/
index.php
170 lines (147 loc) · 7.25 KB
/
index.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
<?php
/*
Copyright:: 2013, Sebastian Grewe
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
// Set a decently long SECURITY key with special chars etc
define('SECURITY', '*)WT#&YHfd');
// Whether or not to check SECHASH for validity, still checks if SECURITY defined as before if disabled
define('SECHASH_CHECK', false);
// Nothing below here to configure, move along...
// change SECHASH every second, we allow up to 3 sec back for slow servers
if (SECHASH_CHECK) {
function fip($tr=0) { return md5(SECURITY.(time()-$tr).SECURITY); }
define('SECHASH', fip());
function cfip() { return (fip()==SECHASH||fip(1)==SECHASH||fip(2)==SECHASH) ? 1 : 0; }
} else {
function cfip() { return (@defined('SECURITY')) ? 1 : 0; }
}
// This should be okay
// No but Its now, - Aim
define("BASEPATH", dirname(__FILE__) . "/");
// all our includes and config etc are now in bootstrap
include_once(BASEPATH . '../include/bootstrap.php');
// switch to https if config option is enabled
$hts = ($config['https_only'] && (!empty($_SERVER['QUERY_STRING']))) ? "https://".$_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME']."?".$_SERVER['QUERY_STRING'] : "https://".$_SERVER['SERVER_NAME'].$_SERVER['SCRIPT_NAME'];
($config['https_only'] && @!$_SERVER['HTTPS']) ? exit(header("Location: ".$hts)):0;
// Rate limiting, we use our initilized memcache from bootstrap/autoloader
if ($config['memcache']['enabled'] && $config['mc_antidos']['enabled']) {
require_once(CLASS_DIR . '/memcache_ad.class.php');
$skip_check = false;
// if this is an api call we need to be careful not to time them out for those calls separately
$per_page = '';
$ajax_calls = array(
array('api', 'getuserbalance'),
array('api', 'getnavbardata'),
array('api', 'getdashboarddata'),
array('api', 'getuserworkers')
);
$iac = 0;
foreach ($ajax_calls as $ac) {
$iac = (@$_REQUEST['page'] == $ac[0] && @$_REQUEST['action'] == $ac[1]) ? $iac+=1 : $iac;
}
$is_ajax_call = ($iac > 0) ? true : false;
if ($is_ajax_call && $config['mc_antidos']['protect_ajax']) {
$per_page = 'api';
} else if ($is_ajax_call && !$config['mc_antidos']['protect_ajax']) {
// protect isn't on, we'll ignore it
$skip_check = true;
} else if ($config['mc_antidos']['ignore_admins'] && isset($_SESSION['USERDATA']['is_admin']) && $_SESSION['USERDATA']['is_admin']) {
$skip_check = true;
}
if (!$skip_check) {
$mcad = new MemcacheAntiDos($config, $memcache, $per_page);
if ($config['mc_antidos']['protect_ajax'] && $is_ajax_call && $mcad->rate_limit_api_request) {
exit(header('HTTP/1.1 401 Unauthorized'));
}
$error_page = $config['mc_antidos']['error_push_page'];
if ($mcad->rate_limit_site_request) {
if (!is_array($error_page) || count($error_page) < 1 || (empty($error_page['page']) && empty($error_page['action']))) {
die("You are sending too many requests too fast!");
} else {
$_REQUEST['page'] = $error_page['page'];
$_REQUEST['action'] = (isset($error_page['action']) && !empty($error_page['action'])) ? $error_page['action'] : $_REQUEST['action'];
}
}
}
}
// Got past rate limiter and session manager
// show last logged in popup if it's still set
if (@$_GET['clp'] == 1 && @$_SESSION['last_ip_pop']) unset($_SESSION['last_ip_pop']);
if (count(@$_SESSION['last_ip_pop']) == 2) {
$data = $_SESSION['last_ip_pop'];
$ip = filter_var($data[0], FILTER_VALIDATE_IP);
$time = date("l, F jS \a\\t g:i a", $data[1]);
if (@$_SESSION['AUTHENTICATED'] && $_SESSION['last_ip_pop'][0] !== $user->getCurrentIP()) {
$_SESSION['POPUP'][] = array('CONTENT' => "You last logged in from <b>$ip</b> on $time", 'DISMISS' => 'yes', 'ID' => 'lastlogin', 'TYPE' => 'alert alert-warning');
} else {
$_SESSION['POPUP'][] = array('CONTENT' => "You last logged in from <b>$ip</b> on $time", 'DISMISS' => 'yes', 'ID' => 'lastlogin', 'TYPE' => 'alert alert-info');
}
}
// Create our pages array from existing files
if (is_dir(INCLUDE_DIR . '/pages/')) {
foreach (glob(INCLUDE_DIR . '/pages/*.inc.php') as $filepath) {
$filename = basename($filepath);
$pagename = substr($filename, 0, strlen($filename) - 8);
$arrPages[$pagename] = $filename;
$debug->append("Adding $pagename as " . $filename . " to accessible pages", 4);
}
}
// Set a default action here if no page has been requested
@$_REQUEST['page'] = (is_array($_REQUEST['page']) || !isset($_REQUEST['page'])) ? 'home' : $_REQUEST['page'];
if (isset($_REQUEST['page']) && isset($arrPages[$_REQUEST['page']])) {
$page = $_REQUEST['page'];
} else if (isset($_REQUEST['page']) && ! isset($arrPages[$_REQUEST['page']])) {
$page = 'error';
} else {
$page = 'home';
}
// Create our pages array from existing files
if (is_dir(INCLUDE_DIR . '/pages/' . $page)) {
foreach (glob(INCLUDE_DIR . '/pages/' . $page . '/*.inc.php') as $filepath) {
$filename = basename($filepath);
$pagename = substr($filename, 0, strlen($filename) - 8);
$arrActions[$pagename] = $filename;
$debug->append("Adding $pagename as " . $filename . ".inc.php to accessible actions", 4);
}
}
// Default to empty (nothing) if nothing set or not known
$action = (isset($_REQUEST['action']) && !is_array($_REQUEST['action'])) && isset($arrActions[$_REQUEST['action']]) ? $_REQUEST['action'] : "";
// Check csrf token validity if necessary
if ($config['csrf']['enabled'] && isset($_REQUEST['ctoken']) && !empty($_REQUEST['ctoken']) && !is_array($_REQUEST['ctoken'])) {
$csrftoken->valid = ($csrftoken->checkBasic(session_id(), $arrPages[$page], $_REQUEST['ctoken'])) ? 1 : 0;
} else if ($config['csrf']['enabled'] && (!@$_REQUEST['ctoken'] || empty($_REQUEST['ctoken']))) {
$csrftoken->valid = 0;
}
if ($config['csrf']['enabled']) $smarty->assign('CTOKEN', $csrftoken->getBasic(session_id(), $arrPages[$page]));
// Load the page code setting the content for the page OR the page action instead if set
if (!empty($action)) {
$debug->append('Loading Action: ' . $action . ' -> ' . $arrActions[$action], 1);
require_once(PAGES_DIR . '/' . $page . '/' . $arrActions[$action]);
} else {
$debug->append('Loading Page: ' . $page . ' -> ' . $arrPages[$page], 1);
require_once(PAGES_DIR . '/' . $arrPages[$page]);
}
define('PAGE', $page);
define('ACTION', $action);
// For our content inclusion
$smarty->assign("PAGE", $page);
$smarty->assign("ACTION", $action);
// Now with all loaded and processed, setup some globals we need for smarty templates
if ($page != 'api') require_once(INCLUDE_DIR . '/smarty_globals.inc.php');
// Load debug information into template
$debug->append("Loading debug information into template", 4);
$smarty->assign('DebuggerInfo', $debug->getDebugInfo());
$smarty->assign('RUNTIME', (microtime(true) - $dStartTime) * 1000);
// Display our page
if (!@$supress_master) $smarty->display($master_template, $smarty_cache_key);
// Unset any temporary values here
unset($_SESSION['POPUP']);