$value) { if ($key == 1) continue; $query .= '&'.$key.'='.$value; } foreach ($_POST as $key => $value) { $query .= '&'.$key.'='.$value; } $url = ui_get_full_url($query); // Prevent HTTP response splitting attacks // http://en.wikipedia.org/wiki/HTTP_response_splitting $url = str_replace ("\n", "", $url); header ('Location: '.$query); exit; //Always exit after sending location headers } // Pure mode (without menu, header and footer). $config["pure"] = (bool) get_parameter ("pure"); // Auto Refresh page (can now be disabled anywhere in the script) $config["refr"] = (int) get_parameter ("refr"); ob_start (); echo ''."\n"; echo ''."\n"; echo ''; //This starts the page head. In the call back function, things from $page['head'] array will be processed into the head ob_start ('ui_process_page_head'); // Enterprise main enterprise_include ('index.php'); // This tag is included in the buffer passed to ui_process_page_head so // technically it can be stripped echo ''."\n"; require_once ("include/functions_themes.php"); ob_start ('ui_process_page_body'); $config["remote_addr"] = $_SERVER['REMOTE_ADDR']; $sec2 = get_parameter_get ('sec2'); $sec2 = safe_url_extraclean ($sec2); $page = $sec2; //Reference variable for old time sake $sec = get_parameter_get ('sec'); $sec = safe_url_extraclean ($sec); $searchPage = false; $search = get_parameter_get("head_search_keywords"); if (strlen($search) > 0) { $config['search_keywords'] = trim(get_parameter('keywords')); // If not search category providad, we'll use an agent search $config['search_category'] = get_parameter('search_category', 'agents'); if (($config['search_keywords'] != 'Enter keywords to search') && (strlen($config['search_keywords']) > 0)) $searchPage = true; } // Hash login process if (! isset ($config['id_user']) && isset ($_GET["loginhash"])) { $loginhash_data = get_parameter("loginhash_data", ""); $loginhash_user = get_parameter("loginhash_user", ""); if ($config["loginhash_pwd"] != "" && $loginhash_data == md5($loginhash_user.$config["loginhash_pwd"])) { db_logon ($loginhash_user, $_SERVER['REMOTE_ADDR']); $_SESSION['id_usuario'] = $loginhash_user; $config["id_user"] = $loginhash_user; } else { require_once ('general/login_page.php'); db_pandora_audit("Logon Failed (loginhash", "", "system"); while (@ob_end_flush ()); exit (""); } } elseif (! isset ($config['id_user']) && isset ($_GET["login"])) { // Login process include_once('include/functions_db.php');//Include it to use escape_string_sql function $config["auth_error"] = ""; //Set this to the error message from the authorization mechanism $nick = get_parameter_post ("nick"); //This is the variable with the login $pass = get_parameter_post ("pass"); //This is the variable with the password $nick = db_escape_string_sql($nick); $pass = db_escape_string_sql($pass); // process_user_login is a virtual function which should be defined in each auth file. // It accepts username and password. The rest should be internal to the auth file. // The auth file can set $config["auth_error"] to an informative error output or reference their internal error messages to it // process_user_login should return false in case of errors or invalid login, the nickname if correct $nick_in_db = process_user_login ($nick, $pass); if ($nick_in_db !== false) { unset ($_GET["sec2"]); $_GET["sec"] = "general/logon_ok"; $home_page =''; if (isset($nick)) { $user_info = users_get_user_by_id($nick); $home_page = io_safe_output($user_info['section']); $home_url = $user_info['data_section']; if ($home_page != '') { switch($home_page) { case __('Event list'): $_GET["sec"] = "eventos"; $_GET["sec2"] = "operation/events/events"; break; case __('Group view'): $_GET["sec"] = "estado"; $_GET["sec2"] = "operation/agentes/group_view"; break; case __('Alert detail'): $_GET["sec"] = "estado"; $_GET["sec2"] = "operation/agentes/alerts_status"; break; case __('Tactical view'): $_GET["sec"] = "estado"; $_GET["sec2"] = "operation/agentes/tactical"; break; case __('Default'): $_GET["sec"] = "general/logon_ok"; break; case __('Dashboard'): $_GET["sec"] = "dashboard"; $_GET["sec2"] = ENTERPRISE_DIR.'/dashboard/main_dashboard'; break; case __('Visual console'): $_GET["sec"] = "visualc"; $_GET["sec2"] = "operation/visual_console/index"; break; case __('Other'): $home_url = io_safe_output($home_url); parse_str ($home_url, $res); $_GET["sec"] = $res["sec"]; $_GET["sec2"] = $res["sec2"]; break; } } else { $_GET["sec"] = "general/logon_ok"; } } db_logon ($nick_in_db, $_SERVER['REMOTE_ADDR']); $_SESSION['id_usuario'] = $nick_in_db; $config['id_user'] = $nick_in_db; //Remove everything that might have to do with people's passwords or logins unset ($_GET['pass'], $pass, $_POST['pass'], $_REQUEST['pass'], $login_good); $user_language = get_user_language ($config['id_user']); $l10n = NULL; if (file_exists ('./include/languages/'.$user_language.'.mo')) { $l10n = new gettext_reader (new CachedFileReader ('./include/languages/'.$user_language.'.mo')); $l10n->load_tables(); } } else { // User not known $login_failed = true; require_once ('general/login_page.php'); db_pandora_audit("Logon Failed", "Invalid login: ".$nick, $nick); while (@ob_end_flush ()); exit (""); } } elseif (! isset ($config['id_user'])) { // There is no user connected require_once ('general/login_page.php'); while (@ob_end_flush ()); exit (""); } // Log off if (isset ($_GET["bye"])) { include ("general/logoff.php"); $iduser = $_SESSION["id_usuario"]; db_logoff ($iduser, $_SERVER['REMOTE_ADDR']); // Unregister Session (compatible with 5.2 and 6.x, old code was deprecated unset($_SESSION['id_usuario']); unset($iduser); while (@ob_end_flush ()); exit (""); } /** * Load the basic configurations of extension and add extensions into menu. * Load here, because if not, some extensions not load well, I don't why. */ extensions_load_extensions ($config['extensions']); // Header if ($config["pure"] == 0) { echo '
'; } else { echo '
'; } // http://es2.php.net/manual/en/ref.session.php#64525 // Session locking concurrency speedup! session_write_close (); // Main block of content if ($config["pure"] == 0) { echo '
'; } // Page loader / selector if ($searchPage) { require ('operation/search_results.php'); } else { if ($page != "") { $page .= '.php'; // Enterprise ACL check if (enterprise_hook ('enterprise_acl', array ($config['id_user'], $sec, $sec2)) == false) { require ("general/noaccess.php"); } elseif (file_exists ($page)) { if (! extensions_is_extension ($page)) { require_once($page); } else { if ($sec[0] == 'g') extensions_call_godmode_function (basename ($page)); else extensions_call_main_function (basename ($page)); } } else echo '
'.__('Sorry! I can\'t find the page!').''; } else { //home screen chosen by the user $home_page =''; if (isset($config['id_user'])) { $user_info = users_get_user_by_id($config['id_user']); $home_page = io_safe_output($user_info['section']); $home_url = $user_info['data_section']; } if ($home_page != '') { switch($home_page) { case __('Event list'): require ('operation/events/events.php'); break; case __('Group view'): require ('operation/agentes/group_view.php'); break; case __('Alert detail'): require ('operation/agentes/alerts_status.php'); break; case __('Tactical view'): require ('operation/agentes/tactical.php'); break; case __('Default'): require ('general/logon_ok.php'); break; case __('Dashboard'): $id_dashboard = db_get_value('id', 'tdashboard', 'name', $home_url); $str = 'sec=visualc&sec2='.ENTERPRISE_DIR.'/dashboard/main_dashboard&id='.$id_dashboard; parse_str($str, $res); foreach ($res as $key => $param) { $_GET[$key] = $param; } require(ENTERPRISE_DIR.'/dashboard/main_dashboard.php'); break; case __('Visual console'): $id_visualc = db_get_value('id', 'tlayout', 'name', $home_url); if (($home_url == '') || ($id_visualc == false)) { $str = 'sec=visualc&sec2=operation/visual_console/index&refr=60'; } else $str = 'sec=visualc&sec2=operation/visual_console/render_view&id='.$id_visualc .'&refr=60'; parse_str($str, $res); foreach ($res as $key => $param) { $_GET[$key] = $param; } require($_GET["sec2"].'.php'); break; case __('Other'): $home_url = io_safe_output($home_url); parse_str ($home_url, $res); foreach ($res as $key => $param) { $_GET[$key] = $param; } if (isset($_GET['sec2'])) { $file = $_GET['sec2'].'.php'; if (!file_exists ($file)) { unset($_GET['sec2']); require('general/logon_ok.php'); } else { require($file); } } break; } } else { require("general/logon_ok.php"); } } require("general/shortcut_bar.php"); } if ($config["pure"] == 0) { echo '
'; // main echo '
 
'; echo '
'; // page (id = page) } else { echo "
"; // main_pure } if ($config["pure"] == 0) { echo ''; echo '
'; //container div } while (@ob_end_flush ()); db_print_database_debug (); echo ''; $run_time = format_numeric (microtime (true) - $config['start_time'], 3); echo "\n\n"; ?>