/home/techb158/workloadmatch.com/api
Edit: /home/techb158/workloadmatch.com/api/api_functions.php (21474B)
prepare("SELECT $id_col FROM $table WHERE $col = ? LIMIT 1")) {
$stmt->bind_param('s', $email);
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($user_id);
$stmt->fetch();
if ($stmt->num_rows == 1) {
$_SESSION['UserDB'] = $table;
$_SESSION['Profile_ID'] = $id_col;
return true;
}
}
}
}
return false;
}
/*
function login($email, $password, $mysqli) {
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
if (checkuser($email, $mysqli)) {
$UserDB = $_SESSION['UserDB'];
$UA = 1;
// Using prepared statements means that SQL injection is not possible.
$query = "SELECT * FROM $UserDB Where Email = '".$email."' AND User_Access = '".$UA."'";
$result = $mysqli->query($query);
$Managers = $result->fetch_assoc();
$ID = $Managers['User_Access'];
$prof_lang = $Managers['prof_lang'];
if ($ID == 1) {
$Profile_ID = $_SESSION['Profile_ID'];
if ($stmt = $mysqli->prepare("SELECT $Profile_ID,User_Name, Password, salt
FROM $UserDB
WHERE Email = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id, $username, $db_password, $salt);
$stmt->fetch();
// hash the password with the unique salt.
$input_hash = $password;
$stored_hash = $db_password;
$passwordValid = false;
if (strlen($stored_hash) === 60 && strpos($stored_hash, '$2y$') === 0) {
$passwordValid = password_verify($input_hash, $stored_hash);
} else {
$computed = hash('sha512', $input_hash . $salt);
$passwordValid = ($stored_hash === $computed);
if ($passwordValid) {
$new_hash = password_hash($input_hash, PASSWORD_BCRYPT);
$rehash_stmt = $mysqli->prepare("UPDATE $UserDB SET Password = ?, salt = '' WHERE $Profile_ID = ?");
if ($rehash_stmt) {
$rehash_stmt->bind_param('ss', $new_hash, $user_id);
$rehash_stmt->execute();
$rehash_stmt->close();
}
}
}
if ($stmt->num_rows == 1) {
//echo $db_password .'=+='. $password;
//$Managers_ID= $db_password .'=+='. $password;
//header('Location: api_process_login.php?error='.$Managers_ID.'');
//exit();
// If the user exists we check if the account is locked
// from too many login attempts
if (checkbrute($user_id, $mysqli) == true) {
//header("Location: ../error.php?err=error: your account is locked");
echo "error: your account is locked";
exit();
//return false;
}else{
// Check if the password in the database matches
// the password the user submitted.
if ($passwordValid) {
// Password is correct!
// Get the user-agent string of the user.
$user_browser = $_SERVER['HTTP_USER_AGENT'];
// XSS protection as we might print this value
$user_id = preg_replace("/[^0-9]+/", "", $user_id);
$_SESSION['user_id'] = $user_id;
$_SESSION['myusername'] = $username;
// XSS protection as we might print this value
$username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);
$_SESSION['username'] = $username;
$_SESSION['User_type'] = $UserDB;
$_SESSION['login_string'] = hash('sha512', $password . $user_browser);
$LoginDate =date("Y/m/d");
$LoginTime =date('H:i:s');
$logins=1;
$context = stream_context_create(
array(
"http" => array(
"header" => "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"
)
)
);
$HTML = file_get_contents("https://whatismyipaddress.com/ip/$ip", false,$context);
preg_match_all('/
(.*?)<\/th> | (.*?)<\/td>/s', $HTML, $Matches, PREG_SET_ORDER);
$isp=$Matches[5][2]; //Videotron Ltee
$city=$Matches[14][2]; //Saint-Lambert
$state=$Matches[13][2]; // Quebec
$zipcode=$Matches[17][2]; //Postal Code
$country=$Matches[12][2]; //Canada
$Continent=$Matches[11][2]; //North America
if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time)
VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) {
}
$bytes = openssl_random_pseudo_bytes(16);
$Token_User = ($bytes !== false) ? mb_strtoupper(bin2hex($bytes)) : mb_strtoupper(bin2hex(random_bytes(16)));
$_SESSION['Token_User'] = $Token_User;
$upd_stmt = $mysqli->prepare("UPDATE $UserDB SET Login_Time = ?, User_IP = ?, User_agent = ?, ISP = ?, Token_User = ? WHERE ID = ?");
if ($upd_stmt) {
$upd_stmt->bind_param('ssssss', $datetime, $ip, $agent, $isp, $Token_User, $user_id);
$upd_stmt->execute();
$upd_stmt->close();
}
// Login successful.
return true;
} else {
// Password is not correct
// We record this attempt in the database
$now = time();
if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time)
VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) {
//header("Location: ../error.php?err=Database error: login_attempts");
echo "Database error: login_attempts";
exit();
}
//if (!$mysqli->query("INSERT INTO Login_log(User_ID, time)
// VALUES ('$user_id', '$now')")) {
// header("Location: ../error.php?err=Database error: login_attempts");
// exit();
//}
return false;
}
}
} else {
// No user exists.
return false;
}
} else {
// Could not create a prepared statement
//header("Location: ../error.php?err=Database error: cannot prepare statement X");
echo "Database error: cannot prepare statement";
exit();
}
}else{
//header("Location: ../error.php?err=error: Access denid");
echo "Database error: Access denid";
exit();
}
}else{
// Could not create a prepared statement
//header("Location: ../index.php?err=error: you are not allow to login");
echo "error: you are not allow to login";
exit();
}
}
*/
function checkbrute($user_id, $mysqli) {
$now = time();
$valid_attempts = $now - (2 * 60 * 60);
$UserDB = $_SESSION['UserDB'] ?? '';
if ($stmt = $mysqli->prepare("SELECT time FROM Login_log WHERE User_ID = ? AND time > ? AND User_Type = ?")) {
$stmt->bind_param('iis', $user_id, $valid_attempts, $UserDB);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows > 5) {
return true;
} else {
return false;
}
} else {
echo "Database error: cannot prepare statement 1";
exit();
}
}
function login_check($mysqli) {
//sec_session_start();
// Check if all session variables are set
if (isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
$user_id = $_SESSION['user_id'];
$login_string = $_SESSION['login_string'];
$username = $_SESSION['username'];
$Profile_ID = $_SESSION['Profile_ID'];
$UserDB = $_SESSION['UserDB'];
// Get the user-agent string of the user.
$user_browser = $_SERVER['HTTP_USER_AGENT'];
if ($stmt = $mysqli->prepare("SELECT Password
FROM $UserDB
WHERE $Profile_ID = ? LIMIT 1")) {
// Bind "$user_id" to parameter.
$stmt->bind_param('s', $user_id);
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
if ($stmt->num_rows == 1) {
// If the user exists get variables from result.
$stmt->bind_result($password);
$stmt->fetch();
$login_check = hash('sha512', $password . $user_browser);
if ($login_check == $login_string) {
// Logged In!!!!
return true;
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
} else {
// Could not prepare statement
//header("Location: ../error.php?err=Database error: cannot prepare statement 2");
echo "Database error: cannot prepare statement 2";
exit();
}
} else {
// Not logged in
return false;
}
}
function login($email, $password, $mysqli) {
$ip = $_SERVER["REMOTE_ADDR"];
$agent = $_SERVER["HTTP_USER_AGENT"];
$datetime = date("Y/m/d") . ' ' . date('H:i:s');
if (checkuser($email, $mysqli)) {
$UserDB = $_SESSION['UserDB'];
$Profile_ID = $_SESSION['Profile_ID'];
$UA = 1;
$stmt = $mysqli->prepare("SELECT $Profile_ID, User_Name, Password, salt, prof_lang, User_Access FROM $UserDB WHERE User_Name = ? AND User_Access = ?");
if (!$stmt) {
$stmt = $mysqli->prepare("SELECT $Profile_ID, User_Name, Password, salt, prof_lang, User_Access FROM $UserDB WHERE Email = ? AND User_Access = ?");
}
if ($stmt) {
$stmt->bind_param('ss', $email, $UA);
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($user_id, $username, $db_password, $salt, $prof_lang, $access);
$stmt->fetch();
if ($stmt->num_rows == 1) {
if (checkbrute($user_id, $mysqli) == true) {
echo "error: your account is locked";
exit();
} else {
$input_hash = $password;
$stored_hash = $db_password;
$passwordValid = false;
if (strlen($stored_hash) === 60 && strpos($stored_hash, '$2y$') === 0) {
$passwordValid = password_verify($input_hash, $stored_hash);
if (!$passwordValid) {
$computed = hash('sha512', $input_hash . $salt);
$passwordValid = password_verify($computed, $stored_hash);
if ($passwordValid) {
$new_hash = password_hash($input_hash, PASSWORD_BCRYPT);
$rehash_stmt = $mysqli->prepare("UPDATE $UserDB SET Password = ?, salt = '' WHERE $Profile_ID = ?");
if ($rehash_stmt) {
$rehash_stmt->bind_param('ss', $new_hash, $user_id);
$rehash_stmt->execute();
$rehash_stmt->close();
$db_password = $new_hash;
}
}
}
} else {
$computed = hash('sha512', $input_hash . $salt);
$passwordValid = ($stored_hash === $computed);
if ($passwordValid) {
$new_hash = password_hash($input_hash, PASSWORD_BCRYPT);
$rehash_stmt = $mysqli->prepare("UPDATE $UserDB SET Password = ?, salt = '' WHERE $Profile_ID = ?");
if ($rehash_stmt) {
$rehash_stmt->bind_param('ss', $new_hash, $user_id);
$rehash_stmt->execute();
$rehash_stmt->close();
$db_password = $new_hash;
}
}
}
if ($passwordValid) {
$user_browser = $_SERVER['HTTP_USER_AGENT'];
$user_id = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $user_id);
$_SESSION['user_id'] = $user_id;
$_SESSION['myusername'] = $username;
$username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);
$_SESSION['username'] = $username;
$_SESSION['User_type'] = $UserDB;
$_SESSION['login_string'] = hash('sha512', $db_password . $user_browser);
$isp = 'Unknown';
if ($UserDB === 'teacher_profile') {
$upd_stmt = $mysqli->prepare("UPDATE $UserDB SET Login_Date = ?, User_IP = ?, User_agent = ?, ISP = ?, Token_User = ? WHERE $Profile_ID = ?");
if ($upd_stmt) {
$bytes = openssl_random_pseudo_bytes(16);
$Token_User = ($bytes !== false) ? mb_strtoupper(bin2hex($bytes)) : mb_strtoupper(bin2hex(random_bytes(16)));
$_SESSION['Token_User'] = $Token_User;
$upd_stmt->bind_param('ssssss', $datetime, $ip, $agent, $isp, $Token_User, $user_id);
$upd_stmt->execute();
$upd_stmt->close();
}
} else {
$upd_stmt = $mysqli->prepare("UPDATE $UserDB SET Login_Date = ? WHERE $Profile_ID = ?");
if ($upd_stmt) {
$upd_stmt->bind_param('ss', $datetime, $user_id);
$upd_stmt->execute();
$upd_stmt->close();
}
}
return true;
} else {
$now = time();
$stmt2 = $mysqli->prepare("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time) VALUES (?, ?, ?, ?, ?, ?)");
if ($stmt2) {
$stmt2->bind_param('ssssss', $user_id, $UserDB, $datetime, $ip, $agent, $now);
$stmt2->execute();
$stmt2->close();
}
return false;
}
}
} else {
return false;
}
} else {
echo "Database error: cannot prepare statement";
exit();
}
} else {
echo "error: you are not allowed to login";
exit();
}
}
function esc_url($url) {
if ('' == $url) {
return $url;
}
$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
$strip = array('%0d', '%0a', '%0D', '%0A');
$url = (string) $url;
$count = 1;
while ($count) {
$url = str_replace($strip, '', $url, $count);
}
$url = str_replace(';//', '://', $url);
$url = htmlentities($url, ENT_QUOTES, "UTF-8");
$url = str_replace('&', '&', $url);
$url = str_replace("'", ''', $url);
if ($url[0] !== '/') {
// We're only interested in relative links from $_SERVER['PHP_SELF']
return '';
} else {
return $url;
}
}
function encrypt_decrypt($action, $string) {
$output = false;
$encrypt_method = "AES-256-CBC";
$secret_key = ENCRYPTION_SECRET_KEY;
$secret_iv = ENCRYPTION_SECRET_IV;
// hash
$key = hash('sha256', $secret_key);
// iv - encrypt method AES-256-CBC expects 16 bytes - else you will get a warning
$iv = substr(hash('sha256', $secret_iv), 0, 16);
if ( $action == 'encrypt' ) {
$output = openssl_encrypt($string, $encrypt_method, $key, 0, $iv);
$output = base64_encode($output);
} else if( $action == 'decrypt' ) {
$output = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv);
}
return $output;
}
function addinfo($page, $mysqli){
if ($stmt = $mysqli->prepare("SELECT page FROM hits WHERE page = ?")) {
$stmt->bind_param('s', $page);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows != 0) {
$stmt->close();
if ($stmt2 = $mysqli->prepare("UPDATE hits SET count = count+1 WHERE page = ?")) {
$stmt2->bind_param('s', $page);
$stmt2->execute();
$stmt2->close();
}
} else {
$stmt->close();
$act = 1;
if ($insert_stmt = $mysqli->prepare("INSERT INTO hits (page, count) VALUES (?, ?)")) {
$insert_stmt->bind_param('ss', $page, $act);
$insert_stmt->execute();
$insert_stmt->close();
}
}
}
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
if ($stmt = $mysqli->prepare("SELECT ip_address FROM info WHERE ip_address = ?")) {
$stmt->bind_param('s', $ip);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows == 0) {
$stmt->close();
if ($insert_stmt = $mysqli->prepare("INSERT INTO info (ip_address, user_agent, datetime) VALUES (?, ?, ?)")) {
$insert_stmt->bind_param('sss', $ip, $agent, $datetime);
$insert_stmt->execute();
$insert_stmt->close();
}
} else {
$stmt->close();
}
}
// ####################################################
// ######### add IP and user-agent and time ###########
// ####################################################
// gather user data
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
$query = "SELECT ip_address FROM info WHERE ip_address = '".$ip."'";
$result = $mysqli->query($query);
$Managers = $result->fetch_assoc();
if ($result->num_rows == 0) {
// if not , add it.
if ($insert_stmt = $mysqli->prepare("INSERT INTO info (ip_address, user_agent, datetime) VALUES (?, ?, ?)")) {
$insert_stmt->bind_param('sss', $ip, $agent, $datetime);
if (! $insert_stmt->execute()) {
}
}
}
// ***************************************************************
// ** delete the first entry in $dbtableinfo if rows > $maxrows **
// ***************************************************************
//mysqli_close($link);
} |