benjaminramey/bobsleighphotos.com
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Ben Ramey
2017-03-02 20:30:40 -06:00
commit ab3c6fc8d5
10773 changed files with 515124 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

136
production/classes/session/cc_admin_session.php Normal file
View File

@@ -0,0 +1,136 @@
<?php
/*
+--------------------------------------------------------------------------
| CubeCart 4
| ========================================
| CubeCart is a registered trade mark of Devellion Limited
| Copyright Devellion Limited 2006. All rights reserved.
| Devellion Limited,
| 5 Bridge Street,
| Bishops Stortford,
| HERTFORDSHIRE.
| CM23 2JU
| UNITED KINGDOM
| http://www.devellion.com
| UK Private Limited Company No. 5323904
| ========================================
| Web: http://www.cubecart.com
| Email: info (at) cubecart (dot) com
| License Type: CubeCart is NOT Open Source Software and Limitations Apply
| Licence Info: http://www.cubecart.com/site/faq/license.php
+--------------------------------------------------------------------------
| cc_admin_session.php
| ========================================
| Admin Authentication and Permissions
+--------------------------------------------------------------------------
*/
class admin_session {
var $config;
var $db;
var $glob;
var $ini;
function admin_session() {
$this->__construct();
}
function __construct() {
global $config, $db, $glob, $ini;
$this->config = $config;
$this->db = &$db;
$this->glob = $glob;
$this->ini = $ini;
}
function get_session_data() {
if (!isset($GLOBALS[CC_ADMIN_SESSION_NAME])) {
## If no session redirect to login screen
httpredir($GLOBALS['rootRel'].$this->glob['adminFile']."?_g=login&goto=".urlencode(currentPage()));
} else {
## Get session information as array
$query = sprintf("SELECT * FROM ".$this->glob['dbprefix']."CubeCart_admin_users WHERE sessId = %s", $this->db->mySQLSafe($GLOBALS[CC_ADMIN_SESSION_NAME]));
$ccAdminData = $this->db->select($query);
## Security checks
//$client_ip = (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];
$client_ip = get_ip_address();
if ($ccAdminData[0]['sessIp'] !== $client_ip || $ccAdminData[0]['browser'] !== $_SERVER['HTTP_USER_AGENT']) {
$this->logout();
}
## Find permissions for those who are not super users
if (!$ccAdminData[0]['isSuper']) {
$query = sprintf("SELECT %1\$sCubeCart_admin_sections.sectId, name, `read`, `write`, `edit`, `delete` FROM %1\$sCubeCart_admin_sections LEFT JOIN %1\$sCubeCart_admin_permissions ON %1\$sCubeCart_admin_sections.sectId = %1\$sCubeCart_admin_permissions.sectId WHERE adminId = %2\$s", $this->glob['dbprefix'], $this->db->mySQLSafe($ccAdminData[0]['adminId']));
$permissionArray = $this->db->select($query);
#print_r($permissionArray);
#die;
if (is_array($permissionArray)) {
for ($i=0; $i<count($permissionArray); $i++) {
foreach ($permissionArray[$i] as $key => $value) {
$masterKey = $permissionArray[$i]['name'];
$ccAdminData[0][$masterKey][$key] = $value;
}
}
}
}
return $ccAdminData[0];
}
}
function makeSessId() {
session_start();
session_regenerate_id(true);
return session_id();
}
function logout() {
## reset session data
$record['sessId'] = "''";
$record['sessIp'] = "''";
$record['browser'] = "''";
$this->db->update($this->glob['dbprefix']."CubeCart_admin_users", $record,"sessId = ".$this->db->MySQLSafe($GLOBALS[CC_ADMIN_SESSION_NAME]));
$this->set_cc_admin_cookie(CC_ADMIN_SESSION_NAME, '');
httpredir($GLOBALS['rootRel'].$this->glob['adminFile']."?_g=login");
}
function login($username, $password) {
$query = sprintf("SELECT adminId FROM %sCubeCart_admin_users WHERE username = %s AND password = %s AND failLevel < %s AND blockTime < %s", $this->glob['dbprefix'], $this->db->mySQLSafe($username), $this->db->mySQLSafe(md5($password)), $this->ini['bfattempts'], time());
$result = $this->db->select($query);
return $result;
}
function createSession($admin_id) {
$sessionId = $this->makeSessId();
$this->set_cc_admin_cookie(CC_ADMIN_SESSION_NAME, $sessionId);
## set session global var because cookie won't show until next page load
$GLOBALS[CC_ADMIN_SESSION_NAME] = $sessionId;
$record['sessId'] = "'".$sessionId."'";
## log browser & ip for security purposes no session hijacking here :)
$record['sessIp'] = $this->db->MySQLSafe(get_ip_address());
$record['browser'] = $this->db->MySQLSafe($_SERVER['HTTP_USER_AGENT']);
$this->db->update($this->glob['dbprefix']."CubeCart_admin_users", $record, "adminId = ".$admin_id);
}
function get_cookie_domain($domain) {
$cookie_domain = str_replace(array('http://', 'https://', 'www.'), '', strtolower($domain));
$cookie_domain = explode("/",$cookie_domain);
$cookie_domain = explode(":", $cookie_domain[0]);
return '.'.$cookie_domain[0];
}
function set_cc_admin_cookie($name, $value) {
$expires = 0; ## remember session until browser is closed
@setcookie($name, $value, $expires, $GLOBALS['rootRel']);
}
}
?>

210
production/classes/session/cc_session.php Normal file
View File

@@ -0,0 +1,210 @@
<?php
/*
+--------------------------------------------------------------------------
| CubeCart 4
| ========================================
| CubeCart is a registered trade mark of Devellion Limited
| Copyright Devellion Limited 2006. All rights reserved.
| Devellion Limited,
| 5 Bridge Street,
| Bishops Stortford,
| HERTFORDSHIRE.
| CM23 2JU
| UNITED KINGDOM
| http://www.devellion.com
| UK Private Limited Company No. 5323904
| ========================================
| Web: http://www.cubecart.com
| Email: info (at) cubecart (dot) com
| License Type: CubeCart is NOT Open Source Software and Limitations Apply
| Licence Info: http://www.cubecart.com/site/faq/license.php
+--------------------------------------------------------------------------
| cc_session.php
| ========================================
| Front Session Class
+--------------------------------------------------------------------------
*/
class session {
var $ccUserData;
var $ccUserBlocked = false;
var $config;
var $db;
var $glob;
var $ini;
function session() {
# $this->__construct();
#}
#function __construct() {
global $config, $db, $glob, $ini;
$this->config = $config;
$this->db = $db;
$this->glob = $glob;
$this->ini = $ini;
if (isset($_GET[CC_SESSION_NAME])) {
$this->set_cc_cookie(CC_SESSION_NAME, $_GET[CC_SESSION_NAME]);
} else {
## see if session is still in db
$query = sprintf("SELECT sessId FROM %sCubeCart_sessions WHERE sessId=%s", $this->glob['dbprefix'], $this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
$results = $this->db->select($query);
## !empty($results[0]['sessId']) critical incase reuslts=true if session DB table has an empty sessionId!!
if ($results && !empty($results[0]['sessId'])) {
$data["timeLast"] = $this->db->mySQLSafe(time());
$data["location"] = $this->db->mySQLSafe(currentPage());
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data, "sessId=".$this->db->mySQLSafe($results[0]['sessId']));
} else {
$this->makeSession();
}
}
## get all session data and store as class array
$query = sprintf("SELECT * FROM %1\$sCubeCart_sessions LEFT JOIN %1\$sCubeCart_customer ON %1\$sCubeCart_sessions.customer_id = %1\$sCubeCart_customer.customer_id WHERE sessId = %2\$s", $this->glob['dbprefix'], $this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
$result = $this->db->select($query);
// security checks
$client_ip = get_ip_address();
if (!empty($result[0]['ip']) && ($result[0]['ip'] !== $client_ip || $result[0]['browser'] !== $_SERVER['HTTP_USER_AGENT'])) {
$this->destroySession($GLOBALS[CC_SESSION_NAME]);
}
$this->ccUserData = $result[0];
if (empty($result[0]['lang'])) {
define("LANG_FOLDER", $this->config['defaultLang']);
} else {
define("LANG_FOLDER", $result[0]['lang']);
}
if (empty($result[0]['skin'])) {
define("SKIN_FOLDER", $this->config['skinDir']);
} else {
define("SKIN_FOLDER", $result[0]['skin']);
}
}
function destroySession($sessionId) {
setcookie(CC_SESSION_NAME);
$data["customer_id"] = '0';
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data,"sessId=".$this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
return ($update) ? true : false;
}
function makeSession() {
$sessionId = $this->makeSessId();
$this->set_cc_cookie(CC_SESSION_NAME, $sessionId);
## set session global var because cookie won't show until next page load
$GLOBALS[CC_SESSION_NAME] = $sessionId;
## insert sessionId into db
$data["sessId"] = $this->db->mySQLSafe($sessionId);
$timeNow = $this->db->mySQLSafe(time());
$data["timeStart"] = $timeNow;
$data["timeLast"] = $timeNow;
$data["customer_id"] = 0;
$data["ip"] = $this->db->mySQLSafe(get_ip_address());
$data["browser"] = $this->db->mySQLSafe($_SERVER['HTTP_USER_AGENT']);
$insert = $this->db->insert($this->glob['dbprefix']."CubeCart_sessions", $data);
$this->deleteOldSessions();
}
function deleteOldSessions() {
$expiredSessTime = time() - $this->config['sqlSessionExpiry'];
/* Stock on add to basket possibly for future
$this->reduce();
*/
## delete sessions older than time set in config file
$delete = $this->db->delete($this->glob['dbprefix']."CubeCart_sessions", "timeLast<".$expiredSessTime);
}
function authenticate($user, $pass, $remember = false) {
$user = sanitizeVar($user);
$pass = sanitizeVar($pass);
$query = "SELECT customer_id FROM ".$this->glob['dbprefix']."CubeCart_customer WHERE email=".$this->db->mySQLSafe($user)." AND password = ".$this->db->mySQLSafe(md5($pass))." AND type>0";
$customer = $this->db->select($query);
if (!$customer) {
if ($this->db->blocker($user, $this->ini['bfattempts'], $this->ini['bftime'], false, 'f')) {
$this->ccUserBlocked = true;
}
} else if ($customer[0]['customer_id']>0) {
// remember user for as long as sessions are allowed in DB
if ($remember == true) {
$this->set_cc_cookie(CC_SESSION_NAME, $GLOBALS[CC_SESSION_NAME], $this->config['sqlSessionExpiry']);
}
if ($this->db->blocker($user, $this->ini['bfattempts'], $this->ini['bftime'], true, 'f')) {
$this->ccUserBlocked = true;
} else {
$data["customer_id"] = $customer[0]['customer_id'];
$update = $this->db->update($this->glob['dbprefix']."CubeCart_sessions", $data,"sessId=".$this->db->mySQLSafe($GLOBALS[CC_SESSION_NAME]));
## "login","reg","unsubscribe","forgotPass" etc..
$redir = sanitizeVar(urldecode($_GET['redir']));
## prevent phishing attacks
if (eregi("^http://|^https://",$redir) && !eregi("^".$this->glob['storeURL']."|^".$this->config['storeURL_SSL'], $redir)) {
die("Redirect URL not allowed!");
}
if (isset($_GET['redir']) && !empty($_GET['redir']) && !eregi("logout|login|forgotPass|changePass", $redir)) {
httpredir($redir);
} else {
httpredir($GLOBALS['rootRel']."index.php");
}
}
} else if (eregi("step1", urldecode($_GET['redir']))) {
httpredir($GLOBALS['rootRel']."index.php?_g=co&_a=step1");
}
}
function makeSessId() {
session_start();
session_regenerate_id(true);
return session_id();
}
function get_cookie_domain($domain) {
$cookie_domain = str_replace(array('http://', 'https://', 'www.'), '', strtolower($domain));
$cookie_domain = explode("/", $cookie_domain);
$cookie_domain = explode(":", $cookie_domain[0]);
return '.'.$cookie_domain[0];
}
function set_cc_cookie($name, $value, $length = '') {
## only set the cookie if the visitor is not a spider or search engine system is off
if (!$this->user_is_search_engine() || $this->config['sef'] == false) {
$expires = ($length>0) ? (time()+$length) : 0;
setcookie($name, $value, $expires, $GLOBALS['rootRel']);
}
}
function user_is_search_engine() {
$user_agent = strtolower($_SERVER['HTTP_USER_AGENT']);
$spider_flag = false;
if (($user_agent != '') && (strtolower($user_agent) != 'null') && (strlen(trim($user_agent)) > 0)) {
$spiders = file(CC_ROOT_DIR.'/spiders.txt');
foreach ($spiders as $spider) {
if (($spider != '') && (strtolower($spider) != 'null') && (strlen(trim($spider)) > 0)) {
if (strpos($user_agent, trim($spider)) !== false) {
$spider_flag = TRUE;
break;
}
}
}
}
return $spider_flag;
}
}
?>