6488574e13368f47547b9cd8c559f02e4334fb41
[cacert.git] / cacert / includes / account.php
1 <? /*
2 LibreSSL - CAcert web application
3 Copyright (C) 2004-2008 CAcert Inc.
4
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; version 2 of the License.
8
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
13
14 You should have received a copy of the GNU General Public License
15 along with this program; if not, write to the Free Software
16 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
17 */
18 require_once("../includes/loggedin.php");
19
20 loadem("account");
21
22 $id = 0; if(array_key_exists("id",$_REQUEST)) $id=intval($_REQUEST['id']);
23 $oldid = 0; if(array_key_exists("oldid",$_REQUEST)) $oldid=intval($_REQUEST['oldid']);
24 $process = ""; if(array_key_exists("process",$_REQUEST)) $process=$_REQUEST['process'];
25
26 $cert=0; if(array_key_exists('cert',$_REQUEST)) $cert=intval($_REQUEST['cert']);
27 $orgid=0; if(array_key_exists('orgid',$_REQUEST)) $orgid=intval($_REQUEST['orgid']);
28 $memid=0; if(array_key_exists('memid',$_REQUEST)) $memid=intval($_REQUEST['memid']);
29 $domid=0; if(array_key_exists('domid',$_REQUEST)) $domid=intval($_REQUEST['domid']);
30
31
32 if(!$_SESSION['mconn'])
33 {
34 echo _("Several CAcert Services are currently unavailable. Please try again later.");
35 exit;
36 }
37
38
39 if($id == 45 || $id == 46 || $oldid == 45 || $oldid == 46)
40 {
41 $id = 1;
42 $oldid=0;
43 }
44
45 if($process != "" && $oldid == 1)
46 {
47 $id = 1;
48 csrf_check('addemail');
49 if(strstr($_REQUEST['newemail'], "xn--") && $_SESSION['profile']['codesign'] <= 0)
50 {
51 showheader(_("My CAcert.org Account!"));
52 echo _("Due to the possibility for punycode domain exploits we currently do not allow any certificates to sign punycode domains or email addresses.");
53 showfooter();
54 exit;
55 }
56 if(trim(mysql_real_escape_string(stripslashes($_REQUEST['newemail']))) == "")
57 {
58 showheader(_("My CAcert.org Account!"));
59 printf(_("Not a valid email address. Can't continue."));
60 showfooter();
61 exit;
62 }
63 $oldid=0;
64 $_REQUEST['email'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['newemail'])));
65 $query = "select * from `email` where `email`='".$_REQUEST['email']."' and `deleted`=0";
66 $res = mysql_query($query);
67 if(mysql_num_rows($res) > 0)
68 {
69 showheader(_("My CAcert.org Account!"));
70 printf(_("The email address '%s' is already in the system. Can't continue."), sanitizeHTML($_REQUEST['email']));
71 showfooter();
72 exit;
73 }
74 $checkemail = checkEmail($_REQUEST['newemail']);
75 if($checkemail != "OK")
76 {
77 showheader(_("My CAcert.org Account!"));
78 if (substr($checkemail, 0, 1) == "4")
79 {
80 echo "<p>"._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."</p>\n";
81 } else {
82 echo "<p>"._("Email Address given was invalid, or a test connection couldn't be made to your server, or the server rejected the email address as invalid")."</p>\n";
83 }
84 echo "<p>$checkemail</p>\n";
85 showfooter();
86 exit;
87 }
88 $hash = make_hash();
89 $query = "insert into `email` set `email`='".$_REQUEST['email']."',`memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'";
90 mysql_query($query);
91 $emailid = mysql_insert_id();
92
93 $body = _("Below is the link you need to open to verify your email address. Once your address is verified you will be able to start issuing certificates to your heart's content!")."\n\n";
94 $body .= "http://".$_SESSION['_config']['normalhostname']."/verify.php?type=email&emailid=$emailid&hash=$hash\n\n";
95 $body .= _("Best regards")."\n"._("CAcert.org Support!");
96
97 sendmail($_REQUEST['email'], "[CAcert.org] "._("Email Probe"), $body, "support@cacert.org", "", "", "CAcert Support");
98
99 showheader(_("My CAcert.org Account!"));
100 printf(_("The email address '%s' has been added to the system, however before any certificates for this can be issued you need to open the link in a browser that has been sent to your email address."), sanitizeHTML($_REQUEST['email']));
101 showfooter();
102 exit;
103 }
104
105 if(array_key_exists("makedefault",$_REQUEST) && $_REQUEST['makedefault'] != "" && $oldid == 2)
106 {
107 $id = 2;
108 $emailid = intval($_REQUEST['emailid']);
109 $query = "select * from `email` where `id`='$emailid' and `memid`='".$_SESSION['profile']['id']."' and `hash` = '' and `deleted`=0";
110 $res = mysql_query($query);
111 if(mysql_num_rows($res) <= 0)
112 {
113 showheader(_("Error!"));
114 echo _("You currently don't have access to the email address you selected, or you haven't verified it yet.");
115 showfooter();
116 exit;
117 }
118 $row = mysql_fetch_assoc($res);
119 $body = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n";
120 $body .= _("You are receiving this email because you or someone else")."\n";
121 $body .= _("has changed the default email on your account.")."\n\n";
122
123 $body .= _("Best regards")."\n"._("CAcert.org Support!");
124
125 sendmail($_SESSION['profile']['email'], "[CAcert.org] "._("Default Account Changed"), $body,
126 "support@cacert.org", "", "", "CAcert Support");
127
128 $_SESSION['profile']['email'] = $row['email'];
129 $query = "update `users` set `email`='".$row['email']."' where `id`='".$_SESSION['profile']['id']."'";
130 mysql_query($query);
131 showheader(_("My CAcert.org Account!"));
132 printf(_("Your default email address has been updated to '%s'."), sanitizeHTML($row['email']));
133 showfooter();
134 exit;
135 }
136
137 if($process != "" && $oldid == 2)
138 {
139 $id = 2;
140 csrf_check("chgdef");
141 showheader(_("My CAcert.org Account!"));
142 $delcount = 0;
143 if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
144 {
145 foreach($_REQUEST['delid'] as $id)
146 {
147 $id = intval($id);
148 $query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and
149 `email`!='".$_SESSION['profile']['email']."'";
150 $res = mysql_query($query);
151 if(mysql_num_rows($res) > 0)
152 {
153 $row = mysql_fetch_assoc($res);
154 echo $row['email']."<br>\n";
155 $query = "select `emailcerts`.`id`
156 from `emaillink`,`emailcerts` where
157 `emailid`='$id' and `emaillink`.`emailcertsid`=`emailcerts`.`id` and
158 `revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0
159 group by `emailcerts`.`id`";
160 $dres = mysql_query($query);
161 while($drow = mysql_fetch_assoc($dres))
162 mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$drow['id']."'");
163
164 $query = "update `email` set `deleted`=NOW() where `id`='$id'";
165 mysql_query($query);
166 $delcount++;
167 }
168 }
169 }
170 else
171 {
172 echo _("You did not select any email accounts for removal.");
173 }
174 if($delcount > 0)
175 {
176 echo _("The following accounts have been removed:")."<br>\n";
177 } else {
178 echo _("You failed to select any accounts to be removed, or you attempted to remove the default account. No action was taken.");
179 }
180
181 showfooter();
182 exit;
183 }
184
185 if($process != "" && $oldid == 3)
186 {
187 if(!(array_key_exists('addid',$_REQUEST) && is_array($_REQUEST['addid'])) && $_REQUEST['SSO'] != '1')
188 {
189 showheader(_("My CAcert.org Account!"));
190 echo _("I didn't receive a valid Certificate Request, hit the back button and try again.");
191 showfooter();
192 exit;
193 }
194
195 $_SESSION['_config']['SSO'] = intval($_REQUEST['SSO']);
196
197 $_SESSION['_config']['addid'] = $_REQUEST['addid'];
198 if($_SESSION['profile']['points'] >= 50)
199 $_SESSION['_config']['incname'] = intval($_REQUEST['incname']);
200 if(array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] != 0 && ($_SESSION['profile']['codesign'] == 0 || $_SESSION['profile']['points'] < 100))
201 {
202 $_REQUEST['codesign'] = 0;
203 }
204 if($_SESSION['profile']['points'] >= 100 && $_SESSION['profile']['codesign'] > 0 && array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] == 1)
205 {
206 if($_SESSION['_config']['incname'] < 1 || $_SESSION['_config']['incname'] > 4)
207 $_SESSION['_config']['incname'] = 1;
208 }
209 if(array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] == 1 && $_SESSION['profile']['points'] >= 100)
210 $_SESSION['_config']['codesign'] = 1;
211 else
212 $_SESSION['_config']['codesign'] = 0;
213
214 if(array_key_exists('login',$_REQUEST) && $_REQUEST['login'] == 1)
215 $_SESSION['_config']['disablelogin'] = 0;
216 else
217 $_SESSION['_config']['disablelogin'] = 1;
218
219 $_SESSION['_config']['rootcert'] = 1;
220 if($_SESSION['profile']['points'] >= 50)
221 {
222 $_SESSION['_config']['rootcert'] = intval($_REQUEST['rootcert']);
223 if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
224 $_SESSION['_config']['rootcert'] = 1;
225 }
226 $csr = "";
227 if(trim($_REQUEST['optionalCSR']) == "")
228 {
229 $id = 4;
230 } else {
231 $oldid = 4;
232 $_REQUEST['keytype'] = "MS";
233 $csr = clean_csr($_REQUEST['optionalCSR']);
234 }
235 }
236
237 if($oldid == 4)
238 {
239 if($_REQUEST['keytype'] == "NS")
240 {
241 $spkac=""; if(array_key_exists('SPKAC',$_REQUEST) && preg_match("/^[a-zA-Z0-9+=\/]+$/", trim(str_replace("\n", "", str_replace("\r", "",$_REQUEST['SPKAC']))))) $spkac=trim(str_replace("\n", "", str_replace("\r", "",$_REQUEST['SPKAC'])));
242
243 if($spkac=="" || $spkac == "deadbeef")
244 {
245 $id = 4;
246 showheader(_("My CAcert.org Account!"));
247 echo _("I didn't receive a valid Certificate Request, please try a different browser.");
248 showfooter();
249 exit;
250 }
251 $count = 0;
252 $emails = "";
253 $addys = array();
254 $defaultemail="";
255 if(is_array($_SESSION['_config']['addid']))
256 foreach($_SESSION['_config']['addid'] as $id)
257 {
258 $res = mysql_query("select * from `email` where `memid`='".$_SESSION['profile']['id']."' and `id`='".intval($id)."'");
259 if(mysql_num_rows($res) > 0)
260 {
261 $row = mysql_fetch_assoc($res);
262 if(!$emails)
263 $defaultemail = $row['email'];
264 $emails .= "$count.emailAddress = ".$row['email']."\n";
265 $count++;
266 $addys[] = intval($row['id']);
267 }
268 }
269 if($count <= 0 && $_SESSION['_config']['SSO'] != 1)
270 {
271 $id = 4;
272 showheader(_("My CAcert.org Account!"));
273 echo _("You submitted invalid email addresses, or email address you no longer have control of. Can't continue with certificate request.");
274 showfooter();
275 exit;
276 }
277 $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'"));
278 if($_SESSION['_config']['SSO'] == 1)
279 $emails .= "$count.emailAddress = ".$user['uniqueID']."\n";
280
281 if(strlen($user['mname']) == 1)
282 $user['mname'] .= '.';
283 if(!array_key_exists('incname',$_SESSION['_config']) || $_SESSION['_config']['incname'] <= 0 || $_SESSION['_config']['incname'] > 4)
284 {
285 $emails .= "commonName = CAcert WoT User\n";
286 }
287 else
288 {
289 if($_SESSION['_config']['incname'] == 1)
290 $emails .= "commonName = ".$user['fname']." ".$user['lname']."\n";
291 if($_SESSION['_config']['incname'] == 2)
292 $emails .= "commonName = ".$user['fname']." ".$user['mname']." ".$user['lname']."\n";
293 if($_SESSION['_config']['incname'] == 3)
294 $emails .= "commonName = ".$user['fname']." ".$user['lname']." ".$user['suffix']."\n";
295 if($_SESSION['_config']['incname'] == 4)
296 $emails .= "commonName = ".$user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix']."\n";
297 }
298 $emails .= "SPKAC = $spkac";
299 $query = "insert into emailcerts set
300 `CN`='$defaultemail',
301 `keytype`='NS',
302 `memid`='".intval($_SESSION['profile']['id'])."',
303 `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
304 `codesign`='".intval($_SESSION['_config']['codesign'])."',
305 `disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
306 `rootcert`='".intval($_SESSION['_config']['rootcert'])."'";
307 mysql_query($query);
308 $emailid = mysql_insert_id();
309 if(is_array($addys))
310 foreach($addys as $addy)
311 mysql_query("insert into `emaillink` set `emailcertsid`='$emailid', `emailid`='$addy'");
312 $CSRname = $_SESSION['_config']['filepath']."/csr/client-".intval($emailid).".csr";
313 $fp = fopen($CSRname, "w");
314 fputs($fp, $emails);
315 fclose($fp);
316 $challenge=$_SESSION['spkac_hash'];
317 $res=`openssl spkac -verify -in $CSRname`;
318 if(!strstr($res,"Challenge String: ".$challenge))
319 {
320 $id = $oldid;
321 showheader(_("My CAcert.org Account!"));
322 echo _("The challenge-response code of your certificate request did not match. Can't continue with certificaterequest.");
323 showfooter();
324 exit;
325 }
326 mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='".intval($emailid)."'");
327 } else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype'] == "VI") {
328 if($csr == "")
329 $csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."\n-----END CERTIFICATE REQUEST-----\n";
330 $tmpfname = tempnam("/tmp", "id4CSR");
331 $fp = fopen($tmpfname, "w");
332 fputs($fp, $csr);
333 fclose($fp);
334
335 $addys = array();
336 $defaultemail = "";
337 $csrsubject="";
338
339 $user = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_SESSION['profile']['id'])."'"));
340 if(strlen($user['mname']) == 1)
341 $user['mname'] .= '.';
342 if($_SESSION['_config']['incname'] <= 0 || $_SESSION['_config']['incname'] > 4)
343 $csrsubject = "/CN=CAcert WoT User";
344 if($_SESSION['_config']['incname'] == 1)
345 $csrsubject = "/CN=".$user['fname']." ".$user['lname'];
346 if($_SESSION['_config']['incname'] == 2)
347 $csrsubject = "/CN=".$user['fname']." ".$user['mname']." ".$user['lname'];
348 if($_SESSION['_config']['incname'] == 3)
349 $csrsubject = "/CN=".$user['fname']." ".$user['lname']." ".$user['suffix'];
350 if($_SESSION['_config']['incname'] == 4)
351 $csrsubject = "/CN=".$user['fname']." ".$user['mname']." ".$user['lname']." ".$user['suffix'];
352 if(is_array($_SESSION['_config']['addid']))
353 foreach($_SESSION['_config']['addid'] as $id)
354 {
355 $res = mysql_query("select * from `email` where `memid`='".intval($_SESSION['profile']['id'])."' and `id`='".intval($id)."'");
356 if(mysql_num_rows($res) > 0)
357 {
358 $row = mysql_fetch_assoc($res);
359 if($defaultemail == "")
360 $defaultemail = $row['email'];
361 $csrsubject .= "/emailAddress=".$row['email'];
362 $addys[] = $row['id'];
363 }
364 }
365 if($_SESSION['_config']['SSO'] == 1)
366 $csrsubject .= "/emailAddress = ".$user['uniqueID'];
367
368 $tmpname = tempnam("/tmp", "id4csr");
369 $do = `/usr/bin/openssl req -in $tmpfname -out $tmpname`; // -subj "$csr"`;
370 @unlink($tmpfname);
371 $csr = "";
372 $fp = fopen($tmpname, "r");
373 while($data = fgets($fp, 4096))
374 $csr .= $data;
375 fclose($fp);
376 @unlink($tmpname);
377
378 if($csr == "")
379 {
380 $id = 4;
381 showheader(_("My CAcert.org Account!"));
382 echo _("I didn't receive a valid Certificate Request, hit the back button and try again.");
383 showfooter();
384 exit;
385 }
386 $query = "insert into emailcerts set
387 `CN`='$defaultemail',
388 `keytype`='".sanitizeHTML($_REQUEST['keytype'])."',
389 `memid`='".$_SESSION['profile']['id']."',
390 `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
391 `subject`='".mysql_real_escape_string($csrsubject)."',
392 `codesign`='".$_SESSION['_config']['codesign']."',
393 `rootcert`='".$_SESSION['_config']['rootcert']."'";
394 mysql_query($query);
395 $emailid = mysql_insert_id();
396 if(is_array($addys))
397 foreach($addys as $addy)
398 mysql_query("insert into `emaillink` set `emailcertsid`='$emailid', `emailid`='".mysql_real_escape_string($addy)."'");
399 $CSRname = $_SESSION['_config']['filepath']."/csr/client-$emailid.csr";
400 $fp = fopen($CSRname, "w");
401 fputs($fp, $csr);
402 fclose($fp);
403 mysql_query("update `emailcerts` set `csr_name`='$CSRname' where `id`='$emailid'");
404 }
405 waitForResult("emailcerts", $emailid, 4);
406 $query = "select * from `emailcerts` where `id`='$emailid' and `crt_name` != ''";
407 $res = mysql_query($query);
408 if(mysql_num_rows($res) <= 0)
409 {
410 $id = 4;
411 showheader(_("My CAcert.org Account!"));
412 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
413 showfooter();
414 exit;
415 } else {
416 $id = 6;
417 $cert = $emailid;
418 $_REQUEST['cert']=$emailid;
419 }
420 }
421
422 if($oldid == 7)
423 {
424 csrf_check("adddomain");
425 if(strstr($_REQUEST['newdomain'],"\x00"))
426 {
427 showheader(_("My CAcert.org Account!"));
428 echo _("Due to the possibility for nullbyte domain exploits we currently do not allow any domain names with nullbytes.");
429 showfooter();
430 exit;
431 }
432
433 list($newdomain) = explode(" ", $_REQUEST['newdomain'], 2); // Ignore the rest
434 while($newdomain['0'] == '-')
435 $newdomain = substr($newdomain, 1);
436 if(strstr($newdomain, "xn--") && $_SESSION['profile']['codesign'] <= 0)
437 {
438 showheader(_("My CAcert.org Account!"));
439 echo _("Due to the possibility for punycode domain exploits we currently do not allow any certificates to sign punycode domains or email addresses.");
440 showfooter();
441 exit;
442 }
443
444 $newdom = trim(escapeshellarg($newdomain));
445 $newdomain = mysql_real_escape_string(trim($newdomain));
446
447 $res1 = mysql_query("select * from `orgdomains` where `domain`='$newdomain'");
448 $query = "select * from `domains` where `domain`='$newdomain' and `deleted`=0";
449 $res2 = mysql_query($query);
450 if(mysql_num_rows($res1) > 0 || mysql_num_rows($res2))
451 {
452 $oldid=0;
453 $id = 7;
454 showheader(_("My CAcert.org Account!"));
455 printf(_("The domain '%s' is already in the system and is listed as valid. Can't continue."), sanitizeHTML($newdomain));
456 showfooter();
457 exit;
458 }
459 }
460
461 if($oldid == 7)
462 {
463 $oldid=0;
464 $id = 8;
465 $addy = array();
466 $adds = array();
467 if(strtolower(substr($newdom, -4, 3)) != ".jp")
468 $adds = explode("\n", trim(`/usr/bin/whois $newdom|grep "@"`));
469 if(substr($newdomain, -4) == ".org" || substr($newdomain, -5) == ".info")
470 {
471 if(is_array($adds))
472 foreach($adds as $line)
473 {
474 $bits = explode(":", $line, 2);
475 $line = trim($bits[1]);
476 if(!in_array($line, $addy) && $line != "")
477 $addy[] = trim(mysql_real_escape_string(stripslashes($line)));
478 }
479 } else {
480 if(is_array($adds))
481 foreach($adds as $line)
482 {
483 $line = trim(str_replace("\t", " ", $line));
484 $line = trim(str_replace("(", "", $line));
485 $line = trim(str_replace(")", " ", $line));
486
487 $bits = explode(" ", $line);
488 foreach($bits as $bit)
489 {
490 if(strstr($bit, "@"))
491 $line = $bit;
492 }
493 if(!in_array($line, $addy) && $line != "")
494 $addy[] = trim(mysql_real_escape_string(stripslashes($line)));
495 }
496 }
497
498 $rfc = array("root@$newdomain", "hostmaster@$newdomain", "postmaster@$newdomain", "admin@$newdomain", "webmaster@$newdomain");
499 foreach($rfc as $sub)
500 if(!in_array($sub, $addy))
501 $addy[] = $sub;
502 $_SESSION['_config']['addy'] = $addy;
503 $_SESSION['_config']['domain'] = mysql_real_escape_string($newdomain);
504 }
505
506 if($process != "" && $oldid == 8)
507 {
508 csrf_check('ctcinfo');
509 $oldid=0;
510 $id = 8;
511
512 $authaddy = trim(mysql_real_escape_string(stripslashes($_REQUEST['authaddy'])));
513
514 if($authaddy == "" || !is_array($_SESSION['_config']['addy']))
515 {
516 showheader(_("My CAcert.org Account!"));
517 echo _("The address you submitted isn't a valid authority address for the domain.");
518 showfooter();
519 exit;
520 }
521
522 if(!in_array($authaddy, $_SESSION['_config']['addy']))
523 {
524 showheader(_("My CAcert.org Account!"));
525 echo _("The address you submitted isn't a valid authority address for the domain.");
526 showfooter();
527 exit;
528 }
529
530 $query = "select * from `domains` where `domain`='".mysql_real_escape_string($_SESSION['_config']['domain'])."' and `deleted`=0";
531 $res = mysql_query($query);
532 if(mysql_num_rows($res) > 0)
533 {
534 showheader(_("My CAcert.org Account!"));
535 printf(_("The domain '%s' is already in the system and is listed as valid. Can't continue."), sanitizeHTML($_SESSION['_config']['domain']));
536 showfooter();
537 exit;
538 }
539 $checkemail = checkEmail($authaddy);
540 if($checkemail != "OK")
541 {
542 showheader(_("My CAcert.org Account!"));
543 //echo "<p>"._("Email Address given was invalid, or a test connection couldn't be made to your server, or the server rejected the email address as invalid")."</p>\n";
544 if (substr($checkemail, 0, 1) == "4")
545 {
546 echo "<p>"._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."</p>\n";
547 } else {
548 echo "<p>"._("Email Address given was invalid, or a test connection couldn't be made to your server, or the server rejected the email address as invalid")."</p>\n";
549 }
550 echo "<p>$checkemail</p>\n";
551 showfooter();
552 exit;
553 }
554
555 $hash = make_hash();
556 $query = "insert into `domains` set `domain`='".mysql_real_escape_string($_SESSION['_config']['domain'])."',
557 `memid`='".$_SESSION['profile']['id']."',`created`=NOW(),`hash`='$hash'";
558 mysql_query($query);
559 $domainid = mysql_insert_id();
560
561 $body = sprintf(_("Below is the link you need to open to verify your domain '%s'. Once your address is verified you will be able to start issuing certificates to your heart's content!"),$_SESSION['_config']['domain'])."\n\n";
562 $body .= "http://".$_SESSION['_config']['normalhostname']."/verify.php?type=domain&domainid=$domainid&hash=$hash\n\n";
563 $body .= _("Best regards")."\n"._("CAcert.org Support!");
564
565 sendmail($authaddy, "[CAcert.org] "._("Email Probe"), $body, "support@cacert.org", "", "", "CAcert Support");
566
567 showheader(_("My CAcert.org Account!"));
568 printf(_("The domain '%s' has been added to the system, however before any certificates for this can be issued you need to open the link in a browser that has been sent to your email address."), $_SESSION['_config']['domain']);
569 showfooter();
570 exit;
571 }
572
573 if($process != "" && $oldid == 9)
574 {
575 $id = 9;
576 showheader(_("My CAcert.org Account!"));
577 if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
578 {
579 echo _("The following domains have been removed:")."<br>
580 ("._("Any valid certificates will be revoked as well").")<br>\n";
581
582 foreach($_REQUEST['delid'] as $id)
583 {
584 $id = intval($id);
585 $query = "select * from `domains` where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
586 $res = mysql_query($query);
587 if(mysql_num_rows($res) > 0)
588 {
589 $row = mysql_fetch_assoc($res);
590 echo $row['domain']."<br>\n";
591 mysql_query("update `domains` set `deleted`=NOW() where `id`='$id'");
592 $dres = mysql_query("select * from `domlink` where `domid`='$id'");
593 while($drow = mysql_fetch_assoc($dres))
594 mysql_query("update `domaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$drow['certid']."' and `revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0");
595 }
596 }
597 }
598 else
599 {
600 echo _("You did not select any domains for removal.");
601 }
602
603 showfooter();
604 exit;
605 }
606
607 if($process != "" && $oldid == 10)
608 {
609 $CSR = clean_csr($_REQUEST['CSR']);
610 $_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id10CSR");
611 $fp = fopen($_SESSION['_config']['tmpfname'], "w");
612 if(strpos($CSR,"---BEGIN")===FALSE)
613 {
614 // In case the CSR is missing the ---BEGIN lines, add them automatically:
615 fputs($fp,"-----BEGIN CERTIFICATE REQUEST-----\n".$CSR."\n-----END CERTIFICATE REQUEST-----\n");
616 }
617 else
618 {
619 fputs($fp, $CSR);
620 }
621 fclose($fp);
622 $CSR = $_SESSION['_config']['tmpfname'];
623 $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep "Subject:"`);
624 $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
625 foreach($bits as $val)
626 {
627 $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
628 }
629 $id = 11;
630
631 $_SESSION['_config']['0.CN'] = $_SESSION['_config']['0.subjectAltName'] = "";
632 extractit();
633 getcn();
634 getalt();
635
636 if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
637 {
638 showheader(_("My CAcert.org Account!"));
639 echo _("CommonName field was blank. This is usually caused by entering your own name when openssl prompt's you for 'YOUR NAME', or if you try to issue certificates for domains you haven't already verified, as such this process can't continue.");
640 showfooter();
641 exit;
642 }
643
644 $_SESSION['_config']['rootcert'] = 1;
645 if($_SESSION['profile']['points'] >= 50)
646 {
647 $_SESSION['_config']['rootcert'] = intval($_REQUEST['rootcert']);
648 if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
649 $_SESSION['_config']['rootcert'] = 1;
650 }
651 }
652
653 if($process != "" && $oldid == 11)
654 {
655 $id = 11;
656 if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
657 {
658 showheader(_("My CAcert.org Account!"));
659 echo _("CommonName field was blank. This is usually caused by entering your own name when openssl prompt's you for 'YOUR NAME', or if you try to issue certificates for domains you haven't already verified, as such this process can't continue.");
660 showfooter();
661 exit;
662 }
663
664 $subject = "";
665 $count = 0;
666 $supressSAN=0;
667 if($_SESSION["profile"]["id"] == 104074) $supressSAN=1;
668
669 if(is_array($_SESSION['_config']['rows']))
670 foreach($_SESSION['_config']['rows'] as $row)
671 {
672 $count++;
673 if($count <= 1)
674 {
675 $subject .= "/CN=$row";
676 if(!$supressSAN) $subject .= "/subjectAltName=DNS:$row";
677 if(!$supressSAN) $subject .= "/subjectAltName=otherName:1.3.6.1.5.5.7.8.5;UTF8:$row";
678 } else {
679 if(!$supressSAN) $subject .= "/subjectAltName=DNS:$row";
680 if(!$supressSAN) $subject .= "/subjectAltName=otherName:1.3.6.1.5.5.7.8.5;UTF8:$row";
681 }
682 }
683 if(is_array($_SESSION['_config']['altrows']))
684 foreach($_SESSION['_config']['altrows'] as $row)
685 {
686 if(substr($row, 0, 4) == "DNS:")
687 {
688 $row = substr($row, 4);
689 if(!$supressSAN) $subject .= "/subjectAltName=DNS:$row";
690 if(!$supressSAN) $subject .= "/subjectAltName=otherName:1.3.6.1.5.5.7.8.5;UTF8:$row";
691 }
692 }
693
694 if(array_key_exists('0',$_SESSION['_config']['rowid']) && $_SESSION['_config']['rowid']['0'] > 0)
695 {
696 $query = "insert into `domaincerts` set
697 `CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."',
698 `domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."',
699 `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
700 `rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."'";
701 } elseif(array_key_exists('0',$_SESSION['_config']['altid']) && $_SESSION['_config']['altid']['0'] > 0) {
702 $query = "insert into `domaincerts` set
703 `CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
704 `domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."',
705 `created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
706 `rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."'";
707 } else {
708 showheader(_("My CAcert.org Account!"));
709 echo _("Domain not verified.");
710 showfooter();
711 exit;
712
713 }
714
715 mysql_query($query);
716 $CSRid = mysql_insert_id();
717
718 if(is_array($_SESSION['_config']['rowid']))
719 foreach($_SESSION['_config']['rowid'] as $dom)
720 mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
721 if(is_array($_SESSION['_config']['altid']))
722 foreach($_SESSION['_config']['altid'] as $dom)
723 mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
724
725 $CSRname = $_SESSION['_config']['filepath']."/csr/server-$CSRid.csr";
726 if(!file_exists($_SESSION['_config']['tmpfname']))
727 {
728 showheader(_("My CAcert.org Account!"));
729 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
730 showfooter();
731 exit;
732 }
733 rename($_SESSION['_config']['tmpfname'], $CSRname);
734 chmod($CSRname,0644);
735 mysql_query("update `domaincerts` set `CSR_name`='$CSRname' where `id`='$CSRid'");
736 waitForResult("domaincerts", $CSRid, 11);
737 $query = "select * from `domaincerts` where `id`='$CSRid' and `crt_name` != ''";
738 $res = mysql_query($query);
739 if(mysql_num_rows($res) <= 0)
740 {
741 $id = 11;
742 showheader(_("My CAcert.org Account!"));
743 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
744 showfooter();
745 exit;
746 } else {
747 $id = 15;
748 $cert = $CSRid;
749 $_REQUEST['cert']=$CSRid;
750 }
751 }
752
753 if($oldid == 12 && array_key_exists('renew',$_REQUEST) && $_REQUEST['renew'] != "")
754 {
755 csrf_check('srvcerchange');
756 $id = 12;
757 showheader(_("My CAcert.org Account!"));
758 if(is_array($_REQUEST['revokeid']))
759 {
760 echo _("Now renewing the following certificates:")."<br>\n";
761 foreach($_REQUEST['revokeid'] as $id)
762 {
763 $id = intval($id);
764 echo _("Processing request")." $id:<br/>";
765 $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
766 where `domaincerts`.`id`='$id' and
767 `domaincerts`.`domid`=`domains`.`id` and
768 `domains`.`memid`='".$_SESSION['profile']['id']."'";
769 $res = mysql_query($query);
770 if(mysql_num_rows($res) <= 0)
771 {
772 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br/>\n", $id);
773 continue;
774 }
775 mysql_query("update `domaincerts` set `renewed`='1' where `id`='$id'");
776 $row = mysql_fetch_assoc($res);
777 $query = "insert into `domaincerts` set
778 `domid`='".$row['domid']."',
779 `CN`='".mysql_real_escape_string($row['CN'])."',
780 `subject`='".mysql_real_escape_string($row['subject'])."',".
781 //`csr_name`='".$row['csr_name']."', // RACE CONDITION
782 "`created`='".$row['created']."',
783 `modified`=NOW(),
784 `rootcert`='".$row['rootcert']."',
785 `type`='".$row['type']."',
786 `pkhash`='".$row['pkhash']."'";
787 mysql_query($query);
788 $newid = mysql_insert_id();
789 $newfile = $_SESSION['_config']['filepath']."/csr/server-$newid.csr";
790 copy($row['csr_name'], $newfile);
791 $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in "$newfile"|tr -d "\\0"|grep "Subject:"`);
792 $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in "$newfile"|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
793 foreach($bits as $val)
794 {
795 $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
796 }
797 $_SESSION['_config']['0.CN'] = $_SESSION['_config']['0.subjectAltName'] = "";
798 extractit();
799 getcn();
800 getalt();
801
802 if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
803 {
804 echo _("CommonName field was blank. This is usually caused by entering your own name when openssl prompt's you for 'YOUR NAME', or if you try to issue certificates for domains you haven't already verified, as such this process can't continue.");
805 continue;
806 }
807
808 $subject = "";
809 $count = 0;
810 if(is_array($_SESSION['_config']['rows']))
811 foreach($_SESSION['_config']['rows'] as $row)
812 {
813 $count++;
814 if($count <= 1)
815 {
816 $subject .= "/CN=$row";
817 if(!strstr($subject, "=$row/") &&
818 substr($subject, -strlen("=$row")) != "=$row")
819 $subject .= "/subjectAltName=$row";
820 } else {
821 if(!strstr($subject, "=$row/") &&
822 substr($subject, -strlen("=$row")) != "=$row")
823 $subject .= "/subjectAltName=$row";
824 }
825 }
826 if(is_array($_SESSION['_config']['altrows']))
827 foreach($_SESSION['_config']['altrows'] as $row)
828 if(!strstr($subject, "=$row/") &&
829 substr($subject, -strlen("=$row")) != "=$row")
830 $subject .= "/subjectAltName=$row";
831 $subject = mysql_real_escape_string($subject);
832 mysql_query("update `domaincerts` set `subject`='$subject',`csr_name`='$newfile' where `id`='$newid'");
833
834 echo _("Renewing").": ".sanitizeHTML($_SESSION['_config']['0.CN'])."<br>\n";
835 waitForResult("domaincerts", $newid,$oldid,0);
836 $query = "select * from `domaincerts` where `id`='$newid' and `crt_name` != ''";
837 $res = mysql_query($query);
838 if(mysql_num_rows($res) <= 0)
839 {
840 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
841 } else {
842 $drow = mysql_fetch_assoc($res);
843 $cert = `/usr/bin/openssl x509 -in $drow[crt_name]`;
844 echo "<pre>\n$cert\n</pre>\n";
845 }
846 }
847 }
848 else
849 {
850 echo _("You did not select any certificates for renewal.");
851 }
852 showfooter();
853 exit;
854 }
855
856 if($oldid == 12 && array_key_exists('revoke',$_REQUEST) && $_REQUEST['revoke'] != "")
857 {
858 csrf_check('srvcerchange');
859 $id = 12;
860 showheader(_("My CAcert.org Account!"));
861 if(is_array($_REQUEST['revokeid']))
862 {
863 echo _("Now revoking the following certificates:")."<br>\n";
864 foreach($_REQUEST['revokeid'] as $id)
865 {
866 $id = intval($id);
867 $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
868 where `domaincerts`.`id`='$id' and
869 `domaincerts`.`domid`=`domains`.`id` and
870 `domains`.`memid`='".$_SESSION['profile']['id']."'";
871 $res = mysql_query($query);
872 if(mysql_num_rows($res) <= 0)
873 {
874 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
875 continue;
876 }
877 $row = mysql_fetch_assoc($res);
878 if($row['revoke'] > 0)
879 {
880 printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
881 continue;
882 }
883 mysql_query("update `domaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
884 printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
885 }
886 }
887 else
888 {
889 echo _("You did not select any certificates for revocation.");
890 }
891
892 if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
893 {
894 echo _("Now deleting the following pending requests:")."<br>\n";
895 foreach($_REQUEST['delid'] as $id)
896 {
897 $id = intval($id);
898 $query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains`
899 where `domaincerts`.`id`='$id' and
900 `domaincerts`.`domid`=`domains`.`id` and
901 `domains`.`memid`='".$_SESSION['profile']['id']."'";
902 $res = mysql_query($query);
903 if(mysql_num_rows($res) <= 0)
904 {
905 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
906 continue;
907 }
908 $row = mysql_fetch_assoc($res);
909 if($row['expired'] > 0)
910 {
911 printf(_("Couldn't remove the request for `%s`, request had already been processed.")."<br>\n", $row['CN']);
912 continue;
913 }
914 mysql_query("delete from `domaincerts` where `id`='$id'");
915 @unlink($row['csr_name']);
916 @unlink($row['crt_name']);
917 printf(_("Removed a pending request for '%s'")."<br>\n", $row['CN']);
918 }
919 }
920 showfooter();
921 exit;
922 }
923
924 if($oldid == 5 && array_key_exists('renew',$_REQUEST) && $_REQUEST['renew'] != "")
925 {
926 showheader(_("My CAcert.org Account!"));
927 if(is_array($_REQUEST['revokeid']))
928 {
929 echo _("Now renewing the following certificates:")."<br>\n";
930 foreach($_REQUEST['revokeid'] as $id)
931 {
932 $id = intval($id);
933 $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
934 where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
935 $res = mysql_query($query);
936 if(mysql_num_rows($res) <= 0)
937 {
938 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
939 continue;
940 }
941 mysql_query("update `emailcerts` set `renewed`='1' where `id`='$id'");
942 $row = mysql_fetch_assoc($res);
943 $query = "insert into emailcerts set
944 `memid`='".$row['memid']."',
945 `CN`='".mysql_real_escape_string($row['CN'])."',
946 `subject`='".mysql_real_escape_string($row['subject'])."',
947 `keytype`='".$row['keytype']."',
948 `csr_name`='".$row['csr_name']."',
949 `created`='".$row['created']."',
950 `modified`=NOW(),
951 `disablelogin`='".$row['disablelogin']."',
952 `codesign`='".$row['codesign']."',
953 `rootcert`='".$row['rootcert']."'";
954 mysql_query($query);
955 $newid = mysql_insert_id();
956 $newfile = $_SESSION['_config']['filepath']."/csr/client-$newid.csr";
957 copy($row['csr_name'], $newfile);
958 mysql_query("update `emailcerts` set `csr_name`='$newfile' where `id`='$newid'");
959 $res = mysql_query("select * from `emaillink` where `emailcertsid`='".$row['id']."'");
960 while($r2 = mysql_fetch_assoc($res))
961 {
962 mysql_query("insert into `emaillink` set `emailid`='".$r2['emailid']."',
963 `emailcertsid`='$newid'");
964 }
965 waitForResult("emailcerts", $newid,$oldid,0);
966 $query = "select * from `emailcerts` where `id`='$newid' and `crt_name` != ''";
967 $res = mysql_query($query);
968 if(mysql_num_rows($res) <= 0)
969 {
970 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
971 } else {
972 printf(_("Certificate for '%s' has been renewed."), $row['CN']);
973 echo "<a href='account.php?id=6&cert=$newid' target='_new'>".
974 _("Click here")."</a> "._("to install your certificate.");
975 }
976 }
977 }
978 else
979 {
980 echo _("You did not select any certificates for renewal.");
981 }
982
983 showfooter();
984 exit;
985 }
986
987 if($oldid == 5 && array_key_exists('revoke',$_REQUEST) && $_REQUEST['revoke'] != "")
988 {
989 $id = 5;
990 showheader(_("My CAcert.org Account!"));
991 if(array_key_exists('revokeid',$_REQUEST) && is_array($_REQUEST['revokeid']))
992 {
993 echo _("Now revoking the following certificates:")."<br>\n";
994 foreach($_REQUEST['revokeid'] as $id)
995 {
996 $id = intval($id);
997 $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
998 where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
999 $res = mysql_query($query);
1000 if(mysql_num_rows($res) <= 0)
1001 {
1002 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1003 continue;
1004 }
1005 $row = mysql_fetch_assoc($res);
1006 if($row['revoke'] > 0)
1007 {
1008 printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
1009 continue;
1010 }
1011 mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
1012 printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
1013 }
1014 }
1015 else
1016 {
1017 echo _("You did not select any certificates for revocation.");
1018 }
1019
1020 if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
1021 {
1022 echo _("Now deleting the following pending requests:")."<br>\n";
1023 foreach($_REQUEST['delid'] as $id)
1024 {
1025 $id = intval($id);
1026 $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts`
1027 where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
1028 $res = mysql_query($query);
1029 if(mysql_num_rows($res) <= 0)
1030 {
1031 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1032 continue;
1033 }
1034 $row = mysql_fetch_assoc($res);
1035 if($row['expired'] > 0)
1036 {
1037 printf(_("Couldn't remove the request for `%s`, request had already been processed.")."<br>\n", $row['CN']);
1038 continue;
1039 }
1040 mysql_query("delete from `emailcerts` where `id`='$id'");
1041 @unlink($row['csr_name']);
1042 @unlink($row['crt_name']);
1043 printf(_("Removed a pending request for '%s'")."<br>\n", $row['CN']);
1044 }
1045 }
1046 showfooter();
1047 exit;
1048 }
1049
1050 if($oldid == 5 && array_key_exists('change',$_REQUEST) && $_REQUEST['change'] != "")
1051 {
1052 showheader(_("My CAcert.org Account!"));
1053 //echo _("Now changing the settings for the following certificates:")."<br>\n";
1054 foreach($_REQUEST as $id => $val)
1055 {
1056 //echo $id."<br/>";
1057 if(substr($id,0,5)=="cert_")
1058 {
1059 $id = intval(substr($id,5));
1060 $dis=(array_key_exists('disablelogin_'.$id,$_REQUEST) && $_REQUEST['disablelogin_'.$id]=="1")?"0":"1";
1061 //echo "$id -> ".$_REQUEST['disablelogin_'.$id]."<br/>\n";
1062 mysql_query("update `emailcerts` set `disablelogin`='$dis' where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'");
1063 //$row = mysql_fetch_assoc($res);
1064 }
1065 }
1066 echo(_("Certificate settings have been changed.")."<br/>\n");
1067 showfooter();
1068 exit;
1069 }
1070
1071
1072 if($oldid == 13 && $process != "")
1073 {
1074 csrf_check("perschange");
1075 $_SESSION['_config']['user'] = $_SESSION['profile'];
1076
1077 $_SESSION['_config']['user']['Q1'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q1']))));
1078 $_SESSION['_config']['user']['Q2'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q2']))));
1079 $_SESSION['_config']['user']['Q3'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q3']))));
1080 $_SESSION['_config']['user']['Q4'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q4']))));
1081 $_SESSION['_config']['user']['Q5'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['Q5']))));
1082 $_SESSION['_config']['user']['A1'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A1']))));
1083 $_SESSION['_config']['user']['A2'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A2']))));
1084 $_SESSION['_config']['user']['A3'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A3']))));
1085 $_SESSION['_config']['user']['A4'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A4']))));
1086 $_SESSION['_config']['user']['A5'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['A5']))));
1087
1088 if($_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q2'] ||
1089 $_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q3'] ||
1090 $_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q4'] ||
1091 $_SESSION['_config']['user']['Q1'] == $_SESSION['_config']['user']['Q5'] ||
1092 $_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q3'] ||
1093 $_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q4'] ||
1094 $_SESSION['_config']['user']['Q2'] == $_SESSION['_config']['user']['Q5'] ||
1095 $_SESSION['_config']['user']['Q3'] == $_SESSION['_config']['user']['Q4'] ||
1096 $_SESSION['_config']['user']['Q3'] == $_SESSION['_config']['user']['Q5'] ||
1097 $_SESSION['_config']['user']['Q4'] == $_SESSION['_config']['user']['Q5'] ||
1098 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q1'] ||
1099 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q2'] ||
1100 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q3'] ||
1101 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q4'] ||
1102 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['Q5'] ||
1103 $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q3'] ||
1104 $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q4'] ||
1105 $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['Q5'] ||
1106 $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['Q4'] ||
1107 $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['Q5'] ||
1108 $_SESSION['_config']['user']['A4'] == $_SESSION['_config']['user']['Q5'] ||
1109 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A2'] ||
1110 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A3'] ||
1111 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A4'] ||
1112 $_SESSION['_config']['user']['A1'] == $_SESSION['_config']['user']['A5'] ||
1113 $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A3'] ||
1114 $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A4'] ||
1115 $_SESSION['_config']['user']['A2'] == $_SESSION['_config']['user']['A5'] ||
1116 $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['A4'] ||
1117 $_SESSION['_config']['user']['A3'] == $_SESSION['_config']['user']['A5'] ||
1118 $_SESSION['_config']['user']['A4'] == $_SESSION['_config']['user']['A5'])
1119 {
1120 $_SESSION['_config']['errmsg'] .= _("For your own security you must enter 5 different password questions and answers. You aren't allowed to duplicate questions, set questions as answers or use the question as the answer.")."<br>\n";
1121 $id = $oldid;
1122 $oldid=0;
1123 }
1124
1125 if($_SESSION['_config']['user']['Q1'] == "" || $_SESSION['_config']['user']['Q2'] == "" ||
1126 $_SESSION['_config']['user']['Q3'] == "" || $_SESSION['_config']['user']['Q4'] == "" ||
1127 $_SESSION['_config']['user']['Q5'] == "")
1128 {
1129 $_SESSION['_config']['errmsg'] .= _("For your own security you must enter 5 lost password questions and answers.")."<br>";
1130 $id = $oldid;
1131 $oldid=0;
1132 }
1133 }
1134
1135 if($oldid == 13 && $process != "")
1136 {
1137 $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
1138 $ddres = mysql_query($ddquery);
1139 $ddrow = mysql_fetch_assoc($ddres);
1140 $_SESSION['profile']['points'] = $ddrow['total'];
1141
1142 if($_SESSION['profile']['points'] == 0)
1143 {
1144 $_SESSION['_config']['user']['fname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['fname']))));
1145 $_SESSION['_config']['user']['mname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['mname']))));
1146 $_SESSION['_config']['user']['lname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['lname']))));
1147 $_SESSION['_config']['user']['suffix'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['suffix']))));
1148 $_SESSION['_config']['user']['day'] = intval($_REQUEST['day']);
1149 $_SESSION['_config']['user']['month'] = intval($_REQUEST['month']);
1150 $_SESSION['_config']['user']['year'] = intval($_REQUEST['year']);
1151
1152 if($_SESSION['_config']['user']['fname'] == "" || $_SESSION['_config']['user']['lname'] == "")
1153 {
1154 $_SESSION['_config']['errmsg'] .= _("First and Last name fields can not be blank.")."<br>";
1155 $id = $oldid;
1156 $oldid=0;
1157 }
1158 if($_SESSION['_config']['user']['year'] < 1900 || $_SESSION['_config']['user']['month'] < 1 || $_SESSION['_config']['user']['month'] > 12 ||
1159 $_SESSION['_config']['user']['day'] < 1 || $_SESSION['_config']['user']['day'] > 31)
1160 {
1161 $_SESSION['_config']['errmsg'] .= _("Invalid date of birth")."<br>\n";
1162 $id = $oldid;
1163 $oldid=0;
1164 }
1165 }
1166 }
1167
1168 if($oldid == 13 && $process != "")
1169 {
1170 if($_SESSION['profile']['points'] == 0)
1171 {
1172 $query = "update `users` set `fname`='".$_SESSION['_config']['user']['fname']."',
1173 `mname`='".$_SESSION['_config']['user']['mname']."',
1174 `lname`='".$_SESSION['_config']['user']['lname']."',
1175 `suffix`='".$_SESSION['_config']['user']['suffix']."',
1176 `dob`='".$_SESSION['_config']['user']['year']."-".$_SESSION['_config']['user']['month']."-".$_SESSION['_config']['user']['day']."'
1177 where `id`='".$_SESSION['profile']['id']."'";
1178 mysql_query($query);
1179 }
1180 $query = "update `users` set `Q1`='".$_SESSION['_config']['user']['Q1']."',
1181 `Q2`='".$_SESSION['_config']['user']['Q2']."',
1182 `Q3`='".$_SESSION['_config']['user']['Q3']."',
1183 `Q4`='".$_SESSION['_config']['user']['Q4']."',
1184 `Q5`='".$_SESSION['_config']['user']['Q5']."',
1185 `A1`='".$_SESSION['_config']['user']['A1']."',
1186 `A2`='".$_SESSION['_config']['user']['A2']."',
1187 `A3`='".$_SESSION['_config']['user']['A3']."',
1188 `A4`='".$_SESSION['_config']['user']['A4']."',
1189 `A5`='".$_SESSION['_config']['user']['A5']."'
1190 where `id`='".$_SESSION['profile']['id']."'";
1191 mysql_query($query);
1192
1193 //!!!Should be rewritten
1194 $_SESSION['_config']['user']['otphash'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otphash']))));
1195 $_SESSION['_config']['user']['otppin'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otppin']))));
1196 if($_SESSION['_config']['user']['otphash'] != "" && $_SESSION['_config']['user']['otppin'] != "")
1197 {
1198 $query = "update `users` set `otphash`='".$_SESSION['_config']['user']['otphash']."',
1199 `otppin`='".$_SESSION['_config']['user']['otppin']."' where `id`='".$_SESSION['profile']['id']."'";
1200 mysql_query($query);
1201 }
1202
1203 $_SESSION['_config']['user']['set'] = 0;
1204 $_SESSION['profile'] = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."'"));
1205 $_SESSION['profile']['loggedin'] = 1;
1206
1207 $ddquery = "select sum(`points`) as `total` from `notary` where `to`='".$_SESSION['profile']['id']."' group by `to`";
1208 $ddres = mysql_query($ddquery);
1209 $ddrow = mysql_fetch_assoc($ddres);
1210 $_SESSION['profile']['points'] = $ddrow['total'];
1211
1212
1213 $id = 13;
1214 showheader(_("My CAcert.org Account!"));
1215 echo _("Your details have been updated with the database.");
1216 showfooter();
1217 exit;
1218 }
1219
1220 if($oldid == 14 && $process != "")
1221 {
1222 $_SESSION['_config']['user']['oldpass'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['oldpassword'])));
1223 $_SESSION['_config']['user']['pword1'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['pword1'])));
1224 $_SESSION['_config']['user']['pword2'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['pword2'])));
1225
1226 $id = 14;
1227 csrf_check("pwchange");
1228
1229 showheader(_("My CAcert.org Account!"));
1230 if($_SESSION['_config']['user']['pword1'] == "" || $_SESSION['_config']['user']['pword1'] != $_SESSION['_config']['user']['pword2'])
1231 {
1232 echo _("New Pass Phrases specified don't match or were blank.");
1233 } else {
1234 $score = checkpw($_SESSION['_config']['user']['pword1'], $_SESSION['profile']['email'], $_SESSION['profile']['fname'],
1235 $_SESSION['profile']['mname'], $_SESSION['profile']['lname'], $_SESSION['profile']['suffix']);
1236
1237 if($_SESSION['_config']['hostname'] != $_SESSION['_config']['securehostname'])
1238 {
1239 $match = mysql_query("select * from `users` where `id`='".$_SESSION['profile']['id']."' and
1240 (`password`=old_password('".$_SESSION['_config']['user']['oldpass']."') or
1241 `password`=sha1('".$_SESSION['_config']['user']['oldpass']."'))");
1242 $rc = mysql_num_rows($match);
1243 } else {
1244 $rc = 1;
1245 }
1246
1247 if(strlen($_SESSION['_config']['user']['pword1']) < 6) {
1248 echo _("The Pass Phrase you submitted was too short.");
1249 } else if($score < 3) {
1250 printf(_("The Pass Phrase you submitted failed to contain enough differing characters and/or contained words from your name and/or email address. Only scored %s points out of 6."), $score);
1251 } else if($rc <= 0) {
1252 echo _("You failed to correctly enter your current Pass Phrase.");
1253 } else {
1254 mysql_query("update `users` set `password`=sha1('".$_SESSION['_config']['user']['pword1']."')
1255 where `id`='".$_SESSION['profile']['id']."'");
1256 echo _("Your Pass Phrase has been updated and your primary email account has been notified of the change.");
1257 $body = sprintf(_("Hi %s,"),$_SESSION['profile']['fname'])."\n";
1258 $body .= _("You are receiving this email because you or someone else")."\n";
1259 $body .= _("has changed the password on your account.")."\n";
1260
1261 $body .= _("Best regards")."\n"._("CAcert.org Support!");
1262
1263 sendmail($_SESSION['profile']['email'], "[CAcert.org] "._("Password Update Notification"), $body,
1264 "support@cacert.org", "", "", "CAcert Support");
1265 }
1266 }
1267 showfooter();
1268 exit;
1269 }
1270
1271 if($oldid == 16)
1272 {
1273 $id = 16;
1274 $_SESSION['_config']['emails'] = array();
1275
1276 foreach($_REQUEST['emails'] as $val)
1277 {
1278 $val = mysql_real_escape_string(stripslashes(trim($val)));
1279 $bits = explode("@", $val);
1280 $count = count($bits);
1281 if($count != 2)
1282 continue;
1283
1284 if(checkownership($bits[1]) == false)
1285 continue;
1286
1287 if(!is_array($_SESSION['_config']['row']))
1288 continue;
1289 else if($_SESSION['_config']['row']['id'] > 0)
1290 $_SESSION['_config']['domids'][] = $_SESSION['_config']['row']['id'];
1291
1292 if($val != "")
1293 $_SESSION['_config']['emails'][] = $val;
1294 }
1295 $_SESSION['_config']['name'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['name'])));
1296 $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU'])));
1297 }
1298
1299 if($oldid == 16 && (intval(count($_SESSION['_config']['emails'])) + 0) <= 0)
1300 {
1301 $id = 16;
1302 showheader(_("My CAcert.org Account!"));
1303 echo _("I couldn't match any emails against your organisational account.");
1304 showfooter();
1305 exit;
1306 }
1307
1308 if($oldid == 16 && $process != "")
1309 {
1310
1311 if(array_key_exists('codesign',$_REQUEST) && $_REQUEST['codesign'] && $_SESSION['profile']['codesign'] && ($_SESSION['profile']['points'] >= 100))
1312 {
1313 $_REQUEST['codesign'] = 1;
1314 $_SESSION['_config']['codesign'] = 1;
1315 }
1316 else
1317 {
1318 $_REQUEST['codesign'] = 0;
1319 $_SESSION['_config']['codesign'] = 0;
1320 }
1321
1322 $_SESSION['_config']['rootcert'] = intval($_REQUEST['rootcert']);
1323 if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
1324 $_SESSION['_config']['rootcert'] = 1;
1325
1326 if(@count($_SESSION['_config']['emails']) > 0)
1327 $id = 17;
1328 }
1329
1330 if($oldid == 17)
1331 {
1332 $org = $_SESSION['_config']['row'];
1333 if($_REQUEST['keytype'] == "NS")
1334 {
1335 $spkac=""; if(preg_match("/^[a-zA-Z0-9+=\/]+$/", trim(str_replace("\n", "", str_replace("\r", "",$_REQUEST['SPKAC']))))) $spkac=trim(str_replace("\n", "", str_replace("\r", "",$_REQUEST['SPKAC'])));
1336
1337 if($spkac == "" || strlen($spkac) < 128)
1338 {
1339 $id = 17;
1340 showheader(_("My CAcert.org Account!"));
1341 echo _("I didn't receive a valid Certificate Request, hit the back button and try again.");
1342 showfooter();
1343 exit;
1344 }
1345
1346 $count = 0;
1347 $emails = "";
1348 $addys = array();
1349 if(is_array($_SESSION['_config']['emails']))
1350 foreach($_SESSION['_config']['emails'] as $_REQUEST['email'])
1351 {
1352 if(!$emails)
1353 $defaultemail = $_REQUEST['email'];
1354 $emails .= "$count.emailAddress = $_REQUEST[email]\n";
1355 $count++;
1356 }
1357 if($_SESSION['_config']['name'] != "")
1358 $emails .= "commonName = ".$_SESSION['_config']['name']."\n";
1359 if($_SESSION['_config']['OU'])
1360 $emails .= "organizationalUnitName = ".$_SESSION['_config']['OU']."\n";
1361 if($org['O'])
1362 $emails .= "organizationName = ".$org['O']."\n";
1363 if($org['L'])
1364 $emails .= "localityName = ".$org['L']."\n";
1365 if($org['ST'])
1366 $emails .= "stateOrProvinceName = ".$org['ST']."\n";
1367 if($org['C'])
1368 $emails .= "countryName = ".$org['C']."\n";
1369
1370 $emails .= "SPKAC = $spkac";
1371 $query = "insert into `orgemailcerts` set
1372 `CN`='$defaultemail',
1373 `keytype`='NS',
1374 `orgid`='".$org['orgid']."',
1375 `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
1376 `codesign`='".$_SESSION['_config']['codesign']."',
1377 `rootcert`='".$_SESSION['_config']['rootcert']."'";
1378 mysql_query($query);
1379 $emailid = mysql_insert_id();
1380
1381 foreach($_SESSION['_config']['domids'] as $addy)
1382 mysql_query("insert into `domemaillink` set `emailcertsid`='$emailid', `emailid`='$addy'");
1383
1384 $CSRname = $_SESSION['_config']['filepath']."/csr/orgclient-$emailid.csr";
1385 $fp = fopen($CSRname, "w");
1386 fputs($fp, $emails);
1387 fclose($fp);
1388 $challenge=$_SESSION['spkac_hash'];
1389 $res=`openssl spkac -verify -in $CSRname`;
1390 if(!strstr($res,"Challenge String: ".$challenge))
1391 {
1392 $id = $oldid;
1393 showheader(_("My CAcert.org Account!"));
1394 echo _("The challenge-response code of your certificate request did not match. Can't continue with certificaterequest.");
1395 showfooter();
1396 exit;
1397 }
1398 mysql_query("update `orgemailcerts` set `csr_name`='$CSRname' where `id`='$emailid'");
1399 } else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype']=="VI") {
1400 $csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."-----END CERTIFICATE REQUEST-----\n";
1401 $tmpfname = tempnam("/tmp", "id17CSR");
1402 $fp = fopen($tmpfname, "w");
1403 fputs($fp, $csr);
1404 fclose($fp);
1405
1406 $addys = array();
1407 $defaultemail = "";
1408 $csrsubject="";
1409
1410 if($_SESSION['_config']['name'] != "")
1411 $csrsubject = "/CN=".$_SESSION['_config']['name'];
1412 if(is_array($_SESSION['_config']['emails']))
1413 foreach($_SESSION['_config']['emails'] as $_REQUEST['email'])
1414 {
1415 if($defaultemail == "")
1416 $defaultemail = $_REQUEST['email'];
1417 $csrsubject .= "/emailAddress=$_REQUEST[email]";
1418 }
1419 if($_SESSION['_config']['OU'])
1420 $csrsubject .= "/organizationalUnitName=".$_SESSION['_config']['OU'];
1421 if($org['O'])
1422 $csrsubject .= "/organizationName=".$org['O'];
1423 if($org['L'])
1424 $csrsubject .= "/localityName=".$org['L'];
1425 if($org['ST'])
1426 $csrsubject .= "/stateOrProvinceName=".$org['ST'];
1427 if($org['C'])
1428 $csrsubject .= "/countryName=".$org['C'];
1429
1430 $tmpname = tempnam("/tmp", "id17csr");
1431 $do = `/usr/bin/openssl req -in $tmpfname -out $tmpname`;
1432 @unlink($tmpfname);
1433 $csr = "";
1434 $fp = fopen($tmpname, "r");
1435 while($data = fgets($fp, 4096))
1436 $csr .= $data;
1437 fclose($fp);
1438 @unlink($tmpname);
1439
1440 if($csr == "")
1441 {
1442 showheader(_("My CAcert.org Account!"));
1443 echo _("I didn't receive a valid Certificate Request, hit the back button and try again.");
1444 showfooter();
1445 exit;
1446 }
1447 $query = "insert into `orgemailcerts` set
1448 `CN`='$defaultemail',
1449 `keytype`='" . sanitizeHTML($_REQUEST['keytype']) . "',
1450 `orgid`='".$org['orgid']."',
1451 `created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
1452 `subject`='$csrsubject',
1453 `codesign`='".$_SESSION['_config']['codesign']."',
1454 `rootcert`='".$_SESSION['_config']['rootcert']."'";
1455 mysql_query($query);
1456 $emailid = mysql_insert_id();
1457
1458 foreach($_SESSION['_config']['domids'] as $addy)
1459 mysql_query("insert into `domemaillink` set `emailcertsid`='$emailid', `emailid`='$addy'");
1460
1461 $CSRname = $_SESSION['_config']['filepath']."/csr/orgclient-$emailid.csr";
1462 $fp = fopen($CSRname, "w");
1463 fputs($fp, $csr);
1464 fclose($fp);
1465 mysql_query("update `orgemailcerts` set `csr_name`='$CSRname' where `id`='$emailid'");
1466 }
1467 waitForResult("orgemailcerts", $emailid,$oldid);
1468 $query = "select * from `orgemailcerts` where `id`='$emailid' and `crt_name` != ''";
1469 $res = mysql_query($query);
1470 if(mysql_num_rows($res) <= 0)
1471 {
1472 showheader(_("My CAcert.org Account!"));
1473 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
1474 showfooter();
1475 exit;
1476 } else {
1477 $id = 19;
1478 $cert = $emailid;
1479 $_REQUEST['cert']=$emailid;
1480 }
1481 }
1482
1483 if($oldid == 18 && array_key_exists('renew',$_REQUEST) && $_REQUEST['renew'] != "")
1484 {
1485 csrf_check('clicerchange');
1486 showheader(_("My CAcert.org Account!"));
1487 if(is_array($_REQUEST['revokeid']))
1488 {
1489 $id = 18;
1490 echo _("Now renewing the following certificates:")."<br>\n";
1491 foreach($_REQUEST['revokeid'] as $id)
1492 {
1493 echo "Renewing certificate #$id ...\n<br/>";
1494 $id = intval($id);
1495 $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org`
1496 where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
1497 `org`.`orgid`=`orgemailcerts`.`orgid`";
1498 $res = mysql_query($query);
1499 if(mysql_num_rows($res) <= 0)
1500 {
1501 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1502 continue;
1503 }
1504 mysql_query("update `orgemailcerts` set `renewed`='1' where `id`='$id'");
1505 $row = mysql_fetch_assoc($res);
1506 if($row['revoke'] > 0)
1507 {
1508 printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
1509 continue;
1510 }
1511 $query = "insert into `orgemailcerts` set
1512 `orgid`='".$row['orgid']."',
1513 `CN`='".$row['CN']."',
1514 `subject`='".$row['subject']."',
1515 `keytype`='".$row['keytype']."',
1516 `csr_name`='".$row['csr_name']."',
1517 `created`='".$row['created']."',
1518 `modified`=NOW(),
1519 `codesign`='".$row['codesign']."',
1520 `rootcert`='".$row['rootcert']."'";
1521 mysql_query($query);
1522 $newid = mysql_insert_id();
1523 $newfile = $_SESSION['_config']['filepath']."/csr/orgclient-$newid.csr";
1524 copy($row['csr_name'], $newfile);
1525 mysql_query("update `orgemailcerts` set `csr_name`='$newfile' where `id`='$newid'");
1526 waitForResult("orgemailcerts", $newid,$oldid,0);
1527 $query = "select * from `orgemailcerts` where `id`='$newid' and `crt_name` != ''";
1528 $res = mysql_query($query);
1529 if(mysql_num_rows($res) > 0)
1530 {
1531 printf(_("Certificate for '%s' has been renewed."), $row['CN']);
1532 echo "<a href='account.php?id=19&cert=$newid' target='_new'>".
1533 _("Click here")."</a> "._("to install your certificate.");
1534 }
1535 echo("<br/>");
1536 }
1537 }
1538 else
1539 {
1540 echo _("You did not select any certificates for renewal.");
1541 }
1542 showfooter();
1543 exit;
1544 }
1545
1546 if($oldid == 18 && array_key_exists('revoke',$_REQUEST) && $_REQUEST['revoke'] != "")
1547 {
1548 csrf_check('clicerchange');
1549 $id = 18;
1550 showheader(_("My CAcert.org Account!"));
1551 if(is_array($_REQUEST['revokeid']))
1552 {
1553 echo _("Now revoking the following certificates:")."<br>\n";
1554 foreach($_REQUEST['revokeid'] as $id)
1555 {
1556 $id = intval($id);
1557 $query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `orgemailcerts`, `org`
1558 where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
1559 `org`.`orgid`=`orgemailcerts`.`orgid`";
1560 $res = mysql_query($query);
1561 if(mysql_num_rows($res) <= 0)
1562 {
1563 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1564 continue;
1565 }
1566 $row = mysql_fetch_assoc($res);
1567 if($row['revoke'] > 0)
1568 {
1569 printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
1570 continue;
1571 }
1572 mysql_query("update `orgemailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
1573 printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
1574 }
1575 }
1576 else
1577 {
1578 echo _("You did not select any certificates for revocation.");
1579 }
1580
1581 if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
1582 {
1583 echo _("Now deleting the following pending requests:")."<br>\n";
1584 foreach($_REQUEST['delid'] as $id)
1585 {
1586 $id = intval($id);
1587 $query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `orgemailcerts`, `org`
1588 where `orgemailcerts`.`id`='$id' and `org`.`memid`='".$_SESSION['profile']['id']."' and
1589 `org`.`orgid`=`orgemailcerts`.`orgid`";
1590 $res = mysql_query($query);
1591 if(mysql_num_rows($res) <= 0)
1592 {
1593 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1594 continue;
1595 }
1596 $row = mysql_fetch_assoc($res);
1597 if($row['expired'] > 0)
1598 {
1599 printf(_("Couldn't remove the request for `%s`, request had already been processed.")."<br>\n", $row['CN']);
1600 continue;
1601 }
1602 mysql_query("delete from `orgemailcerts` where `id`='$id'");
1603 @unlink($row['csr_name']);
1604 @unlink($row['crt_name']);
1605 printf(_("Removed a pending request for '%s'")."<br>\n", $row['CN']);
1606 }
1607 }
1608 showfooter();
1609 exit;
1610 }
1611
1612 if($process != "" && $oldid == 20)
1613 {
1614 $CSR = clean_csr($_REQUEST['CSR']);
1615 $_SESSION['_config']['tmpfname'] = tempnam("/tmp", "id20CSR");
1616 $fp = fopen($_SESSION['_config']['tmpfname'], "w");
1617 fputs($fp, $CSR);
1618 fclose($fp);
1619 $CSR = $_SESSION['_config']['tmpfname'];
1620 $_SESSION['_config']['subject'] = trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep "Subject:"`);
1621 $bits = explode(",", trim(`/usr/bin/openssl req -text -noout -in "$CSR"|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
1622 foreach($bits as $val)
1623 {
1624 $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
1625 }
1626 $id = 21;
1627
1628 $_SESSION['_config']['0.CN'] = $_SESSION['_config']['0.subjectAltName'] = "";
1629 extractit();
1630 getcn2();
1631 getalt2();
1632
1633 $query = "select * from `orginfo`,`org`,`orgdomains` where
1634 `org`.`memid`='".$_SESSION['profile']['id']."' and
1635 `org`.`orgid`=`orginfo`.`id` and
1636 `org`.`orgid`=`orgdomains`.`orgid` and
1637 `orgdomains`.`domain`='".$_SESSION['_config']['0.CN']."'";
1638 $_SESSION['_config']['CNorg'] = mysql_fetch_assoc(mysql_query($query));
1639 $query = "select * from `orginfo`,`org`,`orgdomains` where
1640 `org`.`memid`='".$_SESSION['profile']['id']."' and
1641 `org`.`orgid`=`orginfo`.`id` and
1642 `org`.`orgid`=`orgdomains`.`orgid` and
1643 `orgdomains`.`domain`='".$_SESSION['_config']['0.subjectAltName']."'";
1644 $_SESSION['_config']['SANorg'] = mysql_fetch_assoc(mysql_query($query));
1645 //echo "<pre>"; print_r($_SESSION['_config']); die;
1646
1647 if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
1648 {
1649 $id = 20;
1650 showheader(_("My CAcert.org Account!"));
1651 echo _("CommonName field was blank. This is usually caused by entering your own name when openssl prompt's you for 'YOUR NAME', or if you try to issue certificates for domains you haven't already verified, as such this process can't continue.");
1652 showfooter();
1653 exit;
1654 }
1655
1656 $_SESSION['_config']['rootcert'] = intval($_REQUEST['rootcert']);
1657 if($_SESSION['_config']['rootcert'] < 1 || $_SESSION['_config']['rootcert'] > 2)
1658 $_SESSION['_config']['rootcert'] = 1;
1659 }
1660
1661 if($process != "" && $oldid == 21)
1662 {
1663 $id = 21;
1664
1665 if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
1666 {
1667 showheader(_("My CAcert.org Account!"));
1668 echo _("CommonName field was blank. This is usually caused by entering your own name when openssl prompt's you for 'YOUR NAME', or if you try to issue certificates for domains you haven't already verified, as such this process can't continue.");
1669 showfooter();
1670 exit;
1671 }
1672
1673 if($_SESSION['_config']['rowid']['0'] > 0)
1674 {
1675 $query = "select * from `org`,`orginfo` where
1676 `orginfo`.`id`='".$_SESSION['_config']['rowid']['0']."' and
1677 `orginfo`.`id`=`org`.`orgid` and
1678 `org`.`memid`='".$_SESSION['profile']['id']."'";
1679 } else {
1680 $query = "select * from `org`,`orginfo` where
1681 `orginfo`.`id`='".$_SESSION['_config']['altid']['0']."' and
1682 `orginfo`.`id`=`org`.`orgid` and
1683 `org`.`memid`='".$_SESSION['profile']['id']."'";
1684 }
1685 $org = mysql_fetch_assoc(mysql_query($query));
1686 $csrsubject = "";
1687
1688 if($_SESSION['_config']['OU'])
1689 $csrsubject .= "/organizationalUnitName=".$_SESSION['_config']['OU'];
1690 if($org['O'])
1691 $csrsubject .= "/organizationName=".$org['O'];
1692 if($org['L'])
1693 $csrsubject .= "/localityName=".$org['L'];
1694 if($org['ST'])
1695 $csrsubject .= "/stateOrProvinceName=".$org['ST'];
1696 if($org['C'])
1697 $csrsubject .= "/countryName=".$org['C'];
1698 //if($org['contact'])
1699 // $csrsubject .= "/emailAddress=".trim($org['contact']);
1700
1701 if(is_array($_SESSION['_config']['rows']))
1702 foreach($_SESSION['_config']['rows'] as $row)
1703 $csrsubject .= "/commonName=$row";
1704 $SAN="";
1705 if(is_array($_SESSION['_config']['altrows']))
1706 foreach($_SESSION['_config']['altrows'] as $subalt)
1707 {
1708 if($SAN != "")
1709 $SAN .= ",";
1710 $SAN .= "$subalt";
1711 }
1712
1713 if($SAN != "")
1714 $csrsubject .= "/subjectAltName=".$SAN;
1715
1716 $type="";
1717 if($_REQUEST["ocspcert"]!="" && $_SESSION['profile']['admin'] == 1) $type="8";
1718
1719 if($_SESSION['_config']['rowid']['0'] > 0)
1720 {
1721 $query = "insert into `orgdomaincerts` set
1722 `CN`='".$_SESSION['_config']['rows']['0']."',
1723 `orgid`='".$org['id']."',
1724 `created`=NOW(),
1725 `subject`='$csrsubject',
1726 `rootcert`='".$_SESSION['_config']['rootcert']."',
1727 `type`='$type'";
1728 } else {
1729 $query = "insert into `orgdomaincerts` set
1730 `CN`='".$_SESSION['_config']['altrows']['0']."',
1731 `orgid`='".$org['id']."',
1732 `created`=NOW(),
1733 `subject`='$csrsubject',
1734 `rootcert`='".$_SESSION['_config']['rootcert']."',
1735 `type`='$type'";
1736 }
1737 mysql_query($query);
1738 $CSRid = mysql_insert_id();
1739
1740 $CSRname = $_SESSION['_config']['filepath']."/csr/orgserver-$CSRid.csr";
1741 rename($_SESSION['_config']['tmpfname'], $CSRname);
1742 chmod($CSRname,0644);
1743 mysql_query("update `orgdomaincerts` set `CSR_name`='$CSRname' where `id`='$CSRid'");
1744 if(is_array($_SESSION['_config']['rowid']))
1745 foreach($_SESSION['_config']['rowid'] as $id)
1746 mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'");
1747 if(is_array($_SESSION['_config']['altid']))
1748 foreach($_SESSION['_config']['altid'] as $id)
1749 mysql_query("insert into `orgdomlink` set `orgdomid`='$id', `orgcertid`='$CSRid'");
1750 waitForResult("orgdomaincerts", $CSRid,$oldid);
1751 $query = "select * from `orgdomaincerts` where `id`='$CSRid' and `crt_name` != ''";
1752 $res = mysql_query($query);
1753 if(mysql_num_rows($res) <= 0)
1754 {
1755 showheader(_("My CAcert.org Account!"));
1756 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions.")." CSRid: $CSRid", "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
1757 showfooter();
1758 exit;
1759 } else {
1760 $id = 23;
1761 $cert = $CSRid;
1762 $_REQUEST['cert']=$CSRid;
1763 }
1764 }
1765
1766 if($oldid == 22 && array_key_exists('renew',$_REQUEST) && $_REQUEST['renew'] != "")
1767 {
1768 csrf_check('orgsrvcerchange');
1769 showheader(_("My CAcert.org Account!"));
1770 if(is_array($_REQUEST['revokeid']))
1771 {
1772 echo _("Now renewing the following certificates:")."<br>\n";
1773 foreach($_REQUEST['revokeid'] as $id)
1774 {
1775 $id = intval($id);
1776 $query = "select *,UNIX_TIMESTAMP(`orgdomaincerts`.`revoked`) as `revoke` from
1777 `orgdomaincerts`,`org`
1778 where `orgdomaincerts`.`id`='$id' and
1779 `orgdomaincerts`.`orgid`=`org`.`orgid` and
1780 `org`.`memid`='".$_SESSION['profile']['id']."'";
1781 $res = mysql_query($query);
1782 if(mysql_num_rows($res) <= 0)
1783 {
1784 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1785 continue;
1786 }
1787 mysql_query("update `orgdomaincerts` set `renewed`='1' where `id`='$id'");
1788 $row = mysql_fetch_assoc($res);
1789 if($row['revoke'] > 0)
1790 {
1791 printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
1792 continue;
1793 }
1794 $query = "insert into `orgdomaincerts` set
1795 `orgid`='".$row['orgid']."',
1796 `CN`='".$row['CN']."',
1797 `csr_name`='".$row['csr_name']."',
1798 `created`='".$row['created']."',
1799 `modified`=NOW(),
1800 `subject`='".$row['subject']."',
1801 `type`='".$row['type']."',
1802 `rootcert`='".$row['rootcert']."'";
1803 mysql_query($query);
1804 $newid = mysql_insert_id();
1805 //echo "NewID: $newid<br/>\n";
1806 $newfile = $_SESSION['_config']['filepath']."/csr/orgserver-$newid.csr";
1807 copy($row['csr_name'], $newfile);
1808 mysql_query("update `orgdomaincerts` set `csr_name`='$newfile' where `id`='$newid'");
1809 echo _("Renewing").": ".$row['CN']."<br>\n";
1810 $res = mysql_query("select * from `orgdomlink` where `orgcertid`='".$row['id']."'");
1811 while($r2 = mysql_fetch_assoc($res))
1812 mysql_query("insert into `orgdomlink` set `orgdomid`='".$r2['id']."', `orgcertid`='$newid'");
1813 waitForResult("orgdomaincerts", $newid,$oldid,0);
1814 $query = "select * from `orgdomaincerts` where `id`='$newid' and `crt_name` != ''";
1815 $res = mysql_query($query);
1816 if(mysql_num_rows($res) <= 0)
1817 {
1818 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions.")." newid: $newid", "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
1819 } else {
1820 $drow = mysql_fetch_assoc($res);
1821 $cert = `/usr/bin/openssl x509 -in $drow[crt_name]`;
1822 echo "<pre>\n$cert\n</pre>\n";
1823 }
1824 }
1825 }
1826 else
1827 {
1828 echo _("You did not select any certificates for renewal.");
1829 }
1830 showfooter();
1831 exit;
1832 }
1833
1834 if($oldid == 22 && array_key_exists('revoke',$_REQUEST) && $_REQUEST['revoke'] != "")
1835 {
1836 csrf_check('orgsrvcerchange');
1837 showheader(_("My CAcert.org Account!"));
1838 if(is_array($_REQUEST['revokeid']))
1839 {
1840 echo _("Now revoking the following certificates:")."<br>\n";
1841 foreach($_REQUEST['revokeid'] as $id)
1842 {
1843 $id = intval($id);
1844 $query = "select *,UNIX_TIMESTAMP(`orgdomaincerts`.`revoked`) as `revoke` from
1845 `orgdomaincerts`,`org`
1846 where `orgdomaincerts`.`id`='$id' and
1847 `orgdomaincerts`.`orgid`=`org`.`orgid` and
1848 `org`.`memid`='".$_SESSION['profile']['id']."'";
1849 $res = mysql_query($query);
1850 if(mysql_num_rows($res) <= 0)
1851 {
1852 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1853 continue;
1854 }
1855 $row = mysql_fetch_assoc($res);
1856 if($row['revoke'] > 0)
1857 {
1858 printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."<br>\n", $row['CN']);
1859 continue;
1860 }
1861 mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='$id'");
1862 printf(_("Certificate for '%s' has been revoked.")."<br>\n", $row['CN']);
1863 }
1864 }
1865 else
1866 {
1867 echo _("You did not select any certificates for revocation.");
1868 }
1869
1870 if(array_key_exists('delid',$_REQUEST) && is_array($_REQUEST['delid']))
1871 {
1872 echo _("Now deleting the following pending requests:")."<br>\n";
1873 foreach($_REQUEST['delid'] as $id)
1874 {
1875 $id = intval($id);
1876 $query = "select *,UNIX_TIMESTAMP(`orgdomaincerts`.`expire`) as `expired` from
1877 `orgdomaincerts`,`org`
1878 where `orgdomaincerts`.`id`='$id' and
1879 `orgdomaincerts`.`orgid`=`org`.`orgid` and
1880 `org`.`memid`='".$_SESSION['profile']['id']."'";
1881 $res = mysql_query($query);
1882 if(mysql_num_rows($res) <= 0)
1883 {
1884 printf(_("Invalid ID '%s' presented, can't do anything with it.")."<br>\n", $id);
1885 continue;
1886 }
1887 $row = mysql_fetch_assoc($res);
1888 if($row['expired'] > 0)
1889 {
1890 printf(_("Couldn't remove the request for `%s`, request had already been processed.")."<br>\n", $row['CN']);
1891 continue;
1892 }
1893 mysql_query("delete from `orgdomaincerts` where `id`='$id'");
1894 @unlink($row['csr_name']);
1895 @unlink($row['crt_name']);
1896 printf(_("Removed a pending request for '%s'")."<br>\n", $row['CN']);
1897 }
1898 }
1899 showfooter();
1900 exit;
1901 }
1902
1903 if(($id == 24 || $oldid == 24 || $id == 25 || $oldid == 25 || $id == 26 || $oldid == 26 ||
1904 $id == 27 || $oldid == 27 || $id == 28 || $oldid == 28 || $id == 29 || $oldid == 29 ||
1905 $id == 30 || $oldid == 30 || $id == 31 || $oldid == 31) &&
1906 $_SESSION['profile']['orgadmin'] != 1)
1907 {
1908 showheader(_("My CAcert.org Account!"));
1909 echo _("You don't have access to this area.");
1910 showfooter();
1911 exit;
1912 }
1913
1914 if($oldid == 24 && $process != "")
1915 {
1916 $id = intval($oldid);
1917 $_SESSION['_config']['O'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['O'])));
1918 $_SESSION['_config']['contact'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['contact'])));
1919 $_SESSION['_config']['L'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['L'])));
1920 $_SESSION['_config']['ST'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['ST'])));
1921 $_SESSION['_config']['C'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['C'])));
1922 $_SESSION['_config']['comments'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['comments'])));
1923
1924 if($_SESSION['_config']['O'] == "" || $_SESSION['_config']['contact'] == "")
1925 {
1926 $_SESSION['_config']['errmsg'] = _("Organisation Name and Contact Email are required fields.");
1927 } else {
1928 mysql_query("insert into `orginfo` set `O`='".$_SESSION['_config']['O']."',
1929 `contact`='".$_SESSION['_config']['contact']."',
1930 `L`='".$_SESSION['_config']['L']."',
1931 `ST`='".$_SESSION['_config']['ST']."',
1932 `C`='".$_SESSION['_config']['C']."',
1933 `comments`='".$_SESSION['_config']['comments']."'");
1934 showheader(_("My CAcert.org Account!"));
1935 printf(_("'%s' has just been successfully added as an organisation to the database."), sanitizeHTML($_SESSION['_config']['O']));
1936 showfooter();
1937 exit;
1938 }
1939 }
1940
1941 if($oldid == 27 && $process != "")
1942 {
1943 csrf_check('orgdetchange');
1944 $id = intval($oldid);
1945 $_SESSION['_config']['O'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['O'])));
1946 $_SESSION['_config']['contact'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['contact'])));
1947 $_SESSION['_config']['L'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['L'])));
1948 $_SESSION['_config']['ST'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['ST'])));
1949 $_SESSION['_config']['C'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['C'])));
1950 $_SESSION['_config']['comments'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['comments'])));
1951
1952 if($_SESSION['_config']['O'] == "" || $_SESSION['_config']['contact'] == "")
1953 {
1954 $_SESSION['_config']['errmsg'] = _("Organisation Name and Contact Email are required fields.");
1955 } else {
1956 mysql_query("update `orginfo` set `O`='".$_SESSION['_config']['O']."',
1957 `contact`='".$_SESSION['_config']['contact']."',
1958 `L`='".$_SESSION['_config']['L']."',
1959 `ST`='".$_SESSION['_config']['ST']."',
1960 `C`='".$_SESSION['_config']['C']."',
1961 `comments`='".$_SESSION['_config']['comments']."'
1962 where `id`='".$_SESSION['_config']['orgid']."'");
1963 showheader(_("My CAcert.org Account!"));
1964 printf(_("'%s' has just been successfully updated in the database."), sanitizeHTML($_SESSION['_config']['O']));
1965 showfooter();
1966 exit;
1967 }
1968 }
1969
1970 if($oldid == 28 && $process != "" && array_key_exists("domainname",$_REQUEST))
1971 {
1972 $domain = $_SESSION['_config']['domain'] = trim(mysql_real_escape_string(stripslashes($_REQUEST['domainname'])));
1973 $res1 = mysql_query("select * from `orgdomains` where `domain`='$domain'");
1974 if(mysql_num_rows($res1) > 0)
1975 {
1976 $_SESSION['_config']['errmsg'] = sprintf(_("The domain '%s' is already in the system and is listed as valid. Can't continue."), sanitizeHTML($domain));
1977 $id = $oldid;
1978 $oldid=0;
1979 }
1980 }
1981
1982 if($oldid == 28 && $_SESSION['_config']['orgid'] <= 0)
1983 {
1984 $oldid=0;
1985 $id = 25;
1986 }
1987
1988 if($oldid == 28 && $process != "" && array_key_exists("orgid",$_SESSION["_config"]))
1989 {
1990 mysql_query("insert into `orgdomains` set `orgid`='".intval($_SESSION['_config']['orgid'])."', `domain`='$domain'");
1991 showheader(_("My CAcert.org Account!"));
1992 printf(_("'%s' has just been successfully added to the database."), sanitizeHTML($domain));
1993 echo "<br><br><a href='account.php?id=26&orgid=".intval($_SESSION['_config']['orgid'])."'>"._("Click here")."</a> "._("to continue.");
1994 showfooter();
1995 exit;
1996 }
1997
1998 if($oldid == 29 && $process != "")
1999 {
2000 $domain = mysql_real_escape_string(stripslashes(trim($domainname)));
2001
2002 $res1 = mysql_query("select * from `orgdomains` where `domain` like '$domain' and `id`!='".intval($_SESSION['_config']['domid'])."'");
2003 $res2 = mysql_query("select * from `domains` where `domain` like '$domain' and `deleted`=0");
2004 if(mysql_num_rows($res1) > 0 || mysql_num_rows($res2) > 0)
2005 {
2006 $_SESSION['_config']['errmsg'] = sprintf(_("The domain '%s' is already in the system and is listed as valid. Can't continue."), sanitizeHTML($domain));
2007 $id = $oldid;
2008 $oldid=0;
2009 }
2010 }
2011
2012 if(($oldid == 29 || $oldid == 30) && $process != _("Cancel"))
2013 {
2014 $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
2015 `orgdomlink`.`orgdomid`=`orgdomains`.`id` and
2016 `orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and
2017 `orgdomains`.`id`='".intval($_SESSION['_config']['domid'])."'";
2018 $res = mysql_query($query);
2019 while($row = mysql_fetch_assoc($res))
2020 mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$row['id']."'");
2021
2022 $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
2023 `orgemaillink`.`domid`=`orgdomains`.`id` and
2024 `orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and
2025 `orgdomains`.`id`='".intval($_SESSION['_config']['domid'])."'";
2026 $res = mysql_query($query);
2027 while($row = mysql_fetch_assoc($res))
2028 mysql_query("update `orgemailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".intval($row['id'])."'");
2029 }
2030
2031 if($oldid == 29 && $process != "")
2032 {
2033 $row = mysql_fetch_assoc(mysql_query("select * from `orgdomains` where `id`='".intval($_SESSION['_config']['domid'])."'"));
2034 mysql_query("update `orgdomains` set `domain`='$domain' where `id`='".intval($_SESSION['_config']['domid'])."'");
2035 showheader(_("My CAcert.org Account!"));
2036 printf(_("'%s' has just been successfully updated in the database."), sanitizeHTML($domain));
2037 echo "<br><br><a href='account.php?id=26&orgid=".intval($_SESSION['_config']['orgid'])."'>"._("Click here")."</a> "._("to continue.");
2038 showfooter();
2039 exit;
2040 }
2041
2042 if($oldid == 30 && $process != "")
2043 {
2044 $row = mysql_fetch_assoc(mysql_query("select * from `orgdomains` where `id`='".intval($_SESSION['_config']['domid'])."'"));
2045 $domain = $row['domain'];
2046 mysql_query("delete from `orgdomains` where `id`='".intval($_SESSION['_config']['domid'])."'");
2047 showheader(_("My CAcert.org Account!"));
2048 printf(_("'%s' has just been successfully deleted from the database."), sanitizeHTML($domain));
2049 echo "<br><br><a href='account.php?id=26&orgid=".intval($_SESSION['_config']['orgid'])."'>"._("Click here")."</a> "._("to continue.");
2050 showfooter();
2051 exit;
2052 }
2053
2054 if($oldid == 30)
2055 {
2056 $id = 26;
2057 $orgid = 0;
2058 }
2059
2060 if($oldid == 31 && $process != _("Cancel"))
2061 {
2062 $query = "select * from `orgdomains` where `orgid`='".intval($_SESSION['_config']['orgid'])."'";
2063 $dres = mysql_query($query);
2064 while($drow = mysql_fetch_assoc($dres))
2065 {
2066 $query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
2067 `orgdomlink`.`orgdomid`=`orgdomains`.`id` and
2068 `orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and
2069 `orgdomains`.`id`='".intval($drow['id'])."'";
2070 $res = mysql_query($query);
2071 while($row = mysql_fetch_assoc($res))
2072 {
2073 mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".intval($row['id'])."'");
2074 mysql_query("delete from `orgdomaincerts` where `orgid`='".intval($row['id'])."'");
2075 mysql_query("delete from `orgdomlink` where `domid`='".intval($row['id'])."'");
2076 }
2077
2078 $query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
2079 `orgemaillink`.`domid`=`orgdomains`.`id` and
2080 `orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and
2081 `orgdomains`.`id`='".intval($drow['id'])."'";
2082 $res = mysql_query($query);
2083 while($row = mysql_fetch_assoc($res))
2084 {
2085 mysql_query("update `orgemailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".intval($row['id'])."'");
2086 mysql_query("delete from `orgemailcerts` where `id`='".intval($row['id'])."'");
2087 mysql_query("delete from `orgemaillink` where `domid`='".intval($row['id'])."'");
2088 }
2089 }
2090 mysql_query("delete from `org` where `orgid`='".intval($_SESSION['_config']['orgid'])."'");
2091 mysql_query("delete from `orgdomains` where `orgid`='".intval($_SESSION['_config']['orgid'])."'");
2092 mysql_query("delete from `orginfo` where `id`='".intval($_SESSION['_config']['orgid'])."'");
2093 }
2094
2095 if($oldid == 31)
2096 {
2097 $id = 25;
2098 $orgid = 0;
2099 }
2100
2101 if($id == 32 || $oldid == 32 || $id == 33 || $oldid == 33 || $id == 34 || $oldid == 34 ||
2102 $id == 35 || $oldid == 35)
2103 {
2104 $query = "select * from `org` where `memid`='".intval($_SESSION['profile']['id'])."' and `masteracc`='1'";
2105 $_macc = mysql_num_rows(mysql_query($query));
2106 if($_SESSION['profile']['orgadmin'] != 1 && $_macc <= 0)
2107 {
2108 showheader(_("My CAcert.org Account!"));
2109 echo _("You don't have access to this area.");
2110 showfooter();
2111 exit;
2112 }
2113 }
2114
2115 if($id == 33 && $_SESSION['profile']['orgadmin'] != 1)
2116 {
2117 $orgid = intval($_SESSION['_config']['orgid']);
2118 $query = "select * from `org` where `orgid`='$orgid' and `memid`='".intval($_SESSION['profile']['id'])."' and `masteracc`='1'";
2119 $res = mysql_query($query);
2120 if(mysql_num_rows($res) <= 0)
2121 {
2122 $id = 35;
2123 }
2124 }
2125
2126 if($oldid == 33 && $process != "")
2127 {
2128 csrf_check('orgadmadd');
2129 if($_SESSION['profile']['orgadmin'] == 1)
2130 $masteracc = $_SESSION['_config'][masteracc] = intval($_REQUEST['masteracc']);
2131 else
2132 $masteracc = $_SESSION['_config'][masteracc] = 0;
2133 $_REQUEST['email'] = $_SESSION['_config']['email'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['email'])));
2134 $OU = $_SESSION['_config']['OU'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['OU'])));
2135 $comments = $_SESSION['_config']['comments'] = mysql_real_escape_string(stripslashes(trim($_REQUEST['comments'])));
2136 $res = mysql_query("select * from `users` where `email`='".$_REQUEST['email']."' and `deleted`=0");
2137 if(mysql_num_rows($res) <= 0)
2138 {
2139 $id = $oldid;
2140 $oldid=0;
2141 $_SESSION['_config']['errmsg'] = sprintf(_("Wasn't able to match '%s' against any user in the system"), sanitizeHTML($_REQUEST['email']));
2142 } else {
2143 $row = mysql_fetch_assoc($res);
2144 mysql_query("insert into `org` set `memid`='".intval($row['id'])."', `orgid`='".intval($_SESSION['_config']['orgid'])."',
2145 `masteracc`='$masteracc', `OU`='$OU', `comments`='$comments'");
2146 }
2147 }
2148
2149 if(($oldid == 34 || $id == 34) && $_SESSION['profile']['orgadmin'] != 1)
2150 {
2151 $orgid = intval($_SESSION['_config']['orgid']);
2152 $res = mysql_query("select * from `org` where `orgid`='$orgid' and `memid`='".$_SESSION['profile']['id']."' and `masteracc`='1'");
2153 if(mysql_num_rows($res) <= 0)
2154 $id = 32;
2155 }
2156
2157 if($oldid == 34 && $process != "")
2158 {
2159 $orgid = intval($_SESSION['_config']['orgid']);
2160 $memid = intval($_REQUEST['memid']);
2161 $query = "delete from `org` where `orgid`='$orgid' and `memid`='$memid'";
2162 mysql_query($query);
2163 }
2164
2165 if($oldid == 34 || $oldid == 33)
2166 {
2167 $oldid=0;
2168 $id = 32;
2169 $orgid = 0;
2170 }
2171
2172 if($id == 36)
2173 {
2174 $row = mysql_fetch_assoc(mysql_query("select * from `alerts` where `memid`='".intval($_SESSION['profile']['id'])."'"));
2175 $_REQUEST['general'] = $row['general'];
2176 $_REQUEST['country'] = $row['country'];
2177 $_REQUEST['regional'] = $row['regional'];
2178 $_REQUEST['radius'] = $row['radius'];
2179 }
2180
2181 if($oldid == 36)
2182 {
2183 $rc = mysql_num_rows(mysql_query("select * from `alerts` where `memid`='".intval($_SESSION['profile']['id'])."'"));
2184 if($rc > 0)
2185 {
2186 $query = "update `alerts` set `general`='".intval(array_key_exists('general',$_REQUEST)?$_REQUEST['general']:0)."',
2187 `country`='".intval(array_key_exists('country',$_REQUEST)?$_REQUEST['country']:0)."',
2188 `regional`='".intval(array_key_exists('regional',$_REQUEST)?$_REQUEST['regional']:0)."',
2189 `radius`='".intval(array_key_exists('radius',$_REQUEST)?$_REQUEST['radius']:0)."'
2190 where `memid`='".intval($_SESSION['profile']['id'])."'";
2191 } else {
2192 $query = "insert into `alerts` set `general`='".intval(array_key_exists('general',$_REQUEST)?$_REQUEST['general']:0)."',
2193 `country`='".intval(array_key_exists('country',$_REQUEST)?$_REQUEST['country']:0)."',
2194 `regional`='".intval(array_key_exists('regional',$_REQUEST)?$_REQUEST['regional']:0)."',
2195 `radius`='".intval(array_key_exists('radius',$_REQUEST)?$_REQUEST['radius']:0)."',
2196 `memid`='".intval($_SESSION['profile']['id'])."'";
2197 }
2198 mysql_query($query);
2199 $id = $oldid;
2200 $oldid=0;
2201 }
2202
2203 if($oldid == 41 && $_REQUEST['action'] == 'default')
2204 {
2205 csrf_check("mainlang");
2206 $lang = mysql_real_escape_string($_REQUEST['lang']);
2207 foreach($_SESSION['_config']['translations'] as $key => $val)
2208 {
2209 if($key == $lang)
2210 {
2211 mysql_query("update `users` set `language`='$lang' where `id`='".$_SESSION['profile']['id']."'");
2212 $_SESSION['profile']['language'] = $lang;
2213 showheader(_("My CAcert.org Account!"));
2214 echo _("Your language setting has been updated.");
2215 showfooter();
2216 exit;
2217 }
2218 }
2219
2220 showheader(_("My CAcert.org Account!"));
2221 echo _("You tried to use an invalid language.");
2222 showfooter();
2223 exit;
2224 }
2225
2226 if($oldid == 41 && $_REQUEST['action'] == 'addsec')
2227 {
2228 csrf_check("seclang");
2229 $addlang = mysql_real_escape_string($_REQUEST['addlang']);
2230 // Does the language exist?
2231 mysql_query("insert into `addlang` set `userid`='".intval($_SESSION['profile']['id'])."', `lang`='$addlang'");
2232 showheader(_("My CAcert.org Account!"));
2233 echo _("Your language setting has been updated.");
2234 showfooter();
2235 exit;
2236 }
2237
2238 if($oldid == 41 && $_REQUEST['action'] == 'dellang')
2239 {
2240 csrf_check("seclang");
2241 $remove = mysql_real_escape_string($_REQUEST['remove']);
2242 mysql_query("delete from `addlang` where `userid`='".intval($_SESSION['profile']['id'])."' and `lang`='$remove'");
2243 showheader(_("My CAcert.org Account!"));
2244 echo _("Your language setting has been updated.");
2245 showfooter();
2246 exit;
2247 }
2248
2249 if(($id == 42 || $id == 43 || $id == 44 || $id == 48 || $id == 49 || $id == 50 ||
2250 $oldid == 42 || $oldid == 43 || $oldid == 44 || $oldid == 48 || $oldid == 49 || $oldid == 50) &&
2251 $_SESSION['profile']['admin'] != 1)
2252 {
2253 showheader(_("My CAcert.org Account!"));
2254 echo _("You don't have access to this area.");
2255 showfooter();
2256 exit;
2257 }
2258
2259 if(($id == 53 || $id == 54 || $oldid == 53 || $oldid == 54) &&
2260 $_SESSION['profile']['locadmin'] != 1)
2261 {
2262 showheader(_("My CAcert.org Account!"));
2263 echo _("You don't have access to this area.");
2264 showfooter();
2265 exit;
2266 }
2267
2268 if($oldid == 54 || ($id == 53 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "") ||
2269 ($id == 54 && array_key_exists('action',$_REQUEST) && $_REQUEST['action'] != "" &&
2270 $_REQUEST['action'] != "aliases" && $_REQUEST['action'] != "edit" && $_REQUEST['action'] != "add"))
2271 {
2272 $id = 53;
2273 $ccid = intval(array_key_exists('ccid',$_REQUEST)?$_REQUEST['ccid']:0);
2274 $regid = intval(array_key_exists('regid',$_REQUEST)?$_REQUEST['regid']:0);
2275 $newreg = intval(array_key_exists('newreg',$_REQUEST)?$_REQUEST['newreg']:0);
2276 $locid = intval(array_key_exists('locid',$_REQUEST)?$_REQUEST['locid']:0);
2277 $name = array_key_exists('name',$_REQUEST)?mysql_real_escape_string(strip_tags($_REQUEST['name'])):"";
2278 $long = array_key_exists('longitude',$_REQUEST)?doubleval($_REQUEST['longitude']):"";
2279 $lat = array_key_exists('latitude', $_REQUEST)?doubleval($_REQUEST['latitude']):"";
2280 $action = array_key_exists('action',$_REQUEST)?$_REQUEST['action']:"";
2281
2282 if($locid > 0 && $action == "edit")
2283 {
2284 $query = "update `locations` set `name`='$name', `lat`='$lat', `long`='$long' where `id`='$locid'";
2285 mysql_query($query);
2286 $row = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='$locid'"));
2287 $_REQUEST['regid'] = $row['regid'];
2288 unset($_REQUEST['ccid']);
2289 unset($_REQUEST['locid']);
2290 unset($_REQUEST['action']);
2291 } else if($regid > 0 && $action == "edit") {
2292 $query = "update `regions` set `name`='$name' where `id`='$regid'";
2293 mysql_query($query);
2294 $row = mysql_fetch_assoc(mysql_query("select * from `regions` where `id`='$regid'"));
2295 $_REQUEST['ccid'] = $row['ccid'];
2296 unset($_REQUEST['regid']);
2297 unset($_REQUEST['locid']);
2298 unset($_REQUEST['action']);
2299 } else if($regid > 0 && $action == "add") {
2300 $row = mysql_fetch_assoc(mysql_query("select `ccid` from `regions` where `id`='$regid'"));
2301 $ccid = $row['ccid'];
2302 $query = "insert into `locations` set `ccid`='$ccid', `regid`='$regid', `name`='$name', `lat`='$lat', `long`='$long'";
2303 mysql_query($query);
2304 unset($_REQUEST['ccid']);
2305 unset($_REQUEST['locid']);
2306 unset($_REQUEST['action']);
2307 } else if($ccid > 0 && $action == "add" && $name != "") {
2308 $query = "insert into `regions` set `ccid`='$ccid', `name`='$name'";
2309 mysql_query($query);
2310 $row = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='$locid'"));
2311 unset($_REQUEST['regid']);
2312 unset($_REQUEST['locid']);
2313 unset($_REQUEST['action']);
2314 } else if($locid > 0 && $action == "delete") {
2315 $row = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='$locid'"));
2316 $_REQUEST['regid'] = $row['regid'];
2317 mysql_query("delete from `localias` where `locid`='$locid'");
2318 mysql_query("delete from `locations` where `id`='$locid'");
2319 unset($_REQUEST['ccid']);
2320 unset($_REQUEST['locid']);
2321 unset($_REQUEST['action']);
2322 } else if($locid > 0 && $action == "move") {
2323 $row = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='$locid'"));
2324 $oldregid = $row['regid'];
2325 mysql_query("update `locations` set `regid`='$newreg' where `id`='$locid'");
2326 mysql_query("update `users` set `regid`='$newreg' where `regid`='$oldregid'");
2327 $row = mysql_fetch_assoc(mysql_query("select * from `locations` where `id`='$locid'"));
2328 $_REQUEST['regid'] = $row['regid'];
2329 unset($_REQUEST['ccid']);
2330 unset($_REQUEST['locid']);
2331 unset($_REQUEST['action']);
2332 } else if($regid > 0 && $action == "delete") {
2333 $row = mysql_fetch_assoc(mysql_query("select * from `regions` where `id`='$regid'"));
2334 $_REQUEST['ccid'] = $row['ccid'];
2335 mysql_query("delete from `locations` where `regid`='$regid'");
2336 mysql_query("delete from `regions` where `id`='$regid'");
2337 unset($_REQUEST['regid']);
2338 unset($_REQUEST['locid']);
2339 unset($_REQUEST['action']);
2340 } else if($locid > 0 && $action == "alias") {
2341 $id = 54;
2342 $_REQUEST['action'] = "aliases";
2343 $_REQUEST['locid'] = $locid;
2344 $name = htmlentities($name);
2345 $row = mysql_query("insert into `localias` set `locid`='$locid',`name`='$name'");
2346 } else if($locid > 0 && $action == "delalias") {
2347 $id = 54;
2348 $_REQUEST['action'] = "aliases";
2349 $_REQUEST['locid'] = $locid;
2350 $row = mysql_query("delete from `localias` where `locid`='$locid' and `name`='$name'");
2351 }
2352 }
2353
2354 if($oldid == 42 && $_REQUEST['email'] == "")
2355 {
2356 $id = $oldid;
2357 $oldid=0;
2358 }
2359
2360 if($oldid == 42)
2361 {
2362 $id = 43;
2363 $oldid=0;
2364 }
2365
2366 if($oldid == 43 && $_REQUEST['action'] == "updatedob")
2367 {
2368 $id = 43;
2369 $oldid=0;
2370 $fname = mysql_real_escape_string($_REQUEST['fname']);
2371 $mname = mysql_real_escape_string($_REQUEST['mname']);
2372 $lname = mysql_real_escape_string($_REQUEST['lname']);
2373 $suffix = mysql_real_escape_string($_REQUEST['suffix']);
2374 $day = intval($_REQUEST['day']);
2375 $month = intval($_REQUEST['month']);
2376 $year = intval($_REQUEST['year']);
2377 $userid = intval($_REQUEST['userid']);
2378 $query = "select `fname`,`mname`,`lname`,`suffix`,`dob` from `users` where `id`='$userid'";
2379 $details = mysql_fetch_assoc(mysql_query($query));
2380 $query = "insert into `adminlog` set `when`=NOW(),`old-lname`='${details['lname']}',`old-dob`='${details['dob']}',
2381 `new-lname`='$lname',`new-dob`='$year-$month-$day',`uid`='$userid',`adminid`='".$_SESSION['profile']['id']."'";
2382 mysql_query($query);
2383 $query = "update `users` set `fname`='$fname',`mname`='$mname',`lname`='$lname',`suffix`='$suffix',`dob`='$year-$month-$day' where `id`='$userid'";
2384 mysql_query($query);
2385 }
2386
2387 if($oldid == 48 && $_REQUEST['domain'] == "")
2388 {
2389 $id = $oldid;
2390 $oldid=0;
2391 }
2392
2393 if($oldid == 48)
2394 {
2395 $id = 49;
2396 $oldid=0;
2397 }
2398
2399 if($id == 44)
2400 {
2401 if($_REQUEST['userid'] != "")
2402 $_REQUEST['userid'] = intval($_REQUEST['userid']);
2403 $row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
2404 if($row['email'] == "")
2405 $id = 42;
2406 else
2407 $_REQUEST['email'] = $row['email'];
2408 }
2409
2410 if($oldid == 44)
2411 {
2412 showheader(_("My CAcert.org Account!"));
2413 if(intval($_REQUEST['userid']) <= 0)
2414 {
2415 echo _("No such user found.");
2416 } else {
2417 mysql_query("update `users` set `password`=sha1('".mysql_real_escape_string(stripslashes($_REQUEST['newpass']))."') where `id`='".intval($_REQUEST['userid'])."'");
2418 $row = mysql_fetch_assoc(mysql_query("select * from `users` where `id`='".intval($_REQUEST['userid'])."'"));
2419 printf(_("The password for %s has been updated successfully in the system."), sanitizeHTML($row['email']));
2420
2421
2422 $body = sprintf(_("Hi %s,"),$row['fname'])."\n";
2423 $body .= _("You are receiving this email because a CAcert administrator")."\n";
2424 $body .= _("has changed the password on your account.")."\n";
2425
2426 $body .= _("Best regards")."\n"._("CAcert.org Support!");
2427
2428 sendmail($row['email'], "[CAcert.org] "._("Password Update Notification"), $body,
2429 "support@cacert.org", "", "", "CAcert Support");
2430
2431 }
2432 showfooter();
2433 exit;
2434 }
2435
2436 if($process != "" && $oldid == 45)
2437 {
2438 $CSR = clean_csr($CSR);
2439 $_SESSION['_config']['CSR'] = $CSR;
2440 $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
2441 $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
2442 foreach($bits as $val)
2443 {
2444 $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
2445 }
2446 $id = 46;
2447
2448 $_SESSION['_config']['0.CN'] = $_SESSION['_config']['0.subjectAltName'] = "";
2449 extractit();
2450 getcn();
2451 getalt();
2452
2453 if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
2454 {
2455 showheader(_("My CAcert.org Account!"));
2456 echo _("CommonName field was blank. This is usually caused by entering your own name when openssl prompt's you for 'YOUR NAME', or if you try to issue certificates for domains you haven't already verified, as such this process can't continue.");
2457 showfooter();
2458 exit;
2459 }
2460 }
2461
2462 if($process != "" && $oldid == 46)
2463 {
2464 $CSR = clean_csr($_SESSION['_config']['CSR']);
2465 $_SESSION['_config']['subject'] = trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep "Subject:"`);
2466 $bits = explode(",", trim(`echo "$CSR"|/usr/bin/openssl req -text -noout|tr -d "\\0"|grep -A1 'X509v3 Subject Alternative Name:'|grep DNS:`));
2467 foreach($bits as $val)
2468 {
2469 $_SESSION['_config']['subject'] .= "/subjectAltName=".trim($val);
2470 }
2471 $id = 11;
2472
2473 $_SESSION['_config']['0.CN'] = $_SESSION['_config']['0.subjectAltName'] = "";
2474 extractit();
2475 getcn();
2476 getalt();
2477
2478 if($_SESSION['_config']['0.CN'] == "" && $_SESSION['_config']['0.subjectAltName'] == "")
2479 {
2480 showheader(_("My CAcert.org Account!"));
2481 echo _("CommonName field was blank. This is usually caused by entering your own name when openssl prompt's you for 'YOUR NAME', or if you try to issue certificates for domains you haven't already verified, as such this process can't continue.");
2482 showfooter();
2483 exit;
2484 }
2485
2486 $query = "insert into `domaincerts` set
2487 `CN`='".$_SESSION['_config']['0.CN']."',
2488 `domid`='".$_SESSION['_config']['row']['id']."',
2489 `created`=NOW()";
2490 mysql_query($query);
2491 $CSRid = mysql_insert_id();
2492
2493 foreach($_SESSION['_config']['rowid'] as $dom)
2494 mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
2495 if(is_array($_SESSION['_config']['altid']))
2496 foreach($_SESSION['_config']['altid'] as $dom)
2497 mysql_query("insert into `domlink` set `certid`='$CSRid', `domid`='$dom'");
2498
2499 $CSRname = $_SESSION['_config']['filepath']."/csr/server-$CSRid.csr";
2500 $fp = fopen($CSRname, "w");
2501 fputs($fp, $_SESSION['_config']['CSR']);
2502 fclose($fp);
2503 mysql_query("update `domaincerts` set `CSR_name`='$CSRname' where `id`='$CSRid'");
2504 waitForResult("domaincerts", $CSRid,$oldid);
2505 $query = "select * from `domaincerts` where `id`='$CSRid' and `crt_name` != ''";
2506 $res = mysql_query($query);
2507 if(mysql_num_rows($res) <= 0)
2508 {
2509 showheader(_("My CAcert.org Account!"));
2510 printf(_("Your certificate request has failed to be processed correctly, see %sthe WIKI page%s for reasons and solutions."), "<a href='http://wiki.cacert.org/wiki/FAQ/CertificateRenewal'>", "</a>");
2511 showfooter();
2512 exit;
2513 } else {
2514 $id = 47;
2515 $cert = $CSRid;
2516 $_REQUEST['cert']=$CSRid;
2517 }
2518 }
2519
2520 if($id == 43 && array_key_exists('tverify',$_REQUEST) &&am