PCNet 2006 April/PCnet 2006-06.4.iso/shareware/nmsetup.exe/WebServer/web/_session_common.php

PHP Script | 2006-05-01 | 5.8 KB | 201 lines

<?php
////////////////////////////////////////////////////////////////////////////////
// <!--Copyright (c) 2005 Pure Networks Inc.  All rights reserved.-->
////////////////////////////////////////////////////////////////////////////////
//
// Build: 3.0.6121.0 (Stable)
// $Revision: #3 $
//

session_start();
// Common functions
require "_util.php";
require "_config.php";
require "_error_codes.php";
$sNetworkName = "";

$bLoggedIn = false;

try
{
    $nmNetworkLib = new COM("PureNetworks.NetMagic.NmRaNetworkLib");
    $nmNetworkLib->EnsureLoaded();
    $sNetworkName = $nmNetworkLib->NetworkName;

    $nmRaHelper = new COM("PureNetworks.NetMagic.NmRaMgrHelper");
    $nmRaManager = $nmRaHelper->GetNmRaManager();
    $sIntoTitle = $nmRaManager->IntroHeadline;
    $sIntroHeadline = htmlentities($sIntoTitle);
    $sHomeUrl = $nmRaManager->HomeUrl;
}
catch(com_exception $ex)
{
    $sNetworkName = "(Could not determine the network name)";
    log_activity("Attempting nmNetworkLib->NetworkName", "exception", $ex->getMessage());
    if ($sNavLocation != "error")
    {
        gotoAbs("/error/103/return");
        exit();
    }
}

if ($sNavLocation != "error" && $sNavLocation != "help")
{
    // we have to check for shields up FIRST, as being in shields up mode will make it such
    // that we have no WAN IP address and that error case will fail out too.
    try
    {
        $bShieldsUp = $nmNetworkLib->RaShieldsUp ;
        if ($bShieldsUp)
        {
            logoff();
            log_activity("shields up check", "failure", return_error_text(112, "", $arErrors));
            if ($sNavLocation != "error")
            {
                gotoAbs("/error/112/return");
                exit();
            }
        }
    }
    catch(com_exception $ex)
    {
        logoff();
        log_activity("Attempting nmNetworkLib->RaShieldsUp", "exception", $ex->getMessage());
        if ($sNavLocation != "error")
        {
            gotoAbs('/error/113');
            exit();
        }
    }
}

// they are not logged in and thus have no session, let's set the transfer cookie
switch ($sNavLocation)
{
    case "upload":
    case "login":
    case "download":
    case "debug":
    case "whatsnew":
    case "details":
    case "feed":
    case "error":
    case "playlist":
    case "preferences":
    case "rdp":
    case "robots":
    case "slideshow":
    case "usbcamera":
    case "xslt":
        // do nothing, we don't want a transfer URL here
        break;
    default:
        set_transfer_cookie();
}

    if (is_user_logged_on() == 0)
    {
        if ($sNavLocation == "upload")
        {
?>
            <script type="text/javascript">
                window.close();
                if (window.opener)
                {
                    window.opener.location.reload();
                }
            </script>
<?php        exit();
        }
    }
    else
    {
        // they are logged in

        // let's see if the password is set to blank and if so shoot them to login
        try
        {
            $newhash = strtolower($nmRaManager->GetPasswordHash(session_id()));

            if (strcmp($newhash, md5("" . session_id())) == 0)
            {
                log_activity("blank password check", "failure", $newhash);
                logoff();
                gotoAbs("/authorize/114");
                exit();
            }
        }
        catch (exception $ex)
        {
            log_activity("Attempting blank password check", "exception", $ex->getMessage());
            gotoAbs("/authorize/103");
            exit();
        }

        // let's see if it's them or a spoofer
        if (check_cookie_IP(strtolower(md5(md5($_SERVER['REMOTE_ADDR'])))) == 1)
        {
            $bLoggedIn = true;
            logonUpdate();
            $_SESSION['session_id'] = strtolower(md5(md5($_SERVER['REMOTE_ADDR'])));
        }
        else
        {
            log_activity("session IP check", "failure", return_error_text(111, "", $arErrors));
            gotoAbs("/authorize/111");
            exit();
        }
    }

    function check_cookie_IP($sCookieIp)
    {
        $arRequestHeaders = apache_request_headers();
        //check for existence of VIA headers
        $sVia = ""; $sVIA = ""; $svia = "";
        if (isset($arRequestHeaders['Via']))
        {
            $sVia = $arRequestHeaders['Via'];
        }
        if (isset($arRequestHeaders['VIA']))
        {
            $sVIA = $arRequestHeaders['VIA'];
        }
        if (isset($arRequestHeaders['via']))
        {
            $svia = $arRequestHeaders['via'];
        }

        if (strlen($sVia) > 0 OR strlen($sVIA) > 0 OR strlen($svia) > 0 )
        {
            // we likely have a proxy server here that may return multiple addresses, so we can't rely on a user having a single IP.
            return 1;
        }
        else
        {
            if (isset($_SESSION['session_id']))
            {
                if ($sCookieIp == $_SESSION['session_id'])
                {
                    // stored ip matches requesting ip, proceed
                    return 1;
                }
                else
                {
                    logoff();
                    return 0;
                }
            }
            else
            {
                // stored ip not found, but it should be stored at login, so there is some issue here (cookies disabled after login, full cookie not specified)
                logoff();
                return 0;
            }
        }
    }

if ($bLoggedIn && $sNavLocation != "download")
{
    header("Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0");
}
?>