From 3ac0eccf782387815cdd838dd88bbd41ca83692d Mon Sep 17 00:00:00 2001 From: guruevi Date: Thu, 21 Aug 2008 21:07:20 +0000 Subject: [PATCH] 2008-08-21 Evi Vanoost * index.php: Update HTML for unclosed tags and put everything in PHP Updated the HTTPS detection. Made sure the password doesn't get passed to other scripts (like 'evil' plugins) * include/functions_html.php: Added print_input_password_extended() * general/main_menu.php: Removed old code and header * general/login_page.php: Tried putting it in functions_html code but that didn't work (rowspan), so I just ended up with a smaller file and the input boxes getting printed * general/header.php: Updated to use functions_html * general/footer.php: Updated header and develop_bypass for the query counter git-svn-id: https://svn.code.sf.net/p/pandora/code/trunk@1020 c3f86ba8-e40f-0410-aaad-9ba5e7f4b01f --- pandora_console/ChangeLog | 19 +++++ pandora_console/general/footer.php | 36 ++++----- pandora_console/general/header.php | 90 +++++++++------------- pandora_console/general/login_page.php | 61 ++++++--------- pandora_console/general/main_menu.php | 32 +++----- pandora_console/include/functions_html.php | 35 +++++++++ pandora_console/index.php | 77 +++++++++--------- 7 files changed, 180 insertions(+), 170 deletions(-) diff --git a/pandora_console/ChangeLog b/pandora_console/ChangeLog index 5abb098c57..79544d3dcd 100644 --- a/pandora_console/ChangeLog +++ b/pandora_console/ChangeLog @@ -1,3 +1,22 @@ +2008-08-21 Evi Vanoost + + * index.php: Update HTML for unclosed tags and put everything in PHP + Updated the HTTPS detection. Made sure the password doesn't get + passed to other scripts (like 'evil' plugins) + + * include/functions_html.php: Added print_input_password_extended() + + * general/main_menu.php: Removed old code and header + + * general/login_page.php: Tried putting it in functions_html code but + that didn't work (rowspan), so I just ended up with a smaller file and + the input boxes getting printed + + * general/header.php: Updated to use functions_html + + * general/footer.php: Updated header and develop_bypass for the query + counter + 2008-08-21 Sancho Lerena diff --git a/pandora_console/general/footer.php b/pandora_console/general/footer.php index dc43c7ab4d..0631b1fd68 100644 --- a/pandora_console/general/footer.php +++ b/pandora_console/general/footer.php @@ -1,7 +1,6 @@ -"; -echo ' -Pandora FMS '.$pandora_version.' - Build '.$build_version.'
'. -__('is a OpenSource Software Project, licensed under GPL terms').'
'; - if (isset($_SERVER['REQUEST_TIME'])) { - $time = $_SERVER['REQUEST_TIME']; - } else { - $time = time(); - } - echo "".__('Page generated at')." ".$LOCALE->fmt_time($time)." - Saved ".$LOCALE->fmt_number($sql_cache["saved"])." Queries
"; -echo ""; +if (isset($_SERVER['REQUEST_TIME'])) { + $time = $_SERVER['REQUEST_TIME']; +} else { + $time = time(); +} + +echo 'Pandora FMS '.$pandora_version.' - Build '.$build_version.'
'. +__('is an OpenSource Software Project, licensed under GPL terms').'
+'.__('Page generated at').' '.$LOCALE->fmt_time($time); +if ($develop_bypass == 1) { + echo ' - Saved '.$LOCALE->fmt_number($sql_cache["saved"]).' Queries'; +} +echo '
'; ?> diff --git a/pandora_console/general/header.php b/pandora_console/general/header.php index f014b52b9f..a870bd6144 100644 --- a/pandora_console/general/header.php +++ b/pandora_console/general/header.php @@ -15,60 +15,46 @@ // along with this program; if not, write to the Free Software // Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -echo ' -
- Pandora FMS -
-
- logo -
- -'; -echo "
"; - -echo " - "; -if (isset ($_SESSION["id_usuario"])){ - // Fist column - echo "
"; - if (dame_admin($_SESSION["id_usuario"])==1) - echo " "; - else - echo " "; - echo "".__('You are '). ' - ['. $_SESSION["id_usuario"]. ']'; - - // Second column - echo ""; - echo " ". __('General information').""; - - // Third column - echo ""; - // Autorefresh - if ((isset($_GET["refr"]) AND $_GET["refr"] != 0) OR (isset($_POST["refr"]) AND $_POST["refr"] != 0)) { - echo " ". __('Autorefresh').""; - } else { - echo " ". __('Autorefresh').""; - } - - - echo "
"; - echo " ". __('Logout').""; - - echo ""; - $server_status = check_server_status (); - if ($server_status == 0) - echo " ". __('Server status: DOWN').""; - else - echo " ". __('Sytem ready').""; - - echo ""; - // Event - refresh - echo " ". __('Events').""; - +echo '
Pandora FMS
+
logo
'; +if(!isset ($_SESSION["id_usuario"])) { + echo "
"; + return; } -echo "
"; +$table->width=520; +$table->border=0; +$table->cellpadding=3; +$table->size=array("30%"); +$table->class="inherit"; +$table->rowclass=array("inherit","inherit"); + +$table->data[] = array ( + // First column + ''.''.__('You are ').'['.$_SESSION["id_usuario"].']', + // Second column + ''.__('General information').'', + // Third column + // Autorefresh + ((get_parameter ("refr") != 0) ? + ''. __('Autorefresh').'' + : + ''.__('Autorefresh').'' + ) + ); + +$table->data[] = array ( + ''. __('Logout').'', + ''. + ((check_server_status () == 0) ? + ''.__('Server status: DOWN') + : + ''.__('System ready') + ).'', + // Event - refresh + ''.__('Events').'' + ); +print_table ($table); echo "
"; ?> diff --git a/pandora_console/general/login_page.php b/pandora_console/general/login_page.php index 60aa5d562b..9fc4cd3c2d 100644 --- a/pandora_console/general/login_page.php +++ b/pandora_console/general/login_page.php @@ -19,54 +19,37 @@ $addr = ""; if (isset($_GET['sec'])){ - $addr = 'http://' . $_SERVER['SERVER_NAME']; // TODO: check https - - if ($_SERVER['SERVER_PORT'] != 80) - $addr .= ":" . $_SERVER['SERVER_PORT']; - + $addr = 'http' . (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == TRUE ? 's': '') . '://' . $_SERVER['SERVER_NAME']; + + if ($_SERVER['SERVER_PORT'] != 80 && (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == TRUE && $_SERVER['SERVER_PORT'] != 443)) + $query .= ":" . $_SERVER['SERVER_PORT']; + $addr .= $_SERVER['REQUEST_URI']; $addr = urlencode($addr); } -?> -
-

-
+echo '
+

'.__('Welcome to Pandora FMS Web Console').'

+
- -
- - logo
- - 		- - Login
- + + - -
+ logo
+ '.$pandora_version.(($develop_bypass == 1) ? ' '.__('Build').' '.$build_version : '').' + 		+ '.__('Login').':
'.print_input_text_extended ("nick",'', "nick",'','','',false,'','class="login"',true).'
- Password
- +
+ '.__('Password').':
'.print_input_password_extended ("pass",'', "pass",'','','',false,'','class="login"',true).'
- +
+ '.print_submit_button ("Login",'',false,'class="sub next"',true).'
- - 0) { ?> - - + '.((strlen($addr) > 0) ? print_input_hidden("redirect",$addr,true) : '').' -
'.$REMOTE_ADDR.''; ?>
- - - - +
IP: '.$REMOTE_ADDR.'
+ '; +?> diff --git a/pandora_console/general/main_menu.php b/pandora_console/general/main_menu.php index 583579ea18..2bdb1b5e51 100644 --- a/pandora_console/general/main_menu.php +++ b/pandora_console/general/main_menu.php @@ -1,35 +1,23 @@ ' . __('You\'re not connected'); - echo '

'; - echo '
'; - echo '
Login
'; - echo '
Password
'; - echo '
'; - echo '
IP: ' . $REMOTE_ADDR . '
'; - -} else { - require ("godmode/menu.php"); - require ("links_menu.php"); + require ("general/login_page.php"); + exit(); } +require ("godmode/menu.php"); +require ("links_menu.php"); ?> diff --git a/pandora_console/include/functions_html.php b/pandora_console/include/functions_html.php index 86a1fa68aa..afe37eb0b7 100644 --- a/pandora_console/include/functions_html.php +++ b/pandora_console/include/functions_html.php @@ -152,6 +152,41 @@ function print_input_text_extended ($name, $value, $id, $alt, $size, $maxlength, echo $output; } +/** + * Render an input password element. Extended version + * See print_input_text_extended for all options + */ +function print_input_password_extended ($name, $value, $id, $alt, $size, $maxlength, $disabled, $script, $attributes, $return = false) { + static $idcounter = 0; + + ++$idcounter; + if (empty ($name)) { + $name = 'unnamed'; + } + if (empty ($alt)) { + $alt = 'textfield'; + } + if (!empty ($maxlength)) { + $maxlength = ' maxlength="'.$maxlength.'" '; + } + $output = ' - - - -'; + // Pure mode (without menu, header and footer). $config["pure"] = get_parameter ("pure", 0); @@ -79,7 +76,7 @@ $intervalo = get_parameter ("refr", 0); if ($intervalo > 0){ // Agent selection filters and refresh $query = 'http' . (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == TRUE ? 's': '') . '://' . $_SERVER['SERVER_NAME']; - if ($_SERVER['SERVER_PORT'] != 80) + if ($_SERVER['SERVER_PORT'] != 80 && (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == TRUE && $_SERVER['SERVER_PORT'] != 443)) $query .= ":" . $_SERVER['SERVER_PORT']; $query .= $_SERVER['SCRIPT_NAME']; @@ -95,8 +92,8 @@ if ($intervalo > 0){ } if (isset ($_POST["ag_group"])) { $ag_group = $_POST["ag_group"]; - $query = 'http://' . $_SERVER['SERVER_NAME']; - if ($_SERVER['SERVER_PORT'] != 80) + $query = 'http' . (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == TRUE ? 's': '') . '://' . $_SERVER['SERVER_NAME']; + if ($_SERVER['SERVER_PORT'] != 80 && (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == TRUE && $_SERVER['SERVER_PORT'] != 443)) $query .= ":" . $_SERVER['SERVER_PORT']; $query .= $_SERVER['REQUEST_URI'] . '&ag_group_refresh=' . $ag_group; } else { @@ -104,8 +101,7 @@ if ($intervalo > 0){ } } -?> -Pandora FMS - <?php echo __('the Flexible Monitoring System'); ?> +echo 'Pandora FMS - '.__('the Flexible Monitoring System').' @@ -115,18 +111,18 @@ if ($intervalo > 0){ - - + - +'; -'; -else +} else { echo ''; +} + $REMOTE_ADDR = $_SERVER['REMOTE_ADDR']; // Login process @@ -153,32 +149,36 @@ if (! isset ($_SESSION['id_usuario']) && isset ($_GET["login"])) { logon_db ($nick, $REMOTE_ADDR); $_SESSION['id_usuario'] = $nick; $config['id_user'] = $nick; + unset ($_GET['pass'], $pass); } else { // Login failed (bad password) unset ($_GET["sec2"]); - include "general/logon_failed.php"; - // change password to do not show all string - $primera = substr ($pass,0,1); - $ultima = substr ($pass, strlen ($pass) - 1, 1); - $pass = $primera . "****" . $ultima; + require "general/logon_failed.php"; + // change password to do not show any string + // $primera = substr ($pass,0,1); + // $ultima = substr ($pass, strlen ($pass) - 1, 1); + // $pass = $primera . "****" . $ultima; audit_db ($nick, $REMOTE_ADDR, "Logon Failed", - "Incorrect password: " . $nick . " / " . $pass); + "Incorrect password: " . $nick); exit; } } else { // User not known unset ($_GET["sec2"]); - include "general/logon_failed.php"; - $primera = substr ($pass, 0, 1); - $ultima = substr ($pass, strlen ($pass) - 1, 1); - $pass = $primera . "****" . $ultima; + require "general/logon_failed.php"; + // do not show any password string. Unsafe especially with + // short passwords + //$primera = substr ($pass, 0, 1); + //$ultima = substr ($pass, strlen ($pass) - 1, 1); + //$pass = $primera . "****" . $ultima; audit_db ($nick, $REMOTE_ADDR, "Logon Failed", - "Invalid username: " . $nick . " / " . $pass); + "Invalid username: " . $nick); exit; } } elseif (! isset ($_SESSION['id_usuario'])) { // There is no user connected include "general/login_page.php"; + echo ''; exit; } else { // There is session for id_usuario @@ -198,9 +198,10 @@ if (isset ($_GET["sec2"])){ $sec2 = get_parameter_get ('sec2'); $sec2 = parameter_extra_clean ($sec2); $page = $sec2; -} else +} else { $sec2 = ""; - +} + if (isset ($_GET["sec"])){ $sec = get_parameter_get ('sec'); $sec = parameter_extra_clean ($sec); @@ -215,12 +216,9 @@ session_write_close(); // Header if ($config["pure"] == 0) { - echo '
'; - echo '"; + echo "
"; // main_pure } if ($config["pure"] == 0) {