FM / includes

/home/techb158/workloadmatch.com/workloadmatch.com/BackUp/includes/

/home/techb158/workloadmatch.com/workloadmatch.com/BackUp/includes

Name	Size	Mode	Actions
CSRF_Protect.php	2188	0644	edit dl rm
db_connect.php	694	0644	edit dl rm
error.php	451	0644	edit dl rm
error_log	2418	0644	edit dl rm
forgetpassword.php	6831	0644	edit dl rm
functions.php	24162	0644	edit dl rm
geoiploc.php	2520435	0644	edit dl rm
hex.php	1050	0644	edit dl rm
hexbin.php	942	0644	edit dl rm
logout.php	794	0644	edit dl rm
process_login.php	2884	0644	edit dl rm
process_login_Remove rechaptcha.php	2891	0644	edit dl rm
psl-config.php	1687	0644	edit dl rm
register.inc.php	3304	0644	edit dl rm
register.php	26322	0644	edit dl rm
reset.php	6154	0644	edit dl rm

Edit: /home/techb158/workloadmatch.com/workloadmatch.com/BackUp/includes/functions.php (24162B)

<?php

include_once 'psl-config.php';

include("geoiploc.php"); // Must include

function sec_session_start() {
    $session_name = 'sec_session_id';   // Set a custom session name 
    $secure = SECURE;

// This stops JavaScript being able to access the session id.
    $httponly = true;

// Forces sessions to only use cookies.
    if (session_status() == PHP_SESSION_NONE) {
        // Gets current cookies params.
        $cookieParams = session_get_cookie_params();
        session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly);

// Sets the session name to the one set above.
        session_name($session_name);

session_start();            // Start the PHP session //User_Name
        session_regenerate_id();    // regenerated the session, delete the old one.
    }
}

function login($email, $password, $mysqli) {
	$ip= $_SERVER["REMOTE_ADDR"]; 
	$agent =$_SERVER["HTTP_USER_AGENT"];
	$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;

if (checkuser($email, $mysqli)) {	
	$UserDB = $_SESSION['UserDB'];
	$UA = 1;
	
    // Using prepared statements means that SQL injection is not possible.  //User_Name
     $query = "SELECT * FROM $UserDB Where Email = '".$email."' AND User_Access = '".$UA."'";	
	$result = $mysqli->query($query);	
	$Managers = $result->fetch_assoc();
	$ID = $Managers['User_Access'];
	$prof_lang = $Managers['prof_lang'];
			
			
        if ($ID == 1) {    
    $Profile_ID = $_SESSION['Profile_ID'];
    if ($stmt = $mysqli->prepare("SELECT $Profile_ID,User_Name, Password, salt 
				  FROM $UserDB 
                                  WHERE Email = ? LIMIT 1")) {
        $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
        $stmt->execute();    // Execute the prepared query.
        $stmt->store_result();

// get variables from result.
 $stmt->bind_result($user_id, $username, $db_password, $salt);
 $stmt->fetch();
		
 // hash the password with the unique salt.
 $password = hash('sha512', $password . $salt);
 if ($stmt->num_rows == 1) {
 // If the user exists we check if the account is locked
 // from too many login attempts 
 if (checkbrute($user_id, $mysqli) == true) {		
	
 //// Account is locked 
 //// Send an email to user saying their account is locked 
		//$to= $email;				
		//$subject = "Your account is locked!";
		//$url = "https://". $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
		//$message = '
		//<html>
		//<head>
		//<title>Planly: account locked</title>
		//</head>
		//<body>
		//Dear Customer, 		
		//Your account is locked! 		
		//Thank you for choosing Planly.com. 
		//Support Team 
		//<a><img src="http://myratebid.com/image/Logo.png" class="stone-logo"></a>
		//</footer>
		//</body>
		//</html>
		//';
		//$headers = "MIME-Version: 1.0" . "\r\n";
		//$headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n";
		//$headers .= 'From: support<support@myratebid.com>' . "\r\n";
		//$headers .= 'Bcc: support<support@myratebid.com>' . "\r\n";
		//mail($to,$subject,$message,$headers);	
		 header("Location: ../error.php?err=error: your account is locked");
		exit();
		//return false;
 }else 
	 {
 // Check if the password in the database matches 
 // the password the user submitted.
 if ($db_password == $password) {
 // Password is correct!
 // Get the user-agent string of the user.
 $user_browser = $_SERVER['HTTP_USER_AGENT'];

// XSS protection as we might print this value
                    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                    $_SESSION['user_id'] = $user_id;
			 $_SESSION['myusername'] = $username;
                    // XSS protection as we might print this value
                    $username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);

$_SESSION['username'] = $username;
                    $_SESSION['User_type'] = $UserDB;
                    $_SESSION['login_string'] = hash('sha512', $password . $user_browser);
		
		language($prof_lang, $mysqli);
		//$registersw=mysql_query("UPDATE Client set Login_Time='" . $datetime . "',User_IP='" . $ip . "', User_agent='" . $agent . "' where ID='".$user_id."'");							
		if (!$mysqli->query("UPDATE $UserDB SET Login_Time = '$datetime', User_IP='$ip', User_agent='$agent' WHERE ID = '$user_id'")) {
							    
                    }
					
					
					$LoginDate =date("Y/m/d");
$LoginTime =date('H:i:s');
$logins=1;

//$context = stream_context_create(
// array(
// "http" => array(
// "header" => "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"
// )
// )
//);
//
//$HTML = file_get_contents("https://whatismyipaddress.com/ip/$ip", false,$context);
//preg_match_all('/<th>(.*?)<\/th><td>(.*?)<\/td>/s', $HTML, $Matches, PREG_SET_ORDER);
//
//$isp=$Matches[5][2]; //Videotron Ltee
//$city=$Matches[14][2]; //Saint-Lambert
//$state=$Matches[13][2]; // Quebec
//$zipcode=$Matches[17][2]; //Postal Code
//$country=$Matches[12][2]; //Canada
//$Continent=$Matches[11][2]; //North America

// Set a stream context with a User-Agent header (if needed)
$context = stream_context_create([
    "http" => [
        "header" => "User-Agent: Mozilla/5.0 (compatible; YourAppName/1.0)"
    ]
]);

// Try to retrieve IP info from ipapi.co
$ipApiUrl = "https://ipapi.co/{$ip}/json/";
$ipInfo = @file_get_contents($ipApiUrl, false, $context);

$isp = "Unknown";
$city = "Unknown";
$state = "Unknown";
$zipcode = "Unknown";
$country = "Unknown";
$Continent = "Unknown";

if ($ipInfo !== false) {
 $ipData = json_decode($ipInfo, true);
 if (is_array($ipData)) {
 $isp = isset($ipData['org']) ? $ipData['org'] : "Unknown";
 $city = isset($ipData['city']) ? $ipData['city'] : "Unknown";
 $state = isset($ipData['region']) ? $ipData['region'] : "Unknown";
 $zipcode = isset($ipData['postal']) ? $ipData['postal'] : "Unknown";
 $country = isset($ipData['country_name']) ? $ipData['country_name'] : "Unknown";
 // ipapi.co does not directly provide a continent value
 }
} else {
 // Log an error if needed
 error_log("Unable to retrieve IP information from ipapi.co for $ip. Using default values.");
}
// Now you can use $isp, $city, $state, $zipcode, $country, $Continent safely.
// For example:
//echo "ISP: " . $isp . " ";
//echo "City: " . $city . " ";
//echo "State: " . $state . " ";
//echo "Zipcode: " . $zipcode . " ";
//echo "Country: " . $country . " ";
//echo "Continent: " . $Continent . " ";

if ($insertstmt = $mysqli->prepare("INSERT INTO Logged_In_Machine (Clients_ID, IP_Address, User_Agent, Account_Status, Login_Date, Login_Time, ISP) VALUES (?, ?, ?, ?, ?, ?, ?)")) {
		$insertstmt->bind_param('sssssss',$user_id,$ip,$agent,$logins,$LoginDate,$LoginTime,$isp);
		if (! $insertstmt->execute()) {	
		
		}
	}
	
	$Token_User= mb_strtoupper(strval(bin2hex(openssl_random_pseudo_bytes(16))));
		 $_SESSION['Token_User'] = $Token_User;
		if (!$mysqli->query("UPDATE $UserDB SET Login_Date = '$datetime', User_IP='$ip', User_agent='$agent', ISP='$isp', Token_User='$Token_User' WHERE Teacher_ID = '$user_id'")) {
							    
                    }	
                    // Login successful. 
                    return true;
                } else {
                    // Password is not correct 
                    // We record this attempt in the database 
                    $now = time();
		     if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time) 
                                    VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) {
                        header("Location: ../error.php?err=Database error: login_attempts");
                        exit();
                    }
                    //if (!$mysqli->query("INSERT INTO Login_log(User_ID, time) 
                    //                VALUES ('$user_id', '$now')")) {
                    //    header("Location: ../error.php?err=Database error: login_attempts");
                    //    exit();
                    //}

return false;
                }
            }
        } else {
            // No user exists. 
            return false;
        }
    } else {
        // Could not create a prepared statement
        header("Location: ../error.php?err=Database error: cannot prepare statement X");
        exit();
    }
    
	}else{
	header("Location: ../error.php?err=error: Access denid");
	exit();  
	}
    
}else{
// Could not create a prepared statement
        header("Location: ../index.php?err=you are not allow to login");
        exit();
}

}

function checkbrute($user_id, $mysqli) {
    // Get timestamp of current time 
    $now = time();

// All login attempts are counted from the past 2 hours. 
    $valid_attempts = $now - (2 * 60 * 60);
$UserDB = $_SESSION['UserDB'];
    if ($stmt = $mysqli->prepare("SELECT time 
                                  FROM Login_log 
                                  WHERE User_ID = ? AND time > '$valid_attempts' AND User_Type = '$UserDB'")) {
        $stmt->bind_param('i', $user_id);

// Execute the prepared query. 
        $stmt->execute();
        $stmt->store_result();

// If there have been more than 5 failed logins 
        if ($stmt->num_rows > 5) {
            return true;
        } else {
            return false;
        }
    } else {
        // Could not create a prepared statement
        header("Location: ../error.php?err=Database error: cannot prepare statement 1");
        exit();
    }
}

function login_check($mysqli) {
    // Check if all session variables are set 
    if (isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
        $user_id = $_SESSION['user_id'];
        $login_string = $_SESSION['login_string'];
        $username = $_SESSION['username'];
	$Profile_ID = $_SESSION['Profile_ID'];
$UserDB = $_SESSION['UserDB'];
        // Get the user-agent string of the user.
        $user_browser = $_SERVER['HTTP_USER_AGENT'];

if ($stmt = $mysqli->prepare("SELECT Password 
				      FROM $UserDB 
				      WHERE $Profile_ID = ? LIMIT 1")) {
            // Bind "$user_id" to parameter. 
            $stmt->bind_param('i', $user_id);
            $stmt->execute();   // Execute the prepared query.
            $stmt->store_result();

if ($stmt->num_rows == 1) {
                // If the user exists get variables from result.
                $stmt->bind_result($password);
                $stmt->fetch();
                $login_check = hash('sha512', $password . $user_browser);

if ($login_check == $login_string) {
                    // Logged In!!!! 
                    return true;
                } else {
                    // Not logged in 
                    return false;
                }
            } else {
                // Not logged in 
                return false;
            }
        } else {
            // Could not prepare statement
            header("Location: ../error.php?err=Database error: cannot prepare statement 2");
            exit();
        }
    } else {
        // Not logged in 
        return false;
    }
}

function esc_url($url) {

if ('' == $url) {
        return $url;
    }

$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
    
    $strip = array('%0d', '%0a', '%0D', '%0A');
    $url = (string) $url;
    
    $count = 1;
    while ($count) {
        $url = str_replace($strip, '', $url, $count);
    }
    
    $url = str_replace(';//', '://', $url);

$url = htmlentities($url);
    
    $url = str_replace('&amp;', '&#038;', $url);
    $url = str_replace("'", '&#039;', $url);

if ($url[0] !== '/') {
        // We're only interested in relative links from $_SERVER['PHP_SELF']
        return '';
    } else {
        return $url;
    }
}

function addinfo($page, $mysqli){

$query = "SELECT page FROM hits WHERE page = '".$page."'";		
	$result = $mysqli->query($query);	
	$Managers = $result->fetch_assoc();
	if ($result->num_rows != 0) {	
	//A counter for this page  already exsists. Now we have to update it.
	$mysqli->query("UPDATE hits SET count = count+1 WHERE page = '".$page."'");
	}else{
		$act=1;		
	if ($insert_stmt = $mysqli->prepare("INSERT INTO hits (page, count) VALUES (?, ?)")) {
		$insert_stmt->bind_param('ss',$page,$act);
		if (! $insert_stmt->execute()) {
			
		}
	}
	
	}
		
	
$ip= get_client_ip(); 
$getCountryFromIP= getCountryFromIP($ip, " NamE ");
$agent =$_SERVER["HTTP_USER_AGENT"];
$HTTP_X_FORWARDED_FOR = "";//$_SERVER["HTTP_X_FORWARDED_FOR"];
//$_SERVER['HTTP_REFERER'];
$host_name_by_address = gethostbyaddr($_SERVER['REMOTE_ADDR']);
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
$view_date =date("Y/m/d");

$query = "SELECT ip_address FROM info_page WHERE page = '".$page."' and ip_address = '".$ip."' and view_date = '".$view_date."'";		
	$results = $mysqli->query($query);	
	if ($results->num_rows == 0) {	
	$act=1;
		if ($insert_stmt = $mysqli->prepare("INSERT INTO info_page (page, country, ip_address, user_agent, HTTP_X_FORWARDED_FOR, host_name_by_address, count, datetime,view_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
		$insert_stmt->bind_param('sssssssss', $page, $getCountryFromIP, $ip, $agent, $HTTP_X_FORWARDED_FOR, $host_name_by_address, $act, $datetime, $view_date);
		if (! $insert_stmt->execute()) {
			
		}
		}
	
	}else{
		$mysqli->query("UPDATE info_page SET page = '".$page."', count = count+1 WHERE page = '".$page."' and ip_address = '".$ip."' and view_date = '".$view_date."'");
		
	}

$query = "SELECT ip_address FROM info WHERE ip_address = '".$ip."'";		
	$result = $mysqli->query($query);	
	$Managers = $result->fetch_assoc();
	if ($result->num_rows == 0) {	
	// if not , add it.	
	if ($insert_stmt = $mysqli->prepare("INSERT INTO info (country, ip_address, user_agent, HTTP_X_FORWARDED_FOR, host_name_by_address, datetime) VALUES (?, ?, ?, ?, ?, ?)")) {
		$insert_stmt->bind_param('ssssss', $getCountryFromIP, $ip, $agent, $HTTP_X_FORWARDED_FOR,$host_name_by_address, $datetime);
		if (! $insert_stmt->execute()) {
			
		}
	}
	}
	
if($getCountryFromIP != "Canada")
{
//	header('Location: ../index.php?err=You need permission to perform this action!');
//	exit();
}

}

function getUserIP()
{
    $client  = @$_SERVER['HTTP_CLIENT_IP'];
    $forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
    $remote  = $_SERVER['REMOTE_ADDR'];

if(filter_var($client, FILTER_VALIDATE_IP))
    {
        $ip = $client;
    }
    elseif(filter_var($forward, FILTER_VALIDATE_IP))
    {
        $ip = $forward;
    }
    else
    {
        $ip = $remote;
    }

return $ip;
}
function get_client_ip()
{
	return $_SERVER["REMOTE_ADDR"]; 
    //// Nothing to do without any reliable information
    //if (!isset ($_SERVER['REMOTE_ADDR'])) {
    //    return NULL;
    //}
	//
    //// Header that is used by the trusted proxy to refer to
    //// the original IP
    //$proxy_header = "HTTP_X_FORWARDED_FOR";
	//
    //// List of all the proxies that are known to handle 'proxy_header'
    //// in known, safe manner
    //$trusted_proxies = array ("10.81.200.4");
	//
    //if (in_array ($_SERVER['REMOTE_ADDR'], $trusted_proxies)) {
	//
    //    // Get the IP address of the client behind trusted proxy
    //    if (array_key_exists ($proxy_header, $_SERVER)) {
	//
    //        // Header can contain multiple IP-s of proxies that are passed through.
    //        // Only the IP added by the last proxy (last IP in the list) can be trusted.
    //        $proxy_list = explode (",", $_SERVER[$proxy_header]);
    //        $client_ip = trim (end ($proxy_list));
	//
    //        // Validate just in case
    //        if (filter_var ($client_ip, FILTER_VALIDATE_IP)) {
    //            return $client_ip;
    //        } else {
    //            // Validation failed - beat the guy who configured the proxy or
    //            // the guy who created the trusted proxy list?
    //            // TODO: some error handling to notify about the need of punishment
    //        }
    //    }
    //}
	//
    //// In all other cases, REMOTE_ADDR is the ONLY IP we can trust.
    //return $_SERVER['HTTP_X_FORWARDED_FOR'];
}

function BlacklistIP($page,$User_ID,$My_Name, $mysqli){

$ip= get_client_ip(); 
$getCountryFromIP= getCountryFromIP($ip, " NamE ");
$agent =$_SERVER["HTTP_USER_AGENT"];
//$HTTP_X_FORWARDED_FOR = $_SERVER["HTTP_X_FORWARDED_FOR"];
$HTTP_X_FORWARDED_FOR = $_SERVER['HTTP_REFERER'];
$host_name_by_address = gethostbyaddr($_SERVER['REMOTE_ADDR']);
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
$view_date =date("Y/m/d");

$query = "SELECT ip_address FROM IP_Blacklist WHERE user_id = '".$User_ID."' AND ip_address = '".$ip."'";		
	$results = $mysqli->query($query);	
	if ($results->num_rows == 0) {	
	$act=1;
		if ($insert_stmt = $mysqli->prepare("INSERT INTO IP_Blacklist (user_id, user_name, page, country, ip_address, user_agent, HTTP_X_FORWARDED_FOR, host_name_by_address, count, datetime,view_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
		$insert_stmt->bind_param('sssssssssss', $User_ID, $My_Name, $page, $getCountryFromIP, $ip, $agent, $HTTP_X_FORWARDED_FOR, $host_name_by_address,$act, $datetime, $view_date);
		if (! $insert_stmt->execute()) {
			//echo $mysqli->error;
		}
		}
		//header('Location: ../index.php?err=You are not allowed to view this page!');
		//header("location: https://www.immovalet.com",  true,  404 );
		//exit();

}else{
		$mysqli->query("UPDATE IP_Blacklist SET count = count+1 WHERE page = '".$page."' and ip_address = '".$ip."' and view_date = '".$view_date."'");
		
	}
		// Destroy session 
// Unset all session values 
$_SESSION = array();

// Destroy session 
session_destroy();
//exit();
if($getCountryFromIP != "Canada")
{
	header('Location: ../index.php?err=You need permission to perform this action!');
	exit();
}

}

function language($lang, $mysqli) {
	//if (isset($_POST)) {
			// Getting all language variables into array as global variable
$i=1;
$query = "SELECT * FROM tbl_language";	
$result = $mysqli->query($query);	
$results = $result->fetch_assoc();

$langs= 'lang_'.$lang;								
//foreach ($results as $row) {
	while($results = $result->fetch_assoc())
	{
	define('LANG_VALUE_'.$i,$results[$langs]);
	$i++;
	}
//}
$Profile_ID= $_SESSION['Profile_ID'];
$UserDB= $_SESSION['UserDB'];

if ($stmt = $mysqli->prepare("SELECT prof_lang 
				      FROM $UserDB 
				      WHERE $Profile_ID = ? LIMIT 1")) {
            // Bind "$user_id" to parameter. 
            $stmt->bind_param('i', $lang);
            $stmt->execute();   // Execute the prepared query.
            $stmt->store_result();

if ($stmt->num_rows != 1) {
				
				$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
if (!$mysqli->query("UPDATE $UserDB SET prof_lang='".$lang."',Login_Date='".$datetime."' WHERE User_Name ='".$_SESSION['username']."' AND $Profile_ID ='".$_SESSION['user_id']."'")) {
	//echo $mysqli->error;
	}
			}
			}
	
	
}

function encrypt_decrypt($action, $string) {
    $output = false;
    $encrypt_method = "AES-256-CBC";
    $secret_key = '6LdWMB8UAAAAAE1IgbcbI47oAAxIMRWZ9KS-zysf';
    $secret_iv = '6LdWMB8UAAAAACRZ6smoOM0D71bIWP0f2H8o9Fo-';
    // hash
    $key = hash('sha256', $secret_key);

// iv - encrypt method AES-256-CBC expects 16 bytes - else you will get a warning
    $iv = substr(hash('sha256', $secret_iv), 0, 16);
    if ( $action == 'encrypt' ) {
        $output = openssl_encrypt($string, $encrypt_method, $key, 0, $iv);
        $output = base64_encode($output);
    } else if( $action == 'decrypt' ) {
        $output = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv);
    }
    return $output;
}

/*===============================================================================================================================*/
/*=============================================== ANTI SQL INJECTION Function ===================================================*/
/*===============================================================================================================================*/

function antiSQLInjection($texto){
	// Words for search
	$check[1] = chr(34); // simbol "
	$check[2] = chr(39); // simbol '
	$check[3] = chr(92); // simbol /
	$check[4] = chr(96); // simbol `
	$check[5] = "drop table";
	$check[6] = "update";
	$check[7] = "alter table";
	$check[8] = "drop database";
	$check[9] = "drop";
	$check[10] = "select";
	$check[11] = "delete";
	$check[12] = "insert";
	$check[13] = "alter";
	$check[14] = "destroy";
	$check[15] = "table";
	$check[16] = "database";
	$check[17] = "union";
	$check[18] = "TABLE_NAME";
	$check[19] = "1=1";
	$check[20] = 'or 1';
	$check[21] = 'exec';
	$check[22] = 'INFORMATION_SCHEMA';
	$check[23] = 'like';
	$check[24] = 'COLUMNS';
	$check[25] = 'into';
	$check[26] = 'VALUES';

// Creates if the variables $ y and $ x to control in WHILE that will make the search and substitution
	$y = 1;
	$x = sizeof($check);
	// WHILE is done, looking for any of the words specified above, if you find any of them, this script will replace it with a blank space " ".
	while($y <= $x){
		 $target = strpos($texto,$check[$y]);
			if($target !== false){
				$texto = str_replace($check[$y], "", $texto);
			}
		$y++;
	}
	// Returns the harmless clean variable from SQL Injection
	return $texto;
}

prepare("SELECT Teacher_ID FROM teacher_profile WHERE Email = ? LIMIT 1")) { $stmt->bind_param('s', $email); // Bind "$email" to parameter. $stmt->execute(); // Execute the prepared query. $stmt->store_result(); // get variables from result. $stmt->bind_result($user_id); $stmt->fetch(); //header('Location: reset.php?error='.$stmt->num_rows); //exit(); if ($stmt->num_rows == 1) { $_SESSION['UserDB'] = "teacher_profile"; $_SESSION['Profile_ID'] = "Teacher_ID"; return true; } } if ($stmt = $mysqli->prepare("SELECT Manager_ID FROM manager_profile WHERE Email = ? LIMIT 1")) { $stmt->bind_param('s', $email); // Bind "$email" to parameter. $stmt->execute(); // Execute the prepared query. $stmt->store_result(); // get variables from result. $stmt->bind_result($user_id); $stmt->fetch(); if ($stmt->num_rows == 1) { $_SESSION['UserDB'] = "manager_profile"; $_SESSION['Profile_ID'] = "Manager_ID"; return true; } } if ($stmt = $mysqli->prepare("SELECT Master_ID FROM master_profile WHERE User_Name = ? LIMIT 1")) { $stmt->bind_param('s', $email); // Bind "$email" to parameter. $stmt->execute(); // Execute the prepared query. $stmt->store_result(); // get variables from result. $stmt->bind_result($user_id); $stmt->fetch(); if ($stmt->num_rows == 1) { $_SESSION['UserDB'] = "master_profile"; $_SESSION['Profile_ID'] = "Master_ID"; return true; } } if ($stmt = $mysqli->prepare("SELECT Admin_ID FROM admin_profile WHERE User_Name = ? LIMIT 1")) { $stmt->bind_param('s', $email); // Bind "$email" to parameter. $stmt->execute(); // Execute the prepared query. $stmt->store_result(); // get variables from result. $stmt->bind_result($user_id); $stmt->fetch(); if ($stmt->num_rows == 1) { $_SESSION['UserDB'] = "admin_profile"; $_SESSION['Profile_ID'] = "Admin_ID"; return true; } } else{ return false; } } function login($email, $password, $mysqli) { $ip= $_SERVER["REMOTE_ADDR"]; $agent =$_SERVER["HTTP_USER_AGENT"]; $datetime =date("Y/m/d") . ' ' . date('H:i:s') ; if (checkuser($email, $mysqli)) { $UserDB = $_SESSION['UserDB']; $UA = 1; // Using prepared statements means that SQL injection is not possible. //User_Name $query = "SELECT * FROM $UserDB Where Email = '".$email."' AND User_Access = '".$UA."'"; $result = $mysqli->query($query); $Managers = $result->fetch_assoc(); $ID = $Managers['User_Access']; $prof_lang = $Managers['prof_lang']; if ($ID == 1) { $Profile_ID = $_SESSION['Profile_ID']; if ($stmt = $mysqli->prepare("SELECT $Profile_ID,User_Name, Password, salt FROM $UserDB WHERE Email = ? LIMIT 1")) { $stmt->bind_param('s', $email); // Bind "$email" to parameter. $stmt->execute(); // Execute the prepared query. $stmt->store_result(); // get variables from result. $stmt->bind_result($user_id, $username, $db_password, $salt); $stmt->fetch(); // hash the password with the unique salt. $password = hash('sha512', $password . $salt); if ($stmt->num_rows == 1) { // If the user exists we check if the account is locked // from too many login attempts if (checkbrute($user_id, $mysqli) == true) { //// Account is locked //// Send an email to user saying their account is locked //$to= $email; //$subject = "Your account is locked!"; //$url = "https://". $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; //$message = ' // // //Planly: account locked // // //

Dear Customer,

Your account is locked!

Thank you for choosing Planly.com.

Support Team

// // // //'; //$headers = "MIME-Version: 1.0" . "\r\n"; //$headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n"; //$headers .= 'From: support' . "\r\n"; //$headers .= 'Bcc: support' . "\r\n"; //mail($to,$subject,$message,$headers); header("Location: ../error.php?err=error: your account is locked"); exit(); //return false; }else { // Check if the password in the database matches // the password the user submitted. if ($db_password == $password) { // Password is correct! // Get the user-agent string of the user. $user_browser = $_SERVER['HTTP_USER_AGENT']; // XSS protection as we might print this value $user_id = preg_replace("/[^0-9]+/", "", $user_id); $_SESSION['user_id'] = $user_id; $_SESSION['myusername'] = $username; // XSS protection as we might print this value $username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username); $_SESSION['username'] = $username; $_SESSION['User_type'] = $UserDB; $_SESSION['login_string'] = hash('sha512', $password . $user_browser); language($prof_lang, $mysqli); //$registersw=mysql_query("UPDATE Client set Login_Time='" . $datetime . "',User_IP='" . $ip . "', User_agent='" . $agent . "' where ID='".$user_id."'"); if (!$mysqli->query("UPDATE $UserDB SET Login_Time = '$datetime', User_IP='$ip', User_agent='$agent' WHERE ID = '$user_id'")) { } $LoginDate =date("Y/m/d"); $LoginTime =date('H:i:s'); $logins=1; //$context = stream_context_create( // array( // "http" => array( // "header" => "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" // ) // ) //); // //$HTML = file_get_contents("https://whatismyipaddress.com/ip/$ip", false,$context); //preg_match_all('/(.*?)<\/th>(.*?)<\/td>/s', $HTML, $Matches, PREG_SET_ORDER); // //$isp=$Matches[5][2]; //Videotron Ltee //$city=$Matches[14][2]; //Saint-Lambert //$state=$Matches[13][2]; // Quebec //$zipcode=$Matches[17][2]; //Postal Code //$country=$Matches[12][2]; //Canada //$Continent=$Matches[11][2]; //North America // Set a stream context with a User-Agent header (if needed) $context = stream_context_create([ "http" => [ "header" => "User-Agent: Mozilla/5.0 (compatible; YourAppName/1.0)" ] ]); // Try to retrieve IP info from ipapi.co $ipApiUrl = "https://ipapi.co/{$ip}/json/"; $ipInfo = @file_get_contents($ipApiUrl, false, $context); $isp = "Unknown"; $city = "Unknown"; $state = "Unknown"; $zipcode = "Unknown"; $country = "Unknown"; $Continent = "Unknown"; if ($ipInfo !== false) { $ipData = json_decode($ipInfo, true); if (is_array($ipData)) { $isp = isset($ipData['org']) ? $ipData['org'] : "Unknown"; $city = isset($ipData['city']) ? $ipData['city'] : "Unknown"; $state = isset($ipData['region']) ? $ipData['region'] : "Unknown"; $zipcode = isset($ipData['postal']) ? $ipData['postal'] : "Unknown"; $country = isset($ipData['country_name']) ? $ipData['country_name'] : "Unknown"; // ipapi.co does not directly provide a continent value } } else { // Log an error if needed error_log("Unable to retrieve IP information from ipapi.co for $ip. Using default values."); } // Now you can use $isp, $city, $state, $zipcode, $country, $Continent safely. // For example: //echo "ISP: " . $isp . "
"; //echo "City: " . $city . "
"; //echo "State: " . $state . "
"; //echo "Zipcode: " . $zipcode . "
"; //echo "Country: " . $country . "
"; //echo "Continent: " . $Continent . "
"; if ($insertstmt = $mysqli->prepare("INSERT INTO Logged_In_Machine (Clients_ID, IP_Address, User_Agent, Account_Status, Login_Date, Login_Time, ISP) VALUES (?, ?, ?, ?, ?, ?, ?)")) { $insertstmt->bind_param('sssssss',$user_id,$ip,$agent,$logins,$LoginDate,$LoginTime,$isp); if (! $insertstmt->execute()) { } } $Token_User= mb_strtoupper(strval(bin2hex(openssl_random_pseudo_bytes(16)))); $_SESSION['Token_User'] = $Token_User; if (!$mysqli->query("UPDATE $UserDB SET Login_Date = '$datetime', User_IP='$ip', User_agent='$agent', ISP='$isp', Token_User='$Token_User' WHERE Teacher_ID = '$user_id'")) { } // Login successful. return true; } else { // Password is not correct // We record this attempt in the database $now = time(); if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time) VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) { header("Location: ../error.php?err=Database error: login_attempts"); exit(); } //if (!$mysqli->query("INSERT INTO Login_log(User_ID, time) // VALUES ('$user_id', '$now')")) { // header("Location: ../error.php?err=Database error: login_attempts"); // exit(); //} return false; } } } else { // No user exists. return false; } } else { // Could not create a prepared statement header("Location: ../error.php?err=Database error: cannot prepare statement X"); exit(); } }else{ header("Location: ../error.php?err=error: Access denid"); exit(); } }else{ // Could not create a prepared statement header("Location: ../index.php?err=you are not allow to login"); exit(); } } function checkbrute($user_id, $mysqli) { // Get timestamp of current time $now = time(); // All login attempts are counted from the past 2 hours. $valid_attempts = $now - (2 * 60 * 60); $UserDB = $_SESSION['UserDB']; if ($stmt = $mysqli->prepare("SELECT time FROM Login_log WHERE User_ID = ? AND time > '$valid_attempts' AND User_Type = '$UserDB'")) { $stmt->bind_param('i', $user_id); // Execute the prepared query. $stmt->execute(); $stmt->store_result(); // If there have been more than 5 failed logins if ($stmt->num_rows > 5) { return true; } else { return false; } } else { // Could not create a prepared statement header("Location: ../error.php?err=Database error: cannot prepare statement 1"); exit(); } } function login_check($mysqli) { // Check if all session variables are set if (isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) { $user_id = $_SESSION['user_id']; $login_string = $_SESSION['login_string']; $username = $_SESSION['username']; $Profile_ID = $_SESSION['Profile_ID']; $UserDB = $_SESSION['UserDB']; // Get the user-agent string of the user. $user_browser = $_SERVER['HTTP_USER_AGENT']; if ($stmt = $mysqli->prepare("SELECT Password FROM $UserDB WHERE $Profile_ID = ? LIMIT 1")) { // Bind "$user_id" to parameter. $stmt->bind_param('i', $user_id); $stmt->execute(); // Execute the prepared query. $stmt->store_result(); if ($stmt->num_rows == 1) { // If the user exists get variables from result. $stmt->bind_result($password); $stmt->fetch(); $login_check = hash('sha512', $password . $user_browser); if ($login_check == $login_string) { // Logged In!!!! return true; } else { // Not logged in return false; } } else { // Not logged in return false; } } else { // Could not prepare statement header("Location: ../error.php?err=Database error: cannot prepare statement 2"); exit(); } } else { // Not logged in return false; } } function esc_url($url) { if ('' == $url) { return $url; } $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url); $strip = array('%0d', '%0a', '%0D', '%0A'); $url = (string) $url; $count = 1; while ($count) { $url = str_replace($strip, '', $url, $count); } $url = str_replace(';//', '://', $url); $url = htmlentities($url); $url = str_replace('&', '&', $url); $url = str_replace("'", ''', $url); if ($url[0] !== '/') { // We're only interested in relative links from $_SERVER['PHP_SELF'] return ''; } else { return $url; } } function addinfo($page, $mysqli){ $query = "SELECT page FROM hits WHERE page = '".$page."'"; $result = $mysqli->query($query); $Managers = $result->fetch_assoc(); if ($result->num_rows != 0) { //A counter for this page already exsists. Now we have to update it. $mysqli->query("UPDATE hits SET count = count+1 WHERE page = '".$page."'"); }else{ $act=1; if ($insert_stmt = $mysqli->prepare("INSERT INTO hits (page, count) VALUES (?, ?)")) { $insert_stmt->bind_param('ss',$page,$act); if (! $insert_stmt->execute()) { } } } $ip= get_client_ip(); $getCountryFromIP= getCountryFromIP($ip, " NamE "); $agent =$_SERVER["HTTP_USER_AGENT"]; $HTTP_X_FORWARDED_FOR = "";//$_SERVER["HTTP_X_FORWARDED_FOR"]; //$_SERVER['HTTP_REFERER']; $host_name_by_address = gethostbyaddr($_SERVER['REMOTE_ADDR']); $datetime =date("Y/m/d") . ' ' . date('H:i:s') ; $view_date =date("Y/m/d"); $query = "SELECT ip_address FROM info_page WHERE page = '".$page."' and ip_address = '".$ip."' and view_date = '".$view_date."'"; $results = $mysqli->query($query); if ($results->num_rows == 0) { $act=1; if ($insert_stmt = $mysqli->prepare("INSERT INTO info_page (page, country, ip_address, user_agent, HTTP_X_FORWARDED_FOR, host_name_by_address, count, datetime,view_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)")) { $insert_stmt->bind_param('sssssssss', $page, $getCountryFromIP, $ip, $agent, $HTTP_X_FORWARDED_FOR, $host_name_by_address, $act, $datetime, $view_date); if (! $insert_stmt->execute()) { } } }else{ $mysqli->query("UPDATE info_page SET page = '".$page."', count = count+1 WHERE page = '".$page."' and ip_address = '".$ip."' and view_date = '".$view_date."'"); } $query = "SELECT ip_address FROM info WHERE ip_address = '".$ip."'"; $result = $mysqli->query($query); $Managers = $result->fetch_assoc(); if ($result->num_rows == 0) { // if not , add it. if ($insert_stmt = $mysqli->prepare("INSERT INTO info (country, ip_address, user_agent, HTTP_X_FORWARDED_FOR, host_name_by_address, datetime) VALUES (?, ?, ?, ?, ?, ?)")) { $insert_stmt->bind_param('ssssss', $getCountryFromIP, $ip, $agent, $HTTP_X_FORWARDED_FOR,$host_name_by_address, $datetime); if (! $insert_stmt->execute()) { } } } if($getCountryFromIP != "Canada") { // header('Location: ../index.php?err=You need permission to perform this action!'); // exit(); } } function getUserIP() { $client = @$_SERVER['HTTP_CLIENT_IP']; $forward = @$_SERVER['HTTP_X_FORWARDED_FOR']; $remote = $_SERVER['REMOTE_ADDR']; if(filter_var($client, FILTER_VALIDATE_IP)) { $ip = $client; } elseif(filter_var($forward, FILTER_VALIDATE_IP)) { $ip = $forward; } else { $ip = $remote; } return $ip; } function get_client_ip() { return $_SERVER["REMOTE_ADDR"]; //// Nothing to do without any reliable information //if (!isset ($_SERVER['REMOTE_ADDR'])) { // return NULL; //} // //// Header that is used by the trusted proxy to refer to //// the original IP //$proxy_header = "HTTP_X_FORWARDED_FOR"; // //// List of all the proxies that are known to handle 'proxy_header' //// in known, safe manner //$trusted_proxies = array ("10.81.200.4"); // //if (in_array ($_SERVER['REMOTE_ADDR'], $trusted_proxies)) { // // // Get the IP address of the client behind trusted proxy // if (array_key_exists ($proxy_header, $_SERVER)) { // // // Header can contain multiple IP-s of proxies that are passed through. // // Only the IP added by the last proxy (last IP in the list) can be trusted. // $proxy_list = explode (",", $_SERVER[$proxy_header]); // $client_ip = trim (end ($proxy_list)); // // // Validate just in case // if (filter_var ($client_ip, FILTER_VALIDATE_IP)) { // return $client_ip; // } else { // // Validation failed - beat the guy who configured the proxy or // // the guy who created the trusted proxy list? // // TODO: some error handling to notify about the need of punishment // } // } //} // //// In all other cases, REMOTE_ADDR is the ONLY IP we can trust. //return $_SERVER['HTTP_X_FORWARDED_FOR']; } function BlacklistIP($page,$User_ID,$My_Name, $mysqli){ $ip= get_client_ip(); $getCountryFromIP= getCountryFromIP($ip, " NamE "); $agent =$_SERVER["HTTP_USER_AGENT"]; //$HTTP_X_FORWARDED_FOR = $_SERVER["HTTP_X_FORWARDED_FOR"]; $HTTP_X_FORWARDED_FOR = $_SERVER['HTTP_REFERER']; $host_name_by_address = gethostbyaddr($_SERVER['REMOTE_ADDR']); $datetime =date("Y/m/d") . ' ' . date('H:i:s') ; $view_date =date("Y/m/d"); $query = "SELECT ip_address FROM IP_Blacklist WHERE user_id = '".$User_ID."' AND ip_address = '".$ip."'"; $results = $mysqli->query($query); if ($results->num_rows == 0) { $act=1; if ($insert_stmt = $mysqli->prepare("INSERT INTO IP_Blacklist (user_id, user_name, page, country, ip_address, user_agent, HTTP_X_FORWARDED_FOR, host_name_by_address, count, datetime,view_date) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) { $insert_stmt->bind_param('sssssssssss', $User_ID, $My_Name, $page, $getCountryFromIP, $ip, $agent, $HTTP_X_FORWARDED_FOR, $host_name_by_address,$act, $datetime, $view_date); if (! $insert_stmt->execute()) { //echo $mysqli->error; } } //header('Location: ../index.php?err=You are not allowed to view this page!'); //header("location: https://www.immovalet.com", true, 404 ); //exit(); }else{ $mysqli->query("UPDATE IP_Blacklist SET count = count+1 WHERE page = '".$page."' and ip_address = '".$ip."' and view_date = '".$view_date."'"); } // Destroy session // Unset all session values $_SESSION = array(); // Destroy session session_destroy(); //exit(); if($getCountryFromIP != "Canada") { header('Location: ../index.php?err=You need permission to perform this action!'); exit(); } } function language($lang, $mysqli) { //if (isset($_POST)) { // Getting all language variables into array as global variable $i=1; $query = "SELECT * FROM tbl_language"; $result = $mysqli->query($query); $results = $result->fetch_assoc(); $langs= 'lang_'.$lang; //foreach ($results as $row) { while($results = $result->fetch_assoc()) { define('LANG_VALUE_'.$i,$results[$langs]); $i++; } //} $Profile_ID= $_SESSION['Profile_ID']; $UserDB= $_SESSION['UserDB']; if ($stmt = $mysqli->prepare("SELECT prof_lang FROM $UserDB WHERE $Profile_ID = ? LIMIT 1")) { // Bind "$user_id" to parameter. $stmt->bind_param('i', $lang); $stmt->execute(); // Execute the prepared query. $stmt->store_result(); if ($stmt->num_rows != 1) { $datetime =date("Y/m/d") . ' ' . date('H:i:s') ; if (!$mysqli->query("UPDATE $UserDB SET prof_lang='".$lang."',Login_Date='".$datetime."' WHERE User_Name ='".$_SESSION['username']."' AND $Profile_ID ='".$_SESSION['user_id']."'")) { //echo $mysqli->error; } } } } function encrypt_decrypt($action, $string) { $output = false; $encrypt_method = "AES-256-CBC"; $secret_key = '6LdWMB8UAAAAAE1IgbcbI47oAAxIMRWZ9KS-zysf'; $secret_iv = '6LdWMB8UAAAAACRZ6smoOM0D71bIWP0f2H8o9Fo-'; // hash $key = hash('sha256', $secret_key); // iv - encrypt method AES-256-CBC expects 16 bytes - else you will get a warning $iv = substr(hash('sha256', $secret_iv), 0, 16); if ( $action == 'encrypt' ) { $output = openssl_encrypt($string, $encrypt_method, $key, 0, $iv); $output = base64_encode($output); } else if( $action == 'decrypt' ) { $output = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv); } return $output; } /*===============================================================================================================================*/ /*=============================================== ANTI SQL INJECTION Function ===================================================*/ /*===============================================================================================================================*/ function antiSQLInjection($texto){ // Words for search $check[1] = chr(34); // simbol " $check[2] = chr(39); // simbol ' $check[3] = chr(92); // simbol / $check[4] = chr(96); // simbol ` $check[5] = "drop table"; $check[6] = "update"; $check[7] = "alter table"; $check[8] = "drop database"; $check[9] = "drop"; $check[10] = "select"; $check[11] = "delete"; $check[12] = "insert"; $check[13] = "alter"; $check[14] = "destroy"; $check[15] = "table"; $check[16] = "database"; $check[17] = "union"; $check[18] = "TABLE_NAME"; $check[19] = "1=1"; $check[20] = 'or 1'; $check[21] = 'exec'; $check[22] = 'INFORMATION_SCHEMA'; $check[23] = 'like'; $check[24] = 'COLUMNS'; $check[25] = 'into'; $check[26] = 'VALUES'; // Creates if the variables $ y and $ x to control in WHILE that will make the search and substitution $y = 1; $x = sizeof($check); // WHILE is done, looking for any of the words specified above, if you find any of them, this script will replace it with a blank space " ". while($y <= $x){ $target = strpos($texto,$check[$y]); if($target !== false){ $texto = str_replace($check[$y], "", $texto); } $y++; } // Returns the harmless clean variable from SQL Injection return $texto; }