name="CSR" cols="80" rows="15"></textarea> +</p> + +<fieldset> +<legend> + <input type="checkbox" id="expertbox" onchange="showExpert(this.checked)" style="display:none" /> + <label for="expertbox"><?=_("Advanced Options")?></label> +</legend> +<div id="advanced_options"> + <? if($_SESSION['profile']['points'] >= 50) { ?> -<input type="radio" name="rootcert" value="1"/> <?=_("Sign by class 1 root certificate")?><br /> -<input type="radio" name="rootcert" value="2" checked/> <?=_("Sign by class 3 root certificate")?><br /> +<ul class="no_indent"> + <li> + <input type="radio" id="root1" name="rootcert" value="1" /> + <label for="root1"><?=_("Sign by class 1 root certificate")?></label> + </li> + <li> + <input type="radio" id="root2" name="rootcert" value="2" checked="checked" /> + <label for="root2"><?=_("Sign by class 3 root certificate")?></label> + </li> +</ul> <p><?=_("Please note: The class 3 root certificate needs to be setup in your webserver as a chained certificate, while slightly more complicated to setup, this root certificate is more likely to be trusted by more people.")?></p> <? } ?> -<p><?=_("Optional comment, only used in the certificate overview")?><br> - <input type="text" name="description" maxlength="80" size=80/></p> -<p><?=_("Paste your CSR(Certificate Signing Request) below...")?></p> -<textarea name="CSR" cols="80" rows="15"></textarea><br /> -<p><input type="checkbox" name="CCA" /> <strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br /> - <?=_("Please Note: You need to accept the CCA to proceed.")?></p> + +<p class="attach_ul"><?=_("Hash algorithm used when signing the certificate:")?></p> +<ul class="no_indent"> +<? +foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) { +?> + <li> + <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> /> + <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label> + </li> +<? +} +?> +</ul> + +</div> +</fieldset> + +<p><input type="checkbox" id="CCA" name="CCA" /> <label for="CCA"><strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br /> + <?=_("Please note: You need to accept the CCA to proceed.")?></label></p> <input type="submit" name="process" value="<?=_("Submit")?>" /> <input type="hidden" name="oldid" value="<?=$id?>" /> </form> + + +<script language="javascript"> +function showExpert(a) +{ + var options=document.getElementById("advanced_options"); + options.style.display = (a) ? "" : "none"; + + var checkbox=document.getElementById("expertbox"); + checkbox.style.display = ""; +} +showExpert(false); +</script> diff --git a/pages/account/12.php b/pages/account/12.php index 9058a07..f4428aa 100644 --- a/pages/account/12.php +++ b/pages/account/12.php @@ -19,7 +19,7 @@ <form method="post" action="account.php"> <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> <tr> - <td colspan="8" class="title"><?=_("Domain Certificates")?> - <a href="account.php?id=12&viewall=<?=!$viewall?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td> + <td colspan="8" class="title"><?=_("Domain Certificates")?> - <a href="account.php?id=12&viewall=<?=intval(!$viewall)?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td> </tr> <tr> <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td> @@ -34,17 +34,20 @@ $query = "select UNIX_TIMESTAMP(`domaincerts`.`created`) as `created`, UNIX_TIMESTAMP(`domaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`, UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired`, - `domaincerts`.`expire` as `expires`, `revoked` as `revoke`, - UNIX_TIMESTAMP(`revoked`) as `revoked`, `CN`, `domaincerts`.`serial`, `domaincerts`.`id` as `id`, + `domaincerts`.`expire`, + `domaincerts`.`revoked` as `revoke`, + UNIX_TIMESTAMP(`revoked`) as `revoked`, + if (`domaincerts`.`expire`=0,CURRENT_TIMESTAMP(),`domaincerts`.`modified`) as `modified`, + `CN`, `domaincerts`.`serial`, `domaincerts`.`id` as `id`, `domaincerts`.`description` from `domaincerts`,`domains` where `memid`='".intval($_SESSION['profile']['id'])."' and `domaincerts`.`domid`=`domains`.`id` "; if($viewall != 1) { $query .= "AND `revoked`=0 AND `renewed`=0 "; - $query .= "HAVING `timeleft` > 0 "; + $query .= "HAVING `timeleft` > 0 or `expire` = 0 "; } - $query .= "ORDER BY `domaincerts`.`modified` desc"; + $query .= "ORDER BY `modified` desc"; //echo $query."<br>\n"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -69,24 +72,24 @@ ?> <tr> <? if($verified != _("Pending") && $verified != _("Revoked")) { ?> - <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=$row['id']?>"/></td> + <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"/></td> <? } else if($verified != _("Revoked")) { ?> - <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=$row['id']?>"/></td> + <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"/></td> <? } else { ?> <td class="DataTD"> </td> <? } ?> <td class="DataTD"><?=$verified?></td> - <td class="DataTD"><a href="account.php?id=15&cert=<?=$row['id']?>"><?=$row['CN']?></a></td> + <td class="DataTD"><a href="account.php?id=15&cert=<?=intval($row['id'])?>"><?=htmlspecialchars($row['CN'])?></a></td> <td class="DataTD"><?=$row['serial']?></td> <td class="DataTD"><?=$row['revoke']?></td> - <td class="DataTD"><?=$row['expires']?></td> - <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td> - <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td> + <td class="DataTD"><?=$row['expire']?></td> + <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td> + <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td> </tr> <? } ?> <tr> <td class="DataTD" colspan="8"> - <a href="account.php?id=12&viewall=<?=!$viewall?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a> + <a href="account.php?id=12&viewall=<?=intval(!$viewall)?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a> </td> </tr> <tr> @@ -104,6 +107,6 @@ <td class="DataTD" colspan="8"><?=_("From here you can delete pending requests, or revoke valid certificates.")?></td> </tr> </table> -<input type="hidden" name="oldid" value="<?=$id?>"/> +<input type="hidden" name="oldid" value="<?=intval($id)?>"/> <input type="hidden" name="csrf" value="<?=make_csrf('srvcerchange')?>"/> </form> diff --git a/pages/account/13.php b/pages/account/13.php index 08f325d..ea28c0e 100644 --- a/pages/account/13.php +++ b/pages/account/13.php @@ -52,22 +52,22 @@ <? if($_SESSION['profile']['points'] == 0) { ?> <tr> <td class="DataTD" width="125"><?=_("First Name")?>: </td> - <td class="DataTD" width="125"><input type="text" name="fname" value="<?=$user['fname']?>"></td> + <td class="DataTD" width="125"><input type="text" name="fname" value="<?=sanitizeHTML($user['fname'])?>"></td> </tr> <tr> <td class="DataTD" valign="top"><?=_("Middle Name(s)")?><br> (<?=_("optional")?>) </td> - <td class="DataTD"><input type="text" name="mname" value="<?=$user['mname']?>"></td> + <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($user['mname'])?>"></td> </tr> <tr> <td class="DataTD"><?=_("Last Name")?>: </td> - <td class="DataTD"><input type="text" name="lname" value="<?=$user['lname']?>"></td> + <td class="DataTD"><input type="text" name="lname" value="<?=sanitizeHTML($user['lname'])?>"></td> </tr> <tr> <td class="DataTD"><?=_("Suffix")?><br> (<?=_("optional")?>)</td> - <td class="DataTD"><input type="text" name="suffix" value="<?=$user['suffix']?>"></td> + <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($user['suffix'])?>"></td> </tr> <tr> <td class="DataTD"><?=_("Date of Birth")?><br> @@ -100,22 +100,22 @@ <? } else { ?> <tr> <td class="DataTD" width="125"><?=_("First Name")?>: </td> - <td class="DataTD" width="125"><?=$user['fname']?></td> + <td class="DataTD" width="125"><?=sanitizeHTML($user['fname'])?></td> </tr> <tr> <td class="DataTD" valign="top"><?=_("Middle Name(s)")?><br> (<?=_("optional")?>) </td> - <td class="DataTD"><?=$user['mname']?></td> + <td class="DataTD"><?=sanitizeHTML($user['mname'])?></td> </tr> <tr> <td class="DataTD"><?=_("Last Name")?>: </td> - <td class="DataTD"><?=$user['lname']?></td> + <td class="DataTD"><?=sanitizeHTML($user['lname'])?></td> </tr> <tr> <td class="DataTD"><?=_("Suffix")?><br> (<?=_("optional")?>)</td> - <td class="DataTD"><?=$user['suffix']?></td> + <td class="DataTD"><?=sanitizeHTML($user['suffix'])?></td> </tr> <tr> <td class="DataTD"><?=_("Date of Birth")?><br> @@ -124,19 +124,12 @@ </tr> <? } ?> <tr> - <td colspan="2" class="title"><a href="account.php?id=13&showdetails=<?=!$showdetails?>"><?=_("View secret question & answers and OTP phrases")?></a></td> - </tr> - <? if($showdetails){ ?> - <tr> - <td class="DataTD"><?=_("OTP Hash")?><br> - (<?=_("Not displayed")?>)</td> - <td class="DataTD"><input type="text" name="otphash"></td> + <td colspan="2" class="title"><a href="account.php?id=59&oldid=13&userid=<?=intval($_SESSION['profile']['id'])?>"><?=_('Show account history')?></a></td> </tr> <tr> - <td class="DataTD"><?=_("OTP PIN")?><br> - (<?=_("Not displayed")?>)</td> - <td class="DataTD"><input type="text" name="otppin"></td> + <td colspan="2" class="title"><a href="account.php?id=13&showdetails=<?=intval(!$showdetails)?>"><?=_("View secret question & answers")?></a></td> </tr> + <? if($showdetails){ ?> <tr> <td class="DataTD" colspan="2"><?=_("Lost Pass Phrase Questions")?></td> </tr> @@ -167,5 +160,5 @@ </tr> </table> <input type="hidden" name="csrf" value="<?=make_csrf('perschange')?>" /> -<input type="hidden" name="oldid" value="<?=$id?>"> +<input type="hidden" name="oldid" value="<?=intval($id)?>"> </form> diff --git a/pages/account/15.php b/pages/account/15.php index 6cd3115..405cb44 100644 --- a/pages/account/15.php +++ b/pages/account/15.php @@ -30,7 +30,7 @@ } $row = mysql_fetch_assoc($res); $crtname=escapeshellarg($row['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crtname`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crtname"); ?> <h3><?=_("Below is your Server Certificate")?></h3> <pre> diff --git a/pages/account/16.php b/pages/account/16.php index 564463e..8783bc5 100644 --- a/pages/account/16.php +++ b/pages/account/16.php @@ -25,47 +25,101 @@ <tr> <td class="DataTD"><?=_("Add")?></td> <td class="DataTD"><?=_("Address")?></td> -<? if(array_key_exists('emails',$_SESSION['_config']) && is_array($_SESSION['_config']['emails'])) - foreach($_SESSION['_config']['emails'] as $val) { ?> +<? +if (array_key_exists('emails',$_SESSION['_config']) && is_array($_SESSION['_config']['emails'])) { + $i = 1; + foreach($_SESSION['_config']['emails'] as $val) { +?> <tr> - <td class="DataTD"><?=_("Email")?>:</td> - <td class="DataTD"><input type="text" name="emails[]" value="<?=$val?>"/></td> + <td class="DataTD"><label for="email<?=$i?>"><?=_("Email")?></label></td> + <td class="DataTD"><input type="text" id="email<?=$i?>" name="emails[]" value="<?=$val?>"/></td> </tr> -<? } ?> +<? + $i++; + } +} ?> <tr> - <td class="DataTD"><?=_("Email")?>:</td> - <td class="DataTD"><input type="text" name="emails[]"/></td> + <td class="DataTD"><label for="email0"><?=_("Email")?></td> + <td class="DataTD"><input type="text" id="email0" name="emails[]"/></td> </tr> <tr> - <td class="DataTD"><?=_("Name")?>:</td> - <td class="DataTD"><input type="text" name="name" value="<?=array_key_exists('name',$_SESSION['_config'])?($_SESSION['_config']['name']):''?>"/></td> + <td class="DataTD"><label for="name"><?=_("Name")?></label></td> + <td class="DataTD"><input type="text" id="name" name="name" value="<?=array_key_exists('name',$_SESSION['_config'])?($_SESSION['_config']['name']):''?>"/></td> </tr> <tr> - <td class="DataTD"><?=_("Department")?>:</td> - <td class="DataTD"><input type="text" name="OU" value="<?=array_key_exists('OU',$_SESSION['_config'])?($_SESSION['_config']['OU']):''?>"/></td> + <td class="DataTD"><label for="OU"><?=_("Department")?></label></td> + <td class="DataTD"><input type="text" id="OU" name="OU" value="<?=array_key_exists('OU',$_SESSION['_config'])?(sanitizeHTML($_SESSION['_config']['OU'])):''?>"/></td> </tr> - <tr> + + <tr name="expertoff" style="display:none"> + <td class="DataTD"> + <input type="checkbox" id="expertbox" name="expertbox" onchange="showExpert(this.checked)" /> + </td> + <td class="DataTD"> + <label for="expertbox"><?=_("Show advanced options")?></label> + </td> + </tr> + <tr name="expert"> + <td class="DataTD" colspan="2" align="left"> + <input type="radio" id="root1" name="rootcert" value="1" /> <label for="root1"><?=_("Sign by class 1 root certificate")?></label><br /> + <input type="radio" id="root2" name="rootcert" value="2" checked="checked" /> <label for="root2"><?=_("Sign by class 3 root certificate")?></label><br /> + <?=str_replace("\n", "<br>\n", wordwrap(_("Please note: If you use a certificate signed by the class 3 root, the class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain."), 60))?> + </td> + </tr> + + <tr name="expert"> <td class="DataTD" colspan="2" align="left"> - <input type="radio" name="rootcert" value="1" checked /> <?=_("Sign by class 1 root certificate")?><br /> - <input type="radio" name="rootcert" value="2" /> <?=_("Sign by class 3 root certificate")?><br /> - <?=str_replace("\n", "<br>\n", wordwrap(_("Please note: The class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain. Until we are included in browsers this might not be a desirable option for most people"), 60))?> + <?=_("Hash algorithm used when signing the certificate:")?><br /> + <? + foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) { + ?> + <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> /> + <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label><br /> + <? + } + ?> </td> </tr> + <? if($_SESSION['profile']['codesign'] && $_SESSION['profile']['points'] >= 100) { ?> - <tr> - <td class="DataTD" colspan="2" align="left"><input type="checkbox" name="codesign" value="1" /><?=_("Code Signing")?></td> + <tr name="expert"> + <td class="DataTD" colspan="2" align="left"> + <input type="checkbox" id="codesign" name="codesign" value="1" /> + <label for="codesign"><?=_("Code Signing")?></label> + </td> </tr> <? } ?> - <tr> - <td class="DataTD" colspan="2" align="left"> - <?=_("Optional comment, only used in the certificate overview")?><br /> - <input type="text" name="description" maxlength="80" size=80 /> - </td> + <tr> + <td class="DataTD" colspan="2" align="left"> + <label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br /> + <input type="text" id="description" name="description" maxlength="80" size="80" /> + </td> </tr> <tr> - <td class="DataTD" colspan="2"><input type="submit" name="add_email" value="<?=_("Another Email")?>"> - <input type="submit" name="process" value="<?=_("Next")?>" /></td> + <td class="DataTD" colspan="2"> + <input type="submit" name="add_email" value="<?=_("Add Another Email Address")?>"> + <input type="submit" name="process" value="<?=_("Next")?>" /> + </td> </tr> </table> <input type="hidden" name="oldid" value="<?=$id?>"> </form> + +<script language="javascript"> +function showExpert(a) +{ + b=document.getElementsByName("expert"); + for(i=0;b.length>i;i++) + { + if(!a) {b[i].setAttribute("style","display:none"); } + else {b[i].removeAttribute("style");} + } + b=document.getElementsByName("expertoff"); + for(i=0;b.length>i;i++) + { + b[i].removeAttribute("style"); + } + +} +showExpert(false); +</script> diff --git a/pages/account/18.php b/pages/account/18.php index 9ab13b2..ca0a3c8 100644 --- a/pages/account/18.php +++ b/pages/account/18.php @@ -79,6 +79,7 @@ $status = array_key_exists('status',$_SESSION['_config']) ? intval($_SESSION['_c UNIX_TIMESTAMP(`oemail`.`expire`) as `expired`, `oemail`.`expire` as `expires`, `oemail`.`revoked` as `revoke`, UNIX_TIMESTAMP(`oemail`.`revoked`) as `revoked`, + if (`oemail`.`expire`=0,CURRENT_TIMESTAMP(),`oemail`.`modified`) as `modified`, `oemail`.`CN`, `oemail`.`serial`, `oemail`.`id`, `oemail`.`description`, `oemail`.`ou`, `orginfo`.`O` from `orgemailcerts` as `oemail`, `org`, `orginfo` @@ -92,17 +93,17 @@ $status = array_key_exists('status',$_SESSION['_config']) ? intval($_SESSION['_c if(0==$status) { $query .= "AND `oemail`.`revoked`=0 AND `oemail`.`renewed`=0 "; - $query .= "HAVING `timeleft` > 0 AND `revoked`=0 "; + $query .= "HAVING `timeleft` > 0 AND `revoked`=0 or `expires` = 0 "; } switch ($sorting){ case 0: - $query .= "ORDER BY `orginfo`.`O`, `oemail`.`expire` desc"; + $query .= "ORDER BY `orginfo`.`O`, `modified` desc"; break; case 1: - $query .= "ORDER BY `orginfo`.`O`, `oemail`.`ou`, `oemail`.`expire` desc"; + $query .= "ORDER BY `orginfo`.`O`, `oemail`.`ou`, `modified` desc"; break; case 2: - $query .= "ORDER BY `orginfo`.`O`, `oemail`.`CN`, `oemail`.`expire` desc"; + $query .= "ORDER BY `orginfo`.`O`, `oemail`.`CN`, `modified` desc"; break; } $res = mysql_query($query); diff --git a/pages/account/19.php b/pages/account/19.php index 6a2749c..959111f 100644 --- a/pages/account/19.php +++ b/pages/account/19.php @@ -31,7 +31,7 @@ } $row = mysql_fetch_assoc($res); $crtname=escapeshellarg($row['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crtname`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crtname"); if($row['keytype'] == "NS") { diff --git a/pages/account/20.php b/pages/account/20.php index ee16dd4..89bbc30 100644 --- a/pages/account/20.php +++ b/pages/account/20.php @@ -27,13 +27,60 @@ <p><?=_("If the Subscriber's name and/or domain name registration change the subscriber will immediately inform CAcert Inc. who shall revoke the digital certificate. When the Digital Certificate expires or is revoked the company will permanently remove the certificate from the server on which it is installed and will not use it for any purpose thereafter. The person responsible for key management and security is fully authorized to install and utilize the certificate to represent this organization's electronic presence.")?></p> <form method="post" action="account.php"> -<input type="radio" name="rootcert" value="1" /> <?=_("Sign by class 1 root certificate")?><br /> -<input type="radio" name="rootcert" value="2" checked /> <?=_("Sign by class 3 root certificate")?><br /> -<p> <?=_("Optional comment, only used in the certificate overview")?><br /> - <input type="text" name="description" maxlength="80" size=80 /></p> +<p><label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br /> + <input type="text" id="description" name="description" maxlength="80" size="80" /> +</p> +<p><label for="CSR"><?=_("Paste your CSR (Certificate Signing Request) below...")?></label><br /> + <textarea id="CSR" name="CSR" cols="80" rows="15"></textarea> +</p> + +<fieldset> +<legend> + <input type="checkbox" id="expertbox" onchange="showExpert(this.checked)" style="display:none" /> + <label for="expertbox"><?=_("Advanced Options")?></label> +</legend> +<div id="advanced_options"> +<ul class="no_indent"> + <li> + <input type="radio" id="root1" name="rootcert" value="1" /> + <label for="root1"><?=_("Sign by class 1 root certificate")?></label> + </li> + <li> + <input type="radio" id="root2" name="rootcert" value="2" checked="checked" /> + <label for="root2"><?=_("Sign by class 3 root certificate")?></label> + </li> +</ul> <p><?=_("Please note: The class 3 root certificate needs to be setup in your webserver as a chained certificate, while slightly more complicated to setup, this root certificate is more likely to be trusted by more people.")?></p> -<p><?=_("Paste your CSR below...")?></p> -<textarea name="CSR" cols="80" rows="15"></textarea><br /> + +<p class="attach_ul"><?=_("Hash algorithm used when signing the certificate:")?></p> +<ul class="no_indent"> +<? +foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) { +?> + <li> + <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> /> + <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label> + </li> +<? +} +?> +</ul> + +</div> +</fieldset> + <input type="submit" name="process" value="<?=_("Submit")?>" /> <input type="hidden" name="oldid" value="<?=$id?>" /> -</form>
\ No newline at end of file +</form> + +<script language="javascript"> +function showExpert(a) +{ + var options=document.getElementById("advanced_options"); + options.style.display = (a) ? "" : "none"; + + var checkbox=document.getElementById("expertbox"); + checkbox.style.display = ""; +} +showExpert(false); +</script> diff --git a/pages/account/21.php b/pages/account/21.php index 75827fb..c5832b9 100644 --- a/pages/account/21.php +++ b/pages/account/21.php @@ -41,7 +41,7 @@ if (is_array($_SESSION['_config']['altrows'])) { } echo _("Organisation"), ": {$org['O']}<br>\n"; -echo _("Org. Unit"), ": {$_SESSION['_config']['OU']}<br>\n"; +echo _("Org. Unit"), ": ", sanitizeHTML($_SESSION['_config']['OU']), "<br>\n"; echo _("Location"), ": {$org['L']}<br>\n"; echo _("State/Province"), ": {$org['ST']}<br>\n"; echo _("Country"), ": {$org['C']}<br>\n"; @@ -52,7 +52,7 @@ echo _("Country"), ": {$org['C']}<br>\n"; <input type="submit" name="process" value="<?=_("Submit")?>"> <input type="hidden" name="oldid" value="<?=$id?>"> </p> - + <? if ($_SESSION['profile']['admin'] == 1) { ?> diff --git a/pages/account/22.php b/pages/account/22.php index 0413da0..7b7db2d 100644 --- a/pages/account/22.php +++ b/pages/account/22.php @@ -78,7 +78,9 @@ $status = array_key_exists('dstatus',$_SESSION['_config']) ? intval($_SESSION['_ UNIX_TIMESTAMP(`orgdomaincerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`, UNIX_TIMESTAMP(`orgdomaincerts`.`expire`) as `expired`, `orgdomaincerts`.`expire` as `expires`, `revoked` as `revoke`, - UNIX_TIMESTAMP(`revoked`) as `revoked`, `CN`, + UNIX_TIMESTAMP(`orgdomaincerts`.`revoked`) as `revoked`, + if (`orgdomaincerts`.`expire`=0,CURRENT_TIMESTAMP(),`orgdomaincerts`.`modified`) as `modified`, + `CN`, `orgdomaincerts`.`serial`, `orgdomaincerts`.`id` as `id`, `orgdomaincerts`.`description`, `orginfo`.`O` @@ -94,14 +96,14 @@ $status = array_key_exists('dstatus',$_SESSION['_config']) ? intval($_SESSION['_ if(0==$status) { $query .= "AND `revoked`=0 AND `renewed`=0 "; - $query .= "HAVING `timeleft` > 0 "; + $query .= "HAVING `timeleft` > 0 or `expires` = 0 "; } switch ($sorting){ case 0: - $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`expire` desc"; + $query .= "ORDER BY `orginfo`.`O`, `modified` desc"; break; case 1: - $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`CN`, `orgdomaincerts`.`expire` desc"; + $query .= "ORDER BY `orginfo`.`O`, `orgdomaincerts`.`CN`, `modified` desc"; break; } diff --git a/pages/account/23.php b/pages/account/23.php index 4ec56c3..4255b47 100644 --- a/pages/account/23.php +++ b/pages/account/23.php @@ -30,7 +30,7 @@ } $row = mysql_fetch_assoc($res); $crtname=escapeshellarg($row['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crtname`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crtname"); ?> <h3><?=_("Below is your Server Certificate")?></h3> <pre> diff --git a/pages/account/3.php b/pages/account/3.php index 7e34300..cd62ce0 100644 --- a/pages/account/3.php +++ b/pages/account/3.php @@ -34,6 +34,7 @@ <tr> <td class="DataTD"><?=_("Add")?></td> <td class="DataTD"><?=_("Address")?></td> + </tr> <? $query = "select * from `email` where `memid`='".intval($_SESSION['profile']['id'])."' and `deleted`=0 and `hash`=''"; @@ -41,8 +42,8 @@ while($row = mysql_fetch_assoc($res)) { ?> <tr> - <td class="DataTD"><input type="checkbox" name="addid[]" value="<?=intval($row['id'])?>"></td> - <td class="DataTD"><?=sanitizeHTML($row['email'])?></td> + <td class="DataTD"><input type="checkbox" id="addid<?=intval($row['id'])?>" name="addid[]" value="<?=intval($row['id'])?>"></td> + <td class="DataTD" align="left"><label for="addid<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></label></td> </tr> <? } if($_SESSION['profile']['points'] >= 50) @@ -52,81 +53,120 @@ if($_SESSION['profile']['points'] >= 50) $lname = $_SESSION['profile']['lname']; $suffix = $_SESSION['profile']['suffix']; ?> - <td class="DataTD" colspan="2" align="left"> - <input type="radio" name="rootcert" value="1" checked /> <?=_("Sign by class 1 root certificate")?><br /> - <input type="radio" name="rootcert" value="2" /> <?=_("Sign by class 3 root certificate")?><br /> - <?=str_replace("\n", "<br />\n", wordwrap(_("Please note: The class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain. Until we are included in browsers this might not be a desirable option for most people"), 125))?> - </td> - </tr> <tr> <td class="DataTD" colspan="2" align="left"> - <input type="radio" name="incname" value="0" checked /> <?=_("No Name")?><br /> - <? if($fname && $lname) { ?><input type="radio" name="incname" value="1" /> <?=_("Include")?> '<?=$fname." ".$lname?>'<br /><? } ?> - <? if($fname && $mname && $lname) { ?><input type="radio" name="incname" value="2" /> <?=_("Include")?> '<?=$fname." ".$mname." ".$lname?>'<br /><? } ?> - <? if($fname && $lname && $suffix) { ?><input type="radio" name="incname" value="3" /> <?=_("Include")?> '<?=$fname." ".$lname." ".$suffix?>'<br /><? } ?> - <? if($fname && $mname && $lname && $suffix) { ?><input type="radio" name="incname" value="4" /> <?=_("Include")?> '<?=$fname." ".$mname." ".$lname." ".$suffix?>'<br /><? } ?> + <input type="radio" id="incname0" name="incname" value="0" checked="checked" /> + <label for="incname0"><?=_("No Name")?></label><br /> + <? if($fname && $lname) { ?> + <input type="radio" id="incname1" name="incname" value="1" /> + <label for="incname1"><?=_("Include")?> '<?=$fname." ".$lname?>'</label><br /> + <? } ?> + <? if($fname && $mname && $lname) { ?> + <input type="radio" id="incname2" name="incname" value="2" /> + <label for="incname2"><?=_("Include")?> '<?=$fname." ".$mname." ".$lname?>'</label><br /> + <? } ?> + <? if($fname && $lname && $suffix) { ?> + <input type="radio" id="incname3" name="incname" value="3" /> + <label for="incname3"><?=_("Include")?> '<?=$fname." ".$lname." ".$suffix?>'</label><br /> + <? } ?> + <? if($fname && $mname && $lname && $suffix) { ?> + <input type="radio" id="incname4" name="incname" value="4" /> + <label for="incname4"><?=_("Include")?> '<?=$fname." ".$mname." ".$lname." ".$suffix?>'</label><br /> + <? } ?> </td> </tr> <? } ?> -<? if($_SESSION['profile']['points'] >= 100 && $_SESSION['profile']['codesign'] > 0) { ?> + <tr> <td class="DataTD"> - <input type="checkbox" name="codesign" value="1" /> + <input type="checkbox" id="login" name="login" value="1" checked="checked" /> </td> <td class="DataTD" align="left"> - <?=_("Code Signing")?><br /> - <?=_("Please Note: By ticking this box you will automatically have your name included in any certificates.")?> + <label for="login"><?=_("Enable certificate login with this certificate")?><br /> + <?=_("By allowing certificate login, this certificate can be used to login into this account at https://secure.cacert.org/ .")?></label> </td> </tr> -<? } ?> - <tr> + <td class="DataTD" colspan="2" align="left"> + <label for="description"><?=_("Optional comment, only used in the certificate overview")?></label><br /> + <input type="text" id="description" name="description" maxlength="100" size="100" /> + </td> + </tr> + + <tr name="expertoff" style="display:none"> <td class="DataTD"> - <input type="checkbox" name="login" value="1" checked="checked" /> + <input type="checkbox" id="expertbox" name="expertbox" onchange="showExpert(this.checked)" /> </td> - <td class="DataTD"> <?=_("Enable certificate login with this certificate")?><br /> - <?=_("By allowing certificate login, this certificate can be used to login into this account at https://secure.cacert.org/ .")?><br/> + <td class="DataTD" align="left"> + <label for="expertbox"><?=_("Show advanced options")?></label> </td> </tr> - <tr> - <td class="DataTD" colspan="2" align="left"> - <?=_("Optional comment, only used in the certificate overview")?><br /> - <input type="text" name="description" maxlength="100" size="100" /> - </td> + +<? +if($_SESSION['profile']['points'] >= 50) +{ +?> + <tr name="expert"> + <td class="DataTD" colspan="2" align="left"> + <input type="radio" id="root1" name="rootcert" value="1" /> <label for="root1"><?=_("Sign by class 1 root certificate")?></label><br /> + <input type="radio" id="root2" name="rootcert" value="2" checked="checked" /> <label for="root2"><?=_("Sign by class 3 root certificate")?></label><br /> + <?=str_replace("\n", "<br />\n", wordwrap(_("Please note: If you use a certificate signed by the class 3 root, the class 3 root certificate needs to be imported into your email program as well as the class 1 root certificate so your email program can build a full trust path chain."), 125))?> + </td> </tr> +<? } ?> - <tr name="expertoff" style="display:none"> + <tr name="expert"> + <td class="DataTD" colspan="2" align="left"> + <?=_("Hash algorithm used when signing the certificate:")?><br /> + <? + foreach (HashAlgorithms::getInfo() as $algorithm => $display_info) { + ?> + <input type="radio" id="hash_alg_<?=$algorithm?>" name="hash_alg" value="<?=$algorithm?>" <?=(HashAlgorithms::$default === $algorithm)?'checked="checked"':''?> /> + <label for="hash_alg_<?=$algorithm?>"><?=$display_info['name']?><?=$display_info['info']?' - '.$display_info['info']:''?></label><br /> + <? + } + ?> + </td> + </tr> + +<? if($_SESSION['profile']['points'] >= 100 && $_SESSION['profile']['codesign'] > 0) { ?> + <tr name="expert"> <td class="DataTD"> - <input type="checkbox" name="expertbox" onchange="showExpert(this.checked)" /> + <input type="checkbox" id="codesign" name="codesign" value="1" /> </td> + <td class="DataTD" align="left"> + <label for="codesign"><?=_("Code Signing")?><br /> + <?=_("Please note: By ticking this box you will automatically have your name included in the certificate.")?></label> + </td> + </tr> +<? } ?> + + <tr name="expert"> <td class="DataTD"> - <?=_("Show advanced options")?> + <input type="checkbox" id="SSO" name="SSO" value="1" /> + </td> + <td class="DataTD" align="left"> + <label for="SSO"><?=_("Add Single Sign On ID Information")?><br /> + <?=str_replace("\n", "<br>\n", wordwrap(_("By adding Single Sign On (SSO) ID information to your certificates this could be used to track you, you can also issue certificates with no email addresses that are useful only for Authentication. Please see a more detailed description on our WIKI about it."), 125))?> + <a href="http://wiki.cacert.org/wiki/SSO"><?=_("SSO WIKI Entry")?></a></label> </td> </tr> <tr name="expert"> - <td class="DataTD" colspan="2" align="left"> - <input type="radio" name="SSO" value="0" checked /> <?=_("No Single Sign On ID")?><br /> - <input type="radio" name="SSO" value="1" /> <?=_("Add Single Sign On ID Information")?><br /> - <?=str_replace("\n", "<br>\n", wordwrap(_("By adding Single Sign On (SSO) ID information to your certificates this could be used to track you, you can also issue certificates with no email addresses that are useful only for Authentication. Please see a more detailed description on our WIKI about it."), 125))?> - <a href="http://wiki.cacert.org/wiki/SSO"><?=_("SSO WIKI Entry")?></a> + <td class="DataTD" colspan="2"> + <label for="optionalCSR"><?=_("Optional Client CSR, no information on the certificate will be used")?></label><br /> + <textarea id="optionalCSR" name="optionalCSR" cols="80" rows="5"></textarea> </td> </tr> - <tr name="expert"> - <td class="DataTD" colspan="2"><?=_("Optional Client CSR, no information on the certificate will be used")?></td> - </tr> - <tr name="expert"> - <td class="DataTD" colspan="2"><textarea name="optionalCSR" cols="80" rows="5"></textarea></td> - </tr> - <tr> + <tr> <td class="DataTD"> - <input type="checkbox" name="CCA" /> + <input type="checkbox" id="CCA" name="CCA" /> </td> <td class="DataTD" align="left"> - <strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br /> - <?=_("Please Note: You need to accept the CCA to proceed.")?> + <label for="CCA"><strong><?=sprintf(_("I accept the CAcert Community Agreement (%s)."),"<a href='/policy/CAcertCommunityAgreement.html'>CCA</a>")?></strong><br /> + <?=_("Please note: You need to accept the CCA to proceed.")?></label> </td> </tr> <tr> @@ -154,4 +194,3 @@ function showExpert(a) } showExpert(false); </script> - diff --git a/pages/account/43.php b/pages/account/43.php index 53b24d3..c889ce3 100644 --- a/pages/account/43.php +++ b/pages/account/43.php @@ -14,30 +14,30 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ ?> -<? +*/ + include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php"); +$ticketno=''; +$ticketvalidation=FALSE; - if(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0) - { - $assurance = mysql_escape_string(intval($_REQUEST['assurance'])); - $row = 0; - $res = mysql_query("select `to` from `notary` where `id`='$assurance'"); - if ($res) { - $row = mysql_fetch_assoc($res); - } - mysql_query("delete from `notary` where `id`='$assurance'"); - if ($row) { - fix_assurer_flag($row['to']); - } - } +if (isset($_SESSION['ticketno'])) { + $ticketno = $_SESSION['ticketno']; + $ticketvalidation = valid_ticket_number($ticketno); +} +if (isset($_SESSION['ticketmsg'])) { + $ticketmsg = $_SESSION['ticketmsg']; +} else { + $ticketmsg = ''; +} - if(intval(array_key_exists('userid',$_REQUEST)?$_REQUEST['userid']:0) <= 0) - { + +// search for an account by email search, if more than one is found display list to choose +if(intval(array_key_exists('userid',$_REQUEST)?$_REQUEST['userid']:0) <= 0) +{ $_REQUEST['userid'] = 0; - $emailsearch = $email = mysql_escape_string(stripslashes($_REQUEST['email'])); + $emailsearch = $email = mysql_real_escape_string(stripslashes($_REQUEST['email'])); //Disabled to speed up the queries //if(!strstr($email, "%")) @@ -45,877 +45,1036 @@ include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php"); // bug-975 ted+uli changes --- begin if(preg_match("/^[0-9]+$/", $email)) { - // $email consists of digits only ==> search for IDs - // Be defensive here (outer join) if primary mail is not listed in email table - $query = "select `users`.`id` as `id`, `email`.`email` as `email` - from `users` left outer join `email` on (`users`.`id`=`email`.`memid`) - where (`email`.`id`='$email' or `users`.`id`='$email') - and `users`.`deleted`=0 - group by `users`.`id` limit 100"; + // $email consists of digits only ==> search for IDs + // Be defensive here (outer join) if primary mail is not listed in email table + $query = "select `users`.`id` as `id`, `email`.`email` as `email` + from `users` left outer join `email` on (`users`.`id`=`email`.`memid`) + where (`email`.`id`='$email' or `users`.`id`='$email') + and `users`.`deleted`=0 + group by `users`.`id` limit 100"; } else { - // $email contains non-digits ==> search for mail addresses - // Be defensive here (outer join) if primary mail is not listed in email table - $query = "select `users`.`id` as `id`, `email`.`email` as `email` - from `users` left outer join `email` on (`users`.`id`=`email`.`memid`) - where (`email`.`email` like '$emailsearch' - or `users`.`email` like '$emailsearch') - and `users`.`deleted`=0 - group by `users`.`id` limit 100"; + // $email contains non-digits ==> search for mail addresses + // Be defensive here (outer join) if primary mail is not listed in email table + $query = "select `users`.`id` as `id`, `email`.`email` as `email` + from `users` left outer join `email` on (`users`.`id`=`email`.`memid`) + where (`email`.`email` like '$emailsearch' + or `users`.`email` like '$emailsearch') + and `users`.`deleted`=0 + group by `users`.`id` limit 100"; } // bug-975 ted+uli changes --- end $res = mysql_query($query); - if(mysql_num_rows($res) > 1) { ?> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="5" class="title"><?=_("Select Specific Account Details")?></td> - </tr> - <tr> - <td class="DataTD"><?=_("User ID")?></td> - <td class="DataTD"><?=_("Email")?></td> - </tr> -<? - while($row = mysql_fetch_assoc($res)) - { ?> - <tr> - <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($row['id'])?>"><?=intval($row['id'])?></a></td> - <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td> - </tr> -<? } if(mysql_num_rows($res) >= 100) { ?> - <tr> - <td class="DataTD" colspan="2"><?=_("Only the first 100 rows are displayed.")?></td> - </tr> -<? } else { ?> - <tr> - <td class="DataTD" colspan="2"><? printf(_("%s rows displayed."), mysql_num_rows($res)); ?></td> - </tr> -<? } ?> -</table><br><br> -<? } elseif(mysql_num_rows($res) == 1) { - $row = mysql_fetch_assoc($res); - $_REQUEST['userid'] = $row['id']; - } else { - printf(_("No users found matching %s"), sanitizeHTML($email)); - } - } - - if(intval($_REQUEST['userid']) > 0) - { - $userid = intval($_REQUEST['userid']); - $query = "select * from `users` where `users`.`id`='$userid' and `users`.`deleted`=0"; - $res = mysql_query($query); - if(mysql_num_rows($res) <= 0) - { - echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!"); - } else { - $row = mysql_fetch_assoc($res); - $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($row['id'])."'"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $alerts = mysql_fetch_assoc(mysql_query("select * from `alerts` where `memid`='".intval($row['id'])."'")); + if(mysql_num_rows($res) > 1) { ?> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="5" class="title"><? printf(_("%s's Account Details"), sanitizeHTML($row['email'])); ?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Email")?>:</td> - <td class="DataTD"><?=sanitizeHTML($row['email'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("First Name")?>:</td> - <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to modify this DOB and/or last name?")?>')) return false;"> - <input type="hidden" name="csrf" value="<?=make_csrf('admchangepers')?>" /> - <input type="text" name="fname" value="<?=sanitizeHTML($row['fname'])?>"></td> - </tr> - <tr> - <td class="DataTD"><?=_("Middle Name")?>:</td> - <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($row['mname'])?>"></td> - </tr> - <tr> - <td class="DataTD"><?=_("Last Name")?>:</td> - <td class="DataTD"> <input type="hidden" name="oldid" value="43"> - <input type="hidden" name="action" value="updatedob"> - <input type="hidden" name="userid" value="<?=intval($userid)?>"> - <input type="text" name="lname" value="<?=sanitizeHTML($row['lname'])?>"></td> - </tr> - <tr> - <td class="DataTD"><?=_("Suffix")?>:</td> - <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($row['suffix'])?>"></td> - </tr> - <tr> - <td class="DataTD"><?=_("Date of Birth")?>:</td> - <td class="DataTD"> -<? - $year = intval(substr($row['dob'], 0, 4)); - $month = intval(substr($row['dob'], 5, 2)); - $day = intval(substr($row['dob'], 8, 2)); - ?><nobr><select name="day"> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="5" class="title"><?=_("Select Specific Account Details")?></td> + </tr> + <tr> + <td class="DataTD"><?=_("User ID")?></td> + <td class="DataTD"><?=_("Email")?></td> + </tr> <? - for($i = 1; $i <= 31; $i++) + while($row = mysql_fetch_assoc($res)) { - echo "<option"; - if($day == $i) - echo " selected='selected'"; - echo ">$i</option>"; - } ?> - </select> - <select name="month"> + <tr> + <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($row['id'])?>"><?=intval($row['id'])?></a></td> + <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td> + </tr> <? - for($i = 1; $i <= 12; $i++) - { - echo "<option value='$i'"; - if($month == $i) - echo " selected='selected'"; - echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))."</option>"; } + + if(mysql_num_rows($res) >= 100) { ?> - </select> - <input type="text" name="year" value="<?=$year?>" size="4"> - <input type="submit" value="Go"></form></nobr></td> - </tr> - <tr> - <td class="DataTD"><?=_("CCA accepted")?>:</td> - <td class="DataTD"><a href="account.php?id=57&userid=<?=intval($row['id'])?>"><?=intval(get_user_agreement_status($row['id'])) ? _("Yes") : _("No") ?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Trainings")?>:</td> - <td class="DataTD"><a href="account.php?id=55&userid=<?=intval($row['id'])?>">show</a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Is Assurer")?>:</td> - <td class="DataTD"><a href="account.php?id=43&assurer=<?=intval($row['id'])?>&csrf=<?=make_csrf('admsetassuret')?>"><?=$row['assurer']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Blocked Assurer")?>:</td> - <td class="DataTD"><a href="account.php?id=43&assurer_blocked=<?=intval($row['id'])?>"><?=$row['assurer_blocked']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Account Locking")?>:</td> - <td class="DataTD"><a href="account.php?id=43&locked=<?=$row['id']?>&csrf=<?=make_csrf('admactlock')?>"><?=$row['locked']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Code Signing")?>:</td> - <td class="DataTD"><a href="account.php?id=43&codesign=<?=$row['id']?>&csrf=<?=make_csrf('admcodesign')?>"><?=$row['codesign']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Org Assurer")?>:</td> - <td class="DataTD"><a href="account.php?id=43&orgadmin=<?=$row['id']?>&csrf=<?=make_csrf('admorgadmin')?>"><?=$row['orgadmin']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("TTP Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&ttpadmin=<?=$row['id']?>&csrf=<?=make_csrf('admttpadmin')?>"><?=$row['ttpadmin']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Location Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&locadmin=<?=$row['id']?>"><?=$row['locadmin']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&admin=<?=$row['id']?>&csrf=<?=make_csrf('admsetadmin')?>"><?=$row['admin']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Ad Admin")?>:</td> - <td class="DataTD"><a href="account.php?id=43&adadmin=<?=$row['id']?>"><?=$row['adadmin']?></a> (0 = none, 1 = submit, 2 = approve)</td> - </tr> - <tr> - <td class="DataTD"><?=_("Tverify Account")?>:</td> - <td class="DataTD"><a href="account.php?id=43&tverify=<?=$row['id']?>"><?=$row['tverify']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("General Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&general=<?=$row['id']?>"><?=$alerts['general']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Country Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&country=<?=$row['id']?>"><?=$alerts['country']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Regional Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&regional=<?=$row['id']?>"><?=$alerts['regional']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Within 200km Announcements")?>:</td> - <td class="DataTD"><a href="account.php?id=43&radius=<?=$row['id']?>"><?=$alerts['radius']?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Change Password")?>:</td> - <td class="DataTD"><a href="account.php?id=44&userid=<?=$row['id']?>"><?=_("Change Password")?></a></td> - </tr> - <tr> - <td class="DataTD"><?=_("Delete Account")?>:</td> - <td class="DataTD"><a href="account.php?id=50&userid=<?=$row['id']?>&csrf=<?=make_csrf('admdelaccount')?>"><?=_("Delete Account")?></a></td> - </tr> + <tr> + <td class="DataTD" colspan="2"><?=_("Only the first 100 rows are displayed.")?></td> + </tr> <? - // This is intensionally a $_GET for audit purposes. DO NOT CHANGE!!! - if(array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes") { + } else { ?> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - Q1:</td> - <td class="DataTD"><?=sanitizeHTML($row['Q1'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - A1:</td> - <td class="DataTD"><?=sanitizeHTML($row['A1'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - Q2:</td> - <td class="DataTD"><?=sanitizeHTML($row['Q2'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - A2:</td> - <td class="DataTD"><?=sanitizeHTML($row['A2'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - Q3:</td> - <td class="DataTD"><?=sanitizeHTML($row['Q3'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - A3:</td> - <td class="DataTD"><?=sanitizeHTML($row['A3'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - Q4:</td> - <td class="DataTD"><?=sanitizeHTML($row['Q4'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - A4:</td> - <td class="DataTD"><?=sanitizeHTML($row['A4'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - Q5:</td> - <td class="DataTD"><?=sanitizeHTML($row['Q5'])?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Lost Password")?> - A5:</td> - <td class="DataTD"><?=sanitizeHTML($row['A5'])?></td> - </tr> -<? } else { ?> - <tr> - <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=$row['id']?>&showlostpw=yes"><?=_("Show Lost Password Details")?></a></td> - </tr> -<? } ?> - <tr> - <td class="DataTD"><?=_("Assurance Points")?>:</td> - <td class="DataTD"><?=intval($drow['points'])?></td> - </tr> -</table> -<br><? - $query = "select * from `email` where `memid`='".intval($row['id'])."' and `deleted`=0 and `hash`='' - and `email`!='".mysql_escape_string($row['email'])."'"; - $dres = mysql_query($query); - if(mysql_num_rows($dres) > 0) { ?> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="5" class="title"><?=_("Alternate Verified Email Addresses")?></td> - </tr><? - $rc = mysql_num_rows($dres); - while($drow = mysql_fetch_assoc($dres)) - { ?> - <tr> - <td class="DataTD"><?=_("Secondary Emails")?>:</td> - <td class="DataTD"><?=sanitizeHTML($drow['email'])?></td> - </tr> -<? } ?> -</table> -<br><? } ?> + <tr> + <td class="DataTD" colspan="2"><? printf(_("%s rows displayed."), mysql_num_rows($res)); ?></td> + </tr> <? - $query = "select * from `domains` where `memid`='".intval($row['id'])."' and `deleted`=0 and `hash`=''"; - $dres = mysql_query($query); - if(mysql_num_rows($dres) > 0) { ?> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="5" class="title"><?=_("Verified Domains")?></td> - </tr><? - $rc = mysql_num_rows($dres); - while($drow = mysql_fetch_assoc($dres)) - { ?> - <tr> - <td class="DataTD"><?=_("Domain")?>:</td> - <td class="DataTD"><?=sanitizeHTML($drow['domain'])?></td> - </tr> -<? } ?> -</table> -<br> -<? } ?> -<? // Begin - Debug infos ?> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="2" class="title"><?=_("Account State")?></td> - </tr> - -<? - // --- bug-975 begin --- - // potential db inconsistency like in a20110804.1 - // Admin console -> don't list user account - // User login -> impossible - // Assurer, assure someone -> user displayed - /* regular user account search with regular settings - - --- Admin Console find user query - $query = "select `users`.`id` as `id`, `email`.`email` as `email` from `users`,`email` - where `users`.`id`=`email`.`memid` and - (`email`.`email` like '$emailsearch' or `email`.`id`='$email' or `users`.`id`='$email') and - `email`.`hash`='' and `email`.`deleted`=0 and `users`.`deleted`=0 - group by `users`.`id` limit 100"; - => requirements - 1. email.hash = '' - 2. email.deleted = 0 - 3. users.deleted = 0 - 4. email.email = primary-email (???) or'd - not covered by admin console find user routine, but may block users login - 5. users.verified = 0|1 - further "special settings" - 6. users.locked (setting displayed in display form) - 7. users.assurer_blocked (setting displayed in display form) - - --- User login user query - select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or - `password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0 - => requirements - 1. users.verified = 1 - 2. users.deleted = 0 - 3. users.locked = 0 - 4. users.email = primary-email - - --- Assurer, assure someone find user query - select * from `users` where `email`='".mysql_escape_string(stripslashes($_POST['email']))."' - and `deleted`=0 - => requirements - 1. users.deleted = 0 - 2. users.email = primary-email - Admin User Assurer - bit Console Login assure someone - - 1. email.hash = '' Yes No No - 2. email.deleted = 0 Yes No No - 3. users.deleted = 0 Yes Yes Yes - 4. users.verified = 1 No Yes No - 5. users.locked = 0 No Yes No - 6. users.email = prim-email No Yes Yes - 7. email.email = prim-email Yes No No - - full usable account needs all 7 requirements fulfilled - so if one setting isn't set/cleared there is an inconsistency either way - if eg email.email is not avail, admin console cannot open user info - but user can login and assurer can display user info - if user verified is not set to 1, admin console displays user record - but user cannot login, but assurer can search for the user and the data displays - - consistency check: - 1. search primary-email in users.email - 2. search primary-email in email.email - 3. userid = email.memid - 4. check settings from table 1. - 5. - - */ - - $inconsistency = 0; - $inconsistencydisp = ""; - $inccause = ""; - // current userid intval($row['id']) - $query = "select `email` as `uemail`, `deleted` as `udeleted`, `verified`, `locked` - from `users` where `id`='".intval($row['id'])."' "; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $uemail = $drow['uemail']; - $udeleted = $drow['udeleted']; - $uverified = $drow['verified']; - $ulocked = $drow['locked']; - - $query = "select `hash`, `email` as `eemail` from `email` - where `memid`='".intval($row['id'])."' and - `email` ='".$uemail."' and - `deleted` = 0"; - $dres = mysql_query($query); - if ($drow = mysql_fetch_assoc($dres)) { - $drow['edeleted'] = 0; - } else { - // try if there are deleted entries - $query = "select `hash`, `deleted` as `edeleted`, `email` as `eemail` from `email` - where `memid`='".intval($row['id'])."' and - `email` ='".$uemail."'"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - } - - if ($drow) { - $eemail = $drow['eemail']; - $edeleted = $drow['edeleted']; - $ehash = $drow['hash']; - if ($udeleted!=0) { - $inconsistency += 1; - $inccause .= (empty($inccause)?"":"<br>")._("Users record set to deleted"); - } - if ($uverified!=1) { - $inconsistency += 2; - $inccause .= (empty($inccause)?"":"<br>")._("Users record verified not set"); - } - if ($ulocked!=0) { - $inconsistency += 4; - $inccause .= (empty($inccause)?"":"<br>")._("Users record locked set"); - } - if ($edeleted!=0) { - $inconsistency += 8; - $inccause .= (empty($inccause)?"":"<br>")._("Email record set deleted"); - } - if ($ehash!='') { - $inconsistency += 16; - $inccause .= (empty($inccause)?"":"<br>")._("Email record hash not unset"); - } - } else { - $inconsistency = 32; - $inccause = _("Prim. email, Email record doesn't exist"); - } - if ($inconsistency>0) { - // $inconsistencydisp = _("Yes"); -?> - <tr> - <td class="DataTD"><?=_("Account inconsistency")?>:</td> - <td class="DataTD"><?=$inccause?><br>code: <?=$inconsistency?></td> - </tr> - <tr> - <td colspan="2" class="DataTD" style="max-width: 75ex"> - <?=_("Account inconsistency can cause problems in daily account ". - "operations and needs to be fixed manually through arbitration/critical ". - "team.")?> - </td> - </tr> -<? } - - // --- bug-975 end --- + } ?> -</table> -<br> + </table><br><br> <? - // End - Debug infos -?> + } elseif(mysql_num_rows($res) == 1) { + $row = mysql_fetch_assoc($res); + $_REQUEST['userid'] = $row['id']; + } else { + printf(_("No users found matching %s"), sanitizeHTML($email)); + } +} + +// display user information for given user id +if(intval($_REQUEST['userid']) > 0) { + $userid = intval($_REQUEST['userid']); + $res =get_user_data($userid); + if(mysql_num_rows($res) <= 0) { + echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!"); + } else { + $row = mysql_fetch_assoc($res); + $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($row['id'])."' and `deleted` = 0"; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $alerts =get_alerts(intval($row['id'])); -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="6" class="title"><?=_("Certificates")?></td> - </tr> - - <tr> - <td class="DataTD"><?=_("Cert Type")?>:</td> - <td class="DataTD"><?=_("Total")?></td> - <td class="DataTD"><?=_("Valid")?></td> - <td class="DataTD"><?=_("Expired")?></td> - <td class="DataTD"><?=_("Revoked")?></td> - <td class="DataTD"><?=_("Latest Expire")?></td> - </tr> -<!-- server certificates --> - <tr> - <td class="DataTD"><?=_("Server")?>:</td> - <? - $query = "select COUNT(*) as `total`, - MAX(`domaincerts`.`expire`) as `maxexpire` - from `domains` inner join `domaincerts` - on `domains`.`id` = `domaincerts`.`domid` - where `domains`.`memid` = '".intval($row['id'])."' "; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $total = $drow['total']; - - $maxexpire = "0000-00-00 00:00:00"; - if ($drow['maxexpire']) { - $maxexpire = $drow['maxexpire']; - } - - if($total > 0) { - $query = "select COUNT(*) as `valid` - from `domains` inner join `domaincerts` - on `domains`.`id` = `domaincerts`.`domid` - where `domains`.`memid` = '".intval($row['id'])."' - and `revoked` = '0000-00-00 00:00:00' - and `expire` > NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $valid = $drow['valid']; - - $query = "select COUNT(*) as `expired` - from `domains` inner join `domaincerts` - on `domains`.`id` = `domaincerts`.`domid` - where `domains`.`memid` = '".intval($row['id'])."' - and `expire` <= NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $expired = $drow['expired']; - - $query = "select COUNT(*) as `revoked` - from `domains` inner join `domaincerts` - on `domains`.`id` = `domaincerts`.`domid` - where `domains`.`memid` = '".intval($row['id'])."' - and `revoked` != '0000-00-00 00:00:00'"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $revoked = $drow['revoked']; - ?> - <td class="DataTD"><?=intval($total)?></td> - <td class="DataTD"><?=intval($valid)?></td> - <td class="DataTD"><?=intval($expired)?></td> - <td class="DataTD"><?=intval($revoked)?></td> - <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")? - substr($maxexpire, 0, 10) : _("Pending")?></td> - <? - } else { // $total > 0 - ?> - <td colspan="5" class="DataTD"><?=_("None")?></td> - <? - } ?> - </tr> -<!-- client certificates --> - <tr> - <td class="DataTD"><?=_("Client")?>:</td> - <? - $query = "select COUNT(*) as `total`, MAX(`expire`) as `maxexpire` - from `emailcerts` - where `memid` = '".intval($row['id'])."' "; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $total = $drow['total']; - - $maxexpire = "0000-00-00 00:00:00"; - if ($drow['maxexpire']) { - $maxexpire = $drow['maxexpire']; - } - - if($total > 0) { - $query = "select COUNT(*) as `valid` - from `emailcerts` - where `memid` = '".intval($row['id'])."' - and `revoked` = '0000-00-00 00:00:00' - and `expire` > NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $valid = $drow['valid']; - - $query = "select COUNT(*) as `expired` - from `emailcerts` - where `memid` = '".intval($row['id'])."' - and `expire` <= NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $expired = $drow['expired']; - - $query = "select COUNT(*) as `revoked` - from `emailcerts` - where `memid` = '".intval($row['id'])."' - and `revoked` != '0000-00-00 00:00:00'"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $revoked = $drow['revoked']; - ?> - <td class="DataTD"><?=intval($total)?></td> - <td class="DataTD"><?=intval($valid)?></td> - <td class="DataTD"><?=intval($expired)?></td> - <td class="DataTD"><?=intval($revoked)?></td> - <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")? - substr($maxexpire, 0, 10) : _("Pending")?></td> - <? - } else { // $total > 0 - ?> - <td colspan="5" class="DataTD"><?=_("None")?></td> - <? - } ?> - </tr> -<!-- gpg certificates --> - <tr> - <td class="DataTD"><?=_("GPG")?>:</td> - <? - $query = "select COUNT(*) as `total`, MAX(`expire`) as `maxexpire` - from `gpg` - where `memid` = '".intval($row['id'])."' "; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $total = $drow['total']; - - $maxexpire = "0000-00-00 00:00:00"; - if ($drow['maxexpire']) { - $maxexpire = $drow['maxexpire']; - } - - if($total > 0) { - $query = "select COUNT(*) as `valid` - from `gpg` - where `memid` = '".intval($row['id'])."' - and `expire` > NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $valid = $drow['valid']; - - $query = "select COUNT(*) as `expired` - from `gpg` - where `memid` = '".intval($row['id'])."' - and `expire` <= NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $expired = $drow['expired']; - - ?> - <td class="DataTD"><?=intval($total)?></td> - <td class="DataTD"><?=intval($valid)?></td> - <td class="DataTD"><?=intval($expired)?></td> - <td class="DataTD"></td> - <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")? - substr($maxexpire, 0, 10) : _("Pending")?></td> - <? - } else { // $total > 0 - ?> - <td colspan="5" class="DataTD"><?=_("None")?></td> - <? - } ?> - </tr> -<!-- org server certificates --> - <tr> - <td class="DataTD"><a href="account.php?id=58&userid=<?=intval($row['id'])?>"><?=_("Org Server")?></a>:</td> - <? - $query = "select COUNT(*) as `total`, - MAX(`orgcerts`.`expire`) as `maxexpire` - from `orgdomaincerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' "; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $total = $drow['total']; - - $maxexpire = "0000-00-00 00:00:00"; - if ($drow['maxexpire']) { - $maxexpire = $drow['maxexpire']; - } - - if($total > 0) { - $query = "select COUNT(*) as `valid` - from `orgdomaincerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' - and `orgcerts`.`revoked` = '0000-00-00 00:00:00' - and `orgcerts`.`expire` > NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $valid = $drow['valid']; - - $query = "select COUNT(*) as `expired` - from `orgdomaincerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' - and `orgcerts`.`expire` <= NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $expired = $drow['expired']; - - $query = "select COUNT(*) as `revoked` - from `orgdomaincerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' - and `orgcerts`.`revoked` != '0000-00-00 00:00:00'"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $revoked = $drow['revoked']; - ?> - <td class="DataTD"><?=intval($total)?></td> - <td class="DataTD"><?=intval($valid)?></td> - <td class="DataTD"><?=intval($expired)?></td> - <td class="DataTD"><?=intval($revoked)?></td> - <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")? - substr($maxexpire, 0, 10) : _("Pending")?></td> - <? - } else { // $total > 0 - ?> - <td colspan="5" class="DataTD"><?=_("None")?></td> - <? - } ?> - </tr> -<!-- org client certificates --> - <tr> - <td class="DataTD"><?=_("Org Client")?>:</td> - <? - $query = "select COUNT(*) as `total`, - MAX(`orgcerts`.`expire`) as `maxexpire` - from `orgemailcerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' "; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $total = $drow['total']; - - $maxexpire = "0000-00-00 00:00:00"; - if ($drow['maxexpire']) { - $maxexpire = $drow['maxexpire']; - } - - if($total > 0) { - $query = "select COUNT(*) as `valid` - from `orgemailcerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' - and `orgcerts`.`revoked` = '0000-00-00 00:00:00' - and `orgcerts`.`expire` > NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $valid = $drow['valid']; - - $query = "select COUNT(*) as `expired` - from `orgemailcerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' - and `orgcerts`.`expire` <= NOW()"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $expired = $drow['expired']; - - $query = "select COUNT(*) as `revoked` - from `orgemailcerts` as `orgcerts` inner join `org` - on `orgcerts`.`orgid` = `org`.`orgid` - where `org`.`memid` = '".intval($row['id'])."' - and `orgcerts`.`revoked` != '0000-00-00 00:00:00'"; - $dres = mysql_query($query); - $drow = mysql_fetch_assoc($dres); - $revoked = $drow['revoked']; - ?> - <td class="DataTD"><?=intval($total)?></td> - <td class="DataTD"><?=intval($valid)?></td> - <td class="DataTD"><?=intval($expired)?></td> - <td class="DataTD"><?=intval($revoked)?></td> - <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")? - substr($maxexpire, 0, 10) : _("Pending")?></td> - <? - } else { // $total > 0 - ?> - <td colspan="5" class="DataTD"><?=_("None")?></td> - <? - } ?> - </tr> - <tr> - <td colspan="6" class="title"> - <form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to revoke all private certificates?")?>')) return false;"> - <input type="hidden" name="action" value="revokecert"> - <input type="hidden" name="oldid" value="43"> - <input type="hidden" name="userid" value="<?=intval($userid)?>"> - <input type="submit" value="<?=_('revoke certificates')?>"> - </form> - </td> - </tr> -</table> -<br> - - -<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredto"><?=_("Show Assurances the user got")?></a> - (<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredto15"><?=_("New calculation")?></a>) -<br /> -<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredby"><?=_("Show Assurances the user gave")?></a> - (<a href="account.php?id=43&userid=<?=$row['id']?>&shownotary=assuredby15"><?=_("New calculation")?></a>) -<br /> +//display account data -<? -// if(array_key_exists('assuredto',$_GET) && $_GET['assuredto'] == "yes") { +//deletes an assurance + if(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0 && $ticketvalidation == true) + { + if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE assurance revoke', $ticketno)) { + $ticketmsg=_("Writing to the admin log failed. Can't continue."); + } else { + $assurance = intval($_REQUEST['assurance']); + $trow = 0; + $res = mysql_query("select `to` from `notary` where `id`='".intval($assurance)."' and `deleted` = 0"); + if ($res) { + $trow = mysql_fetch_assoc($res); + if ($trow) { + mysql_query("update `notary` set `deleted`=NOW() where `id`='".intval($assurance)."'"); + fix_assurer_flag($trow['to']); + } + } + } + } elseif(array_key_exists('assurance',$_REQUEST) && $_REQUEST['assurance'] > 0 && $ticketvalidation == FALSE) { + $ticketmsg=_('No assurance revoked. Ticket number is missing!'); + } -function showassuredto() -{ -?> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="8" class="title"><?=_("Assurance Points")?></td> - </tr> - <tr> - <td class="DataTD"><b><?=_("ID")?></b></td> - <td class="DataTD"><b><?=_("Date")?></b></td> - <td class="DataTD"><b><?=_("Who")?></b></td> - <td class="DataTD"><b><?=_("Email")?></b></td> - <td class="DataTD"><b><?=_("Points")?></b></td> - <td class="DataTD"><b><?=_("Location")?></b></td> - <td class="DataTD"><b><?=_("Method")?></b></td> - <td class="DataTD"><b><?=_("Revoke")?></b></td> - </tr> -<? - $query = "select * from `notary` where `to`='".intval($_GET['userid'])."'"; - $dres = mysql_query($query); - $points = 0; - while($drow = mysql_fetch_assoc($dres)) - { - $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['from'])."'")); - $points += $drow['points']; +//Ticket number ?> - <tr> - <td class="DataTD"><?=$drow['id']?></td> - <td class="DataTD"><?=sanitizeHTML($drow['date'])?></td> - <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['fname'])." ".sanitizeHTML($fromuser['lname'])?></td> - <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td> - <td class="DataTD"><?=intval($drow['points'])?></td> - <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td> - <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td> - <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['to'])?>&assurance=<?=intval($drow['id'])?>&csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$drow['id'])?>');"><?=_("Revoke")?></a></td> - </tr> -<? } ?> - <tr> - <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td> - <td class="DataTD"><?=$points?></td> - <td class="DataTD" colspan="3"> </td> - </tr> -</table> -<? } ?> +<form method="post" action="account.php?id=43&userid=<?=intval($_REQUEST['userid'])?>"> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="2" class="title"><?=_('Ticket handling') ?></td> + </tr> + <tr> + <td class="DataTD"><?=_('Ticket no')?>:</td> + <td class="DataTD"><input type="text" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/></td> + </tr> + <tr> + <td colspan="2" class="DataTDError"><?=$ticketmsg?></td><?php $_SESSION['ticketmsg']='' ?> + </tr> + <tr> + <td colspan="2" ><input type="submit" value="<?=_('Set ticket number') ?>"></td> + </tr> + </table> +</form> +<br/> + + +<!-- display data table --> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="5" class="title"><? printf(_("%s's Account Details"), sanitizeHTML($row['email'])); ?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Email")?>:</td> + <td class="DataTD"><?=sanitizeHTML($row['email'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("First Name")?>:</td> + <td class="DataTD"><form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to modify this DOB and/or last name?")?>')) return false;"> + <input type="hidden" name="csrf" value="<?=make_csrf('admchangepers')?>" /> + <input type="text" name="fname" value="<?=sanitizeHTML($row['fname'])?>"> + </td> + </tr> + <tr> + <td class="DataTD"><?=_("Middle Name")?>:</td> + <td class="DataTD"><input type="text" name="mname" value="<?=sanitizeHTML($row['mname'])?>"></td> + </tr> + <tr> + <td class="DataTD"><?=_("Last Name")?>:</td> + <td class="DataTD"> <input type="hidden" name="oldid" value="43"> + <input type="hidden" name="action" value="updatedob"> + <input type="hidden" name="userid" value="<?=intval($userid)?>"> + <input type="text" name="lname" value="<?=sanitizeHTML($row['lname'])?>"> + </td> + </tr> + <tr> + <td class="DataTD"><?=_("Suffix")?>:</td> + <td class="DataTD"><input type="text" name="suffix" value="<?=sanitizeHTML($row['suffix'])?>"></td> + </tr> + <tr> + <td class="DataTD"><?=_("Date of Birth")?>:</td> + <td class="DataTD"> + <? + $year = intval(substr($row['dob'], 0, 4)); + $month = intval(substr($row['dob'], 5, 2)); + $day = intval(substr($row['dob'], 8, 2)); + ?> + <nobr> + <select name="day"> + <? + for($i = 1; $i <= 31; $i++) { + echo "<option"; + if($day == $i) { + echo " selected='selected'"; + } + echo ">$i</option>"; + } + ?> + </select> + <select name="month"> + <? + for($i = 1; $i <= 12; $i++) { + echo "<option value='$i'"; + if($month == $i) + echo " selected='selected'"; + echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))."</option>"; + } + ?> + </select> + <input type="text" name="year" value="<?=$year?>" size="4"> + <input type="submit" value="Go"> + <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/> + </form> + </nobr> + </td> + </tr> + + <? // list of flags ?> + <tr> + <td class="DataTD"><?=_("CCA accepted")?>:</td> + <td class="DataTD"><a href="account.php?id=57&userid=<?=intval($row['id'])?>"><?=intval(get_user_agreement_status($row['id'], 'CCA')) ? _("Yes") : _("No") ?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Trainings")?>:</td> + <td class="DataTD"><a href="account.php?id=55&userid=<?=intval($row['id'])?>">show</a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Is Assurer")?>:</td> + <td class="DataTD"><a href="account.php?id=43&assurer=<?=intval($row['id'])?>&csrf=<?=make_csrf('admsetassuret')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['assurer'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Blocked Assurer")?>:</td> + <td class="DataTD"><a href="account.php?id=43&assurer_blocked=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['assurer_blocked'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Account Locking")?>:</td> + <td class="DataTD"><a href="account.php?id=43&locked=<?=intval($row['id'])?>&csrf=<?=make_csrf('admactlock')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['locked'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Code Signing")?>:</td> + <td class="DataTD"><a href="account.php?id=43&codesign=<?=intval($row['id'])?>&csrf=<?=make_csrf('admcodesign')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['codesign'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Org Assurer")?>:</td> + <td class="DataTD"><a href="account.php?id=43&orgadmin=<?=intval($row['id'])?>&csrf=<?=make_csrf('admorgadmin')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['orgadmin'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("TTP Admin")?>:</td> + <td class="DataTD"><a href="account.php?id=43&ttpadmin=<?=intval($row['id'])?>&csrf=<?=make_csrf('admttpadmin')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['ttpadmin'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Location Admin")?>:</td> + <td class="DataTD"><a href="account.php?id=43&locadmin=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=$row['locadmin']?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Admin")?>:</td> + <td class="DataTD"><a href="account.php?id=43&admin=<?=intval($row['id'])?>&csrf=<?=make_csrf('admsetadmin')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['admin'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Ad Admin")?>:</td> + <td class="DataTD"><a href="account.php?id=43&adadmin=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['adadmin'])?></a> (0 = none, 1 = submit, 2 = approve)</td> + </tr> + <!-- presently not needed + <tr> + <td class="DataTD"><?=_("Tverify Account")?>:</td> + <td class="DataTD"><a href="account.php?id=43&tverify=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($row['tverify'])?></a></td> + </tr> + --> + <tr> + <td class="DataTD"><?=_("General Announcements")?>:</td> + <td class="DataTD"><a href="account.php?id=43&general=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['general'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Country Announcements")?>:</td> + <td class="DataTD"><a href="account.php?id=43&country=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['country'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Regional Announcements")?>:</td> + <td class="DataTD"><a href="account.php?id=43&regional=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['regional'])?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Within 200km Announcements")?>:</td> + <td class="DataTD"><a href="account.php?id=43&radius=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=intval($alerts['radius'])?></a></td> + </tr> + <? //change password, view secret questions and delete account section ?> + <tr> + <td class="DataTD"><?=_("Change Password")?>:</td> + <td class="DataTD"><a href="account.php?id=44&userid=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Change Password")?></a></td> + </tr> + <tr> + <td class="DataTD"><?=_("Delete Account")?>:</td> + <td class="DataTD"><a href="account.php?id=50&userid=<?=intval($row['id'])?>&csrf=<?=make_csrf('admdelaccount')?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Delete Account")?></a></td> + </tr> + <? + // This is intensionally a $_GET for audit purposes. DO NOT CHANGE!!! + if(array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes" && $ticketvalidation==true) { + if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE view lost password information', $ticketno)) { + ?> + <tr> + <td class="DataTD" colspan="2"><?=_("Writing to the admin log failed. Can't continue.")?></td> + </tr> + <tr> + <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=intval($row['id'])?>&showlostpw=yes&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td> + </tr> + <? + } else { + ?> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - Q1:</td> + <td class="DataTD"><?=sanitizeHTML($row['Q1'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - A1:</td> + <td class="DataTD"><?=sanitizeHTML($row['A1'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - Q2:</td> + <td class="DataTD"><?=sanitizeHTML($row['Q2'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - A2:</td> + <td class="DataTD"><?=sanitizeHTML($row['A2'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - Q3:</td> + <td class="DataTD"><?=sanitizeHTML($row['Q3'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - A3:</td> + <td class="DataTD"><?=sanitizeHTML($row['A3'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - Q4:</td> + <td class="DataTD"><?=sanitizeHTML($row['Q4'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - A4:</td> + <td class="DataTD"><?=sanitizeHTML($row['A4'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - Q5:</td> + <td class="DataTD"><?=sanitizeHTML($row['Q5'])?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Lost Password")?> - A5:</td> + <td class="DataTD"><?=sanitizeHTML($row['A5'])?></td> + </tr> + <? + } + } elseif (array_key_exists('showlostpw',$_GET) && $_GET['showlostpw'] == "yes" && $ticketvalidation==false) { + ?> + <tr> + <td class="DataTD" colspan="2"><?=_('No access granted. Ticket number is missing')?></td> + </tr> + <tr> + <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=intval($row['id'])?>&showlostpw=yes&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td> + </tr> + <? + } else { + ?> + <tr> + <td class="DataTD" colspan="2"><a href="account.php?id=43&userid=<?=intval($row['id'])?>&showlostpw=yes&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Lost Password Details")?></a></td> + </tr> + <? } + + // list assurance points + ?> + <tr> + <td class="DataTD"><?=_("Assurance Points")?>:</td> + <td class="DataTD"><?=intval($drow['points'])?></td> + </tr> + <? + // show account history + ?> + <tr> + <td class="DataTD" colspan="2"><a href="account.php?id=59&oldid=43&userid=<?=intval($row['id'])?>&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_('Show account history')?></a></td> + </tr> + </table> + <br/> + <? + //list secondary email addresses + $dres = get_email_addresses(intval($row['id']),$row['email']); + if(mysql_num_rows($dres) > 0) { + ?> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="5" class="title"><?=_("Alternate Verified Email Addresses")?></td> + </tr> + <? + while($drow = mysql_fetch_assoc($dres)) { + ?> + <tr> + <td class="DataTD"><?=_("Secondary Emails")?>:</td> + <td class="DataTD"><?=sanitizeHTML($drow['email'])?></td> + </tr> + <? + } + ?> + </table> + <br/> + <? + } + + // list of domains + $dres=get_domains(intval($row['id'])); + if(mysql_num_rows($dres) > 0) { + ?> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="5" class="title"><?=_("Verified Domains")?></td> + </tr> + <? + while($drow = mysql_fetch_assoc($dres)) { + ?> + <tr> + <td class="DataTD"><?=_("Domain")?>:</td> + <td class="DataTD"><?=sanitizeHTML($drow['domain'])?></td> + </tr> + <? + } + ?> + </table> + <br/> + <? + } + ?> + <? // Begin - Debug infos ?> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="2" class="title"><?=_("Account State")?></td> + </tr> + + <? + // --- bug-975 begin --- + // potential db inconsistency like in a20110804.1 + // Admin console -> don't list user account + // User login -> impossible + // Assurer, assure someone -> user displayed + /* regular user account search with regular settings + + --- Admin Console find user query + $query = "select `users`.`id` as `id`, `email`.`email` as `email` from `users`,`email` + where `users`.`id`=`email`.`memid` and + (`email`.`email` like '$emailsearch' or `email`.`id`='$email' or `users`.`id`='$email') and + `email`.`hash`='' and `email`.`deleted`=0 and `users`.`deleted`=0 + group by `users`.`id` limit 100"; + => requirements + 1. email.hash = '' + 2. email.deleted = 0 + 3. users.deleted = 0 + 4. email.email = primary-email (???) or'd + not covered by admin console find user routine, but may block users login + 5. users.verified = 0|1 + further "special settings" + 6. users.locked (setting displayed in display form) + 7. users.assurer_blocked (setting displayed in display form) + + --- User login user query + select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or + `password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0 + => requirements + 1. users.verified = 1 + 2. users.deleted = 0 + 3. users.locked = 0 + 4. users.email = primary-email + + --- Assurer, assure someone find user query + select * from `users` where `email`='".mysql_real_escape_string(stripslashes($_POST['email']))."' + and `deleted`=0 + => requirements + 1. users.deleted = 0 + 2. users.email = primary-email + + Admin User Assurer + bit Console Login assure someone + + 1. email.hash = '' Yes No No + 2. email.deleted = 0 Yes No No + 3. users.deleted = 0 Yes Yes Yes + 4. users.verified = 1 No Yes No + 5. users.locked = 0 No Yes No + 6. users.email = prim-email No Yes Yes + 7. email.email = prim-email Yes No No + + full usable account needs all 7 requirements fulfilled + so if one setting isn't set/cleared there is an inconsistency either way + if eg email.email is not avail, admin console cannot open user info + but user can login and assurer can display user info + if user verified is not set to 1, admin console displays user record + but user cannot login, but assurer can search for the user and the data displays + + consistency check: + 1. search primary-email in users.email + 2. search primary-email in email.email + 3. userid = email.memid + 4. check settings from table 1. - 5. + + */ + + $inconsistency = 0; + $inconsistencydisp = ""; + $inccause = ""; + + // current userid intval($row['id']) + $query = "select `email` as `uemail`, `deleted` as `udeleted`, `verified`, `locked` + from `users` where `id`='".intval($row['id'])."' "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $uemail = $drow['uemail']; + $udeleted = $drow['udeleted']; + $uverified = $drow['verified']; + $ulocked = $drow['locked']; + + $query = "select `hash`, `email` as `eemail` from `email` + where `memid`='".intval($row['id'])."' and + `email` ='".$uemail."' and + `deleted` = 0"; + $dres = mysql_query($query); + if ($drow = mysql_fetch_assoc($dres)) { + $drow['edeleted'] = 0; + } else { + // try if there are deleted entries + $query = "select `hash`, `deleted` as `edeleted`, `email` as `eemail` from `email` + where `memid`='".intval($row['id'])."' and + `email` ='".$uemail."'"; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + } + + if ($drow) { + $eemail = $drow['eemail']; + $edeleted = $drow['edeleted']; + $ehash = $drow['hash']; + if ($udeleted!=0) { + $inconsistency += 1; + $inccause .= (empty($inccause)?"":"<br>")._("Users record set to deleted"); + } + if ($uverified!=1) { + $inconsistency += 2; + $inccause .= (empty($inccause)?"":"<br>")._("Users record verified not set"); + } + if ($ulocked!=0) { + $inconsistency += 4; + $inccause .= (empty($inccause)?"":"<br>")._("Users record locked set"); + } + if ($edeleted!=0) { + $inconsistency += 8; + $inccause .= (empty($inccause)?"":"<br>")._("Email record set deleted"); + } + if ($ehash!='') { + $inconsistency += 16; + $inccause .= (empty($inccause)?"":"<br>")._("Email record hash not unset"); + } + } else { + $inconsistency = 32; + $inccause = _("Prim. email, Email record doesn't exist"); + } + if ($inconsistency>0) { + // $inconsistencydisp = _("Yes"); + ?> + <tr> + <td class="DataTD"><?=_("Account inconsistency")?>:</td> + <td class="DataTD"><?=$inccause?><br>code: <?=intval($inconsistency)?></td> + </tr> + <tr> + <td colspan="2" class="DataTD" style="max-width: 75ex;"> + <?=_("Account inconsistency can cause problems in daily account operations and needs to be fixed manually through arbitration/critical team.")?> + </td> + </tr> + <? + } + + // --- bug-975 end --- + ?> + </table> + <br /> + <? + // End - Debug infos + + // certificate overview + ?> + + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="6" class="title"><?=_("Certificates")?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Cert Type")?>:</td> + <td class="DataTD"><?=_("Total")?></td> + <td class="DataTD"><?=_("Valid")?></td> + <td class="DataTD"><?=_("Expired")?></td> + <td class="DataTD"><?=_("Revoked")?></td> + <td class="DataTD"><?=_("Latest Expire")?></td> + </tr> + <!-- server certificates --> + <tr> + <td class="DataTD"><?=_("Server")?>:</td> + <? + $query = " + select COUNT(*) as `total`, + MAX(`domaincerts`.`expire`) as `maxexpire` + from `domains` inner join `domaincerts` + on `domains`.`id` = `domaincerts`.`domid` + where `domains`.`memid` = '".intval($row['id'])."' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $total = $drow['total']; + + $maxexpire = "0000-00-00 00:00:00"; + if ($drow['maxexpire']) { + $maxexpire = $drow['maxexpire']; + } + + if($total > 0) { + $query = " + select COUNT(*) as `valid` + from `domains` inner join `domaincerts` + on `domains`.`id` = `domaincerts`.`domid` + where `domains`.`memid` = '".intval($row['id'])."' + and `revoked` = '0000-00-00 00:00:00' + and `expire` > NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $valid = $drow['valid']; + + $query = " + select COUNT(*) as `expired` + from `domains` inner join `domaincerts` + on `domains`.`id` = `domaincerts`.`domid` + where `domains`.`memid` = '".intval($row['id'])."' + and `expire` <= NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $expired = $drow['expired']; + + $query = " + select COUNT(*) as `revoked` + from `domains` inner join `domaincerts` + on `domains`.`id` = `domaincerts`.`domid` + where `domains`.`memid` = '".intval($row['id'])."' + and `revoked` != '0000-00-00 00:00:00' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $revoked = $drow['revoked']; + ?> + <td class="DataTD"><?=intval($total)?></td> + <td class="DataTD"><?=intval($valid)?></td> + <td class="DataTD"><?=intval($expired)?></td> + <td class="DataTD"><?=intval($revoked)?></td> + <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td> + <? + } else { // $total > 0 + ?> + <td colspan="5" class="DataTD"><?=_("None")?></td> + <? + } + ?> + </tr> + <!-- client certificates --> + <tr> + <td class="DataTD"><?=_("Client")?>:</td> + <? + $query = " + select COUNT(*) as `total`, MAX(`expire`) as `maxexpire` + from `emailcerts` + where `memid` = '".intval($row['id'])."' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $total = $drow['total']; + + $maxexpire = "0000-00-00 00:00:00"; + if ($drow['maxexpire']) { + $maxexpire = $drow['maxexpire']; + } + + if($total > 0) { + $query = " + select COUNT(*) as `valid` + from `emailcerts` + where `memid` = '".intval($row['id'])."' + and `revoked` = '0000-00-00 00:00:00' + and `expire` > NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $valid = $drow['valid']; + + $query = " + select COUNT(*) as `expired` + from `emailcerts` + where `memid` = '".intval($row['id'])."' + and `expire` <= NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $expired = $drow['expired']; + + $query = " + select COUNT(*) as `revoked` + from `emailcerts` + where `memid` = '".intval($row['id'])."' + and `revoked` != '0000-00-00 00:00:00' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $revoked = $drow['revoked']; + ?> + <td class="DataTD"><?=intval($total)?></td> + <td class="DataTD"><?=intval($valid)?></td> + <td class="DataTD"><?=intval($expired)?></td> + <td class="DataTD"><?=intval($revoked)?></td> + <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td> + <? + } else { // $total > 0 + ?> + <td colspan="5" class="DataTD"><?=_("None")?></td> + <? + } + ?> + </tr> + <!-- gpg certificates --> + <tr> + <td class="DataTD"><?=_("GPG")?>:</td> + <? + $query = " + select COUNT(*) as `total`, MAX(`expire`) as `maxexpire` + from `gpg` + where `memid` = '".intval($row['id'])."' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $total = $drow['total']; + + $maxexpire = "0000-00-00 00:00:00"; + if ($drow['maxexpire']) { + $maxexpire = $drow['maxexpire']; + } + + if($total > 0) { + $query = " + select COUNT(*) as `valid` + from `gpg` + where `memid` = '".intval($row['id'])."' + and `expire` > NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $valid = $drow['valid']; + + $query = " + select COUNT(*) as `expired` + from `gpg` + where `memid` = '".intval($row['id'])."' + and `expire` <= NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $expired = $drow['expired']; + ?> + <td class="DataTD"><?=intval($total)?></td> + <td class="DataTD"><?=intval($valid)?></td> + <td class="DataTD"><?=intval($expired)?></td> + <td class="DataTD"></td> + <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td> + <? + } else { // $total > 0 + ?> + <td colspan="5" class="DataTD"><?=_("None")?></td> + <? + } + ?> + </tr> + <!-- org server certificates --> + <tr> + <td class="DataTD"><a href="account.php?id=58&userid=<?=intval($row['id'])?>"><?=_("Org Server")?></a>:</td> + <? + $query = " + select COUNT(*) as `total`, + MAX(`orgcerts`.`expire`) as `maxexpire` + from `orgdomaincerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $total = $drow['total']; + + $maxexpire = "0000-00-00 00:00:00"; + if ($drow['maxexpire']) { + $maxexpire = $drow['maxexpire']; + } + + if($total > 0) { + $query = " + select COUNT(*) as `valid` + from `orgdomaincerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + and `orgcerts`.`revoked` = '0000-00-00 00:00:00' + and `orgcerts`.`expire` > NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $valid = $drow['valid']; + + $query = " + select COUNT(*) as `expired` + from `orgdomaincerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + and `orgcerts`.`expire` <= NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $expired = $drow['expired']; + + $query = " + select COUNT(*) as `revoked` + from `orgdomaincerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + and `orgcerts`.`revoked` != '0000-00-00 00:00:00' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $revoked = $drow['revoked']; + ?> + <td class="DataTD"><?=intval($total)?></td> + <td class="DataTD"><?=intval($valid)?></td> + <td class="DataTD"><?=intval($expired)?></td> + <td class="DataTD"><?=intval($revoked)?></td> + <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td> + <? + } else { // $total > 0 + ?> + <td colspan="5" class="DataTD"><?=_("None")?></td> + <? + } + ?> + </tr> + <!-- org client certificates --> + <tr> + <td class="DataTD"><?=_("Org Client")?>:</td> + <? + $query = " + select COUNT(*) as `total`, + MAX(`orgcerts`.`expire`) as `maxexpire` + from `orgemailcerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $total = $drow['total']; + + $maxexpire = "0000-00-00 00:00:00"; + if ($drow['maxexpire']) { + $maxexpire = $drow['maxexpire']; + } + + if($total > 0) { + $query = " + select COUNT(*) as `valid` + from `orgemailcerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + and `orgcerts`.`revoked` = '0000-00-00 00:00:00' + and `orgcerts`.`expire` > NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $valid = $drow['valid']; + + $query = " + select COUNT(*) as `expired` + from `orgemailcerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + and `orgcerts`.`expire` <= NOW() + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $expired = $drow['expired']; + + $query = " + select COUNT(*) as `revoked` + from `orgemailcerts` as `orgcerts` inner join `org` + on `orgcerts`.`orgid` = `org`.`orgid` + where `org`.`memid` = '".intval($row['id'])."' + and `orgcerts`.`revoked` != '0000-00-00 00:00:00' + "; + $dres = mysql_query($query); + $drow = mysql_fetch_assoc($dres); + $revoked = $drow['revoked']; + ?> + <td class="DataTD"><?=intval($total)?></td> + <td class="DataTD"><?=intval($valid)?></td> + <td class="DataTD"><?=intval($expired)?></td> + <td class="DataTD"><?=intval($revoked)?></td> + <td class="DataTD"><?=($maxexpire != "0000-00-00 00:00:00")?substr($maxexpire, 0, 10) : _("Pending")?></td> + <? + } else { // $total > 0 + ?> + <td colspan="5" class="DataTD"><?=_("None")?></td> + <? + } + ?> + </tr> + <tr> + <td colspan="6" class="title"> + <form method="post" action="account.php" onSubmit="if(!confirm('<?=_("Are you sure you want to revoke all private certificates?")?>')) return false;"> + <input type="hidden" name="action" value="revokecert"> + <input type="hidden" name="oldid" value="43"> + <input type="hidden" name="userid" value="<?=intval($userid)?>"> + <input type="submit" value="<?=_('revoke certificates')?>"> + <input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/> + </form> + </td> + </tr> + </table> + <br /> + <? // list assurances ?> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td class="DataTD"> + <a href="account.php?id=43&userid=<?=intval($row['id'])?>&shownotary=assuredto&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user got")?></a> + (<a href="account.php?id=43&userid=<?=intval($row['id'])?>&shownotary=assuredto15&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>) + </td> + </tr> + <tr> + <td class="DataTD"> + <a href="account.php?id=43&userid=<?=intval($row['id'])?>&shownotary=assuredby&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("Show Assurances the user gave")?></a> + (<a href="account.php?id=43&userid=<?=intval($row['id'])?>&shownotary=assuredby15&ticketno=<?=sanitizeHTML($ticketno)?>"><?=_("New calculation")?></a>) + </td> + </tr> + </table> + <? + // if(array_key_exists('assuredto',$_GET) && $_GET['assuredto'] == "yes") { + + + function showassuredto($ticketno) + { + ?> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="8" class="title"><?=_("Assurance Points")?></td> + </tr> + <tr> + <td class="DataTD"><b><?=_("ID")?></b></td> + <td class="DataTD"><b><?=_("Date")?></b></td> + <td class="DataTD"><b><?=_("Who")?></b></td> + <td class="DataTD"><b><?=_("Email")?></b></td> + <td class="DataTD"><b><?=_("Points")?></b></td> + <td class="DataTD"><b><?=_("Location")?></b></td> + <td class="DataTD"><b><?=_("Method")?></b></td> + <td class="DataTD"><b><?=_("Revoke")?></b></td> + </tr> + <? + $query = "select * from `notary` where `to`='".intval($_GET['userid'])."' and `deleted` = 0"; + $dres = mysql_query($query); + $points = 0; + while($drow = mysql_fetch_assoc($dres)) { + $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['from'])."'")); + $points += $drow['points']; + ?> + <tr> + <td class="DataTD"><?=$drow['id']?></td> + <td class="DataTD"><?=sanitizeHTML($drow['date'])?></td> + <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['fname'])." ".sanitizeHTML($fromuser['lname'])?></td> + <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['from'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td> + <td class="DataTD"><?=intval($drow['points'])?></td> + <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td> + <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td> + <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['to'])?>&assurance=<?=intval($drow['id'])?>&csrf=<?=make_csrf('admdelassurance')?>&ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),intval($drow['id']))?>');"><?=_("Revoke")?></a></td> + </tr> + <? + } + ?> + <tr> + <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td> + <td class="DataTD"><?=intval($points)?></td> + <td class="DataTD" colspan="3"> </td> + </tr> + </table> + <? + } + + function showassuredby($ticketno) + { + ?> + <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="8" class="title"><?=_("Assurance Points The User Issued")?></td> + </tr> + <tr> + <td class="DataTD"><b><?=_("ID")?></b></td> + <td class="DataTD"><b><?=_("Date")?></b></td> + <td class="DataTD"><b><?=_("Who")?></b></td> + <td class="DataTD"><b><?=_("Email")?></b></td> + <td class="DataTD"><b><?=_("Points")?></b></td> + <td class="DataTD"><b><?=_("Location")?></b></td> + <td class="DataTD"><b><?=_("Method")?></b></td> + <td class="DataTD"><b><?=_("Revoke")?></b></td> + </tr> + <? + $query = "select * from `notary` where `from`='".intval($_GET['userid'])."' and `deleted` = 0"; + $dres = mysql_query($query); + $points = 0; + while($drow = mysql_fetch_assoc($dres)) { + $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($drow['to'])."'")); + $points += intval($drow['points']); + ?> + <tr> + <td class="DataTD"><?=intval($drow['id'])?></td> + <td class="DataTD"><?=$drow['date']?></td> + <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['fname']." ".$fromuser['lname'])?></td> + <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td> + <td class="DataTD"><?=intval($drow['points'])?></td> + <td class="DataTD"><?=sanitizeHTML($drow['location'])?></td> + <td class="DataTD"><?=sanitizeHTML($drow['method'])?></td> + <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['from'])?>&assurance=<?=intval($drow['id'])?>&csrf=<?=make_csrf('admdelassurance')?>&ticketno=<?=sanitizeHTML($ticketno)?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),intval($drow['id']))?>');"><?=_("Revoke")?></a></td> + </tr> + <? + } + ?> + <tr> + <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td> + <td class="DataTD"><?=intval($points)?></td> + <td class="DataTD" colspan="3"> </td> + </tr> + </table> + <?} ?> +<br/><br/> <? -function showassuredby() -{ -?> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="8" class="title"><?=_("Assurance Points The User Issued")?></td> - </tr> - <tr> - <td class="DataTD"><b><?=_("ID")?></b></td> - <td class="DataTD"><b><?=_("Date")?></b></td> - <td class="DataTD"><b><?=_("Who")?></b></td> - <td class="DataTD"><b><?=_("Email")?></b></td> - <td class="DataTD"><b><?=_("Points")?></b></td> - <td class="DataTD"><b><?=_("Location")?></b></td> - <td class="DataTD"><b><?=_("Method")?></b></td> - <td class="DataTD"><b><?=_("Revoke")?></b></td> - </tr> -<? - $query = "select * from `notary` where `from`='".intval($_GET['userid'])."'"; - $dres = mysql_query($query); - $points = 0; - while($drow = mysql_fetch_assoc($dres)) - { - $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$drow['to']."'")); - $points += $drow['points']; -?> - <tr> - <td class="DataTD"><?=$drow['id']?></td> - <td class="DataTD"><?=$drow['date']?></td> - <td class="DataTD"><a href="wot.php?id=9&userid=<?=$drow['to']?>"><?=$fromuser['fname']." ".$fromuser['lname']?></td> - <td class="DataTD"><a href="account.php?id=43&userid=<?=intval($drow['to'])?>"><?=sanitizeHTML($fromuser['email'])?></a></td> - <td class="DataTD"><?=$drow['points']?></td> - <td class="DataTD"><?=$drow['location']?></td> - <td class="DataTD"><?=$drow['method']?></td> - <td class="DataTD"><a href="account.php?id=43&userid=<?=$drow['from']?>&assurance=<?=$drow['id']?>&csrf=<?=make_csrf('admdelassurance')?>" onclick="return confirm('<?=sprintf(_("Are you sure you want to revoke the assurance with ID "%s"?"),$drow['id'])?>');"><?=_("Revoke")?></a></td> - </tr> -<? } ?> - <tr> - <td class="DataTD" colspan="4"><b><?=_("Total Points")?>:</b></td> - <td class="DataTD"><?=$points?></td> - <td class="DataTD" colspan="3"> </td> - </tr> -</table> -<? } ?> -<br><br> -<? } } +} } if(isset($_GET['shownotary'])) { switch($_GET['shownotary']) { case 'assuredto': - showassuredto(); + showassuredto($ticketno); break; case 'assuredby': - showassuredby(); + showassuredby($ticketno); break; case 'assuredto15': - output_received_assurances(intval($_GET['userid']),1); + output_received_assurances(intval($_GET['userid']),1,$ticketno); break; case 'assuredby15': - output_given_assurances(intval($_GET['userid']),1); + output_given_assurances(intval($_GET['userid']),1, $ticketno); break; } } diff --git a/pages/account/44.php b/pages/account/44.php index fd34612..718f0e0 100644 --- a/pages/account/44.php +++ b/pages/account/44.php @@ -14,8 +14,28 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ ?> -<? if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") { ?><div color="orange">ERROR: <?=$_SESSION['_config']['error']?></div><? unset($_SESSION['_config']['error']); } ?> +*/ + +if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") { + ?> + <div style="color: orange;">ERROR: <?=$_SESSION['_config']['error']?></div> + <? + unset($_SESSION['_config']['error']); +} + +$ticketno = ""; +if (array_key_exists('ticketno', $_SESSION)) { + $ticketno = $_SESSION['ticketno']; +} + +if (!valid_ticket_number($ticketno)) { + printf(_("I'm sorry, you did not enter a ticket number! %s You cannot reset the password."), '<br/>'); + echo '<br/><a href="account.php?id=43&userid='.intval($_REQUEST['userid']).'">'._('Back to previous page.').'</a>'; + showfooter(); + exit; + } +?> + <form method="post" action="account.php"> <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> <tr> @@ -34,5 +54,6 @@ </tr> </table> <input type="hidden" name="userid" value="<?=intval($_REQUEST['userid'])?>"> -<input type="hidden" name="oldid" value="<?=$id?>"> +<input type="hidden" name="oldid" value="<?=intval($id)?>"> +<input type="hidden" name="ticketno" value="<?=sanitizeHTML($ticketno)?>"/> </form> diff --git a/pages/account/5.php b/pages/account/5.php index 934ca0c..efed0ab 100644 --- a/pages/account/5.php +++ b/pages/account/5.php @@ -19,7 +19,7 @@ <form method="post" action="account.php"> <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> <tr> - <td colspan="10" class="title"><?=_("Client Certificates")?> - <a href="account.php?id=5&viewall=<?=!$viewall?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td> + <td colspan="10" class="title"><?=_("Client Certificates")?> - <a href="account.php?id=5&viewall=<?=intval(!$viewall)?>"><?=$viewall?_("Hide old certificates"):_("View all certificates")?></a></td> </tr> <tr> <td class="DataTD"><?=_("Renew/Revoke/Delete")?></td> @@ -34,23 +34,24 @@ $query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`, UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`, UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`, - `emailcerts`.`expire` as `expires`, + `emailcerts`.`expire`, `emailcerts`.`revoked` as `revoke`, UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`, + if (`emailcerts`.`expire`=0,CURRENT_TIMESTAMP(),`emailcerts`.`modified`) as `modified` , `emailcerts`.`id`, `emailcerts`.`CN`, `emailcerts`.`serial`, `emailcerts`.`disablelogin` as `disablelogin`, `emailcerts`.`description` from `emailcerts` - where `emailcerts`.`memid`='".$_SESSION['profile']['id']."' + where `emailcerts`.`memid`='".intval($_SESSION['profile']['id'])."' "; if($viewall != 1) $query .= " AND `revoked`=0 AND `renewed`=0 "; $query .= " GROUP BY `emailcerts`.`id` "; if($viewall != 1) - $query .= " HAVING `timeleft` > 0 "; - $query .= " ORDER BY `emailcerts`.`modified` desc"; + $query .= " HAVING `timeleft` > 0 or `expire` = 0 "; + $query .= " ORDER BY `modified` desc"; // echo $query."<br>\n"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) @@ -75,32 +76,32 @@ ?> <tr> <? if($verified != _("Pending") && $verified != _("Revoked")) { ?> - <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=$row['id']?>"></td> + <td class="DataTD"><input type="checkbox" name="revokeid[]" value="<?=intval($row['id'])?>"></td> <td class="DataTD"><?=$verified?></td> - <td class="DataTD"><a href="account.php?id=6&cert=<?=$row['id']?>"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></a></td> + <td class="DataTD"><a href="account.php?id=6&cert=<?=intval($row['id'])?>"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></a></td> <? } else if($verified != _("Revoked")) { ?> - <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=$row['id']?>"></td> + <td class="DataTD"><input type="checkbox" name="delid[]" value="<?=intval($row['id'])?>"></td> <td class="DataTD"><?=$verified?></td> - <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td> + <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td> <? } else { ?> <td class="DataTD"> </td> <td class="DataTD"><?=$verified?></td> - <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td> + <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td> <? } ?> - <td class="DataTD"><?=$row['serial']?></td> - <td class="DataTD"><?=$row['revoke']?></td> - <td class="DataTD"><?=$row['expires']?></td> + <td class="DataTD"><?=sanitizeHTML($row['serial'])?></td> + <td class="DataTD"><?=sanitizeHTML($row['revoke'])?></td> + <td class="DataTD"><?=sanitizeHTML($row['expire'])?></td> <td class="DataTD"> - <input type="checkbox" name="disablelogin_<?=$row['id']?>" value="1" <?=$row['disablelogin']?"":'checked="checked"'?>/> - <input type="hidden" name="cert_<?=$row['id']?>" value="1" /> + <input type="checkbox" name="disablelogin_<?=intval($row['id'])?>" value="1" <?=$row['disablelogin']?"":'checked="checked"'?>/> + <input type="hidden" name="cert_<?=intval($row['id'])?>" value="1" /> </td> - <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td> - <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td> + <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td> + <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td> </tr> <? } ?> <tr> <td class="DataTD" colspan="9"> - <a href="account.php?id=5&viewall=<?=!$viewall?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a> + <a href="account.php?id=5&viewall=<?=intval(!$viewall)?>"><b><?=$viewall?_("Hide old certificates"):_("View all certificates")?></b></a> </td> </tr> @@ -119,7 +120,7 @@ </tr> <? } ?> </table> -<input type="hidden" name="oldid" value="<?=$id?>" /> +<input type="hidden" name="oldid" value="<?=intval($id)?>" /> <input type="hidden" name="csrf" value="<?=make_csrf('clicerchange')?>" /> </form> <p><?=_("From here you can delete pending requests, or revoke valid certificates.")?></p> diff --git a/pages/account/52.php b/pages/account/52.php index 77a3bae..6c00c26 100644 --- a/pages/account/52.php +++ b/pages/account/52.php @@ -14,45 +14,51 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ ?> -<? if($_SESSION['profile']['tverify'] <= 0) { echo _("You don't have access to this area."); } else { ?> -<? +*/ + +if($_SESSION['profile']['tverify'] <= 0) { + echo _("You don't have access to this area."); +} else { $uid = intval($_GET['uid']); - $query = "select * from `tverify` where `id`='$uid' and `modified`=0"; + $query = "select * from `tverify` where `id`='".intval($uid)."' and `modified`=0"; $res = mysql_query($query); - if(mysql_num_rows($res) > 0) - { + if(mysql_num_rows($res) > 0) { $row = mysql_fetch_assoc($res); $memid = intval($row['memid']); - $query2 = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".intval($_SESSION['profile']['id'])."'"; - $rc2 = mysql_num_rows(mysql_query($query2)); - if($rc2 > 0) - { + $query2 = "select * from `tverify-vote` where `tverify`='".intval($uid)."' and `memid`='".intval($_SESSION['profile']['id'])."'"; + $rc2 = mysql_num_rows(mysql_query($query2)); + if($rc2 > 0) { showheader(_("My CAcert.org Account!")); echo _("You have already voted on this request."); showfooter(); exit; } - $query = "select sum(`points`) as `points` from `notary` where `to`='$memid'"; + $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `deleted` = 0"; $notary = mysql_fetch_assoc(mysql_query($query)); - $query = "select * from `users` where `id`='$memid'"; + $query = "select * from `users` where `id`='".intval($memid)."'"; $user = mysql_fetch_assoc(mysql_query($query)); $tobe = 50 - $notary['points']; - if($row['URL'] != '' && $row['photoid'] != '') + if($row['URL'] != '' && $row['photoid'] != '') { $tobe = 150 - $notary['points']; - else if($row['URL'] != '') + } else if($row['URL'] != '') { $tobe = 90 - $notary['points']; - if(intval($tobe) <= 0) + } + if(intval($tobe) <= 0) { $tobe = 0; + } ?> <?=_("Request Details")?>:<br> -<?=_("Name on file")?>: <?=$user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix']?><br> -<?=_("Primary email address")?>: <?=$user['email']." (".$user['id'].")"?><br> -<?=_("Certificate Subject")?>: <?=$row['CN']?><br> -<? if($row['URL'] != '') { ?><?=_("Notary URL")?>: <a href="<?=$row['URL']?>"><?=$row['URL']?></a><br><? } ?> -<? if($row['photoid'] != '') { ?><?=_("Photo ID URL")?>: <a href="/account.php?id=51&photoid=<?=intval($row['id'])?>"><?=_("Here")?></a><br><? } ?> +<?=_("Name on file")?>: <?=sanitizeHTML($user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix'])?><br> +<?=_("Primary email address")?>: <?=sanitizeHTML($user['email'])." (".intval($user['id']).")"?><br> +<?=_("Certificate Subject")?>: <?=sanitizeHTML($row['CN'])?><br> +<? if($row['URL'] != '') { ?> +<?=_("Notary URL")?>: <a href="<?=$row['URL']?>"><?=$row['URL']?></a><br> +<? } ?> +<? if($row['photoid'] != '') { ?> +<?=_("Photo ID URL")?>: <a href="/account.php?id=51&photoid=<?=intval($row['id'])?>"><?=_("Here")?></a><br> +<? } ?> <?=_("Current Points")?>: <?=intval($notary['points'])?><br> <?=_("Potential Points")?>: <?=intval($tobe)?><br> <?=_("Date of Birth")?>: <?=$user['dob']?> (YYYY-MM-DD)<br> @@ -63,40 +69,37 @@ <input type="submit" name="agree" value="<?=_("I agree with this Application")?>"> <input type="submit" name="disagree" value="<?=_("I don't agree with this Application")?>"> <input type="hidden" name="oldid" value="<?=intval($_GET['id'])?>"> -<input type="hidden" name="uid" value="<?=$uid?>"> +<input type="hidden" name="uid" value="<?=intval($uid)?>"> </form> -<? } else { - $query = "select * from `tverify` where `id`='$uid' and `modified`=1"; - $res = mysql_query($query); - if(mysql_num_rows($res) > 0) - { - echo _("This UID has already been voted on.")."<br/>"; +<? } else { - if($uid) echo _("Unable to locate a valid request for that UID.")."<br/>"; - } - - // Search for open requests: - $query = "select * from `tverify` where `modified`=0"; - $res = mysql_query($query); - if(mysql_num_rows($res) > 0) - { - echo "<br/>"._("The following requests are still open:")."<br/><ul>"; - while($row = mysql_fetch_assoc($res)) - { - $uid=intval($row['id']); - $query3 = "select * from `tverify-vote` where `tverify`='$uid' and `memid`='".intval($_SESSION['profile']['id'])."'"; - $rc3 = mysql_num_rows(mysql_query($query3)); - if($rc3 <= 0) - { - echo "<li><a href='account.php?id=52&uid=".intval($row['id'])."'>".intval($row['id'])."</a></li>\n"; + $query = "select * from `tverify` where `id`='".intval($uid)."' and `modified`=1"; + $res = mysql_query($query); + if(mysql_num_rows($res) > 0) { + echo _("This UID has already been voted on.")."<br/>"; + } else { + if($uid) echo _("Unable to locate a valid request for that UID.")."<br/>"; + } + + // Search for open requests: + $query = "select * from `tverify` where `modified`=0"; + $res = mysql_query($query); + if(mysql_num_rows($res) > 0) { + echo "<br/>"._("The following requests are still open:")."<br/><ul>"; + while($row = mysql_fetch_assoc($res)) { + $uid=intval($row['id']); + $query3 = "select * from `tverify-vote` where `tverify`='".intval($uid)."' and `memid`='".intval($_SESSION['profile']['id'])."'"; + $rc3 = mysql_num_rows(mysql_query($query3)); + if($rc3 <= 0) + { + echo "<li><a href='account.php?id=52&uid=".intval($row['id'])."'>".intval($row['id'])."</a></li>\n"; + } } - } - echo "</ul>\n<br>\n"; - } - else - { - echo "<br/>"._("There are no pending requests where you haven't voted yet."); + echo "</ul>\n<br>\n"; + } else { + echo "<br/>"._("There are no pending requests where you haven't voted yet."); + } } +} - - } } ?> +?> diff --git a/pages/account/55.php b/pages/account/55.php index ec401a0..24cc86d 100644 --- a/pages/account/55.php +++ b/pages/account/55.php @@ -1,112 +1,122 @@ -<? /*
- LibreSSL - CAcert web application
- Copyright (C) 2004-2008 CAcert Inc.
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; version 2 of the License.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?
- if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST) || intval($_REQUEST['userid']) < 1) {
- $user_id = intval($_SESSION['profile']['id']);
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Your passed Tests")?></td>
- </tr>
- <tr>
- <td class="DataTD"><?=_("The list of tests you did pass at").' <a href="https://cats.cacert.org/">https://cats.cacert.org/</a>'?></td>
- </tr>
-</table>
-<?
- } else {
- $user_id = intval($_REQUEST['userid']);
- $query = "select * from `users` where `id`='$user_id' and `users`.`deleted`=0";
- $res = mysql_query($query);
- if(mysql_num_rows($res) <= 0)
- {
- echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!");
- } else {
- $row = mysql_fetch_assoc($res);
- }
-?>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="5" class="title"><?=_("Passed Tests of")." ".sanitizeHTML($row['fname'])." ".sanitizeHTML($row['mname'])." ".sanitizeHTML($row['lname'])?></td>
- </tr>
-</table>
-
-<?
- }
-?>
-<br>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td class="DataTD"><b><?=_("Date")?></b></td>
- <td class="DataTD"><b><?=_("Test")?></b></td>
- <td class="DataTD"><b><?=_("Variant")?></b></td>
- </tr>
-<?
- $query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ".
- " FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ".
- " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".(int)$user_id."'".
- " ORDER BY `CP`.`pass_date`";
-
- $res = mysql_query($query);
-
- $HaveTest=0;
- while($row = mysql_fetch_array($res, MYSQL_NUM))
- {
- if ($row[1] == "Assurer Challenge") {
- $HaveTest=1;
- }
-?>
- <tr>
- <td class="DataTD"><?=$row[0]?></td>
- <td class="DataTD"><?=$row[1]?></td>
- <td class="DataTD"><?=$row[2]?></td>
- </tr>
-<? }
-?>
-</table>
-<br>
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
-<?
- if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) {
-?>
- <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&userid=<?=$user_id ?>">back</a></td></tr>
-<? } else {
- $query = 'SELECT `u`.id, `u`.`assurer`, SUM(`points`) FROM `users` AS `u`, `notary` AS `n` '.
- ' WHERE `u`.`id` = \''.(int)intval($_SESSION['profile']['id']).'\' AND `n`.`to` = `u`.`id` AND `expire` < now() '.
- ' GROUP BY `u`.id, `u`.`assurer`';
- $res = mysql_query($query);
- if (!$res) {
- print '<td colspan="3" class="DataTD">'._('Internal Error').'</td>'."\n";
- } else {
- $row = mysql_fetch_array($res, MYSQL_NUM);
- if ($HaveTest && ($row[2]>=100)) {
- if (!$row[1]) {
- // This should not happen...
- fix_assurer_flag($_SESSION['profile']['id']);
- }
-?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge and collected at least 100 Assurance Points, you are an Assurer.")?></td>
-<? } elseif (($row[2]>=100) && !$HaveTest) {
-?> <td colspan="3" class="DataTD"><?=_("You have at least 100 Assurance Points, if you want to become an assurer try the ").'<a href="https://cats.cacert.org">'._("Assurer Challenge").'</a>!'?></td>
-<? } elseif ($HaveTest && ($row[2]<100)) {
-?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge, but to become an Assurer you still have to reach 100 Assurance Points!")?></td>
-<? }
- }
- }
-?> </tr>
-</table>
-
+<? /* + LibreSSL - CAcert web application + Copyright (C) 2004-2008 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ ?> +<? + if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST) || intval($_REQUEST['userid']) < 1) { + $user_id = intval($_SESSION['profile']['id']); +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="5" class="title"><?=_("Your passed Tests")?></td> + </tr> + <tr> + <td class="DataTD"><?=_("The list of tests you did pass at").' <a href="https://cats.cacert.org/">https://cats.cacert.org/</a>'?></td> + </tr> +</table> +<? + } else { + $user_id = intval($_REQUEST['userid']); + $query = "select * from `users` where `id`='$user_id' and `users`.`deleted`=0"; + $res = mysql_query($query); + if(mysql_num_rows($res) <= 0) + { + echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!"); + } else { + $row = mysql_fetch_assoc($res); + } +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="5" class="title"><?=_("Passed Tests of")." ".sanitizeHTML($row['fname'])." ".sanitizeHTML($row['mname'])." ".sanitizeHTML($row['lname'])?></td> + </tr> +</table> + +<? + } +?> +<br> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td class="DataTD"><b><?=_("Date")?></b></td> + <td class="DataTD"><b><?=_("Test")?></b></td> + <td class="DataTD"><b><?=_("Variant")?></b></td> + </tr> +<? + $query = "SELECT `CP`.`pass_date`, `CT`.`type_text`, `CV`.`test_text` ". + " FROM `cats_passed` AS CP, `cats_variant` AS CV, `cats_type` AS CT ". + " WHERE `CP`.`variant_id`=`CV`.`id` AND `CV`.`type_id`=`CT`.`id` AND `CP`.`user_id` ='".intval($user_id)."'". + " ORDER BY `CP`.`pass_date`"; + + $res = mysql_query($query); + + $HaveTest=0; + while($row = mysql_fetch_array($res, MYSQL_NUM)) + { + if ($row[1] == "Assurer Challenge") { + $HaveTest=1; + } +?> + <tr> + <td class="DataTD"><?=sanitizeHTML($row[0])?></td> + <td class="DataTD"><?=sanitizeHTML($row[1])?></td> + <td class="DataTD"><?=sanitizeHTML($row[2])?></td> + </tr> +<? } +?> +</table> +<br> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> +<? + if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) { +?> + <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&userid=<?=intval($user_id)?>">back</a></td></tr> +<? + } else { + $query = ' + SELECT `u`.`id`, + `u`.`assurer`, + SUM(`points`) + FROM `users` AS `u`, + `notary` AS `n` + WHERE `u`.`id` = \''.intval($_SESSION['profile']['id']).'\' + AND `n`.`to` = `u`.`id` + AND `expire` < NOW() + AND `n`.`deleted` = 0 + GROUP BY `u`.`id`, `u`.`assurer` + '; + $res = mysql_query($query); + if (!$res) { + print '<td colspan="3" class="DataTD">'._('Internal Error').'</td>'."\n"; + } else { + $row = mysql_fetch_array($res, MYSQL_NUM); + if ($HaveTest && ($row[2]>=100)) { + if (!$row[1]) { + // This should not happen... + fix_assurer_flag($_SESSION['profile']['id']); + } +?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge and collected at least 100 Assurance Points, you are an Assurer.")?></td> +<? } elseif (($row[2]>=100) && !$HaveTest) { +?> <td colspan="3" class="DataTD"><?=_("You have at least 100 Assurance Points, if you want to become an assurer try the ").'<a href="https://cats.cacert.org">'._("Assurer Challenge").'</a>!'?></td> +<? } elseif ($HaveTest && ($row[2]<100)) { +?> <td colspan="3" class="DataTD"><?=_("You have passed the Assurer Challenge, but to become an Assurer you still have to reach 100 Assurance Points!")?></td> +<? } + } + } +?> </tr> +</table> + diff --git a/pages/account/56.php b/pages/account/56.php index 348cc49..cabe8e0 100644 --- a/pages/account/56.php +++ b/pages/account/56.php @@ -1,41 +1,41 @@ -<? /*
-LibreSSL - CAcert web application
-Copyright (C) 2004-2008 CAcert Inc.
-
-This program is free software; you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation; version 2 of the License.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
-Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-*/ ?>
-<?=_("List of Organisation Assurers:")?>
-
-<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper">
- <tr>
- <td colspan="1" class="title"><?=_("Name")?></td>
- <td colspan="1" class="title"><?=_("Email")?></td>
- <td colspan="1" class="title"><?=_("Country")?></td>
- </tr>
- <?
- $query = "select users.fname,users.lname,users.email, countries.name from users left join countries on users.ccid=countries.id where orgadmin=1;";
- $res = mysql_query($query);
- while($row = mysql_fetch_assoc($res))
- {
- ?>
- <tr>
- <td><?=sanitizeHTML($row['fname'])." ".sanitizeHTML($row['lname'])?></td>
- <td><a href="mailto:<?=sanitizeHTML($row['email'])?>"><?=sanitizeHTML($row['email'])?></a></td>
- <td><?=sanitizeHTML($row['name'])?></td>
- </tr>
- <?
- }
-?>
-</table>
-
+<? /* +LibreSSL - CAcert web application +Copyright (C) 2004-2008 CAcert Inc. + +This program is free software; you can redistribute it and/or modify +it under the terms of the GNU General Public License as published by +the Free Software Foundation; version 2 of the License. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU General Public License for more details. + +You should have received a copy of the GNU General Public License +along with this program; if not, write to the Free Software +Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ ?> +<?=_("List of Organisation Assurers:")?> + +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="1" class="title"><?=_("Name")?></td> + <td colspan="1" class="title"><?=_("Email")?></td> + <td colspan="1" class="title"><?=_("Country")?></td> + </tr> + <? + $query = "select users.fname,users.lname,users.email, countries.name from users left join countries on users.ccid=countries.id where orgadmin=1;"; + $res = mysql_query($query); + while($row = mysql_fetch_assoc($res)) + { + ?> + <tr> + <td><?=sanitizeHTML($row['fname'])." ".sanitizeHTML($row['lname'])?></td> + <td><a href="mailto:<?=sanitizeHTML($row['email'])?>"><?=sanitizeHTML($row['email'])?></a></td> + <td><?=sanitizeHTML($row['name'])?></td> + </tr> + <? + } +?> +</table> + diff --git a/pages/account/57.php b/pages/account/57.php index 0356eeb..9db7ccf 100644 --- a/pages/account/57.php +++ b/pages/account/57.php @@ -28,7 +28,7 @@ $res = mysql_query($query); if(mysql_num_rows($res) <= 0) { - echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!"); + echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!"); } else { $row = mysql_fetch_assoc($res); ?> @@ -48,12 +48,12 @@ <td class="DataTD"><b><?=_('Type')?></b></td> </tr> <? - $data=get_first_user_agreement($user_id,1); + $data=get_first_user_agreement($user_id, 'CCA', 1); if (!isset($data['active'])){ $type=''; - }else{ + }else{ $type=_('active'); - } + } ?> <tr> <td class="DataTD"><?=_('First active CCA')?></td> @@ -62,7 +62,7 @@ <td class="DataTD"><?=$type?></td> </tr> <? - $data=get_first_user_agreement($user_id,0); + $data=get_first_user_agreement($user_id, 'CCA', 0); if (!isset($data['active'])){ $type=""; }else{ @@ -76,14 +76,14 @@ <td class="DataTD"><?=$type?></td> </tr> <? - $data=get_last_user_agreement($user_id); + $data=get_last_user_agreement($user_id, 'CCA'); if (!isset($data['active'])){ - $type=""; - }elseif($data['active']==1){ - $type=_('active'); - }else{ - $type=_('passive'); - } + $type=""; + }elseif($data['active']==1){ + $type=_('active'); + }else{ + $type=_('passive'); + } ?> <tr> <td class="DataTD"><?=_('Last CCA')?></td> @@ -98,7 +98,7 @@ <? if ($_SESSION['profile']['admin'] == 1 && array_key_exists('userid',$_REQUEST) && intval($_REQUEST['userid']) > 0) { ?> - <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&userid=<?=$user_id ?>">back</a></td></tr> + <tr><td colspan="3" class="DataTD"><a href="account.php?id=43&userid=<?=intval($user_id)?>">back</a></td></tr> <? } ?> </table> <? diff --git a/pages/account/58.php b/pages/account/58.php index 1f6b1a0..af26b70 100644 --- a/pages/account/58.php +++ b/pages/account/58.php @@ -23,7 +23,7 @@ if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST) $query = "select `users`.`fname`, `users`.`mname`, `users`.`lname` from `users` where `id`='$user_id' and `users`.`deleted`=0"; $res = mysql_query($query); if(mysql_num_rows($res) != 1){ - echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!"); + echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!"); } else { if ($row = mysql_fetch_assoc($res)){ $username=sanitizeHTML($row['fname']).' '.sanitizeHTML($row['mname']).' '.sanitizeHTML($row['lname']); @@ -54,7 +54,7 @@ if ($_SESSION['profile']['admin'] != 1 || !array_key_exists('userid',$_REQUEST) } ?></table> <? }else{ - echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are a foot!"); + echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!"); } } } diff --git a/pages/account/59.php b/pages/account/59.php new file mode 100644 index 0000000..1c73ae5 --- /dev/null +++ b/pages/account/59.php @@ -0,0 +1,385 @@ +<?/* + LibreSSL - CAcert web application + Copyright (C) 2004-2008 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ +include_once($_SESSION['_config']['filepath']."/includes/notary.inc.php"); + + +$userid = intval($_REQUEST['userid']); + +$res = get_user_data($userid); +if (mysql_num_rows($res) <= 0) +{ + echo _("I'm sorry, the user you were looking for seems to have disappeared! Bad things are afoot!"); + exit; +} + +$user = mysql_fetch_assoc($res); + +$fname = $user['fname']; +$mname = $user['mname']; +$lname = $user['lname']; +$suffix = $user['suffix']; +$dob = $user['dob']; +$username = $fname." ".$mname." ".$lname." ".$suffix; +$email = $user['email']; +$alerts =get_alerts($userid); + +$ticketno = ""; +if (array_key_exists('ticketno', $_SESSION)) { + $ticketno = $_SESSION['ticketno']; +} + +$oldid = 0; +if (array_key_exists('oldid', $_REQUEST)) { + $oldid = intval($_REQUEST['oldid']); +} + +// Support Engineer access restrictions +$support=0; +if ($userid != $_SESSION['profile']['id']) { + // Check if support engineer + if (array_key_exists('admin', $_SESSION['profile']) && + $_SESSION['profile']['admin'] != 0) + { + $support=$_SESSION['profile']['admin']; + + } else { + echo _("You do not have access to this page."); + showfooter(); + exit; + } + + if (!valid_ticket_number($ticketno)) { + printf(_("I'm sorry, you did not enter a ticket number! %s Support is not allowed to view the account history without a ticket number."), '<br/>'); + echo '<br/><a href="account.php?id=43&userid='.intval($userid).'">'. _('Back to previous page.') .'</a>'; + showfooter(); + exit; + } + + if (!write_se_log($userid, $_SESSION['profile']['id'], 'SE View account history', $ticketno)) { + echo _("Writing to the admin log failed. Can't continue."); + echo '<br/><a href="account.php?id=43&userid='.intval($userid).'">'. _('Back to previous page.') .'</a>'; + showfooter(); + exit; + } +} + +// Account details +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="2" class="title"><?printf(_('Account history of %s'),$username)?></td> + </tr> + <tr> + <td colspan="2" class="title"><?=_('User actions')?></td> + </tr> + <tr> + <td class="DataTD"><?=_('User name')?></td> + <td class="DataTD"><?=sanitizeHTML($username)?></td> + </tr> + <tr> + <td class="DataTD"><?=_('Date of Birth')?></td> + <td class="DataTD"><?=sanitizeHTML($dob)?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Is Assurer")?>:</td> + <td class="DataTD"><?= ($user['assurer']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Blocked Assurer")?>:</td> + <td class="DataTD"><?= ($user['assurer_blocked']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Account Locking")?>:</td> + <td class="DataTD"><?= ($user['locked']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Code Signing")?>:</td> + <td class="DataTD"><?= ($user['codesign']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Org Assurer")?>:</td> + <td class="DataTD"><?= ($user['orgadmin']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("TTP Admin")?>:</td> + <td class="DataTD"><?= $user['ttpadmin']._(' - 0 = none, 1 = TTP Admin, 2 = TTP TOPUP admin')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Location Admin")?>:</td> + <td class="DataTD"><?= ($user['locadmin']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Admin")?>:</td> + <td class="DataTD"><?= ($user['admin']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Ad Admin")?>:</td> + <td class="DataTD"><?= $user['adadmin']._(' - 0 = none, 1 = submit, 2 = approve')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("General Announcements")?>:</td> + <td class="DataTD"><?= ($alerts['general']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Country Announcements")?>:</td> + <td class="DataTD"><?= ($alerts['country']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Regional Announcements")?>:</td> + <td class="DataTD"><?= ($alerts['regional']==0)? _('No'):_('Yes')?></td> + </tr> + <tr> + <td class="DataTD"><?=_("Within 200km Announcements")?>:</td> + <td class="DataTD"><?= ($alerts['radius']==0)? _('No'):_('Yes')?></td> + </tr> +</table> +<br/> +<? + +// Email addresses +$dres = get_email_addresses($userid,'',1); +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="3" class="title"><?=_('Email addresses')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_log_email_header(); + while ($drow = mysql_fetch_assoc($dres)) + { + output_log_email($drow,$email); + } +} else { + ?> + <tr> + <td colspan="3" ><?=_('no entry available')?></td> + </tr> + <? +} +?> +</table> +<br/> +<? + +// Domains +$dres = get_domains($userid, 1); +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="3" class="title"><?=_('Domains')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_log_domains_header(); + while ($drow = mysql_fetch_assoc($dres)) + { + output_log_domains($drow); + } +} else { + ?> + <tr> + <td colspan="3" ><?=_('no entry available')?></td> + </tr> + <? +} +?> +</table> +<br/> + +<? +// Trainings +$dres = get_training_results($userid); +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="3" class="title"><?=_('Trainings')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_log_training_header(); + while ($drow = mysql_fetch_assoc($dres)) + { + output_log_training($drow); + } +} else { + ?> + <tr> + <td colspan="3" ><?=_('no entry available')?></td> + </tr> + <? +} +?> +</table> +<br/> + +<? +// User Agreements +$dres = get_user_agreements($userid); +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="4" class="title"><?=_('User agreements')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_log_agreement_header(); + while ($drow = mysql_fetch_assoc($dres)) + { + output_log_agreement($drow); + } +} else { + ?> + <tr> + <td colspan="4" ><?=_('no entry available')?></td> + </tr> + <? +} +?> +</table> +<br/> + +<? +// Client Certificates +$dres = get_client_certs($userid, 1); +$colspan=8; +if (1 == $support) { + $colspan=6; +} +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="<?=$colspan?>" class="title"><?=_('Client certificates')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_client_cert_header($support); + while ($drow = mysql_fetch_assoc($dres)) + { + output_client_cert($drow,$support); + } +} else { + ?> + <tr> + <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td> + </tr> + <? +} +?> +</table> +<br/> + +<? +// Server Certificates +$dres = get_server_certs($userid,1); +$colspan = 7; +if (1 == $support) { + $colspan = 5; +} +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="<?=$colspan?>" class="title"><?=_('Server certificates')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_server_certs_header($support); + while ($drow = mysql_fetch_assoc($dres)) + { + output_server_certs($drow,$support); + } +} else { + ?> + <tr> + <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td> + </tr> + <? +} +?> +</table> +<br/> + +<? +// GPG Certificates +$dres = get_gpg_certs($userid,1); +$colspan = 6; +if (1 == $support) { + $colspan = 4; +} +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="<?=$colspan?>" class="title"><?=_('GPG/PGP certificates')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_gpg_certs_header($support); + while ($drow = mysql_fetch_assoc($dres)) + { + output_gpg_certs($drow, $support); + } +} else { + ?> + <tr> + <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td> + </tr> + <? +}?> +</table> +<br/> + +<? + +output_given_assurances($userid, $support, $ticketno, 1); +?><br/><? + +output_received_assurances($userid, $support, $ticketno, 1); +?><br/><? + +$dres = get_se_log($userid); +$colspan = 2; +if (1 == $support) { + $colspan = 4; +} +?> +<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> + <tr> + <td colspan="<?=$colspan?>" class="title"><?=_('Admin log')?></td> + </tr> +<? +if (mysql_num_rows($dres) > 0) { + output_log_se_header($support); + while ($drow = mysql_fetch_assoc($dres)) + { + output_log_se($drow,$support); + } +} else { + ?> + <tr> + <td colspan="<?=$colspan?>" ><?=_('no entry available')?></td> + </tr> + <? +} +?> +<tr> + <td colspan="<?=$colspan?>" > + <a href="account.php?id=<?=$oldid?intval($oldid):($support?43:13)?>&userid=<?=intval($userid)?>"><?= _('Back to previous page.')?></a> + </td> +</tr> + +</table> diff --git a/pages/account/6.php b/pages/account/6.php index 8455499..de8d1a3 100644 --- a/pages/account/6.php +++ b/pages/account/6.php @@ -25,7 +25,7 @@ if(array_key_exists('cert',$_REQUEST)) { $query = "select UNIX_TIMESTAMP(`emailcerts`.`created`) as `created`, UNIX_TIMESTAMP(`emailcerts`.`expire`) - UNIX_TIMESTAMP() as `timeleft`, UNIX_TIMESTAMP(`emailcerts`.`expire`) as `expired`, - `emailcerts`.`expire` as `expires`, + `emailcerts`.`expire`, `emailcerts`.`revoked` as `revoke`, UNIX_TIMESTAMP(`emailcerts`.`revoked`) as `revoked`, `emailcerts`.`id`, @@ -60,7 +60,7 @@ if (array_key_exists('format', $_REQUEST)) { } $crtname=escapeshellarg($row['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crtname $outform`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crtname $outform"); header("Content-Type: application/pkix-cert"); header("Content-Length: ".strlen($cert)); @@ -82,7 +82,7 @@ if (array_key_exists('format', $_REQUEST)) { } else { // All other browsers $crtname=escapeshellarg($row['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crtname -outform DER`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crtname -outform DER"); header("Content-Type: application/x-x509-user-cert"); header("Content-Length: ".strlen($cert)); @@ -111,7 +111,7 @@ if (array_key_exists('format', $_REQUEST)) { // Allow to directly copy and paste the cert in PEM format $crtname=escapeshellarg($row['crt_name']); - $cert = `/usr/bin/openssl x509 -in $crtname -outform PEM`; + $cert = shell_exec("/usr/bin/openssl x509 -in $crtname -outform PEM"); echo "<pre>$cert</pre>"; ?> @@ -137,11 +137,11 @@ if (array_key_exists('format', $_REQUEST)) { </tr> <tr> <td class="DataTD"><?=_("Email Address")?></td> - <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : $row['CN'])?></td> + <td class="DataTD"><?=(trim($row['CN'])=="" ? _("empty") : sanitizeHTML($row['CN']))?></td> </tr> <tr> <td class="DataTD"><?=_("SerialNumber")?></td> - <td class="DataTD"><?=$row['serial']?></td> + <td class="DataTD"><?=sanitizeHTML($row['serial'])?></td> </tr> <tr> <td class="DataTD"><?=_("Revoked")?></td> @@ -149,7 +149,7 @@ if (array_key_exists('format', $_REQUEST)) { </tr> <tr> <td class="DataTD"><?=_("Expires")?></td> - <td class="DataTD"><?=$row['expires']?></td> + <td class="DataTD"><?=$row['expire']?></td> </tr> <tr> <td class="DataTD"><?=_("Login")?></td> diff --git a/pages/gpg/2.php b/pages/gpg/2.php index cc8a872..84e11d2 100644 --- a/pages/gpg/2.php +++ b/pages/gpg/2.php @@ -30,7 +30,7 @@ $query = "select UNIX_TIMESTAMP(`issued`) as `issued`, UNIX_TIMESTAMP(`expire`) - UNIX_TIMESTAMP() as `timeleft`, UNIX_TIMESTAMP(`expire`) as `expired`, - `expire` as `expires`, `id`, `level`, + `expire`, `id`, `level`, `email`,`keyid`,`description` from `gpg` where `memid`='".intval($_SESSION['profile']['id'])."' ORDER BY `issued` desc"; $res = mysql_query($query); @@ -43,6 +43,7 @@ <? } else { while($row = mysql_fetch_assoc($res)) { + $verified = ''; if($row['timeleft'] > 0) $verified = _("Valid"); if($row['timeleft'] < 0) @@ -53,18 +54,18 @@ <tr> <? if($verified == _("Valid")) { ?> <td class="DataTD"><?=$verified?></td> - <td class="DataTD"><a href="gpg.php?id=3&cert=<?=$row['id']?>"><?=$row['email']?></a></td> + <td class="DataTD"><a href="gpg.php?id=3&cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td> <? } else if($verified == _("Pending")) { ?> <td class="DataTD"><?=$verified?></td> - <td class="DataTD"><?=$row['email']?></td> + <td class="DataTD"><?=sanitizeHTML($row['email'])?></td> <? } else { ?> <td class="DataTD"><?=$verified?></td> - <td class="DataTD"><a href="gpg.php?id=3&cert=<?=$row['id']?>"><?=$row['email']?></a></td> + <td class="DataTD"><a href="gpg.php?id=3&cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['email'])?></a></td> <? } ?> - <td class="DataTD"><?=$row['expires']?></td> - <td class="DataTD"><a href="gpg.php?id=3&cert=<?=$row['id']?>"><?=$row['keyid']?></a></td> - <td class="DataTD"><input name="comment_<?=$row['id']?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td> - <td class="DataTD"><input type="checkbox" name="check_comment_<?=$row['id']?>" /></td> + <td class="DataTD"><?=$row['expire']?></td> + <td class="DataTD"><a href="gpg.php?id=3&cert=<?=intval($row['id'])?>"><?=sanitizeHTML($row['keyid'])?></a></td> + <td class="DataTD"><input name="comment_<?=intval($row['id'])?>" type="text" value="<?=htmlspecialchars($row['description'])?>" /></td> + <td class="DataTD"><input type="checkbox" name="check_comment_<?=intval($row['id'])?>" /></td> </tr> <? } ?> <? } ?> @@ -77,5 +78,5 @@ <td class="DataTD" colspan="6"><input type="submit" name="change" value="<?=_("Change settings")?>" /> </td> </tr> </table> -<input type="hidden" name="oldid" value="<?=$id?>" /> +<input type="hidden" name="oldid" value="<?=intval($id)?>" /> </form> diff --git a/pages/index/52.php b/pages/index/52.php new file mode 100644 index 0000000..0926780 --- /dev/null +++ b/pages/index/52.php @@ -0,0 +1,33 @@ +<?/* + LibreSSL - CAcert web application + Copyright (C) 2004-2008 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ + +?> + +<div style="text-align: center;"> + <h1><?=_('CAcert Community Agreement Acceptance')?></h1> + <p><?=sprintf(_('To get access to your account your agreement to the %s CAcert Community Agreement %s (CCA) is required.'),'<a href="/policy/CAcertCommunityAgreement.php">', '</a>')?></p> + <p><?=_('Every member, who has agreed to the CCA, should be able to rely on the fact that every other user of CAcert has also agreed to the CCA and that the same rules apply to everybody. Moreover it is a basic requirement for the audit to be able to tell who has accepted our rules.')?></p> + <p><?=_('Originally the acceptance was not recorded. Up until now, we do not have your agreement on record. Once you have accepted the CCA (again) your agreement is recorded and you will not need to do this step again.')?></p> + <p><?=sprintf(_('If you do not wish to accept the CCA you should consider to ask for the closing of your account as you will not be able to access our system. In this case please send an email to support (%s).'),'<a href="mailto:support@cacert.org">support@cacert.org</a>')?></p> + <p><?=_('If you do not want to decide about the acceptance of the CCA now, you can come back at any time.')?></p> + <form method="post" action="index.php"> + <input type="submit" name="agree" value="<?=_('I agree to the CCA')?>"> + <input type="submit" name="disagree" value="<?=_('I do not want to accept the CCA')?>"> + <input type="hidden" name="oldid" value="<?=$id?>"> + </form> +</div> diff --git a/pages/wot/1.php b/pages/wot/1.php index a45b5df..9047f27 100644 --- a/pages/wot/1.php +++ b/pages/wot/1.php @@ -14,9 +14,9 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ ?> -<? - $res=mysql_fetch_assoc(mysql_query("select sum(acount) as summe from countries")); +*/ + + $res=mysql_fetch_assoc(mysql_query("select sum(acount) as summe from countries")); $total1 =$res['summe']; $locid=array_key_exists('locid',$_REQUEST)?intval($_REQUEST['locid']):0; @@ -91,7 +91,7 @@ { $query = "select *, `users`.`id` as `id` from `users`,`notary` where `listme`='1' and `ccid`='".$ccid."' and `regid`='".$regid."' and - `locid`='".$locid."' and `users`.`id`=`notary`.`to` + `locid`='".$locid."' and `users`.`id`=`notary`.`to` and `notary`.`deleted`=0 group by `notary`.`to` HAVING SUM(`points`) >= 100 order by `points` desc"; $list = mysql_query($query); if(mysql_num_rows($list) > 0) @@ -104,19 +104,19 @@ <td class="title"><?=_("Contact Details")?></td> <td class="title"><?=_("Email Assurer")?></td> <td class="title"><?=_("Assurer Challenge")?></td> - </tr> -<? while($row = mysql_fetch_assoc($list)) { ?> + +<? while($row = mysql_fetch_assoc($list)) { ?> <tr> - <td class="DataTD" width="100"><nobr><?=$row['fname']?> <?=substr($row['lname'], 0, 1)?></nobr></td> + <td class="DataTD" width="100"><nobr><?=sanitizeHTML($row['fname'])?> <?=substr($row['lname'], 0, 1)?>.</nobr></td> <td class="DataTD"><?=maxpoints($row['id'])?></td> - <td class="DataTD"><?=$row['contactinfo']?></td> + <td class="DataTD"><?=sanitizeHTML($row['contactinfo'])?></td> <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($row['id'])?>"><?=_("Email Me")?></a></td> <td class="DataTD"><?=$row['assurer']?_("Yes"):("<font color=\"#ff0000\">"._("Not yet!")."</font>")?></td> - </tr> -<? } - } +<? + } + } ?> </table> <br> diff --git a/pages/wot/10.php b/pages/wot/10.php index bc76a86..b5e146c 100644 --- a/pages/wot/10.php +++ b/pages/wot/10.php @@ -24,7 +24,7 @@ <td colspan="5" class="title"><?=_("Assurer Ranking")?></td> </tr> <tr> -<? +<?// the rank calculation is not adjusted to the new deletion method $query = "SELECT `users`. *, count(*) AS `list` FROM `users`, `notary` WHERE `users`.`id` = `notary`.`from` AND `notary`.`from` != `notary`.`to` AND `from`='".intval($_SESSION['profile']['id'])."' GROUP BY `notary`.`from`"; @@ -36,8 +36,8 @@ WHERE `users`.`id` = `notary`.`from` AND `notary`.`from` != `notary`.`to` GROUP BY `notary`.`from` HAVING count(*) > '$rc' ORDER BY `notary`.`when` DESC"; */ - $query = "SELECT count(*) AS `list` FROM `users` - inner join `notary` on `users`.`id` = `notary`.`from` + $query = "SELECT count(*) AS `list` FROM `users` + inner join `notary` on `users`.`id` = `notary`.`from` GROUP BY `notary`.`from` HAVING count(*) > '$rc'"; $rank = mysql_num_rows(mysql_query($query)) + 1; @@ -64,18 +64,18 @@ <td class="DataTD"><b><?=_("Method")?></b></td> </tr> <? - $query = "select * from `notary` where `to`='".intval($_SESSION['profile']['id'])."'"; + $query = "select `id`, `date`, `from`, `points`, `location`, `method` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0"; $res = mysql_query($query); while($row = mysql_fetch_assoc($res)) { - $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($row['from'])."'")); + $fromuser = mysql_fetch_assoc(mysql_query("select `fname`, `lname` from `users` where `id`='".intval($row['from'])."'")); ?> <tr> - <td class="DataTD"><?=$row['id']?></td> + <td class="DataTD"><?=intval($row['id'])?></td> <td class="DataTD"><?=$row['date']?></td> - <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($row['from'])?>"><?=$fromuser['fname']." ".$fromuser['lname']?></td> - <td class="DataTD"><?=$row['points']?></td> - <td class="DataTD"><?=$row['location']?></td> + <td class="DataTD"><a href="wot.php?id=9&userid=<?=intval($row['from'])?>"><?=sanitizeHTML(trim($fromuser['fname']." ".$fromuser['lname']))?></td> + <td class="DataTD"><?=intval($row['points'])?></td> + <td class="DataTD"><?=sanitizeHTML($row['location'])?></td> <td class="DataTD"><?=_(sprintf("%s", $row['method']))?></td> </tr> <? @@ -114,30 +114,30 @@ if ($thawte) </tr> <? $points = 0; - $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and `to`!='".intval($_SESSION['profile']['id'])."'"; + $query = "select `id`, `date`, `points`, `to`, `location`, `method` from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and `to`!='".intval($_SESSION['profile']['id'])."' and `deleted`=0" ; $res = mysql_query($query); while($row = mysql_fetch_assoc($res)) { - $fromuser = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($row['to'])."'")); - $points += $row['points']; + $fromuser = mysql_fetch_assoc(mysql_query("select `fname`, `lname` from `users` where `id`='".intval($row['to'])."'")); + $points += intval($row['points']); $name = trim($fromuser['fname']." ".$fromuser['lname']); if($name == "") $name = _("Deleted before Verification"); else - $name = "<a href='wot.php?id=9&userid=".intval($row['to'])."'>$name</a>"; + $name = "<a href='wot.php?id=9&userid=".intval($row['to'])."'>".sanitizeHTML($name)."</a>"; ?> <tr> <td class="DataTD"><?=intval($row['id'])?></td> <td class="DataTD"><?=$row['date']?></td> <td class="DataTD"><?=$name?></td> <td class="DataTD"><?=intval($row['points'])?></td> - <td class="DataTD"><?=$row['location']?></td> + <td class="DataTD"><?=sanitizeHTML($row['location'])?></td> <td class="DataTD"><?=$row['method']==""?"":_(sprintf("%s", $row['method']))?></td> </tr> <? } ?> <tr> <td class="DataTD" colspan="3"><b><?=_("Total Points Issued")?>:</b></td> - <td class="DataTD"><?=$points?></td> + <td class="DataTD"><?=intval($points)?></td> <td class="DataTD" colspan="2"> </td> </tr> </table> diff --git a/pages/wot/15.php b/pages/wot/15.php index cca2702..c1f3e0f 100644 --- a/pages/wot/15.php +++ b/pages/wot/15.php @@ -14,7 +14,7 @@ You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA -*/ +*/ require_once($_SESSION['_config']['filepath']."/includes/notary.inc.php"); diff --git a/pages/wot/5.php b/pages/wot/5.php index c1a6438..565dd6a 100644 --- a/pages/wot/5.php +++ b/pages/wot/5.php @@ -18,14 +18,24 @@ include_once("../includes/shutdown.php"); require_once("../includes/lib/l10n.php"); ?> -<? - if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") +<? + if(array_key_exists('error',$_SESSION['_config']) && $_SESSION['_config']['error'] != "") { ?><font color="orange" size="+1"> <? echo _("ERROR").": ".$_SESSION['_config']['error'] ?> </font> <?unset($_SESSION['_config']['error']); - } + } + + if (!isset($_SESSION['assuresomeone']['year'])) { + $_SESSION['assuresomeone']['year'] = 0; + } + if (!isset($_SESSION['assuresomeone']['month'])) { + $_SESSION['assuresomeone']['month'] = 0; + } + if (!isset($_SESSION['assuresomeone']['day'])) { + $_SESSION['assuresomeone']['day'] = 0; + } ?> <? if(array_key_exists('noemailfound',$_SESSION['_config']) && $_SESSION['_config']['noemailfound'] == 1) { ?> <form method="post" action="wot.php"> @@ -60,6 +70,37 @@ <td class="DataTD"><input type="text" name="email" id="email" value="<?=array_key_exists('email',$_POST)?sanitizeHTML($_POST['email']):""?>"></td> <? } ?> </tr> + <tr> + <td class="DataTD"> + <?=_("Date of Birth")?><br/> + (<?=_("yyyy/mm/dd")?>)</td> + <td class="DataTD"> + <input type="text" name="year" value="<?=array_key_exists('year',$_SESSION['assuresomeone']) && intval($_SESSION['assuresomeone']['year']) >= 1900 ? intval($_SESSION['assuresomeone']['year']):''?>" size="4" autocomplete="off"></nobr> + <select name="month"> +<? +for($i = 1; $i <= 12; $i++) +{ + echo "<option value='$i'"; + if(array_key_exists('month',$_SESSION['assuresomeone']) && intval($_SESSION['assuresomeone']['month']) === $i) + echo " selected=\"selected\""; + echo ">".ucwords(strftime("%B", mktime(0,0,0,$i,1,date("Y"))))." ($i)</option>\n"; +} +?> + </select> + <select name="day"> +<? +for($i = 1; $i <= 31; $i++) +{ + echo "<option"; + if(array_key_exists('day',$_SESSION['assuresomeone']) && intval($_SESSION['assuresomeone']['day']) === $i) + echo " selected=\"selected\""; + echo ">$i</option>"; +} +?> + </select> + </td> + </tr> + <tr> <td class="DataTD" colspan="2"><input type="submit" name="process" value="<?=_("Next")?>"></td> </tr> diff --git a/pages/wot/6.php b/pages/wot/6.php index a565aa7..4094a18 100644 --- a/pages/wot/6.php +++ b/pages/wot/6.php @@ -24,6 +24,9 @@ } $row = $_SESSION['_config']['notarise']; + $_SESSION['assuresomeone']['year'] = 0; + $_SESSION['assuresomeone']['month'] = 0; + $_SESSION['assuresomeone']['day'] = 0; if($_SESSION['profile']['ttpadmin'] == 1) // $methods = array("Face to Face Meeting", "Trusted 3rd Parties", "TopUP"); @@ -47,10 +50,10 @@ '12' => _('December') ); - $fname = $row['fname']; - $mname = $row['mname']; - $lname = $row['lname']; - $suffix = $row['suffix']; + $fname = sanitizeHTML($row['fname']); + $mname = sanitizeHTML($row['mname']); + $lname = sanitizeHTML($row['lname']); + $suffix = sanitizeHTML($row['suffix']); $dob = $row['dob']; $dob_date = explode('-', $dob, 3); @@ -74,8 +77,8 @@ AssureMethodLine(_("Method"),$methods,''); AssureBoxLine("certify",sprintf(_("I certify that %s %s %s %s has appeared in person."), $fname, $mname, $lname, $suffix),array_key_exists('certify',$_POST) && $_POST['certify'] == 1); AssureBoxLine("CCAAgreed",sprintf(_("I verify that %s %s %s %s has accepted the CAcert Community Agreement."), $fname, $mname, $lname, $suffix),array_key_exists('CCAAgreed',$_POST) && $_POST['CCAAgreed'] == 1); - AssureInboxLine("location",_("Location"),array_key_exists('location',$_SESSION['_config'])?$_SESSION['_config']['location']:"",""); - AssureInboxLine("date",_("Date"),array_key_exists('date',$_SESSION['_config'])?$_SESSION['_config']['date']:date("Y-m-d"),"<br/>"._("The date when the assurance took place. Please adjust the date if you assured the person on a different day (YYYY-MM-DD).")); + AssureInboxLine("location",_("Location"),array_key_exists('location',$_SESSION['_config'])?sanitizeHTML($_SESSION['_config']['location']):"",""); + AssureInboxLine("date",_("Date"),array_key_exists('date',$_SESSION['_config'])?sanitizeHTML($_SESSION['_config']['date']):date("Y-m-d"),"<br/>"._("The date when the assurance took place. Please adjust the date if you assured the person on a different day (YYYY-MM-DD).")); AssureTextLine("",_("Only tick the next box if the Assurance was face to face.")); AssureBoxLine("assertion",_("I believe that the assertion of identity I am making is correct, complete and verifiable. I have seen original documentation attesting to this identity. I accept that the CAcert Arbitrator may call upon me to provide evidence in any dispute, and I may be held responsible."),array_key_exists('assertion',$_POST) && $_POST['assertion'] == 1); AssureBoxLine("rules",_("I have read and understood the CAcert Community Agreement (CCA), Assurance Policy and the Assurance Handbook. I am making this Assurance subject to and in compliance with the CCA, Assurance policy and handbook."),array_key_exists('rules',$_POST) && $_POST['rules'] == 1); diff --git a/pages/wot/9.php b/pages/wot/9.php index bfa7a98..20f2c6d 100644 --- a/pages/wot/9.php +++ b/pages/wot/9.php @@ -15,9 +15,9 @@ along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */ - + require_once($_SESSION['_config']['filepath'].'/includes/lib/l10n.php'); - + $res = mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."' and `listme`='1'"); if(mysql_num_rows($res) <= 0) @@ -26,11 +26,10 @@ } else { $user = mysql_fetch_array($res); - $userlang = $user['language']; + $userlang = L10n::normalise_translation($user['language']); $points = mysql_num_rows(mysql_query("select sum(`points`) as `total` from `notary` - where `to`='".$user['id']."' group by `to` HAVING SUM(`points`) > 0")); - if($points <= 0) - { + where `to`='".intval($user['id'])."' and `deleted`=0 group by `to` HAVING SUM(`points`) > 0")); + if($points <= 0) { echo _("Sorry, I was unable to locate that user."); } else { @@ -38,31 +37,31 @@ ?> <? if($_SESSION['_config']['error'] != "") { ?><font color="#ff0000" size="+1">ERROR: <?=$_SESSION['_config']['error']?></font><? unset($_SESSION['_config']['error']); } ?> <form method="post" action="wot.php"> -<input type="hidden" name="userid" value="<?=$user['id']?>"> +<input type="hidden" name="userid" value="<?=intval($user['id'])?>"> <table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> <tr> <td colspan="2" class="title"><?=_("Contact Assurer")?></td> </tr> <tr> <td class="DataTD"><?=_("To")?>:</td> - <td class="DataTD" align="left"><?=$user['fname']?> <?=substr($user['lname'], 0, 1)?></td> + <td class="DataTD" align="left"><?=sanitizeHTML(trim($user['fname'].' '.substr($user['lname'], 0, 1)))?></td> </tr> <? if($userlang != "") { ?> <tr> <td class="DataTD"><?=_("Language")?>:</td> - <td class="DataTD" align="left"><? printf(_("%s prefers to be contacted in %s"), $user['fname'], L10n::$translations[$userlang]) ?></td> + <td class="DataTD" align="left"><? printf(_("%s prefers to be contacted in %s"), sanitizeHTML($user['fname']), L10n::$translations[$userlang]) ?></td> </tr> <? } ?> <? - $query = "select * from `addlang` where `userid`='".$user['id']."'"; + $query = "select * from `addlang` where `userid`='".intval($user['id'])."'"; $res = mysql_query($query); while($row = mysql_fetch_assoc($res)) { - $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='${row['lang']}'")); + $lang = mysql_fetch_assoc(mysql_query("select * from `languages` where `locale`='".mysql_real_escape_string($row['lang'])."'")); ?> <tr> <td class="DataTD"><?=_("Additional Language")?>:</td> - <td class="DataTD" align="left"><? printf(_("%s will also accept email in %s - %s"), $user['fname'], $lang['lang'], $lang['country']) ?></td> + <td class="DataTD" align="left"><? printf(_("%s will also accept email in %s - %s"), sanitizeHTML($user['fname']), $lang['lang'], $lang['country']) ?></td> </tr> <? } ?> <tr> @@ -79,7 +78,7 @@ </table> <input type="hidden" name="pageid" value="<?=$_SESSION['_config']['pagehash']?>"> <input type="hidden" name="userid" value="<?=intval($_REQUEST['userid'])?>"> -<input type="hidden" name="oldid" value="<?=$id?>"> +<input type="hidden" name="oldid" value="<?=intval($id)?>"> </form> <p>[ <a href='javascript:history.go(-1)'><?=_("Go Back")?></a> ]</p> <? } } ?> diff --git a/scripts/54at-ate-linz-email.txt b/scripts/54at-ate-linz-email.txt new file mode 100644 index 0000000..1e9020e --- /dev/null +++ b/scripts/54at-ate-linz-email.txt @@ -0,0 +1,91 @@ +[Deutsch] + +Es hat sich viel getan in den letzten Jahren. Eine ganze Reihe von bisher +eher "muendlich ueberlieferten" Regeln wurden in Policies gegossen. +Neue Prozeduren (z.B. die Assurer Challenge) und Verpflichtungen (z.B. +in dem CAcert Community Agreement) wurden beschlossen. Die Assurer +Training Events wollen versuchen, die ganzen Informationen unter's +Volk zu bringen: + +- Welcher Satz fehlt auf alten CAP Formularen? +- Warum soll ich mir R/L/O einpraegen? +- Wie verhaelst du dich, + wenn du ein fremdes Ausweisdokument das erste Mal pruefst? + +Antworten auf diese und weitere Fragen erhaelst du bei den +Assurer Training Events (ATEs). + +Darueberhinaus wird beim ATE der Vorgang der Identitaetsueberpruefung +trainiert und auditiert, um die Qualitaet der Assurances in der +taeglichen Praxis zu erfassen. Dabei gilt es moegliche Fehler und +Fallstricke zu erkennen und aufzudecken. Die Assurer haben also die +Moeglichkeit, sich mit den Fehlern auseinanderzusetzen und zu erfahren, +wie diese vermieden werden koennen. + +Wie IanG sagte: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers, and include parts which contribute +directly to our audit. Come and find out how you can also contribute. + +Die kommende Veranstaltung in deiner Naehe findet statt am: + +- Freitag, den 16. Mai 2014 +- in der Zeit von: 19:00 - ca. 22:00 Uhr +- Fachhochschule Oberoesterreich, Hauptgebaeude, 1.Stock, Raum SR A-103 +- Garnisonstrasse 21 +- 4020 Linz + + +Details zum Veranstaltungsort und Anfahrthinweise findet Ihr im +Wiki [https://wiki.cacert.org/Events/2014-05-16-ATELinz] + + +Teilnehmer Registrierung mit Rueckantwort: + 'Ich moechte am ATE-Linz teilnehmen' + +Das Veranstaltungs-Team freut sich schon auf Eure Teilnahme. + +Kontakt: events@cacert.org + + + +[English] + +During the last years many changes took place inside CAcert. Many "oral" +rules have been put into Policies. New procedures +(e.g. Assurer Challenge) and obligations +(e.g. CAcert Community Agreement) have been put into live. +The Assurer Training Events (ATE) try to spread this information: + +- What is missing on the "old" CAP forms? +- Why should I remember R/L/O? +- What can you do if an Assuree shows an ID document unknown to you? + +These and more questions will be answered during the +Assurer Training Events (ATEs) + +Furthermore, the ATE trains how to do assurances and audits assurances, +to measure the quality of assurances in the daily routine. Here are some +possible errors and pitfalls which need to be found. Assurers have the +opportunity to see those errors and how to avoid them. + +As IanG said: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers and includes parts which contribute +directly to our audit. Come and find out how you can also contribute. + +The next event held in your area will be: + +- Friday, May 16th 2014 +- during: 19:00 - ca. 22:00 +- University of Applied Sciences Upper Austria, Room SR A-103 +- Garnisonstrasse 21 +- 4020 Linz + + +Details to the location can be found: +Wiki [https://wiki.cacert.org/Events/2014-05-16-ATELinz] + +User reply for registration: 'I will attend the ATE-Linz' + +The event team is looking forward for your attendance: + +Contact: events@cacert.org diff --git a/scripts/54at-ate-linz-mail.php.txt b/scripts/54at-ate-linz-mail.php.txt new file mode 100644 index 0000000..5ffdb24 --- /dev/null +++ b/scripts/54at-ate-linz-mail.php.txt @@ -0,0 +1,140 @@ +#!/usr/bin/php -q +<? /* + LibreSSL - CAcert web application + Copyright (C) 2004-2013 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ + include_once("../includes/mysql.php"); + + $lines = ""; + $fp = fopen("54at-ate-linz-email.txt", "r"); + while(!feof($fp)) + { + $line = trim(fgets($fp, 4096)); + $lines .= wordwrap($line, 75, "\n")."\n"; + } + fclose($fp); + + +// $locid = intval($_REQUEST['location']); +// $maxdist = intval($_REQUEST['maxdist']); +// maxdist in [Km] + $maxdist = 200; + + +// location location.ID +// verified: 29.4.09 u.schroeter +// $locid = 7902857; // Paris +// $locid = 238568; // Bielefeld +// $locid = 715191; // Hamburg +// $locid = 1102495; // London +// $locid = 606058; // Frankfurt +// $locid = 1775784; // Stuttgart +// $locid = 228950; // Berlin +// $locid = 606058; // Frankfurt +// $locid = 599389; // Flensburg +// $locid = 61065; // Amsterdam, Eemnes +// $locid = 228950; // Berlin +// $locid = 2138880; // Baltimore (Baltimore (city)), Maryland, United States +// $locid = 1486658; // Potsdam +// $locid = 664715; // Goteborg, Vastra Gotaland, Sweden +// $locid = 2094781; // Mission Hills (Los Angeles), California, United States +// $locid = 423655; // Copenhagen, Kobenhavn*, Denmark +// $locid = 2093625; // Los Angeles, CA ??? +// $locid = 2094326 // Los Angeles (Los Angeles), California, United States +// $locid = 2257312; // Sydney, New South Wales, Australia +// $locid = 572764; // Essen, Nordrhein-Westfalen, Germany +// $locid = 78; // Aachen, Nordrhein-Westfalen, Germany +// $locid = 1260319; // Muenchen +// $locid = 266635; // Bonn, Nordrhein-Westfalen, Germany +// $locid = 873779; // Karlsruhe, Baden-Wuerttemberg, Germany +// $locid = 520340; // Dusseldorf, Nordrhein-Westfalen, Germany +// $locid = 2262656; // Melbourne, Victoria, Australia +// $locid = 2185076; // Raleigh (Wake), North Carolina, United States + +// CAcert Assurance and Keysigning event at FUDcon, Lawrence, KS, Jan 19th 2013 +// $locid = 2126955; // Lawrence (Douglas), Kansas, United States +// $eventname = "CAcert Assurance and Keysigning at FUDcon Lawrence, KS"; +// $city = "January 19th 2013"; + +// ATE-Kiel 2013-02-11 +// $locid = 919560; // Kiel, Schleswig-Holstein, Germany +// $eventname = "ATE-Kiel"; +// $city = "11. Februar 2013"; + +// Linuxtag, Berlin, May 22-25, 2013, +// $locid = 228950; // Berlin +// $eventname = "Linuxtag Berlin"; +// $city = "22.-25. Mai, 2013"; + +// $locid = 1117395; // Lubeck Hansestadt, Schleswig-Holstein, Germany +// $eventname = "ATE-Luebeck"; +// $city = "07. Juni 2013"; + +// $locid = 675661; // Graz, Steiermark, Austria +// $eventname = "ATE-Graz"; +// $city = "16. August 2013"; + +// $locid = 1992733; // Wien, Wien, Austria +// $eventname = "ATE-Wien"; +// $city = "15. Oktober 2013"; + +// $locid = 54334; // Amberg, Bayern, Germany +// $eventname = "ATE-Amberg"; +// $city = "06. Januar 2014"; + + $locid = 1089877; // Linz, Oberoesterreich, Austria + $eventname = "ATE-Linz"; + $city = "16. Mai 2014"; + + + + $query = "select * from `locations` where `id`='$locid'"; + $loc = mysql_fetch_assoc(mysql_query($query)); + + $query = "SELECT ROUND(6378.137 * ACOS(0.9999999*((SIN(PI() * $loc[lat] / 180) * SIN(PI() * `locations`.`lat` / 180)) + + (COS(PI() * $loc[lat] / 180 ) * COS(PI() * `locations`.`lat` / 180) * + COS(PI() * `locations`.`long` / 180 - PI() * $loc[long] / 180)))), -1) AS `distance`, sum(`points`) as pts, `users`.* + FROM `locations` + inner join `users` on `users`.`locid` = `locations`.`id` + inner join `alerts` on `users`.`id`=`alerts`.`memid` + inner join `notary` on `users`.`id`=`notary`.`to` + WHERE (`alerts`.`general`=1 OR `alerts`.`country`=1 OR `alerts`.`regional`=1 OR `alerts`.`radius`=1) + GROUP BY `users`.`id` + HAVING `distance` <= '$maxdist' + ORDER BY `distance` "; + echo $query; + + // comment next line when starting to send mail not only to me + // $query = "select * from `users` where `email` like 'cacerttest%'"; + + $res = mysql_query($query); + $xrows = mysql_num_rows($res); + + while($row = mysql_fetch_assoc($res)) + { + // uncomment next line to send mails ... + sendmail($row['email'], "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + } + // 1x cc to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + // 1x mailing report to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + + // 1x mailing report to Arbitrator of case http://wiki.cacert.org/wiki/Arbitrations/a20090525.1 + sendmail("p.dunkel@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + echo "invitation sent to $xrows recipients.\n"; + +?> diff --git a/scripts/55de-ate-wiesbaden-email.txt b/scripts/55de-ate-wiesbaden-email.txt new file mode 100644 index 0000000..4880388 --- /dev/null +++ b/scripts/55de-ate-wiesbaden-email.txt @@ -0,0 +1,46 @@ +Es hat sich viel getan in den letzten Jahren. Eine ganze Reihe von bisher +eher "muendlich ueberlieferten" Regeln wurden in Policies gegossen. +Neue Prozeduren (z.B. die Assurer Challenge) und Verpflichtungen (z.B. +in dem CAcert Community Agreement) wurden beschlossen. Die Assurer +Training Events wollen versuchen, die ganzen Informationen unter's +Volk zu bringen: + +- Welcher Satz fehlt auf alten CAP Formularen? +- Warum soll ich mir R/L/O einpraegen? +- Wie verhaelst du dich, + wenn du ein fremdes Ausweisdokument das erste Mal pruefst? + +Antworten auf diese und weitere Fragen erhaelst du bei den +Assurer Training Events (ATEs). + +Darueberhinaus wird beim ATE der Vorgang der Identitaetsueberpruefung +trainiert und auditiert, um die Qualitaet der Assurances in der +taeglichen Praxis zu erfassen. Dabei gilt es moegliche Fehler und +Fallstricke zu erkennen und aufzudecken. Die Assurer haben also die +Moeglichkeit, sich mit den Fehlern auseinanderzusetzen und zu erfahren, +wie diese vermieden werden koennen. + +Wie IanG sagte: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers, and include parts which contribute +directly to our audit. Come and find out how you can also contribute. + +Die kommende Veranstaltung in deiner Naehe findet statt am: + +- Donnerstag, den 22. Mai 2014 +- in der Zeit von: 19:00 - ca. 22:00 Uhr +- CCCMZ e.V. +- Sedanplatz 7 +- 65183 Wiesbaden + + + +Details zum Veranstaltungsort und Anfahrthinweise findet Ihr im Wiki +[https://wiki.cacert.org/Events/2014-05-22ATE-Wiesbaden] und Blog +[https://www.cccmz.de/cacert-assurer-training-event-22-mai-2014-in-wiesbaden] + +Teilnehmer Registrierung mit Rueckantwort: + 'Ich moechte am ATE-Wiesbaden teilnehmen' + +Das Veranstaltungs-Team freut sich schon auf Eure Teilnahme. + +Kontakt: events@cacert.org diff --git a/scripts/55de-ate-wiesbaden-mail.php.txt b/scripts/55de-ate-wiesbaden-mail.php.txt new file mode 100644 index 0000000..26666e4 --- /dev/null +++ b/scripts/55de-ate-wiesbaden-mail.php.txt @@ -0,0 +1,122 @@ +#!/usr/bin/php -q +<? /* + LibreSSL - CAcert web application + Copyright (C) 2004-2013 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ + include_once("../includes/mysql.php"); + + $lines = ""; + $fp = fopen("55de-ate-wiesbaden-email.txt", "r"); + while(!feof($fp)) + { + $line = trim(fgets($fp, 4096)); + $lines .= wordwrap($line, 75, "\n")."\n"; + } + fclose($fp); + + +// $locid = intval($_REQUEST['location']); +// $maxdist = intval($_REQUEST['maxdist']); +// maxdist in [Km] + $maxdist = 200; + + +// location location.ID +// verified: 29.4.09 u.schroeter +// $locid = 7902857; // Paris +// $locid = 238568; // Bielefeld +// $locid = 715191; // Hamburg +// $locid = 1102495; // London +// $locid = 606058; // Frankfurt +// $locid = 1775784; // Stuttgart +// $locid = 228950; // Berlin +// $locid = 606058; // Frankfurt +// $locid = 599389; // Flensburg +// $locid = 61065; // Amsterdam, Eemnes +// $locid = 228950; // Berlin +// $locid = 2138880; // Baltimore (Baltimore (city)), Maryland, United States +// $locid = 1486658; // Potsdam +// $locid = 664715; // Goteborg, Vastra Gotaland, Sweden +// $locid = 2094781; // Mission Hills (Los Angeles), California, United States +// $locid = 423655; // Copenhagen, Kobenhavn*, Denmark +// $locid = 2093625; // Los Angeles, CA ??? +// $locid = 2094326 // Los Angeles (Los Angeles), California, United States +// $locid = 2257312; // Sydney, New South Wales, Australia +// $locid = 572764; // Essen, Nordrhein-Westfalen, Germany +// $locid = 78; // Aachen, Nordrhein-Westfalen, Germany +// $locid = 1260319; // Muenchen +// $locid = 266635; // Bonn, Nordrhein-Westfalen, Germany +// $locid = 873779; // Karlsruhe, Baden-Wuerttemberg, Germany +// $locid = 520340; // Dusseldorf, Nordrhein-Westfalen, Germany +// $locid = 2262656; // Melbourne, Victoria, Australia +// $locid = 2185076; // Raleigh (Wake), North Carolina, United States +// $locid = 2126955; // Lawrence (Douglas), Kansas, United States +// $locid = 919560; // Kiel, Schleswig-Holstein, Germany +// $locid = 228950; // Berlin +// $locid = 1117395; // Lubeck Hansestadt, Schleswig-Holstein, Germany +// $locid = 675661; // Graz, Steiermark, Austria +// $locid = 1992733; // Wien, Wien, Austria + +// $locid = 54334; // Amberg, Bayern, Germany +// $eventname = "ATE-Amberg"; +// $city = "06. Januar 2014"; + +// $locid = 1089877; // Linz, Oberoesterreich, Austria +// $eventname = "ATE-Linz"; +// $city = "16. Mai 2014"; + + $locid = 1993029; // Wiesbaden, Hessen, Germany + $eventname = "ATE-Wiesbaden"; + $city = "22. Mai 2014"; + + + $query = "select * from `locations` where `id`='$locid'"; + $loc = mysql_fetch_assoc(mysql_query($query)); + + $query = "SELECT ROUND(6378.137 * ACOS(0.9999999*((SIN(PI() * $loc[lat] / 180) * SIN(PI() * `locations`.`lat` / 180)) + + (COS(PI() * $loc[lat] / 180 ) * COS(PI() * `locations`.`lat` / 180) * + COS(PI() * `locations`.`long` / 180 - PI() * $loc[long] / 180)))), -1) AS `distance`, sum(`points`) as pts, `users`.* + FROM `locations` + inner join `users` on `users`.`locid` = `locations`.`id` + inner join `alerts` on `users`.`id`=`alerts`.`memid` + inner join `notary` on `users`.`id`=`notary`.`to` + WHERE (`alerts`.`general`=1 OR `alerts`.`country`=1 OR `alerts`.`regional`=1 OR `alerts`.`radius`=1) + GROUP BY `users`.`id` + HAVING `distance` <= '$maxdist' + ORDER BY `distance` "; + echo $query; + + // comment next line when starting to send mail not only to me + // $query = "select * from `users` where `email` like 'cacerttest%'"; + + $res = mysql_query($query); + $xrows = mysql_num_rows($res); + + while($row = mysql_fetch_assoc($res)) + { + // uncomment next line to send mails ... + sendmail($row['email'], "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + } + // 1x cc to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + // 1x mailing report to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + + // 1x mailing report to Arbitrator of case http://wiki.cacert.org/wiki/Arbitrations/a20090525.1 + sendmail("p.dunkel@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + echo "invitation sent to $xrows recipients.\n"; + +?> diff --git a/scripts/56at-ate-oberwart-email.txt b/scripts/56at-ate-oberwart-email.txt new file mode 100644 index 0000000..b15f82e --- /dev/null +++ b/scripts/56at-ate-oberwart-email.txt @@ -0,0 +1,93 @@ +[Deutsch] + +Es hat sich viel getan im letzten Jahr. Eine ganze Reihe von bisher +eher "muendlich ueberlieferten" Regeln wurden in Policies gegossen. +Neue Prozeduren (z.B. die Assurer Challenge) und Verpflichtungen (z.B. +in dem CAcert Community Agreement) wurden beschlossen. Die Assurer +Training Events wollen versuchen, die ganzen Informationen unter's +Volk zu bringen: + +- Welcher Satz fehlt auf alten CAP Formularen? +- Warum soll ich mir R/L/O einpraegen? +- Wie verhaelst du dich, + wenn du ein fremdes Ausweisdokument das ersteMal pruefst? + +Antworten auf diese und weitere Fragen erhaelst du bei den +Assurer Training Events (ATEs). + +Darueberhinaus wird beim ATE der Vorgang der Identitaetsueberpruefung +trainiert und auditiert, um die Qualitaet der Assurances in der +taeglichen Praxis zu erfassen. Dabei gilt es moegliche Fehler und +Fallstricke zu erkennen und aufzudecken. Die Assurer haben also die +Moeglichkeit, sich mit den Fehlern auseinanderzusetzen und zu erfahren, +wie diese vermieden werden koennen. + +Wie IanG sagte: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers, and include parts which contribute +directly to our audit. Come and find out how you can also contribute. + +Die kommende Veranstaltung in deiner Naehe findet statt am: + +- Freitag, den 27. Juni 2014 +- in der Zeit von: 19:00 - ca. 22:00 Uhr +- Rotes Kreuz Schulungszentrum Süd (Hotel zur Pinka), Seminarraum "Pinkasaal" +- Grazerstrasse 71 +- A-7400 Oberwart + +Die Arbeitssprache der Veranstaltung ist Deutsch + +Details zum Veranstaltungsort und Anfahrthinweise findet Ihr im +Wiki [https://wiki.cacert.org/Events/2014-06-27-ATEOberwart] + + +Teilnehmer Registrierung mit Rueckantwort: + 'Ich moechte am ATE-Oberwart teilnehmen' + +Das Veranstaltungs-Team freut sich schon auf Eure Teilnahme. + +Kontakt: events@cacert.org + + + +[English] + +During the last year many changes took place inside CAcert. Many "oral" +rules have been put into Policies. New procedures +(e.g. Assurer Challenge) and obligations +(e.g. CAcert Community Agreement) have been put into live. +The Assurer Training Events (ATE) try to spread this information: + +- What is missing on the "old" CAP forms? +- Why should I remember R/L/O? +- What can you do if an Assuree shows an ID document unknown to you? + +These and more questions will be answered during the +Assurer Training Events (ATEs) + +Furthermore, the ATE trains how to do assurances and audits assurances, +to measure the quality of assurances in the daily routine. Here are some +possible errors and pitfalls which need to be found. Assurers have the +opportunity to see those errors and how to avoid them. + +As IanG said: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers and includes parts which contribute +directly to our audit. Come and find out how you can also contribute. + +The next event held in your area will be: + +- Friday, May 16th 2014 +- during: 19:00 - ca. 22:00 +- Rotes Kreuz Schulungszentrum Süd (Hotel zur Pinka), Seminarraum "Pinkasaal" +- Grazerstrasse 71 +- A-7400 Oberwart + +The working language of this event is GERMAN + +Details to the location can be found: +Wiki [https://wiki.cacert.org/Events/2014-06-27-ATEOberwart] + +User reply for registration: 'I will attend the ATE-Oberwart' + +The event team is looking forward for your attendance: + +Contact: events@cacert.org diff --git a/scripts/56at-ate-oberwart-mail.php.txt b/scripts/56at-ate-oberwart-mail.php.txt new file mode 100644 index 0000000..1035f17 --- /dev/null +++ b/scripts/56at-ate-oberwart-mail.php.txt @@ -0,0 +1,147 @@ +#!/usr/bin/php -q +<? /* + LibreSSL - CAcert web application + Copyright (C) 2004-2013 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ + include_once("../includes/mysql.php"); + + $lines = ""; + $fp = fopen("56at-ate-oberwart-email.txt", "r"); + while(!feof($fp)) + { + $line = trim(fgets($fp, 4096)); + $lines .= wordwrap($line, 75, "\n")."\n"; + } + fclose($fp); + + +// $locid = intval($_REQUEST['location']); +// $maxdist = intval($_REQUEST['maxdist']); +// maxdist in [Km] + $maxdist = 200; + + +// location location.ID +// verified: 29.4.09 u.schroeter +// $locid = 7902857; // Paris +// $locid = 238568; // Bielefeld +// $locid = 715191; // Hamburg +// $locid = 1102495; // London +// $locid = 606058; // Frankfurt +// $locid = 1775784; // Stuttgart +// $locid = 228950; // Berlin +// $locid = 606058; // Frankfurt +// $locid = 599389; // Flensburg +// $locid = 61065; // Amsterdam, Eemnes +// $locid = 228950; // Berlin +// $locid = 2138880; // Baltimore (Baltimore (city)), Maryland, United States +// $locid = 1486658; // Potsdam +// $locid = 664715; // Goteborg, Vastra Gotaland, Sweden +// $locid = 2094781; // Mission Hills (Los Angeles), California, United States +// $locid = 423655; // Copenhagen, Kobenhavn*, Denmark +// $locid = 2093625; // Los Angeles, CA ??? +// $locid = 2094326 // Los Angeles (Los Angeles), California, United States +// $locid = 2257312; // Sydney, New South Wales, Australia +// $locid = 572764; // Essen, Nordrhein-Westfalen, Germany +// $locid = 78; // Aachen, Nordrhein-Westfalen, Germany +// $locid = 1260319; // Muenchen +// $locid = 266635; // Bonn, Nordrhein-Westfalen, Germany +// $locid = 873779; // Karlsruhe, Baden-Wuerttemberg, Germany +// $locid = 520340; // Dusseldorf, Nordrhein-Westfalen, Germany +// $locid = 2262656; // Melbourne, Victoria, Australia +// $locid = 2185076; // Raleigh (Wake), North Carolina, United States + +// CAcert Assurance and Keysigning event at FUDcon, Lawrence, KS, Jan 19th 2013 +// $locid = 2126955; // Lawrence (Douglas), Kansas, United States +// $eventname = "CAcert Assurance and Keysigning at FUDcon Lawrence, KS"; +// $city = "January 19th 2013"; + +// ATE-Kiel 2013-02-11 +// $locid = 919560; // Kiel, Schleswig-Holstein, Germany +// $eventname = "ATE-Kiel"; +// $city = "11. Februar 2013"; + +// Linuxtag, Berlin, May 22-25, 2013, +// $locid = 228950; // Berlin +// $eventname = "Linuxtag Berlin"; +// $city = "22.-25. Mai, 2013"; + +// $locid = 1117395; // Lubeck Hansestadt, Schleswig-Holstein, Germany +// $eventname = "ATE-Luebeck"; +// $city = "07. Juni 2013"; + +// $locid = 675661; // Graz, Steiermark, Austria +// $eventname = "ATE-Graz"; +// $city = "16. August 2013"; + +// $locid = 1992733; // Wien, Wien, Austria +// $eventname = "ATE-Wien"; +// $city = "15. Oktober 2013"; + +// $locid = ; 54334 // Amberg, Bayern, Germany +// $eventname = "ATE-Amberg"; +// $city = "06. Januar 2014"; + +// $locid = 1089877; // Linz, Oberoesterreich, Austria +// $eventname = "ATE-Linz"; +// $city = "16. Mai 2014"; + +// $locid = 1993029; // Wiesbaden, Hessen, Germany +// $eventname = "ATE-Wiesbaden"; +// $city = "22. Mai 2014"; + + + $locid = 1356196; // Oberwart, Burgenland, Germany + $eventname = "ATE-Oberwart (Korrektur)"; + $city = "27. Juni 2014"; + + $query = "select * from `locations` where `id`='$locid'"; + $loc = mysql_fetch_assoc(mysql_query($query)); + + $query = "SELECT ROUND(6378.137 * ACOS(0.9999999*((SIN(PI() * $loc[lat] / 180) * SIN(PI() * `locations`.`lat` / 180)) + + (COS(PI() * $loc[lat] / 180 ) * COS(PI() * `locations`.`lat` / 180) * + COS(PI() * `locations`.`long` / 180 - PI() * $loc[long] / 180)))), -1) AS `distance`, sum(`points`) as pts, `users`.* + FROM `locations` + inner join `users` on `users`.`locid` = `locations`.`id` + inner join `alerts` on `users`.`id`=`alerts`.`memid` + inner join `notary` on `users`.`id`=`notary`.`to` + WHERE (`alerts`.`general`=1 OR `alerts`.`country`=1 OR `alerts`.`regional`=1 OR `alerts`.`radius`=1) + GROUP BY `users`.`id` + HAVING `distance` <= '$maxdist' + ORDER BY `distance` "; + echo $query; + + // comment next line when starting to send mail not only to me + // $query = "select * from `users` where `email` like 'cacerttest%'"; + + $res = mysql_query($query); + $xrows = mysql_num_rows($res); + + while($row = mysql_fetch_assoc($res)) + { + // uncomment next line to send mails ... + sendmail($row['email'], "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + } + // 1x cc to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + // 1x mailing report to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + + // 1x mailing report to Arbitrator of case http://wiki.cacert.org/wiki/Arbitrations/a20090525.1 + sendmail("p.dunkel@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + echo "invitation sent to $xrows recipients.\n"; + +?> diff --git a/scripts/57at-ate-graz-email.txt b/scripts/57at-ate-graz-email.txt new file mode 100644 index 0000000..e9b4a63 --- /dev/null +++ b/scripts/57at-ate-graz-email.txt @@ -0,0 +1,91 @@ +[Deutsch] + +Es hat sich viel getan im letzten Jahr. Eine ganze Reihe von bisher +eher "muendlich ueberlieferten" Regeln wurden in Policies gegossen. +Neue Prozeduren (z.B. die Assurer Challenge) und Verpflichtungen (z.B. +in dem CAcert Community Agreement) wurden beschlossen. Die Assurer +Training Events wollen versuchen, die ganzen Informationen unter's +Volk zu bringen: + +- Welcher Satz fehlt auf alten CAP Formularen? +- Warum soll ich mir R/L/O einpraegen? +- Wie verhaelst du dich, + wenn du ein fremdes Ausweisdokument das erste Mal pruefst? + +Antworten auf diese und weitere Fragen erhaelst du bei den +Assurer Training Events (ATEs). + +Darueberhinaus wird beim ATE der Vorgang der Identitaetsueberpruefung +trainiert und auditiert, um die Qualitaet der Assurances in der +taeglichen Praxis zu erfassen. Dabei gilt es moegliche Fehler und +Fallstricke zu erkennen und aufzudecken. Die Assurer haben also die +Moeglichkeit, sich mit den Fehlern auseinanderzusetzen und zu erfahren, +wie diese vermieden werden koennen. + +Wie IanG sagte: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers, and include parts which contribute +directly to our audit. Come and find out how you can also contribute. + +Die kommende Veranstaltung in deiner Naehe findet statt am: + +- Donnerstag, den 13. November 2014 +- in der Zeit von: 19:00 - ca. 22:00 Uhr +- realraum +- Brockmanngasse 15 +- 8010 Graz + + +Details zum Veranstaltungsort und Anfahrthinweise findet Ihr im +Wiki [http://wiki.cacert.org/Events/2014-11-13-ATEGraz] +Blog [http://blog.cacert.org/2014/10/ate-graz-2014-11-13/] + +Teilnehmer Registrierung mit Rueckantwort: + 'Ich moechte am ATE-Graz teilnehmen' + +Das Veranstaltungs-Team freut sich schon auf Eure Teilnahme. + +Kontakt: events@cacert.org + + + +[English] + +During the last year many changes took place inside CAcert. Many "oral" +rules have been put into Policies. New procedures +(e.g. Assurer Challenge) and obligations +(e.g. CAcert Community Agreement) have been put into live. +The Assurer Training Events (ATE) try to spread this information: + +- What is missing on the "old" CAP forms? +- Why should I remember R/L/O? +- What can you do if an Assuree shows an ID document unknown to you? + +These and more questions will be answered during the +Assurer Training Events (ATEs) + +Furthermore, the ATE trains how to do assurances and audits assurances, +to measure the quality of assurances in the daily routine. Here are some +possible errors and pitfalls which need to be found. Assurers have the +opportunity to see those errors and how to avoid them. + +As IanG said: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers and includes parts which contribute +directly to our audit. Come and find out how you can also contribute. + +The next event held in your area will be: + +- Thursday, November 13th 2014 +- during: 19:00 - ca. 22:00 +- realraum +- Brockmanngasse 15 +- 8010 Graz + +Details to the location can be found: +Wiki [http://wiki.cacert.org/Events/2014-11-13-ATEGraz] +Blog [http://blog.cacert.org/2014/10/ate-graz-2014-11-13/] + +User reply for registration: 'I will attend the ATE-Graz' + +The event team is looking forward for your attendance: + +Contact: events@cacert.org diff --git a/scripts/57at-ate-graz-mail.php.txt b/scripts/57at-ate-graz-mail.php.txt new file mode 100644 index 0000000..0e6786f --- /dev/null +++ b/scripts/57at-ate-graz-mail.php.txt @@ -0,0 +1,130 @@ +#!/usr/bin/php -q +<? /* + LibreSSL - CAcert web application + Copyright (C) 2004-2013 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ + include_once("../includes/mysql.php"); + + $lines = ""; + $fp = fopen("57at-ate-graz-email.txt", "r"); + while(!feof($fp)) + { + $line = trim(fgets($fp, 4096)); + $lines .= wordwrap($line, 75, "\n")."\n"; + } + fclose($fp); + + +// $locid = intval($_REQUEST['location']); +// $maxdist = intval($_REQUEST['maxdist']); +// maxdist in [Km] + $maxdist = 200; + + +// location location.ID +// verified: 29.4.09 u.schroeter +// $locid = 7902857; // Paris +// $locid = 238568; // Bielefeld +// $locid = 715191; // Hamburg +// $locid = 1102495; // London +// $locid = 606058; // Frankfurt +// $locid = 1775784; // Stuttgart +// $locid = 228950; // Berlin +// $locid = 606058; // Frankfurt +// $locid = 599389; // Flensburg +// $locid = 61065; // Amsterdam, Eemnes +// $locid = 228950; // Berlin +// $locid = 2138880; // Baltimore (Baltimore (city)), Maryland, United States +// $locid = 1486658; // Potsdam +// $locid = 664715; // Goteborg, Vastra Gotaland, Sweden +// $locid = 2094781; // Mission Hills (Los Angeles), California, United States +// $locid = 423655; // Copenhagen, Kobenhavn*, Denmark +// $locid = 2093625; // Los Angeles, CA ??? +// $locid = 2094326 // Los Angeles (Los Angeles), California, United States +// $locid = 2257312; // Sydney, New South Wales, Australia +// $locid = 572764; // Essen, Nordrhein-Westfalen, Germany +// $locid = 78; // Aachen, Nordrhein-Westfalen, Germany +// $locid = 1260319; // Muenchen +// $locid = 266635; // Bonn, Nordrhein-Westfalen, Germany +// $locid = 873779; // Karlsruhe, Baden-Wuerttemberg, Germany +// $locid = 520340; // Dusseldorf, Nordrhein-Westfalen, Germany +// $locid = 2262656; // Melbourne, Victoria, Australia +// $locid = 2185076; // Raleigh (Wake), North Carolina, United States +// $locid = 2126955; // Lawrence (Douglas), Kansas, United States +// $locid = 919560; // Kiel, Schleswig-Holstein, Germany +// $locid = 228950; // Berlin +// $locid = 1117395; // Lubeck Hansestadt, Schleswig-Holstein, Germany +// $locid = 675661; // Graz, Steiermark, Austria +// $locid = 1992733; // Wien, Wien, Austria + +// $locid = ; 54334 // Amberg, Bayern, Germany +// $eventname = "ATE-Amberg"; +// $city = "06. Januar 2014"; + +// $locid = 1089877; // Linz, Oberoesterreich, Austria +// $eventname = "ATE-Linz"; +// $city = "16. Mai 2014"; + +// $locid = 1993029; // Wiesbaden, Hessen, Germany +// $eventname = "ATE-Wiesbaden"; +// $city = "22. Mai 2014"; + + +// $locid = 1356196; // Oberwart, Burgenland, Germany +// $eventname = "ATE-Oberwart (Korrektur)"; +// $city = "27. Juni 2014"; + + $locid = 675661; // Graz, Steiermark, Austria + $eventname = "ATE-Graz"; + $city = "13. November 2014"; + + $query = "select * from `locations` where `id`='$locid'"; + $loc = mysql_fetch_assoc(mysql_query($query)); + + $query = "SELECT ROUND(6378.137 * ACOS(0.9999999*((SIN(PI() * $loc[lat] / 180) * SIN(PI() * `locations`.`lat` / 180)) + + (COS(PI() * $loc[lat] / 180 ) * COS(PI() * `locations`.`lat` / 180) * + COS(PI() * `locations`.`long` / 180 - PI() * $loc[long] / 180)))), -1) AS `distance`, sum(`points`) as pts, `users`.* + FROM `locations` + inner join `users` on `users`.`locid` = `locations`.`id` + inner join `alerts` on `users`.`id`=`alerts`.`memid` + inner join `notary` on `users`.`id`=`notary`.`to` + WHERE (`alerts`.`general`=1 OR `alerts`.`country`=1 OR `alerts`.`regional`=1 OR `alerts`.`radius`=1) + GROUP BY `users`.`id` + HAVING `distance` <= '$maxdist' + ORDER BY `distance` "; + echo $query; + + // comment next line when starting to send mail not only to me + // $query = "select * from `users` where `email` like 'cacerttest%'"; + + $res = mysql_query($query); + $xrows = mysql_num_rows($res); + + while($row = mysql_fetch_assoc($res)) + { + // uncomment next line to send mails ... + sendmail($row['email'], "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + } + // 1x cc to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + // 1x mailing report to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + + // 1x mailing report to Arbitrator of case http://wiki.cacert.org/wiki/Arbitrations/a20090525.1 + sendmail("p.dunkel@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + echo "invitation sent to $xrows recipients.\n"; + +?> diff --git a/scripts/58at-ate-wien-email.txt b/scripts/58at-ate-wien-email.txt new file mode 100644 index 0000000..4e55b56 --- /dev/null +++ b/scripts/58at-ate-wien-email.txt @@ -0,0 +1,91 @@ +[Deutsch] + +Es hat sich viel getan im letzten Jahr. Eine ganze Reihe von bisher +eher "muendlich ueberlieferten" Regeln wurden in Policies gegossen. +Neue Prozeduren (z.B. die Assurer Challenge) und Verpflichtungen (z.B. +in dem CAcert Community Agreement) wurden beschlossen. Die Assurer +Training Events wollen versuchen, die ganzen Informationen unter's +Volk zu bringen: + +- Welcher Satz fehlt auf alten CAP Formularen? +- Warum soll ich mir R/L/O einpraegen? +- Wie verhaelst du dich, + wenn du ein fremdes Ausweisdokument das erste Mal pruefst? + +Antworten auf diese und weitere Fragen erhaelst du bei den +Assurer Training Events (ATEs). + +Darueberhinaus wird beim ATE der Vorgang der Identitaetsueberpruefung +trainiert und auditiert, um die Qualitaet der Assurances in der +taeglichen Praxis zu erfassen. Dabei gilt es moegliche Fehler und +Fallstricke zu erkennen und aufzudecken. Die Assurer haben also die +Moeglichkeit, sich mit den Fehlern auseinanderzusetzen und zu erfahren, +wie diese vermieden werden koennen. + +Wie IanG sagte: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers, and include parts which contribute +directly to our audit. Come and find out how you can also contribute. + +Die kommende Veranstaltung in deiner Naehe findet statt am: + +- Mittwoch, den 19. November 2014 +- in der Zeit von: 19:00 - ca. 22:00 Uhr +- Metalab Wien +- Rathausstrasse 6 +- 1010 Wien + + +Details zum Veranstaltungsort und Anfahrthinweise findet Ihr im +Wiki [http://wiki.cacert.org/Events/2014-11-19-ATEWien] +Blog [http://blog.cacert.org/2014/10/ate-wien-2014-11-19/] + +Teilnehmer Registrierung mit Rueckantwort: + 'Ich moechte am ATE-Wien teilnehmen' + +Das Veranstaltungs-Team freut sich schon auf Eure Teilnahme. + +Kontakt: events@cacert.org + + + +[English] + +During the last year many changes took place inside CAcert. Many "oral" +rules have been put into Policies. New procedures +(e.g. Assurer Challenge) and obligations +(e.g. CAcert Community Agreement) have been put into live. +The Assurer Training Events (ATE) try to spread this information: + +- What is missing on the "old" CAP forms? +- Why should I remember R/L/O? +- What can you do if an Assuree shows an ID document unknown to you? + +These and more questions will be answered during the +Assurer Training Events (ATEs) + +Furthermore, the ATE trains how to do assurances and audits assurances, +to measure the quality of assurances in the daily routine. Here are some +possible errors and pitfalls which need to be found. Assurers have the +opportunity to see those errors and how to avoid them. + +As IanG said: The ATE or Assurer Training Event is exceptionally +recommended for all Assurers and includes parts which contribute +directly to our audit. Come and find out how you can also contribute. + +The next event held in your area will be: + +- Wednesday, November 19th 2014 +- during: 19:00 - ca. 22:00 +- Metalab Vienna +- Rathausstrasse 6 +- 1010 Vienna + +Details to the location can be found: +Wiki [http://wiki.cacert.org/Events/2014-11-19-ATEWien] +Blog [http://blog.cacert.org/2014/10/ate-wien-2014-11-19/] + +User reply for registration: 'I will attend the ATE-Vienna' + +The event team is looking forward for your attendance: + +Contact: events@cacert.org diff --git a/scripts/58at-ate-wien-mail.php.txt b/scripts/58at-ate-wien-mail.php.txt new file mode 100644 index 0000000..fe95455 --- /dev/null +++ b/scripts/58at-ate-wien-mail.php.txt @@ -0,0 +1,134 @@ +#!/usr/bin/php -q +<? /* + LibreSSL - CAcert web application + Copyright (C) 2004-2013 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ + include_once("../includes/mysql.php"); + + $lines = ""; + $fp = fopen("58at-ate-wien-email.txt", "r"); + while(!feof($fp)) + { + $line = trim(fgets($fp, 4096)); + $lines .= wordwrap($line, 75, "\n")."\n"; + } + fclose($fp); + + +// $locid = intval($_REQUEST['location']); +// $maxdist = intval($_REQUEST['maxdist']); +// maxdist in [Km] + $maxdist = 200; + + +// location location.ID +// verified: 29.4.09 u.schroeter +// $locid = 7902857; // Paris +// $locid = 238568; // Bielefeld +// $locid = 715191; // Hamburg +// $locid = 1102495; // London +// $locid = 606058; // Frankfurt +// $locid = 1775784; // Stuttgart +// $locid = 228950; // Berlin +// $locid = 606058; // Frankfurt +// $locid = 599389; // Flensburg +// $locid = 61065; // Amsterdam, Eemnes +// $locid = 228950; // Berlin +// $locid = 2138880; // Baltimore (Baltimore (city)), Maryland, United States +// $locid = 1486658; // Potsdam +// $locid = 664715; // Goteborg, Vastra Gotaland, Sweden +// $locid = 2094781; // Mission Hills (Los Angeles), California, United States +// $locid = 423655; // Copenhagen, Kobenhavn*, Denmark +// $locid = 2093625; // Los Angeles, CA ??? +// $locid = 2094326 // Los Angeles (Los Angeles), California, United States +// $locid = 2257312; // Sydney, New South Wales, Australia +// $locid = 572764; // Essen, Nordrhein-Westfalen, Germany +// $locid = 78; // Aachen, Nordrhein-Westfalen, Germany +// $locid = 1260319; // Muenchen +// $locid = 266635; // Bonn, Nordrhein-Westfalen, Germany +// $locid = 873779; // Karlsruhe, Baden-Wuerttemberg, Germany +// $locid = 520340; // Dusseldorf, Nordrhein-Westfalen, Germany +// $locid = 2262656; // Melbourne, Victoria, Australia +// $locid = 2185076; // Raleigh (Wake), North Carolina, United States +// $locid = 2126955; // Lawrence (Douglas), Kansas, United States +// $locid = 919560; // Kiel, Schleswig-Holstein, Germany +// $locid = 228950; // Berlin +// $locid = 1117395; // Lubeck Hansestadt, Schleswig-Holstein, Germany +// $locid = 675661; // Graz, Steiermark, Austria +// $locid = 1992733; // Wien, Wien, Austria + +// $locid = ; 54334 // Amberg, Bayern, Germany +// $eventname = "ATE-Amberg"; +// $city = "06. Januar 2014"; + +// $locid = 1089877; // Linz, Oberoesterreich, Austria +// $eventname = "ATE-Linz"; +// $city = "16. Mai 2014"; + +// $locid = 1993029; // Wiesbaden, Hessen, Germany +// $eventname = "ATE-Wiesbaden"; +// $city = "22. Mai 2014"; + + +// $locid = 1356196; // Oberwart, Burgenland, Germany +// $eventname = "ATE-Oberwart (Korrektur)"; +// $city = "27. Juni 2014"; + +// $locid = 675661; // Graz, Steiermark, Austria +// $eventname = "ATE-Graz"; +// $city = "13. November 2014"; + + $locid = 1992733; // Wien, Wien, Austria + $eventname = "ATE-Wien"; + $city = "19. November 2014"; + + $query = "select * from `locations` where `id`='$locid'"; + $loc = mysql_fetch_assoc(mysql_query($query)); + + $query = "SELECT ROUND(6378.137 * ACOS(0.9999999*((SIN(PI() * $loc[lat] / 180) * SIN(PI() * `locations`.`lat` / 180)) + + (COS(PI() * $loc[lat] / 180 ) * COS(PI() * `locations`.`lat` / 180) * + COS(PI() * `locations`.`long` / 180 - PI() * $loc[long] / 180)))), -1) AS `distance`, sum(`points`) as pts, `users`.* + FROM `locations` + inner join `users` on `users`.`locid` = `locations`.`id` + inner join `alerts` on `users`.`id`=`alerts`.`memid` + inner join `notary` on `users`.`id`=`notary`.`to` + WHERE (`alerts`.`general`=1 OR `alerts`.`country`=1 OR `alerts`.`regional`=1 OR `alerts`.`radius`=1) + GROUP BY `users`.`id` + HAVING `distance` <= '$maxdist' + ORDER BY `distance` "; + echo $query; + + // comment next line when starting to send mail not only to me + // $query = "select * from `users` where `email` like 'cacerttest%'"; + + $res = mysql_query($query); + $xrows = mysql_num_rows($res); + + while($row = mysql_fetch_assoc($res)) + { + // uncomment next line to send mails ... + sendmail($row['email'], "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + } + // 1x cc to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city", $lines, "events@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + // 1x mailing report to events.cacert.org + sendmail("events@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + + // 1x mailing report to Arbitrator of case http://wiki.cacert.org/wiki/Arbitrations/a20090525.1 + sendmail("p.dunkel@cacert.org", "[CAcert.org] $eventname - $city Report", "invitation sent to $xrows recipients.", "support@cacert.org", "", "", "CAcert Events Organisation", "returns@cacert.org", 1); + echo "invitation sent to $xrows recipients.\n"; + +?> diff --git a/scripts/cron/refresh_stats.php b/scripts/cron/refresh_stats.php index 2a3d2b5..3b446ba 100755 --- a/scripts/cron/refresh_stats.php +++ b/scripts/cron/refresh_stats.php @@ -23,7 +23,7 @@ require_once(dirname(__FILE__).'/../../includes/mysql.php'); /** * Wrapper around mysql_query() to provide some error handling. Prints an error * message and dies if query fails - * + * * @param string $sql * the SQL statement to execute * @return resource|boolean @@ -35,7 +35,7 @@ function sql_query($sql) { fwrite(STDERR, "MySQL query failed:\n\"$sql\"\n".mysql_error()); die(1); } - + return $res; } @@ -54,7 +54,7 @@ function updateCache($stats) { $sql = "insert into `statscache` (`timestamp`, `cache`) values ('$timestamp', '".mysql_real_escape_string(serialize($stats))."')"; sql_query($sql); - + // Make sure the new statistic was inserted successfully $res = sql_query( "select 1 from `statscache` where `timestamp` = '$timestamp'"); @@ -62,7 +62,7 @@ function updateCache($stats) { fwrite(STDERR, "Error on inserting the new statistic"); return false; } - + sql_query("delete from `statscache` where `timestamp` != '$timestamp'"); return true; } @@ -74,22 +74,22 @@ function updateCache($stats) { */ function getDataFromLive() { echo "Calculating current statistics\n"; - + $stats = array(); $stats['verified_users'] = number_format(tc( "select count(*) as `count` from `users` where `verified` = 1 and `deleted` = 0 and `locked` = 0")); - + $stats['verified_emails'] = number_format(tc( "select count(*) as `count` from `email` where `hash` = '' and `deleted` = 0")); - + $stats['verified_domains'] = number_format(tc( "select count(*) as `count` from `domains` where `hash` = '' and `deleted` = 0")); - + $certs = tc("select count(*) as `count` from `domaincerts` where `expire` != 0"); $certs += tc("select count(*) as `count` from `emailcerts` @@ -101,7 +101,7 @@ function getDataFromLive() { $certs += tc("select count(*) as `count` from `orgemailcerts` where `expire` != 0"); $stats['verified_certificates'] = number_format($certs); - + $certs = tc("select count(*) as `count` from `domaincerts` where `revoked` = 0 and `expire` > NOW()"); $certs += tc("select count(*) as `count` from `emailcerts` @@ -113,11 +113,12 @@ function getDataFromLive() { $certs += tc("select count(*) as `count` from `orgemailcerts` where `revoked` = 0 and `expire` > NOW()"); $stats['valid_certificates'] = number_format($certs); - + $stats['assurances_made'] = number_format(tc( "select count(*) as `count` from `notary` - where `method` = '' or `method` = 'Face to Face Meeting'")); - + where (`method` = '' or `method` = 'Face to Face Meeting') + and `deleted` = 0")); + $stats['users_1to49'] = number_format(tc( "select count(*) as `count` from ( select 1 from `notary` @@ -125,7 +126,7 @@ function getDataFromLive() { group by `to` having sum(`points`) > 0 and sum(`points`) < 50 ) as `low_points`")); - + $stats['users_50to99'] = number_format(tc( "select count(*) as `count` from ( select 1 from `notary` @@ -133,7 +134,7 @@ function getDataFromLive() { group by `to` having sum(`points`) >= 50 and sum(`points`) < 100 ) as `high_points`")); - + $stats['assurer_candidates'] = number_format(tc( "select count(*) as `count` from `users` where ( @@ -148,7 +149,7 @@ function getDataFromLive() { and `cv`.`type_id`=1 )" )); - + $stats['aussurers_with_test'] = number_format(tc( "select count(*) as `count` from `users` where ( @@ -163,7 +164,7 @@ function getDataFromLive() { and `cv`.`type_id`=1 )" )); - + $stats['points_issued'] = number_format(tc( "select sum(greatest(`points`, `awarded`)) as `count` from `notary` where `deleted` = 0 @@ -177,16 +178,16 @@ function getDataFromLive() { $next_month_ts = mktime(0, 0, 0, date("m") - $i + 1, 1, date("Y")); $first = date("Y-m-d", $first_ts); $next_month = date("Y-m-d", $next_month_ts); - + echo "Calculating statistics for month $first\n"; - + $totalusers += $users = tc( - "select count(*) as `count` from `users` + "select count(*) as `count` from `users` where `created` >= '$first' and `created` < '$next_month' and `verified` = 1 and `deleted` = 0 and `locked` = 0"); - + $totassurers += $assurers = tc( "select count(*) as `count` from ( select 1 from `notary` @@ -195,7 +196,7 @@ function getDataFromLive() { and `deleted` = 0 group by `to` having sum(`points`) >= 100 ) as `assurer_candidates`"); - + $certs = tc( "select count(*) as `count` from `domaincerts` where `created` >= '$first' and `created` < '$next_month' @@ -240,16 +241,16 @@ function getDataFromLive() { $next_year_ts = mktime(0, 0, 0, 1, 1, $i + 1); $first = date("Y-m-d", $first_ts); $next_year = date("Y-m-d", $next_year_ts); - + echo "Calculating statistics for year $i\n"; - + $totalusers += $users = tc( - "select count(*) as `count` from `users` + "select count(*) as `count` from `users` where `created` >= '$first' and `created` < '$next_year' and `verified` = 1 and `deleted` = 0 and `locked` = 0"); - + $totassurers += $assurers = tc( "select count(*) as `count` from ( select 1 from `notary` @@ -258,7 +259,7 @@ function getDataFromLive() { and `deleted` = 0 group by `to` having sum(`points`) >= 100 ) as `assurer_candidates`"); - + $certs = tc( "select count(*) as `count` from `domaincerts` where `created` >= '$first' and `created` < '$next_year' @@ -286,7 +287,7 @@ function getDataFromLive() { $tmp_arr['new_users'] = number_format($users); $tmp_arr['new_assurers'] = number_format($assurers); $tmp_arr['new_certificates'] = number_format($certs); - + $stats['growth_last_years'][] = $tmp_arr; } $stats['growth_last_years_total'] = array( diff --git a/scripts/cron/warning.php b/scripts/cron/warning.php index 8f607cd..59b1aa2 100755 --- a/scripts/cron/warning.php +++ b/scripts/cron/warning.php @@ -1,5 +1,5 @@ #!/usr/bin/php -q -<? /* +<?php /* LibreSSL - CAcert web application Copyright (C) 2004-2008 CAcert Inc. @@ -18,6 +18,8 @@ */ require_once(dirname(__FILE__).'/../../includes/mysql.php'); + require_once(dirname(__FILE__).'/../../includes/lib/general.php'); + require_once(dirname(__FILE__).'/../../includes/lib/l10n.php'); $days = array("1" => "3", "15" => "2", "30" => "1", "45" => "0"); @@ -34,12 +36,13 @@ $res = mysql_query($query); while($row = mysql_fetch_assoc($res)) { + L10n::set_recipient_language(intval($row['id'])); if($row['subject'] == "") { $row['crt_name'] = str_replace("../", "www/", $row['crt_name']); $row['crt_name'] = "/home/cacert/".$row['crt_name']; $crt_name = escapeshellarg($row['crt_name']); - $subject = `openssl x509 -in $crt_name -text -noout|grep Subject:`; + $subject = runCommand("openssl x509 -in $crt_name -text -noout|grep Subject:"); $bits = explode("/", $subject); foreach($bits as $val) { @@ -107,6 +110,7 @@ echo $row['fname']." ".$row['lname']." <".$row['email']."> (memid: ".$row['memid $res = mysql_query($query); while($row = mysql_fetch_assoc($res)) { + L10n::set_recipient_language(intval($row['memid'])); if($row['subject'] == "") $row['subject'] = $row['CN']; diff --git a/scripts/db_migrations/version5.sh b/scripts/db_migrations/version5.sh new file mode 100755 index 0000000..f18f8c6 --- /dev/null +++ b/scripts/db_migrations/version5.sh @@ -0,0 +1,249 @@ +#!/bin/sh +# LibreSSL - CAcert web application +# Copyright (C) 2004-2011 CAcert Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + + + +# script to do database migrations + +set -e # script fails if any command fails + +STDIN=0 +STDOUT=1 +STDERR=2 + +if [ "$1" = "--help" ]; then + cat >&$STDERR <<- USAGE + Usage: $0 [MYSQL_OPTIONS] + You have to specify all options needed by "mysql" as if you had started + the MySQL command line client directly (including the name of the + database to operate on). The MySQL user used has to have enough + privileges to do all necessary operations (among others CREATE, ALTER, + DROP, UPDATE, INSERT, DELETE). + You might need to enter the mysql password multiple times if you + specify the -p option. + USAGE + exit 1 +fi + +mysql_opt=" --batch --skip-column-names $@" + +schema_version=$( mysql $mysql_opt <<- 'SQL' + + SELECT MAX(`version`) FROM `schema_version`; +SQL +) +if [ $schema_version != 4 ]; then + cat >&$STDERR <<- ERROR + Error: database schema is not in the right version to do the migration! + Expected version: 4 + ERROR + exit 2 +fi + +mysql $mysql_opt <<- 'SQL' + +-- Move myISAM to InnoDB bug #1172 + +ALTER TABLE `abusereports` ENGINE=INNODB; +system echo "table abusereports altered to InnoDB" + + +ALTER TABLE `addlang` ENGINE=INNODB; +system echo "table addlang altered to InnoDB" + + +ALTER TABLE `adminlog` ENGINE=INNODB; +system echo "table adminlog altered to InnoDB" + + +ALTER TABLE `advertising` ENGINE=INNODB; +system echo "table advertising altered to InnoDB" + + +ALTER TABLE `alerts` ENGINE=INNODB; +system echo "table alerts altered to InnoDB" + + +ALTER TABLE `baddomains` ENGINE=INNODB; +system echo "table baddomains altered to InnoDB" + + +ALTER TABLE `cats_passed` ENGINE=INNODB; +system echo "table cats_passed altered to InnoDB" + + +ALTER TABLE `cats_type` ENGINE=INNODB; +system echo "table cats_type altered to InnoDB" + + +ALTER TABLE `cats_variant` ENGINE=INNODB; +system echo "table cats_variant altered to InnoDB" + + +ALTER TABLE `countries` ENGINE=INNODB; +system echo "table countries altered to InnoDB" + + +ALTER TABLE `disputedomain` ENGINE=INNODB; +system echo "table disputedomain altered to InnoDB" + + +ALTER TABLE `disputeemail` ENGINE=INNODB; +system echo "table disputeemail altered to InnoDB" + +ALTER TABLE `domaincerts` ENGINE=INNODB; +system echo "table domainderts altered to InnoDB" + + +ALTER TABLE `domains` ENGINE=INNODB; +system echo "table domains altered to InnoDB" + + +ALTER TABLE `domlink` ENGINE=INNODB; +system echo "table domlink altered to InnoDB" + + +ALTER TABLE `email` ENGINE=INNODB; +system echo "table email altered to InnoDB" + + +ALTER TABLE `emailcerts` ENGINE=INNODB; +system echo "table emailcerts altered to InnoDB" + + +ALTER TABLE `emaillink` ENGINE=INNODB; +system echo "table emaillink altered to InnoDB" + + +ALTER TABLE `gpg` ENGINE=INNODB; +system echo "table gpg altered to InnoDB" + + +ALTER TABLE `languages` ENGINE=INNODB; +system echo "table languages altered to InnoDB" + + +ALTER TABLE `localias` ENGINE=INNODB; +system echo "table localias altered to InnoDB" + + +ALTER TABLE `locations` ENGINE=INNODB; +system echo "table locations altered to InnoDB" + + +ALTER TABLE `news` ENGINE=INNODB; +system echo "table news altered to InnoDB" + + +ALTER TABLE `notary` ENGINE=INNODB; +system echo "table notary altered to InnoDB" + + +ALTER TABLE `org` ENGINE=INNODB; +system echo "table org altered to InnoDB" + + +ALTER TABLE `orgadminlog` ENGINE=INNODB; +system echo "table orgadminlog altered to InnoDB" + + +ALTER TABLE `orgdomaincerts` ENGINE=INNODB; +system echo "table orgdomaincerts altered to InnoDB" + + +ALTER TABLE `orgdomains` ENGINE=INNODB; +system echo "table orgdomains altered to InnoDB" + + +ALTER TABLE `orgdomlink` ENGINE=INNODB; +system echo "table orgdomlink altered to InnoDB" + + +ALTER TABLE `orgemailcerts` ENGINE=INNODB; +system echo "table orgemailcerts altered to InnoDB" + + +ALTER TABLE `orgemaillink` ENGINE=INNODB; +system echo "table orgemaillink altered to InnoDB" + + +ALTER TABLE `orginfo` ENGINE=INNODB; +system echo "table orginfo altered to InnoDB" + + +ALTER TABLE `otphashes` ENGINE=INNODB; +system echo "table otphashes altered to InnoDB" + + +ALTER TABLE `pinglog` ENGINE=INNODB; +system echo "table pinglog altered to InnoDB" + + +ALTER TABLE `regions` ENGINE=INNODB; +system echo "table regions altered to InnoDB" + + +ALTER TABLE `root_certs` ENGINE=INNODB; +system echo "table root_certs altered to InnoDB" + + +ALTER TABLE `schema_version` ENGINE=INNODB; +system echo "table schema_version altered to InnoDB" + + +ALTER TABLE `stampcache` ENGINE=INNODB; +system echo "table stampcache altered to InnoDB" + + +ALTER TABLE `statscache` ENGINE=INNODB; +system echo "table statscache altered to InnoDB" + + +ALTER TABLE `tickets` ENGINE=INNODB; +system echo "table tickets altered to InnoDB" + + +ALTER TABLE `tverify` ENGINE=INNODB; +system echo "table tverify altered to InnoDB" + + +ALTER TABLE `tverify-vote` ENGINE=INNODB; +system echo "table tverify-vote altered to InnoDB" + + +ALTER TABLE `user_agreements` ENGINE=INNODB; +system echo "table user_agreements altered to InnoDB" + + +ALTER TABLE `userlocations` ENGINE=INNODB; +system echo "table userlocations altered to InnoDB" + + +ALTER TABLE `users` ENGINE=INNODB; +system echo "table users altered to InnoDB" + + + -- Update schema version number + INSERT INTO `schema_version` + (`version`, `when`) VALUES + ('5' , NOW() ); +SQL + + +echo "Database successfully migrated to version 5" +exit 0 + diff --git a/scripts/send_policy_cca_20140916.php b/scripts/send_policy_cca_20140916.php new file mode 100644 index 0000000..6de5207 --- /dev/null +++ b/scripts/send_policy_cca_20140916.php @@ -0,0 +1,137 @@ +#!/usr/bin/php -q +<?php +/* + LibreSSL - CAcert web application + Copyright (C) 2004-2009 CAcert Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; version 2 of the License. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA +*/ +include_once("../includes/mysql.php"); + +// read texts + +$lines_EN = <<<EOF + +We want to inform you about some recent policy changes within CAcert. + +On 2014-07-28, CAcert's policy group voted to accept a new version of the CAcert Community Agreement (short: CCA) into DRAFT status. This makes it a binding policy from that date. + +The CCA is the core document that an user has to accept to become and to remain a member of the CAcert community. The previous CCA version has been in place for about five years, the policy group saw some need to update it and to improve and clarify some topics. + +You can find the current version of the CCA at: +http://www.cacert.org/policy/CAcertCommunityAgreement.php + +The changes are currently highlighted in blue. You can find a summary of the major changes, at the end of this mail. + +Currently the changes are in DRAFT status, which makes them binding, but also gives some room to address them. We plan to change the status to POLICY on about 2014-10-15. + +If you do not accept the CCA changes, please send an email to support@cacert.org no later than 2014-10-15 to request termination of your CAcert membership. Terminating your membership will cause the revocation of all your certificates, disabling your login to the CAcert web interface and the anonymisation of your personal data. + +If you accept the CCA changes, no action is needed. + +Moreover, we want to inform you about a software change that is planned to be installed, soon. When it is installed, the CAcert website will check, if the user has already accepted the CCA at each login. If this is not the case, the user will be presented with the option to either accept the CCA or to leave the page. + +By doing this we will ensure that only users who have accepted the CCA, and by this may be called members of CAcert community will be able to login and issue new certificates. This change will only affect users who have neither issued a new certificate nor participated in assurances for some while. + +The reason for this change is that every member who has agreed to the CCA, should be able to rely on the fact that all other users of CAcert have also agreed to it. For historic reasons this is not always the case, yet. + +Last but not least, the following policies were set to POLICY status on 2014-08-14. They have all been in DRAFT status without any further changes for at least a year: + + * Policy on Policy ("PoP" => COD1) + * Configuration-Control Specification ("CCS" => COD2) + * Certification Practice Statement ("CPS" => COD6) + * Dispute Resolution Policy ("DRP" => COD7) + * Security Policy ("SP" => COD8) + * Organisation Assurance Policy ("OAP" => COD11) + * Root Distribution License ("RDL" => COD14) + * Organisation Assurance Subsidary Policy - Germany (COD11.DE) + * Organisation Assurance Subsidary Policy - Europe (COD11.EU) + * Organisation Assurance Subsidary Policy - Australia (COD11.AU) + * TTP-Assisted Assurance Policy ("TTP-Assist" => COD13.2) + +We are working hard to update all the documents so that they show their policy status. As the content has not been changed and will remain the same, we decided to inform you about this even though we have not finished, yet. + +You can find the above polices at: +https://svn.cacert.org/CAcert/Policies/ControlledDocumentList.html + +As most of those polices have not been reviewed for a while, you probably will see some more updates to CAcert policies coming soon. Those changes will be an important step to be able to pass an audit, which is one of our current goals. + +Every CAcert member interested in participating in the design of our policies, is invited to join our policy group mailing list at: +https://lists.cacert.org/wws/info/cacert-policy + +Major changes for the CCA: + * The CCA was changed to clearly be a general terms and conditions what makes it easier to join and exit as CAcert member. For CAcert it was obvious to do the change, because all CAcert members sign the same conditions without the possibility to strike or add personal clauses. + * More ways to accept the CCA were added. + * Termination of membership was clarified some more. Some other options beside the ruling of an Arbitrator were cautiously added. + * You have a new obligation to answer in arbitration cases. This seems to be obvious, but you never signed it before. In the past this was derived from some points within our Dispute Resolution Policy (DRP). + * Sharing of accounts and credentials was banned more clearly. Also the obligation to only use a certificate in the appropriate contexts was added. It was already part of the Certification Practice Statement (CPS). + * Some kinds of contributions as personal data are now excepted from the non-exclusive non-restrictive non-revocable transfer of licence to CAcert. + * Official communication with CAcert was simplified. + * Some deprecated references were removed. + +A version with all changes can be found at: +https://svn.cacert.org/CAcert/Policies/CAcertCommunityAgreement_20140708.html + +Sincerely, +Eva Stöwe +CAcert Policy Officer +EOF; + +$lines_EN = wordwrap($lines_EN, 75, "\n"); +$lines_EN = mb_convert_encoding($lines_EN, "HTML-ENTITIES", "UTF-8"); + + +// read last used id +$lastid = 0; +if (file_exists("send_policy_cca20140915_lastid.txt")) +{ + $fp = fopen("send_policy_cca20140915_lastid.txt", "r"); + $lastid = trim(fgets($fp, 4096)); + fclose($fp); +} + +echo "ID now: $lastid\n"; + + +$count = 0; + +$query = " + + SELECT `fname`, `lname`, `email` + FROM `users` + WHERE `deleted` = '0000-00-00 00:00:00' + AND `modified` != '0000-00-00 00:00:00' + AND `verified` = '1' + + ORDER BY `id`"; + +$res = mysql_query($query); + +while($row = mysql_fetch_assoc($res)) +{ + $mailtxt = "Dear ${row["fname"]} ${row["lname"]},\n".$lines_EN."\n\n"; + + sendmail($row['email'], "[CAcert.org] CAcert Community Agreement (CCA)", $mailtxt, "support@cacert.org", "", "", "CAcert", "returns@cacert.org", ""); + + $fp = fopen("send_policy_cca20140915_lastid.txt", "w"); + fputs($fp, $row["id"]."\n"); + fclose($fp); + + $count++; + echo "Sent ${count}th mail. User ID: ${row["id"]}\n"; + + if(0 == $count % 5) { + sleep (1); + } +} diff --git a/stamp/common.php b/stamp/common.php index ff814dd..d99a23a 100644 --- a/stamp/common.php +++ b/stamp/common.php @@ -41,9 +41,9 @@ if($row['certid'] > 0) { if($row['org'] == 0) - $query = "select * from `domaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0"; + $query = "select * from `domaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0"; else - $query = "select * from `orgdomaincerts` where `id`='$row[certid]' and `expire`>NOW() and `revoked`=0"; + $query = "select * from `orgdomaincerts` where `id`='".intval($row['certid'])."' and `expire`>NOW() and `revoked`=0"; if($_REQUEST['debug'] == 1) echo $query."<br>\n"; $res = mysql_query($query); @@ -117,7 +117,7 @@ if($org == 0) { $query = "SELECT *, sum(`points`) AS `total` FROM `users`, `notary` WHERE `users`.`id` = '$cert[memid]' AND - `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' GROUP BY `notary`.`to`"; + `notary`.`to` = `users`.`id` and `notary`.`when` <= '$cert[issued]' and `notary`.`deleted`=0 GROUP BY `notary`.`to`"; $user = mysql_fetch_assoc(mysql_query($query)); } else { $query = "select * from `orginfo` where `id`='$cert[orgid]'"; diff --git a/www/api/ccsr.php b/www/api/ccsr.php index 403882f..3bfe55a 100644 --- a/www/api/ccsr.php +++ b/www/api/ccsr.php @@ -31,7 +31,7 @@ require_once '../../includes/lib/check_weak_key.php'; foreach($_REQUEST['email'] as $email) { $email = mysql_real_escape_string(trim($email)); - $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0 and `email`='$email'"; + $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0 and `email`='$email'"; $res = mysql_query($query); if(mysql_num_rows($res) > 0) { @@ -42,7 +42,7 @@ require_once '../../includes/lib/check_weak_key.php'; } if(count($emails) <= 0) die("404,Wasn't able to match any emails sent against your account"); - $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`"; + $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`"; $row = mysql_fetch_assoc(mysql_query($query)); $points = $row['points']; @@ -62,12 +62,12 @@ require_once '../../includes/lib/check_weak_key.php'; $codesign = 1; $CSR = trim($_REQUEST['optionalCSR']); - + if (($weakKey = checkWeakKeyCSR($CSR)) !== "") { die("403, $weakKey"); } - + $incsr = tempnam("/tmp", "ccsrIn"); $checkedcsr = tempnam("/tmp", "ccsrOut"); $fp = fopen($incsr, "w"); @@ -75,7 +75,7 @@ require_once '../../includes/lib/check_weak_key.php'; fclose($fp); $incsr_esc = escapeshellarg($incsr); $checkedcsr_esc = escapeshellarg($checkedcsr); - $do = `/usr/bin/openssl req -in $incsr_esc -out $checkedcsr_esc`; + $do = shell_exec("/usr/bin/openssl req -in $incsr_esc -out $checkedcsr_esc"); @unlink($incsr); if(filesize($checkedcsr) <= 0) die("404,Invalid or missing CSR"); @@ -84,9 +84,9 @@ require_once '../../includes/lib/check_weak_key.php'; foreach($emails as $id => $email) $csrsubject .= "/emailAddress=".$email; - $query = "insert into `emailcerts` set `CN`='".$user['email']."', `keytype`='MS', - `memid`='".$user['id']."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), - `subject`='$csrsubject', `codesign`='$codesign'"; + $query = "insert into `emailcerts` set `CN`='".mysql_real_escape_string($user['email'])."', `keytype`='MS', + `memid`='".intval($user['id'])."', `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()), + `subject`='".mysql_real_escape_string($csrsubject)."', `codesign`='".intval($codesign)."'"; mysql_query($query); $certid = mysql_insert_id(); $CSRname = generatecertpath("csr","client",$certid); @@ -95,14 +95,14 @@ require_once '../../includes/lib/check_weak_key.php'; mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='$certid'"); foreach($emails as $emailid => $email) - mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='$emailid'"); + mysql_query("insert into `emaillink` set `emailcertsid`='$certid', `emailid`='".intval($emailid)."'"); - $do = `../../scripts/runclient`; + $do = shell_exec("../../scripts/runclient"); sleep(10); // THIS IS BROKEN AND SHOULD BE FIXED $query = "select * from `emailcerts` where `id`='$certid' and `crt_name` != ''"; $res = mysql_query($query); if(mysql_num_rows($res) <= 0) - die("404,Your certificate request has failed. ID: $certid"); + die("404,Your certificate request has failed. ID: ".intval($certid)); $cert = mysql_fetch_assoc($res); echo "200,Authentication Ok\n"; readfile("../".$cert['crt_name']); diff --git a/www/api/cemails.php b/www/api/cemails.php index 0d067ea..f937069 100644 --- a/www/api/cemails.php +++ b/www/api/cemails.php @@ -25,7 +25,7 @@ echo "200,Authentication Ok\n"; $user = mysql_fetch_assoc($res); $memid = $user['id']; - $query = "select sum(`points`) as `points` from `notary` where `to`='$memid' group by `to`"; + $query = "select sum(`points`) as `points` from `notary` where `to`='".intval($memid)."' and `notary`.`deleted`=0 group by `to`"; $row = mysql_fetch_assoc(mysql_query($query)); $points = $row['points']; echo "CS=".intval($user['codesign'])."\n"; @@ -40,8 +40,9 @@ if($user['mname'] != "" && $user['suffix'] != "") echo "NAME=".sanitizeHTML($user['fname'])." ".sanitizeHTML($user['mname'])." ".sanitizeHTML($user['lname'])." ".sanitizeHTML($user['suffix'])."\n"; } - $query = "select * from `email` where `memid`='$memid' and `hash`='' and `deleted`=0"; + $query = "select * from `email` where `memid`='".intval($memid)."' and `hash`='' and `deleted`=0"; $res = mysql_query($query); - while($row = mysql_fetch_assoc($res)) - echo "EMAIL=".$row['email']."\n"; + while($row = mysql_fetch_assoc($res)) { + echo "EMAIL=".sanitizeHTML($row['email'])."\n"; + } ?> diff --git a/www/disputes.php b/www/disputes.php index 34a447a..96c7c75 100644 --- a/www/disputes.php +++ b/www/disputes.php @@ -18,6 +18,7 @@ <? require_once("../includes/loggedin.php"); require_once("../includes/notary.inc.php"); + require_once("../includes/lib/l10n.php"); loadem("account"); @@ -287,11 +288,15 @@ `IP`='".$_SERVER['REMOTE_ADDR']."'"; mysql_query($query); + $my_translation = L10n::get_translation(); + L10n::set_recipient_language($oldmemid); + $body = sprintf(_("You have been sent this email as the email address '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $email)."\n\n"; $body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=email&emailid=$emailid&hash=$hash\n\n"; $body .= _("Best regards")."\n"._("CAcert.org Support!"); sendmail($email, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "", "", "CAcert Support"); + L10n::set_translation($my_translation); showheader(_("Email Dispute")); printf(_("The email address '%s' has been entered into the dispute system, the email address will now be sent an email which will give the recipent the option of accepting or rejecting the request, if after 2 days we haven't received a valid response for or against we will discard the request."), sanitizeHTML($email)); @@ -447,10 +452,13 @@ $query = "insert into `disputedomain` set `domain`='$domain',`memid`='".$_SESSION['profile']['id']."', `oldmemid`='$oldmemid',`created`=NOW(),`hash`='$hash',`id`='$domainid'"; mysql_query($query); + $my_translation = L10n::get_translation(); + L10n::set_recipient_language($oldmemid); $body = sprintf(_("You have been sent this email as the domain '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $domain)."\n\n"; $body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=domain&domainid=$domainid&hash=$hash\n\n"; $body .= _("Best regards")."\n"._("CAcert.org Support!"); + L10n::set_recipient_language($my_translation); sendmail($authaddy, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "", "", "CAcert Support"); diff --git a/www/gpg.php b/www/gpg.php index 263c1d3..cb72475 100644 --- a/www/gpg.php +++ b/www/gpg.php @@ -63,12 +63,18 @@ if(0) function verifyName($name) { if($name == "") return 0; - if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']) return 1; - if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']) return 1; - if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1; - if($name == $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix']) return 1; - return 0; + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname'])) return 1; // John Doe + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname'])) return 1; // John Joseph Doe + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0]." ".$_SESSION['profile']['lname'])) return 1; // John J Doe + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0].". ".$_SESSION['profile']['lname'])) return 1; // John J. Doe + + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; // John Doe Jr. + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname']." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John Joseph Doe Jr. + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0]." ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John J Doe Jr. + if(!strcasecmp($name, $_SESSION['profile']['fname']." ".$_SESSION['profile']['mname'][0].". ".$_SESSION['profile']['lname']." ".$_SESSION['profile']['suffix'])) return 1; //John J. Doe Jr. + + return 0; } function verifyEmail($email) @@ -106,7 +112,7 @@ function verifyEmail($email) clean_gpgcsr($CSR), $gpg); - `rm -r $tmpdir`; + shell_exec("rm -r $tmpdir"); } if ($err) @@ -334,7 +340,7 @@ function verifyEmail($email) $cmd_keyid = escapeshellarg($keyid); - $gpg = trim(`gpg --homedir $cwd --with-colons --fixed-list-mode --list-keys $cmd_keyid 2>&1`); + $gpg = trim(shell_exec("gpg --homedir $cwd --with-colons --fixed-list-mode --list-keys $cmd_keyid 2>&1")); $lines = ""; $gpgarr = explode("\n", $gpg); foreach($gpgarr as $line) @@ -519,7 +525,7 @@ function verifyEmail($email) $csrname=generatecertpath("csr","gpg",$insert_id); $cmd_keyid = escapeshellarg($keyid); - $do=`gpg --homedir $cwd --batch --export-options export-minimal --export $cmd_keyid >$csrname`; + $do=shell_exec("gpg --homedir $cwd --batch --export-options export-minimal --export $cmd_keyid >$csrname"); mysql_query("update `gpg` set `csr`='$csrname' where `id`='$insert_id'"); waitForResult('gpg', $insert_id); diff --git a/www/index.php b/www/index.php index c7cc03e..e6fc06a 100644 --- a/www/index.php +++ b/www/index.php @@ -17,7 +17,7 @@ */ require_once('../includes/lib/l10n.php'); - +require_once('../includes/notary.inc.php'); $id = 0; if(array_key_exists("id",$_REQUEST)) $id=intval($_REQUEST['id']); $oldid = 0; if(array_key_exists("oldid",$_REQUEST)) $oldid=intval($_REQUEST['oldid']); @@ -125,7 +125,7 @@ require_once('../includes/lib/l10n.php'); showfooter(); exit; } - } + } } if($oldid == 5 && $process != "") @@ -148,18 +148,19 @@ require_once('../includes/lib/l10n.php'); } } + //client login if($id == 4 && $_SERVER['HTTP_HOST'] == $_SESSION['_config']['securehostname']) { include_once("../includes/lib/general.php"); $user_id = get_user_id_from_cert($_SERVER['SSL_CLIENT_M_SERIAL'], $_SERVER['SSL_CLIENT_I_DN_CN']); - + if($user_id >= 0) { $_SESSION['profile'] = mysql_fetch_assoc(mysql_query( - "select * from `users` where + "select * from `users` where `id`='$user_id' and `deleted`=0 and `locked`=0")); - + if($_SESSION['profile']['id'] != 0) { $_SESSION['profile']['loggedin'] = 1; @@ -171,79 +172,13 @@ require_once('../includes/lib/l10n.php'); } } + if($id == 4 && array_key_exists('profile',$_SESSION) && array_key_exists('loggedin',array($_SESSION['profile'])) && $_SESSION['profile']['loggedin'] == 1) { header("location: https://".$_SERVER['HTTP_HOST']."/account.php"); exit; } - function getOTP64($otp) - { - $lookupChar = "123456789abcdefhkmnprstuvwxyzABCDEFGHKMNPQRSTUVWXYZ=+[]&@#*!-?%:"; - - for($i = 0; $i < 6; $i++) - $val[$i] = hexdec(substr($otp, $i * 2, 2)); - - $tmp1 = $val[0] >> 2; - $OTP = $lookupChar[$tmp1 & 63]; - $tmp2 = $val[0] - ($tmp1 << 2); - $tmp1 = $val[1] >> 4; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 63]; - $tmp2 = $val[1] - ($tmp1 << 4); - $tmp1 = $val[2] >> 6; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 63]; - $tmp2 = $val[2] - ($tmp1 << 6); - $OTP .= $lookupChar[$tmp2 & 63]; - $tmp1 = $val[3] >> 2; - $OTP .= $lookupChar[$tmp1 & 63]; - $tmp2 = $val[3] - ($tmp1 << 2); - $tmp1 = $val[4] >> 4; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 63]; - $tmp2 = $val[4] - ($tmp1 << 4); - $tmp1 = $val[5] >> 6; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 63]; - $tmp2 = $val[5] - ($tmp1 << 6); - $OTP .= $lookupChar[$tmp2 & 63]; - - return $OTP; - } - - function getOTP32($otp) - { - $lookupChar = "0123456789abcdefghkmnoprstuvwxyz"; - - for($i = 0; $i < 7; $i++) - $val[$i] = hexdec(substr($otp, $i * 2, 2)); - - $tmp1 = $val[0] >> 3; - $OTP = $lookupChar[$tmp1 & 31]; - $tmp2 = $val[0] - ($tmp1 << 3); - $tmp1 = $val[1] >> 6; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 31]; - $tmp2 = ($val[1] - ($tmp1 << 6)) >> 1; - $OTP .= $lookupChar[$tmp2 & 31]; - $tmp2 = $val[1] - (($val[1] >> 1) << 1); - $tmp1 = $val[2] >> 4; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 31]; - $tmp2 = $val[2] - ($tmp1 << 4); - $tmp1 = $val[3] >> 7; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 31]; - $tmp2 = ($val[3] - ($tmp1 << 7)) >> 2; - $OTP .= $lookupChar[$tmp2 & 31]; - $tmp2 = $val[3] - (($val[3] - ($tmp1 << 7)) >> 2) << 2; - $tmp1 = $val[4] >> 5; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 31]; - $tmp2 = $val[4] - ($tmp1 << 5); - $OTP .= $lookupChar[$tmp2 & 31]; - $tmp1 = $val[5] >> 3; - $OTP .= $lookupChar[$tmp1 & 31]; - $tmp2 = $val[5] - ($tmp1 << 3); - $tmp1 = $val[6] >> 6; - $OTP .= $lookupChar[($tmp1 + $tmp2) & 31]; - - return $OTP; - } - if($oldid == 4) { $oldid = 0; @@ -256,70 +191,24 @@ require_once('../includes/lib/l10n.php'); $query = "select * from `users` where `email`='$email' and (`password`=old_password('$pword') or `password`=sha1('$pword') or `password`=password('$pword')) and `verified`=1 and `deleted`=0 and `locked`=0"; $res = mysql_query($query); - if(mysql_num_rows($res) <= 0) - { - $otpquery = "select * from `users` where `email`='$email' and `otphash`!='' and `verified`=1 and `deleted`=0 and `locked`=0"; - $otpres = mysql_query($otpquery); - if(mysql_num_rows($otpres) > 0) - { - $otp = mysql_fetch_assoc($otpres); - $otphash = $otp['otphash']; - $otppin = $otp['otppin']; - if(strlen($pword) == 6) - { - $matchperiod = 18; - $time = round(gmdate("U") / 10); - } else { - $matchperiod = 3; - $time = round(gmdate("U") / 60); - } - - $query = "delete from `otphashes` where UNIX_TIMESTAMP(`when`) <= UNIX_TIMESTAMP(NOW()) - 600"; - mysql_query($query); - - $query = "select * from `otphashes` where `username`='$email' and `otp`='$pword'"; - if(mysql_num_rows(mysql_query($query)) <= 0) - { - $query = "insert into `otphashes` set `when`=NOW(), `username`='$email', `otp`='$pword'"; - mysql_query($query); - for($i = $time - $matchperiod; $i <= $time + $matchperiod * 2; $i++) - { - if($otppin > 0) - $tmpmd5 = md5("$i$otphash$otppin"); - else - $tmpmd5 = md5("$i$otphash"); - - if(strlen($pword) == 6) - $md5 = substr(md5("$i$otphash"), 0, 6); - else if(strlen($pword) == 8) - $md5 = getOTP64(md5("$i$otphash")); - else - $md5 = getOTP32(md5("$i$otphash")); - - if($pword == $md5) - $res = mysql_query($otpquery); - } - } - } - } if(mysql_num_rows($res) > 0) { $_SESSION['profile'] = ""; unset($_SESSION['profile']); $_SESSION['profile'] = mysql_fetch_assoc($res); - $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".$_SESSION['profile']['id']."'"; + $query = "update `users` set `modified`=NOW(), `password`=sha1('$pword') where `id`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); if($_SESSION['profile']['language'] == "") { $query = "update `users` set `language`='".L10n::get_translation()."' - where `id`='".$_SESSION['profile']['id']."'"; + where `id`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); } else { L10n::set_translation($_SESSION['profile']['language']); L10n::init_gettext(); } - $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`"; + $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['profile']['id'])."' and `deleted`=0 group by `to`"; $res = mysql_query($query); $row = mysql_fetch_assoc($res); $_SESSION['profile']['points'] = $row['total']; @@ -331,12 +220,16 @@ require_once('../includes/lib/l10n.php'); $_SESSION['_config']['errmsg'] .= _("For your own security you must enter 5 lost password questions and answers.")."<br>"; $_SESSION['_config']['oldlocation'] = "account.php?id=13"; } + if (!isset($_SESSION['_config']['oldlocation'])){ + $_SESSION['_config']['oldlocation']=''; + } if (checkpwlight($pword) < 3) $_SESSION['_config']['oldlocation'] = "account.php?id=14&force=1"; - if($_SESSION['_config']['oldlocation'] != "") + if($_SESSION['_config']['oldlocation'] != ""){ header("location: https://".$_SERVER['HTTP_HOST']."/".$_SESSION['_config']['oldlocation']); - else + }else{ header("location: https://".$_SERVER['HTTP_HOST']."/account.php"); + } exit; } @@ -351,6 +244,40 @@ require_once('../includes/lib/l10n.php'); } } +// check for CCA acceptance prior to login +if ($oldid == 52 ) +{ + // Check if the user is already authenticated + if (!array_key_exists('profile',$_SESSION) + || !array_key_exists('loggedin',$_SESSION['profile']) + || $_SESSION['profile']['loggedin'] != 1) + { + header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4"); + exit; + } + + if (array_key_exists('agree',$_REQUEST) && $_REQUEST['agree'] != "") + { + write_user_agreement($_SESSION['profile']['id'], "CCA", "Login acception", "", 1); + $_SESSION['profile']['ccaagreement']=get_user_agreement_status($_SESSION['profile']['id'],'CCA'); + + if (array_key_exists("oldlocation",$_SESSION['_config']) + && $_SESSION['_config']['oldlocation']!="") + { + header("Location: https://{$_SERVER['HTTP_HOST']}/{$_SESSION['_config']['oldlocation']}"); + exit; + } else { + header("Location: https://{$_SERVER['HTTP_HOST']}/account.php"); + exit; + } + } + + // User didn't agree + header("Location: https://{$_SERVER['HTTP_HOST']}/index.php?id=4"); + exit; +} + + if($process && $oldid == 1) { $id = 2; @@ -499,7 +426,7 @@ require_once('../includes/lib/l10n.php'); if($checkemail != "OK") { $id = 1; - if (substr($checkemail, 0, 1) == "4") + if (substr($checkemail, 0, 1) == "4") { $_SESSION['_config']['errmsg'] .= _("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes."); } else { @@ -545,7 +472,6 @@ require_once('../includes/lib/l10n.php'); `regional`='".$_SESSION['signup']['regional']."', `radius`='".$_SESSION['signup']['radius']."'"; mysql_query($query); - include_once("../includes/notary.inc.php"); write_user_agreement($memid, "CCA", "account creation", "", 1); $body = _("Thanks for signing up with CAcert.org, below is the link you need to open to verify your account. Once your account is verified you will be able to start issuing certificates till your hearts' content!")."\n\n"; @@ -566,9 +492,9 @@ require_once('../includes/lib/l10n.php'); $subject = stripslashes($_REQUEST['subject']); $message = stripslashes($_REQUEST['message']); $secrethash = $_REQUEST['secrethash2']; - + //check for spam via honeypot - if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){ + if(!isset($_REQUEST['robotest']) || !empty($_REQUEST['robotest'])){ echo _("Form could not be sent."); showfooter(); exit; @@ -641,7 +567,7 @@ require_once('../includes/lib/l10n.php'); $newUrl = $protocol . '://wiki.cacert.org/FAQ/AboutUs'; header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved } - + if ($id == 19) { $protocol = $_SERVER['HTTPS'] ? 'https' : 'http'; @@ -655,7 +581,7 @@ require_once('../includes/lib/l10n.php'); $newUrl = $protocol . '://wiki.cacert.org/Board'; header('Location: '.$newUrl, true, 301); // 301 = Permanently Moved } - + showheader(_("Welcome to CAcert.org")); includeit($id); showfooter(); diff --git a/www/policy/CAcertCommunityAgreement.php b/www/policy/CAcertCommunityAgreement.php index 3106eb1..17065f1 100644 --- a/www/policy/CAcertCommunityAgreement.php +++ b/www/policy/CAcertCommunityAgreement.php @@ -1,512 +1,593 @@ -<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> - -<html> -<head><title>CAcert Community Agreement</title></head> +<?='<?xml version="1.0" encoding="utf-8"?>'?> +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" + "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + <meta http-equiv="CONTENT-TYPE" content="text/html; charset=utf-8" /> + <title> CAcert Community Agreement </title> +<style type="text/css"> +<!-- +.comment { + color : steelblue; +} +.first-does-not-work { + color : red; +} +.q { + color : green; + font-weight: bold; + text-align: center; + font-style:italic; +} +.change { + color : blue; + font-weight: bold; +} +.change2 { + color : blue; + font-weight: bold; +} +.change3 { + color : blue; + font-weight: bold; +} +.change4 { + color : blue; + font-weight: bold; +} +.change5 { + color : blue; + font-weight: bold; +} +.change6 { + color : blue; + font-weight: bold; +} +.change7 { + color : blue ; + font-weight: bold; +} +.change8 { + color : blue; + font-weight: bold; +} +.change9 { + color : blue; + font-weight: bold; +} +.change10 { + color : blue; + font-weight: bold; +} +.change11 { + color : blue; + font-weight: bold; +} +.change12 { + color : blue; + font-weight: bold; +} +.change13 { + color : blue; + font-weight: bold; +} +.strike { + color : blue; + text-decoration:line-through; +} +.strike2 { + color : blue; + text-decoration:line-through; +} +.strike4 { + color : blue; + text-decoration:line-through; +} +.strike5 { + color : blue; + text-decoration:line-through; +} +.strike6 { + color : blue; + text-decoration:line-through; +} +.strike7 { + color : blue; + text-decoration:line-through; +} +.strike8 { + color : blue; + text-decoration:line-through; +} +.strike9 { + color : blue; + text-decoration:line-through; +} +.strike10 { + color : blue; + text-decoration:line-through; +} +.strike11 { + color : blue; + text-decoration:line-through; +} +.strike12 { + color : blue; + text-decoration:line-through; +} +.strike13 { + color : blue; + text-decoration:line-through; +} +--> +</style> + +</head> <body> + <div class="comment"> + <table width="100%"> + + <tr> + <td rowspan="2"> + Name: CCA <a style="color: steelblue" href="https://svn.cacert.org/CAcert/Policies/ControlledDocumentList.html">COD9</a><br /> + Status: POLICY <a style="color: steelblue" href="https://wiki.cacert.org/PolicyDecisions#p20080109.1_CCA_to_POLICY_status">p20080109.1</a><br /> + <span class="draftadd">DRAFT <a style="color: steelblue" href="https://wiki.cacert.org/PolicyDecisions#p20140709_CCA_update_to_DRAFT">p20140709</a></span> <br /> + Editor: <a style="color: steelblue" href="https://wiki.cacert.org/Community/HomePagesMembers/BenediktHeintel">Benedikt</a><br /> + Licence: <a style="color: steelblue" href="https://wiki.cacert.org/Policy#Licence" title="this document is Copyright © CAcert Inc., licensed openly under CC-by-sa with all disputes resolved under DRP. More at wiki.cacert.org/Policy">CC-by-sa+DRP</a><br /> + + </td> + <td valign="top" align="right"> + <a href="https://www.cacert.org/policy/PolicyOnPolicy.php"><img src="images/cacert-policy.png" alt="CCA Status - POLICY" height="31" width="88" style="border-style: none;" /></a> + + <!-- XXXXXXXXXXXXXX delete this going to POLICY --> + <br /> + <a href="https://www.cacert.org/policy/PolicyOnPolicy.php"><img src="images/cacert-draft.png" alt="CCA Status - DRAFT" height="31" width="88" style="border-style: none;" /></a> + + </td> + </tr> + </table> + </div> + + <h2>CAcert Community Agreement</h2> + + <h3><a name="0">0.</a> Introduction</h3> + + <p>This agreement is between you, being a registered member ("Member") within + CAcert's community at large ("Community") and CAcert Incorporated ("CAcert"), + being an operator of services to the Community.</p> + + <h4><a name="0.1">0.1</a> Terms</h4> + + <ol> + <li>"CAcert" means CAcert Inc., a non-profit Association of Members + incorporated in New South Wales, Australia. Note that Association Members + are distinct from the Members defined here.</li> + + <li>"Member" means you, a registered participant within CAcert's Community, + with an account on the website and the facility to request certificates. + Members may be individuals ("natural persons") or organisations ("legal + persons").</li> + + <li>"Organisation" is defined under the Organisation Assurance programme, + and generally includes corporations and other entities that become Members + and become Assured.</li> + + <li>"Community" means all of the Members that are registered by this + agreement and other parties by other agreements, all being under CAcert's + Arbitration.</li> + + <li>"Non-Related Person" ("NRP"), being someone who is not a Member, is not + part of the Community, and has not registered their agreement. <span class= + "strike7">Such people are offered the NRP-DaL another agreement allowing + the USE of certificates.</span></li> + + <li><span class="strike7">"Non-Related Persons - Disclaimer and Licence" + ("NRP-DaL"), another agreement that is offered to persons outside the + Community.</span><span class="change7">(withdrawn)</span></li> + + <li>"Arbitration" is the Community's forum for resolving disputes, or + jurisdiction.</li> + + <li>"Dispute Resolution Policy" ("DRP" => COD7) is the policy and rules + for resolving disputes.</li> + + <li>"USE" means the act by your software to conduct its tasks, + incorporating the certificates according to software procedures.</li> + + <li>"RELY" means your human act in taking on a risk and liability on the + basis of the claim(s) bound within a certificate.</li> + + <li>"OFFER" means the your act of making available your certificate to + another person. Generally, you install and configure your software to act + as your agent and facilite this and other tasks. OFFER does not imply + suggestion of reliance.</li> + + <li>"Issue" means creation of a certificate by CAcert. To create a + certificate, CAcert affixes a digital signature from the root onto a public + key and other information. This act would generally bind a statement or + claim, such as your name, to your key.</li> + + <li>"Root" means CAcert's top level key, used for signing certificates for + Members. In this document, the term includes any subroots.</li> + + <li>"CAcert Official Document" ("COD" <span class="strike4">=> + COD3</span>) <span class="strike4">in a standard format for describing the + details of operation and governance essential to a certificate authority. + Changes are managed and controlled. CODs define more technical terms. See + 4.2 for listing of relevant CODs.</span> <span class="change4">is an + official managed and controlled document (e. g. a Policy) of + CAcert.</span></li> + + <li>"Certification Practice Statement" ("CPS" => COD6) is the document + that controls details about operational matters within CAcert.</li> + </ol> + + <h3><a name="1">1.</a> Agreement and Licence</h3> + + <h4><a name="1.1">1.1</a> Agreement</h4> + + <p>You <span class="strike">and CAcert both</span> agree to the terms and + conditions in this agreement. Your agreement is given by <span class= + "change2">but not limited to</span> <span class="strike2">any of</span></p> + + <ul> + <li>your signature on a form to request assurance of identity ("CAP" + form),</li> + + <li>your request on the website to join the Community and create an + account,</li> + + <li>your request for Organisation Assurance,</li> + + <li>your request for issuing of certificates, or</li> + + <li>if you USE, RELY, or OFFER any certificate issued to you.</li> + </ul> + + <p>Your agreement is effective from the date of the first event above that + makes this agreement known to you. This Agreement replaces and <span class= + "strike2">supercedes prior agreements, including the NRP-DaL.</span> + <span class="change2">supersedes any prior agreements.</span></p> + + <h4><a name="1.2">1.2</a> Licence</h4> + + <p>As part of the Community, CAcert offers you these rights:</p> + + <ol> + <li>You may USE any certificates issued by CAcert.</li> + + <li>You may RELY on any certificate issued by CAcert, as explained and + limited by CPS (COD6).</li> + + <li>You may OFFER certificates issued to you by CAcert to Members for their + RELIANCE.</li> + + <li>You may OFFER certificates issued to you by CAcert to NRPs for their + USE, within the general principles of the Community.</li> + + <li>This Licence is free of cost, non-exclusive, and + non-transferrable.</li> + </ol> + + <h4><a name="1.3">1.3</a> Your Contributions</h4> + + <p>You agree to a non-exclusive non-restrictive non-revokable transfer of + Licence to CAcert for your contributions. That is, if you post an idea or + comment on a CAcert forum, or email it to other Members, your work can be + used freely by the Community for CAcert purposes, including placing under + CAcert's licences for wider publication.</p> + + <p>You retain authorship rights, and the rights to also transfer + non-exclusive rights to other parties. That is, you can still use your ideas + and contributions outside the Community.</p> + + <p>Note that the following exceptions override this clause:</p> + + <ol> + <li>Contributions to controlled documents are subject to Policy on Policy + ("PoP" => COD1)</li> + + <li>Source code is subject to an open source licence regime.</li> + + <li><span class="change">Personal data</span></li> + + <li><span class="change">Postings under competing licenses if clearly + stated when posted</span></li> + </ol> + + <h4><a name="1.4">1.4</a> Privacy</h4> + + <p>You give rights to CAcert to store, verify and + process and publish your data in accordance with policies in force. These + rights include shipping the data to foreign countries for system + administration, support and processing purposes. Such shipping will only be + done among CAcert Community administrators and Assurers.</p> + + <p>Privacy is further covered in the Privacy Policy ("PP" => COD5).</p> + + <h3><a name="2">2.</a> Your Risks, Liabilities and Obligations</h3> + + <p>As a Member, you have risks, liabilities and obligations within this agreement.</p> + + <h4><a name="2.1">2.1</a> Risks</h4> + + <ol> + <li>A certificate may prove unreliable.</li> + + <li>Your account, keys or other security tools may be + lost or otherwise compromised.</li> + + <li>You may find yourself subject to Arbitration (DRP + => COD7).</li> + </ol> + + <h4><a name="2.2">2.2</a> Liabilities</h4> + + <ol> + <li>You are liable for any penalties as awarded + against you by the Arbitrator.</li> + + <li>Remedies are as defined in the DRP (COD7). An + Arbitrator's ruling may include monetary amounts, awarded against + you.</li> + + <li>Your liability is limited to a total maximum of + <b>1000 Euros</b>.</li> + + <li>"Foreign Courts" may assert jurisdiction. These + include your local courts, and are outside our Arbitration. Foreign Courts + will generally refer to the Arbitration Act of their country, which will + generally refer civil cases to Arbitration. The Arbitration Act will not + apply to criminal cases.</li> + </ol> + + <h4><a name="2.3">2.3</a> Obligations</h4> + + <p>You are obliged</p> + + <ol> + <li>to provide accurate information as part of + Assurance. You give permission for verification of the information using + CAcert-approved methods.</li> + + <li>to make no false representations.</li> + + <li>to submit all your disputes to Arbitration (DRP + => COD7).</li> + + <li><span class="change">to assist the Arbitrator by truthfully providing + information, or with any other reasonable request.</span></li> + + <li><span class="change7">to not share your CAcert account.</span></li> + </ol> + + <h4><a name="2.4">2.4</a> Principles</h4> + + <p>As a Member of CAcert, you are a member of the Community. You are further + obliged to work within the spirit of the Principles of the Community. These + are described in <a href= + "http://svn.cacert.org/CAcert/principles.html">Principles of the + Community</a>.</p> + + <h4><a name="2.5">2.5</a> Security</h4> + + <p>CAcert exists to help you to secure yourself. You are primarily + responsible for your own security. Your security obligations include</p> + + <ol> + <li>to secure yourself and your computing platform (e. g. PC),</li> + + <li>to keep your email account in good working order,</li> + + <li>to secure your CAcert account (e. g., credentials such as username, + password),</li> + + <li>to secure your private keys, <span class="change8">ensuring that they + are only used as indicated by the certificate, or by wider agreement with + others,</span></li> + + <li>to review certificates for accuracy, and</li> + + <li>when in doubt, notify CAcert,</li> + + <li>when in doubt, take other reasonable actions, such as revoking + certificates, changing account credentials, and/or generating new + keys.</li> + </ol> + + <p>Where, above, 'secure' means to protect to a reasonable degree, in + proportion with your risks and the risks of others.</p> + + <h3><a name="3">3.</a> Law and Jurisdiction</h3> + + <h4><a name="3.1">3.1</a> Governing Law</h4> + + <p>This agreement is governed under the law of New South Wales, Australia, + being the home of the CAcert Inc. Association.</p> + + <h4><a name="3.2">3.2</a> Arbitration as Forum of Dispute Resolution</h4> + + <p>You agree, with CAcert and all of the Community, that all disputes arising + out of or in connection to our use of CAcert services shall be referred to + and finally resolved by Arbitration under the rules within the Dispute + Resolution Policy of CAcert (DRP => COD7). The rules select a single + Arbitrator chosen by CAcert from among senior Members in the Community. The + ruling of the Arbitrator is binding and final on Members and CAcert + alike.</p> + + <p>In general, the jurisdiction for resolution of disputes is within CAcert's + own forum of Arbitration, as defined and controlled by its own rules (DRP + => COD7).</p> + + <p>We use Arbitration for many purposes beyond the strict nature of disputes, + such as governance and oversight. A systems administrator may need + authorisation to conduct a non-routine action, and Arbitration may provide + that authorisation. Thus, you may find yourself party to Arbitration that is + simply support actions, and you may file disputes in order to initiate + support actions.</p> + + <h4><a name="3.3">3.3</a> Termination</h4> + + <p><span class="strike12">You may terminate this agreement by resigning from + CAcert. You may do this at any time by writing to CAcert's online support + forum and filing dispute to resign. All services will be terminated, and your + certificates will be revoked. However, some information will continue to be + held for certificate processing purposes.</span></p> + + <p><span class="strike12">The provisions on Arbitration survive any + termination by you by leaving CAcert. That is, even if you resign from + CAcert, you are still bound by the DRP (COD7), and the Arbitrator may + reinstate any provision of this agreement or bind you to a ruling.</span></p> + + <p><span class="strike12">Only the Arbitrator may terminate this agreement + with you.</span></p> + + <p><span class="change12">The CAcert Community Agreement is + terminated</span></p> + + <ol> + <li><span class="change12">based on a Policy Group decision following (PoP + => COD1). This terminates the Agreement with every member.</span></li> + + <li><span class="change12">with a ruling of the Arbitrator or the + completion of a termination process defined by an Arbitrator ruling (DRP + => COD7).</span></li> + + <li><span class="change12">by the end of existence of a member (i.e. death + in the case of individuals).</span></li> + </ol> + + <p><span class="change12">A member may declare the wish to resign from CAcert + at any time by writing to <em>support AT cacert.org</em>. This triggers a + process for termination of this agreement with the member.</span></p> + + <h4><span class="change12"><a name="3.3">3.3a</a> Consequences of + Termination</span></h4> + + <p><span class="change12">The termination discontinues the right to USE, + OFFER and CREATE personal certificates in any account of the former member. + Those certificates will be revoked and all services to the former member will + be terminated as soon as possible. However, some information will continue to + be held for certificate processing purposes.</span></p> + + <p><span class="change12">The provisions on Arbitration for the time of + membership survive any termination. Former members are still bound by the DRP + (COD7), and the Arbitrator may reinstate any provision of this agreement or + bind them to a ruling.</span></p> + + <p><span class="change12">As far as Organisations are concerned details are + also defined in the Organisation Assurance Policy (OAP => + COD11).</span></p> + + <p><span class="change12">Every member learning about the death of a member + or termination of existence of a member should notify <em>support AT + cacert.org</em>.</span></p> + + <h4><a name="3.4">3.4</a> Changes of Agreement</h4> + + <p>CAcert may from time to time vary the terms of this Agreement. Changes + will be done according to the documented CAcert policy for changing policies, + and is subject to scrutiny and feedback by the Community. Changes will be + notified to you by email to your primary address.</p> + + <p>If you do not agree to the changes, you may terminate as above. Continued + use of the service shall be deemed to be agreement by you.</p> + + <h4><a name="3.5">3.5</a> Communication</h4> + + <p><span class="change6">You are responsible for keeping your primary email + account in good working order and able to receive emails from + CAcert.</span></p> + + <p>Notifications to CAcert are to be sent by email to the address <em>support + AT cacert.org</em>. You should attach a digital signature<span class= + "strike6">, but need not do so in the event of security or similar + urgency</span>.</p> + + <p><span class="strike6">Notifications to you are sent by CAcert to the + primary email address registered with your account. You are responsible for + keeping your email account in good working order and able to receive emails + from CAcert.</span></p> + + <p><span class="strike6">Arbitration is generally conducted by + email.</span></p> + + <h3><a name="4">4.</a> Miscellaneous</h3> + + <h4><a name="4.1">4.1</a> <span class="strike10">Other Parties Within the + Community</span> <span class="change10">(withdrawn)</span></h4> + + <p class="strike10">As well as you and other Members in the Community, CAcert + forms agreements with third party vendors and others. Thus, such parties will + also be in the Community. Such agreements are also controlled by the same + policy process as this agreement, and they should mirror and reinforce these + terms.</p> + + <h4><a name="4.2">4.2</a> References and Other Binding Documents</h4> + + <p class="strike11">This agreement is CAcert Official Document 9 (COD9) and + is a controlled document.</p> + + <p>You are also bound by <span class="change11">the Policies of the Community + under the control of Policy on Policy ("PoP" => COD1) and listed in + <a href= + "https://svn.cacert.org/CAcert/Policies/ControlledDocumentList.html">Controlled + Document List</a>.</span></p> + + <ol> + <li><span class="strike11"><a href= + "http://www.cacert.org/policy/CertificationPracticeStatement.php">Certification + Practice Statement</a> (CPS => COD6).</span></li> + + <li><span class="strike11"><a href= + "http://www.cacert.org/policy/DisputeResolutionPolicy.php">Dispute + Resolution Policy</a> (DRP => COD7).</span></li> + + <li><span class="strike11"><a href="PrivacyPolicy.html">Privacy Policy</a> + (PP => COD5).</span></li> + + <li><span class="strike11"><a href= + "http://svn.cacert.org/CAcert/principles.html">Principles of the + Community</a>.</span></li> + </ol> + + <p class="strike11">Where documents are referred to as <i>=> COD x</i>, + they are controlled documents under the control of Policy on Policies + (COD1).</p> + + <p class="strike11">This agreement and controlled documents above are + primary, and may not be replaced or waived except by formal policy channels + and by Arbitration.</p> + + <p class="change11">Controlled documents are primary, and may not be replaced + or waived except by formal policy channels and Arbitration.</p> + + <p class="change11">This agreement is controlled document COD9.</p> + + <h4><a name="4.3">4.3</a> Informative References</h4> + <p>The governing documents are in English. Documents may be translated for + convenience. Because we cannot control the legal effect of translations, the + English documents are the ruling ones.</p> + <p class="strike9">You are encouraged to be familiar with the Assurer + Handbook, which provides a more readable introduction for much of the + information needed. The Handbook is not however an agreement, and is + overruled by this agreement and others listed above.</p> -<h3> <a name="0"> 0. </a> Introduction </h3> - -<p> -This agreement is between -you, being a registered member ("Member") -within CAcert's community at large ("Community") -and CAcert Incorporated ("CAcert"), -being an operator of services to the Community. -</p> - -<h4> <a name="0.1"> 0.1 </a> Terms </h4> -<ol><li> - "CAcert" - means CAcert Inc., - a non-profit Association of Members incorporated in - New South Wales, Australia. - Note that Association Members are distinct from - the Members defined here. - </li><li> - "Member" - means you, a registered participant within CAcert's Community, - with an account on the website and the - facility to request certificates. - Members may be individuals ("natural persons") - or organisations ("legal persons"). - </li><li> - "Organisation" - is defined under the Organisation Assurance programme, - and generally includes corporations and other entities - that become Members and become Assured. - </li><li> - "Community" - means all of the Members - that are registered by this agreement - and other parties by other agreements, - all being under CAcert's Arbitration. - </li><li> - "Non-Related Person" ("NRP"), - being someone who is not a - Member, is not part of the Community, - and has not registered their agreement. - Such people are offered the NRP-DaL - another agreement allowing the USE of certificates. - </li><li> - "Non-Related Persons - Disclaimer and Licence" ("NRP-DaL"), - another agreement that is offered to persons outside the - Community. - </li><li> - "Arbitration" - is the Community's forum for - resolving disputes, or jurisdiction. - </li><li> - "Dispute Resolution Policy" ("DRP" => COD7) - is the policy and - rules for resolving disputes. - </li><li> - "USE" - means the act by your software - to conduct its tasks, incorporating - the certificates according to software procedures. - </li><li> - "RELY" - means your human act in taking on a - risk and liability on the basis of the claim(s) - bound within a certificate. - </li><li> - "OFFER" - means the your act - of making available your certificate to another person. - Generally, you install and configure your software - to act as your agent and facilite this and other tasks. - OFFER does not imply suggestion of reliance. - </li><li> - "Issue" - means creation of a certificate by CAcert. - To create a certificate, - CAcert affixes a digital signature from the root - onto a public key and other information. - This act would generally bind a statement or claim, - such as your name, to your key. - </li><li> - "Root" - means CAcert's top level key, - used for signing certificates for Members. - In this document, the term includes any subroots. - </li><li> - "CAcert Official Document" ("COD" => COD3) - in a standard format for describing the details of - operation and governance essential to a certificate authority. - Changes are managed and controlled. - CODs define more technical terms. - See 4.2 for listing of relevant CODs. - </li><li> - "Certification Practice Statement" ("CPS" => COD6) - is the document that controls details - about operational matters within CAcert. -</li></ol> - - -<h3> <a name="1"> 1. </a> Agreement and Licence </h3> - -<h4> <a name="1.1"> 1.1 </a> Agreement </h4> - -<p> -You and CAcert both agree to the terms and conditions -in this agreement. -Your agreement is given by any of -</p> - -<ul><li> - your signature on a form to request assurance of identity - ("CAP" form), - </li><li> - your request on the website - to join the Community and create an account, - </li><li> - your request for Organisation Assurance, - </li><li> - your request for issuing of certificates, or - </li><li> - if you USE, RELY, or OFFER - any certificate issued to you. -</li></ul> - -<p> -Your agreement -is effective from the date of the first event above -that makes this agreement known to you. -This Agreement -replaces and supercedes prior agreements, -including the NRP-DaL. -</p> - - -<h4> <a name="1.2"> 1.2 </a> Licence </h4> - -<p> -As part of the Community, CAcert offers you these rights: -</p> - -<ol><li> - You may USE any certificates issued by CAcert. - </li><li> - You may RELY on any certificate issued by CAcert, - as explained and limited by CPS (COD6). - </li><li> - You may OFFER certificates issued to you by CAcert - to Members for their RELIANCE. - </li><li> - You may OFFER certificates issued to you by CAcert - to NRPs for their USE, within the general principles - of the Community. - </li><li> - This Licence is free of cost, - non-exclusive, and non-transferrable. -</li></ol> - -<h4> <a name="1.3"> 1.3 </a> Your Contributions </h4> - - -<p> -You agree to a non-exclusive non-restrictive non-revokable -transfer of Licence to CAcert for your contributions. -That is, if you post an idea or comment on a CAcert forum, -or email it to other Members, -your work can be used freely by the Community for -CAcert purposes, including placing under CAcert's licences -for wider publication. -</p> - -<p> -You retain authorship rights, and the rights to also transfer -non-exclusive rights to other parties. -That is, you can still use your -ideas and contributions outside the Community. -</p> - -<p> -Note that the following exceptions override this clause: -</p> - -<ol><li> - Contributions to controlled documents are subject to - Policy on Policy ("PoP" => COD1) - </li><li> - Source code is subject to an open source licence regime. -</li></ol> - -<h4> <a name="1.4"> 1.4 </a> Privacy </h4> - - -<p> -You give rights to CAcert to store, verify and process -and publish your data in accordance with policies in force. -These rights include shipping the data to foreign countries -for system administration, support and processing purposes. -Such shipping will only be done among -CAcert Community administrators and Assurers. -</p> - -<p> -Privacy is further covered in the Privacy Policy ("PP" => COD5). -</p> - -<h3> <a name="2"> 2. </a> Your Risks, Liabilities and Obligations </h3> - -<p> -As a Member, you have risks, liabilities -and obligations within this agreement. -</p> - -<h4> <a name="2.1"> 2.1 </a> Risks </h4> - -<ol><li> - A certificate may prove unreliable. - </li><li> - Your account, keys or other security tools may be - lost or otherwise compromised. - </li><li> - You may find yourself subject to Arbitration - (DRP => COD7). -</li></ol> - -<h4> <a name="2.2"> 2.2 </a> Liabilities </h4> - -<ol><li> - You are liable for any penalties - as awarded against you by the Arbitrator. - </li><li> - Remedies are as defined in the DRP (COD7). - An Arbitrator's ruling may - include monetary amounts, awarded against you. - </li><li> - Your liability is limited to - a total maximum of - <b>1000 Euros</b>. - </li><li> - "Foreign Courts" may assert jurisdiction. - These include your local courts, and are outside our Arbitration. - Foreign Courts will generally refer to the Arbitration - Act of their country, which will generally refer - civil cases to Arbitration. - The Arbitration Act will not apply to criminal cases. -</li></ol> - -<h4> <a name="2.3"> 2.3 </a> Obligations </h4> - -<p> - You are obliged -</p> - -<ol><li> - to provide accurate information - as part of Assurance. - You give permission for verification of the information - using CAcert-approved methods. - </li><li> - to make no false representations. - </li><li> - to submit all your disputes to Arbitration - (DRP => COD7). -</li></ol> - -<h4> <a name="2.4"> 2.4 </a> Principles </h4> - -<p> -As a Member of CAcert, you are a member of -the Community. - You are further obliged to - work within the spirit of the Principles - of the Community. - These are described in - <a href="http://svn.cacert.org/CAcert/principles.html">Principles of the Community</a>. -</p> - -<h4> <a name="2.5"> 2.5 </a> Security </h4> -<p> -CAcert exists to help you to secure yourself. -You are primarily responsible for your own security. -Your security obligations include -</p> - -<ol><li> - to secure yourself and your computing platform (e.g., PC), - </li><li> - to keep your email account in good working order, - </li><li> - to secure your CAcert account - (e.g., credentials such as username, password), - </li><li> - to secure your private keys, - </li><li> - to review certificates for accuracy, - and - </li><li> - when in doubt, notify CAcert, - </li><li> - when in doubt, take other reasonable actions, such as - revoking certificates, - changing account credentials, - and/or generating new keys. -</li></ol> - -<p> -Where, above, 'secure' means to protect to a reasonable -degree, in proportion with your risks and the risks of -others. -</p> - -<h3> <a name="3"> 3. </a> Law and Jurisdiction </h3> - -<h4> <a name="3.1"> 3.1 </a> Governing Law </h4> - -<p> -This agreement is governed under the law of -New South Wales, Australia, -being the home of the CAcert Inc. Association. -</p> - -<h4> <a name="3.2"> 3.2 </a> Arbitration as Forum of Dispute Resolution </h4> - -<p> -You agree, with CAcert and all of the Community, -that all disputes arising out -of or in connection to our use of CAcert services -shall be referred to and finally resolved -by Arbitration under the rules within the -Dispute Resolution Policy of CAcert -(DRP => COD7). -The rules select a single Arbitrator chosen by CAcert -from among senior Members in the Community. -The ruling of the Arbitrator is binding and -final on Members and CAcert alike. -</p> - -<p> -In general, the jurisdiction for resolution of disputes -is within CAcert's own forum of Arbitration, -as defined and controlled by its own rules (DRP => COD7). -</p> - -<p> -We use Arbitration for many purposes beyond the strict -nature of disputes, such as governance and oversight. -A systems administrator may -need authorisation to conduct a non-routine action, -and Arbitration may provide that authorisation. -Thus, you may find yourself party to Arbitration -that is simply support actions, and you may file disputes in -order to initiate support actions. -</p> - -<h4> <a name="3.3"> 3.3 </a> Termination </h4> -<p> -You may terminate this agreement by resigning -from CAcert. You may do this at any time by -writing to CAcert's online support forum and -filing dispute to resign. -All services will be terminated, and your -certificates will be revoked. -However, some information will continue to -be held for certificate processing purposes. -</p> - -<p> -The provisions on Arbitration survive any termination -by you by leaving CAcert. -That is, even if you resign from CAcert, -you are still bound by the DRP (COD7), -and the Arbitrator may reinstate any provision of this -agreement or bind you to a ruling. -</p> - -<p> -Only the Arbitrator may terminate this agreement with you. -</p> - -<h4> <a name="3.4"> 3.4 </a> Changes of Agreement </h4> - -<p> -CAcert may from time to time vary the terms of this Agreement. -Changes will be done according to the documented CAcert policy -for changing policies, and is subject to scrutiny and feedback -by the Community. -Changes will be notified to you by email to your primary address. -</p> - -<p> -If you do not agree to the changes, you may terminate as above. -Continued use of the service shall be deemed to be agreement -by you. -</p> - -<h4> <a name="3.5"> 3.5 </a> Communication </h4> - -<p> -Notifications to CAcert are to be sent by -email to the address -<b>support</b> <i>at</i> CAcert.org. -You should attach a digital signature, -but need not do so in the event of security -or similar urgency. -</p> - -<p> -Notifications to you are sent -by CAcert to the primary email address -registered with your account. -You are responsible for keeping your email -account in good working order and able -to receive emails from CAcert. -</p> - -<p> -Arbitration is generally conducted by email. -</p> - -<h3> <a name="4"> 4. </a> Miscellaneous </h3> - -<h4> <a name="4.1"> 4.1 </a> Other Parties Within the Community </h4> - -<p> -As well as you and other Members in the Community, -CAcert forms agreements with third party -vendors and others. -Thus, such parties will also be in the Community. -Such agreements are also controlled by the same -policy process as this agreement, and they should -mirror and reinforce these terms. -</p> - - -<h4> <a name="4.2"> 4.2 </a> References and Other Binding Documents </h4> - -<p> -This agreement is CAcert Official Document 9 (COD9) -and is a controlled document. -</p> - -<p> -You are also bound by -</p> - -<ol><li> - <a href="http://www.cacert.org/policy/CertificationPracticeStatement.php"> - Certification Practice Statement</a> (CPS => COD6). - </li><li> - <a href="http://www.cacert.org/policy/DisputeResolutionPolicy.php"> - Dispute Resolution Policy</a> (DRP => COD7). - </li><li> - <a href="PrivacyPolicy.html"> - Privacy Policy</a> (PP => COD5). - </li><li> - <a href="http://svn.cacert.org/CAcert/principles.html"> - Principles of the Community</a>. -</li></ol> - -<p> -Where documents are referred to as <i>=> COD x</i>, -they are controlled documents -under the control of Policy on Policies (COD1). -</p> - -<p> -This agreement and controlled documents above are primary, -and may not be replaced or waived except -by formal policy channels and by Arbitration. -</p> - -<h4> <a name="4.3"> 4.3 </a> Informative References </h4> - -<p> -The governing documents are in English. -Documents may be translated for convenience. -Because we cannot control the legal effect of translations, -the English documents are the ruling ones. -</p> - -<p> -You are encouraged to be familiar with the -Assurer Handbook, -which provides a more readable introduction for much of -the information needed. -The Handbook is not however an agreement, and is overruled -by this agreement and others listed above. -</p> - -<h4> <a name="4.4"> 4.4 </a> Not Covered in this Agreement </h4> - -<p> -<b>Intellectual Property.</b> -This Licence does not transfer any intellectual -property rights ("IPR") to you. CAcert asserts and -maintains its IPR over its roots, issued certificates, -brands, logos and other assets. -Note that the certificates issued to you -are CAcert's intellectual property -and you do not have rights other than those stated. -</p> + <p class="change9">Beside this Agreement and the Policies, there are other + documents, i. e. Policy Guides, Manuals and Handbooks, supporting and + explaining this Agreement and the Policies. These documents are not binding + and in doubt this Agreement and the Policies are valid.</p> + <h4><a name="4.4">4.4</a> <span class="strike9">Not Covered in this + Agreement</span> <span class="change9">(withdrawn)</span></h4> + <p class="strike9"><b>Intellectual Property.</b> This Licence does not + transfer any intellectual property rights ("IPR") to you. CAcert asserts and + maintains its IPR over its roots, issued certificates, brands, logos and + other assets. Note that the certificates issued to you are CAcert's + intellectual property and you do not have rights other than those stated.</p> </body> </html> diff --git a/www/stats.php b/www/stats.php index 1599e17..d4d892d 100644 --- a/www/stats.php +++ b/www/stats.php @@ -32,7 +32,7 @@ $stats['timestamp'] = $ar['timestamp']; return $stats; } - + return null; } @@ -40,7 +40,7 @@ if ($stats === null) { echo '<p>', _("Error while retrieving the statistics!"), '</p>'; showfooter(); - die(); + die(); } ?> <h1>CAcert.org <?=_("Statistics")?></h1> @@ -157,4 +157,3 @@ </div> <? showfooter(); ?> - diff --git a/www/styles/default.css b/www/styles/default.css index 4d4db6a..4ddfbba 100644 --- a/www/styles/default.css +++ b/www/styles/default.css @@ -14,7 +14,7 @@ body { margin: 0px; padding: 0px; background: #cccccc; -/* url("/siteimages/bg_grad.jpg") fixed; */ +/* url("/siteimages/bg_grad.jpg") fixed; */ } @@ -94,6 +94,14 @@ ul.no_indent { padding: 0px; } +.attach_ul { + margin-bottom: 0px; +} + +.attach_ul + ul { + margin-top: 0px; +} + /***********************************************/ /* Layout Divs */ @@ -219,7 +227,7 @@ ul.no_indent { } #globalNav img { - margin-bottom: -4px; + margin-bottom: -4px; } #gnl { @@ -414,10 +422,6 @@ a.glink:hover { color: #000000; } -.story p { - padding: 0px 0px 10px 0px; -} - .story a.capsule { font: bold 1em Arial,sans-serif; color: #005FA9; @@ -558,6 +562,19 @@ td.storyLeft { border-right: 1px #cfcfcf solid; } +.DataTDError { + border-style: inset; + border-width: 1px; + font-size: 8pt; + color: #ff0000; + font-family: Arial, Tahoma, Verdana, Helvetica, sans-serif; + + background: #ffffff; + padding: 1px 5px 1px 5px; + border: 1px #cfcfcf solid; + border-left: 1px #cfcfcf dotted; + border-right: 1px #cfcfcf dotted; +} .wrapper { border-collapse: collapse; font-family: verdana, sans-serif; @@ -571,7 +588,12 @@ td.greytxt { text-align: right; vertical-align: bottom; } - +.bold, .primaryemailaddress { + font-weight:bold; +} +.italic, .deletedemailaddress { + font-style:italic; +} .title { background: #e2e2e2; font-weight: bold; diff --git a/www/wot.php b/www/wot.php index 7200517..35dce1f 100644 --- a/www/wot.php +++ b/www/wot.php @@ -21,7 +21,6 @@ require_once("../includes/lib/l10n.php"); require_once("../includes/notary.inc.php"); - function show_page($target,$message,$error) { showheader(_("My CAcert.org Account!")); @@ -133,9 +132,9 @@ function send_reminder() //This mail does not need to be translated $body = "Hi TTP adminstrators,\n\n"; $body .= "User ".$_SESSION['profile']['fname']." ". - $_SESSION['profile']['lname']." with email address '". - $_SESSION['profile']['email']."' is requesting a TTP assurances for ". - mysql_escape_string(stripslashes($_POST['country'])).".\n\n"; + $_SESSION['profile']['lname']." with email address '". + $_SESSION['profile']['email']."' is requesting a TTP assurances for ". + mysql_escape_string(stripslashes($_POST['country'])).".\n\n"; if ($_POST['ttptopup']=='1') { $body .= "The user is also requesting TTP TOPUP.\n\n"; }else{ @@ -198,6 +197,17 @@ function send_reminder() show_page("EnterEmail","",_("User is not yet verified. Please try again in 24 hours!")); exit; } + if ($_SESSION['profile']['ttpadmin'] != 1) { + $_SESSION['assuresomeone']['year'] = intval($_POST['year']); + $_SESSION['assuresomeone']['month'] = intval($_POST['month']); + $_SESSION['assuresomeone']['day'] = intval($_POST['day']); + $dob = sprintf('%04d-%02d-%02d', $_SESSION['assuresomeone']['year'], $_SESSION['assuresomeone']['month'], $_SESSION['assuresomeone']['day']); + + if ( $_SESSION['_config']['notarise']['dob'] != $dob) { + show_page("EnterEmail","",_("The data entered is not matching with an account.")); + exit; + } + } } $query = "select * from `users` where `email`='".mysql_escape_string(stripslashes($_POST['email']))."' and `locked`=1"; $res = mysql_query($query); @@ -224,8 +234,8 @@ function send_reminder() exit; } - $query = "select * from `notary` where `from`='".$_SESSION['profile']['id']."' and - `to`='".$_SESSION['_config']['notarise']['id']."'"; + $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' and + `to`='".intval($_SESSION['_config']['notarise']['id'])."' and `deleted` = 0"; $res = mysql_query($query); if(mysql_num_rows($res) > 0) { @@ -236,7 +246,7 @@ function send_reminder() if($oldid == 6) { -$iecho= "c"; + $iecho= "c"; //date checks if(trim($_REQUEST['date']) == '') { @@ -310,10 +320,10 @@ $iecho= "c"; exit; } - $query = "select * from `users` where `id`='".$_SESSION['_config']['notarise']['id']."'"; + $query = "select * from `users` where `id`='".intval($_SESSION['_config']['notarise']['id'])."'"; $res = mysql_query($query); $row = mysql_fetch_assoc($res); - $name = $row['fname']." ".$row['mname']." ".$row['lname']." ".$row['suffix']; + $name = sanitizeHTML($row['fname'])." ".sanitizeHTML($row['mname'])." ".sanitizeHTML($row['lname'])." ".sanitizeHTML($row['suffix']); if($_SESSION['_config']['wothash'] != md5($name."-".$row['dob']) || $_SESSION['_config']['wothash'] != $_REQUEST['pagehash']) { show_page("VerifyData","",_("Race condition discovered, user altered details during assurance procedure. PLEASE MAKE SURE THE NEW DETAILS BELOW MATCH THE ID DOCUMENTS.")); @@ -332,7 +342,7 @@ $iecho= "c"; if($newpoints < 0) $newpoints = $awarded = 0; - $query = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['_config']['notarise']['id']."' group by `to`"; + $query = "select sum(`points`) as `total` from `notary` where `to`='".intval($_SESSION['_config']['notarise']['id'])."' and `deleted` = 0 group by `to`"; $res = mysql_query($query); $drow = mysql_fetch_assoc($res); @@ -345,14 +355,15 @@ $iecho= "c"; if($newpoints < 0) $newpoints = 0; - if(mysql_escape_string(stripslashes($_POST['date'])) == "") + if(mysql_real_escape_string(stripslashes($_POST['date'])) == "") $_POST['date'] = date("Y-m-d H:i:s"); - $query = "select * from `notary` where `from`='".$_SESSION['profile']['id']."' AND - `to`='".$_SESSION['_config']['notarise']['id']."' AND - `awarded`='$awarded' AND - `location`='".mysql_escape_string(stripslashes($_POST['location']))."' AND - `date`='".mysql_escape_string(stripslashes($_POST['date']))."'"; + $query = "select * from `notary` where `from`='".intval($_SESSION['profile']['id'])."' AND + `to`='".intval($_SESSION['_config']['notarise']['id'])."' AND + `awarded`='".intval($awarded)."' AND + `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."' AND + `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."' AND + `deleted`=0"; $res = mysql_query($query); if(mysql_num_rows($res) > 0) { @@ -363,11 +374,11 @@ $iecho= "c"; if($oldid == 6) { - $query = "insert into `notary` set `from`='".$_SESSION['profile']['id']."', - `to`='".$_SESSION['_config']['notarise']['id']."', - `points`='$newpoints', `awarded`='$awarded', - `location`='".mysql_escape_string(stripslashes($_POST['location']))."', - `date`='".mysql_escape_string(stripslashes($_POST['date']))."', + $query = "insert into `notary` set `from`='".intval($_SESSION['profile']['id'])."', + `to`='".intval($_SESSION['_config']['notarise']['id'])."', + `points`='".intval($newpoints)."', `awarded`='".intval($awarded)."', + `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."', + `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."', `when`=NOW()"; //record active acceptance by Assurer if (check_date_format(trim($_REQUEST['date']),2010)) { @@ -388,11 +399,11 @@ $iecho= "c"; $addpoints = 2; else if($_SESSION['profile']['points'] == 149 && $_SESSION['profile']['points'] >= 100) $addpoints = 1; - $query = "insert into `notary` set `from`='".$_SESSION['profile']['id']."', - `to`='".$_SESSION['profile']['id']."', - `points`='$addpoints', `awarded`='$addpoints', - `location`='".mysql_escape_string(stripslashes($_POST['location']))."', - `date`='".mysql_escape_string(stripslashes($_POST['date']))."', + $query = "insert into `notary` set `from`='".intval($_SESSION['profile']['id'])."', + `to`='".intval($_SESSION['profile']['id'])."', + `points`='".intval($addpoints)."', `awarded`='".intval($addpoints)."', + `location`='".mysql_real_escape_string(stripslashes($_POST['location']))."', + `date`='".mysql_real_escape_string(stripslashes($_POST['date']))."', `method`='Administrative Increase', `when`=NOW()"; mysql_query($query); @@ -442,35 +453,7 @@ $iecho= "c"; sendmail($_SESSION['profile']['email'], "[CAcert.org] "._("You've Assured Another Member."), $body, "support@cacert.org", "", "", "CAcert Support"); - showheader(_("My CAcert.org Account!")); - echo "<p>"._("Shortly you and the person you were assuring will receive an email confirmation. There is no action on your behalf required to complete this.")."</p>"; -?><form method="post" action="wot.php"> -<table align="center" valign="middle" border="0" cellspacing="0" cellpadding="0" class="wrapper"> - <tr> - <td colspan="2" class="title"><?=_("Assure Someone")?></td> - </tr> - <tr> - <td class="DataTD"><?=_("Email")?>:</td> - <td class="DataTD"><input type="text" name="email" id="email" value=""></td> - </tr> - <tr> - <td class="DataTD" colspan="2"><input type="submit" name="process" value="<?=_("Next")?>"></td> - </tr> -</table> -<input type="hidden" name="oldid" value="5"> -</form> -<SCRIPT LANGUAGE="JavaScript"> -//<![CDATA[ - function my_init() - { - document.getElementById("email").focus(); - } - - window.onload = my_init(); -//]]> -</script> -<? - showfooter(); + show_page('EnterEmail', _("Shortly you and the person you were assuring will receive an email confirmation. There is no action on your behalf required to complete this.")); exit; } @@ -478,7 +461,7 @@ $iecho= "c"; { csrf_check("chgcontact"); - $info = mysql_escape_string(strip_tags(stripslashes($_POST['contactinfo']))); + $info = mysql_real_escape_string(strip_tags(stripslashes($_POST['contactinfo']))); $listme = intval($_POST['listme']); if($listme < 0 || $listme > 1) $listme = 0; @@ -486,7 +469,7 @@ $iecho= "c"; $_SESSION['profile']['listme'] = $listme; $_SESSION['profile']['contactinfo'] = $info; - $query = "update `users` set `listme`='$listme',`contactinfo`='$info' where `id`='".$_SESSION['profile']['id']."'"; + $query = "update `users` set `listme`='$listme',`contactinfo`='$info' where `id`='".intval($_SESSION['profile']['id'])."'"; mysql_query($query); showheader(_("My CAcert.org Account!")); @@ -507,9 +490,9 @@ $iecho= "c"; $body = $_REQUEST['message']; $subject = $_REQUEST['subject']; $userid = intval($_REQUEST['userid']); - $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='$userid' and `listme`=1")); + $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($userid)."' and `listme`=1")); $points = mysql_num_rows(mysql_query("select sum(`points`) as `total` from `notary` - where `to`='".$user['id']."' group by `to` HAVING SUM(`points`) > 0")); + where `to`='".intval($user['id'])."' and `deleted` = 0 group by `to` HAVING SUM(`points`) > 0")); if($points > 0) { $my_translation = L10n::get_translation(); @@ -545,7 +528,7 @@ $iecho= "c"; showheader(_("My CAcert.org Account!"));?> <p> - <? printf(_("Your email has been sent to %s."), $user['fname']); ?> + <? printf(_("Your email has been sent to %s."), sanitizeHTML($user['fname'])); ?> </p> <p>[ <a href='javascript:history.go(-2)'><?= _("Go Back") ?></a> ]</p> <? |