201 lines
5.2 KiB
PHP
201 lines
5.2 KiB
PHP
<?php
|
|
/*
|
|
** showlogsecure.php
|
|
*/
|
|
|
|
//
|
|
// Check inputs for SQL statement injection and such.
|
|
// Items not tested below are not vulnerable for SQL statement injection, e.g.
|
|
// a time is always converted using 'strtotime()' and other items are only
|
|
// used in the PHP but never in the composition of an SQL statement
|
|
// [security audit 2013-10-23]
|
|
//
|
|
if(
|
|
(isset($_GET['id']) && !is_numeric($_GET['id'])) ||
|
|
(isset($_GET['db']) && dirname($_GET['db']) != ".")
|
|
) {
|
|
// don't do anything fancy or interruptive as fiddling with the GET parameters
|
|
// is intended by the author
|
|
die("Parameter error");
|
|
}
|
|
|
|
define('SHOWLOGSECURE_VER_STR', '1.0');
|
|
define('SHOWLOGSECURE_DATECODE', '20110317');
|
|
|
|
require_once("../include/i18n.php");
|
|
require_once("../include/cp3000-tcpclient.php");
|
|
require_once("support.inc.php");
|
|
|
|
?>
|
|
<html>
|
|
<title>Show Log Secure <?php
|
|
echo SHOWLOGSECURE_VER_STR . "-" . SHOWLOGSECURE_DATECODE;
|
|
if( isset($_GET['id']) ) {
|
|
echo " - ";
|
|
echo $_GET['id'];
|
|
}
|
|
?></title>
|
|
<body>
|
|
<style type="text/css">
|
|
|
|
TABLE.DB_TABLE {
|
|
border: 1px solid black;
|
|
table-layout: auto;
|
|
border-collapse: collapse;
|
|
empty-cells: show;
|
|
}
|
|
|
|
TD.DB_TABLE {
|
|
border: 1px solid rgb(192,192,192);
|
|
padding: 2px;
|
|
}
|
|
|
|
TH.DB_TABLE {
|
|
border: 1px solid black;
|
|
border-bottom: 2px solid black;
|
|
}
|
|
|
|
TABLE.SELECT {
|
|
border: none;
|
|
table-layout: auto;
|
|
border-collapse: collapse;
|
|
empty-cells: show;
|
|
}
|
|
|
|
TD.SELECT {
|
|
border: none;
|
|
padding: 0px 4px;
|
|
vertical-align: top;
|
|
}
|
|
|
|
</style>
|
|
|
|
<?php
|
|
|
|
// read the database information
|
|
if( isset($_GET['db']) ) $db_info = read_database(DBCONFIG_DIR, $_GET['db']);
|
|
else $db_info = array();
|
|
if( !isset($db_info['host']) ) $db_info['host'] = "localhost";
|
|
if( !isset($db_info['user']) ) $db_info['user'] = "root";
|
|
if( !isset($db_info['passwd']) ) $db_info['passwd'] = "";
|
|
if( !isset($db_info['db']) ) $db_info['db'] = "di_zkl";
|
|
|
|
// open the database
|
|
$db_data_handle = mysql_connect($db_info['host'], $db_info['user'], $db_info['passwd']);
|
|
if( $db_data_handle === FALSE ) {
|
|
echo mysql_error();
|
|
exit(1);
|
|
}
|
|
mysql_select_db($db_info['database'], $db_data_handle);
|
|
if( $db_info['main'] ) {
|
|
$db_main_info = read_database(DBCONFIG_DIR, $db_info['main']);
|
|
$db_main_handle = mysql_connect($db_main_info['host'], $db_main_info['user'], $db_main_info['passwd'], true);
|
|
if( $db_main_handle === FALSE ) {
|
|
echo mysql_error();
|
|
exit(1);
|
|
}
|
|
mysql_select_db($db_main_info['database'], $db_main_handle);
|
|
}
|
|
else {
|
|
$db_main_handle = $db_data_handle;
|
|
$db_main_info = $db_info;
|
|
}
|
|
|
|
echo "<a name=\"event_selectie\">";
|
|
echo "<div align=\"right\">";
|
|
if( isset($_GET['id']) ) {
|
|
echo "selecteer:\n";
|
|
echo "<a href=\"#event_selectie\">event</a>\n";
|
|
}
|
|
if( isset($_GET['id']) ) {
|
|
echo "ga naar:\n";
|
|
echo "<a href=\"#logdata\">logdata</a>\n";
|
|
}
|
|
echo "</div>\n";
|
|
|
|
echo "<h1>Selecteer event</h1>\n";
|
|
echo "<table class=\"SELECT\">";
|
|
echo "<tr class=\"SELECT\">";
|
|
echo "<td class=\"SELECT\">";
|
|
echo "<form id=\"event\" action=\"showlogsecure.php#logdata\" method=\"get\">\n";
|
|
echo "<input type=\"hidden\" id=\"db\" name=\"db\" value=\"" . $db_info['file'] . "\">\n";
|
|
echo "<input type=\"text\" id=\"id\" name=\"id\" value=\"" . $_GET['id'] . "\">\n";
|
|
echo "<p>";
|
|
echo "<input type=\"submit\" value=\"Submit\">\n";
|
|
echo "</form>\n";
|
|
echo "</td>\n";
|
|
echo "</tr>\n";
|
|
echo "</table>\n";
|
|
|
|
if( isset($_GET['id']) ) {
|
|
echo "<hr>\n";
|
|
|
|
echo "<a name=\"logdata\">";
|
|
echo "selecteer:\n";
|
|
echo "<a href=\"#event_selectie\">event</a>\n";
|
|
echo "ga naar:\n";
|
|
echo "<a href=\"#logdata\">logdata</a>\n";
|
|
|
|
echo "<h1>Event " . $_GET['id'] . "</h1>\n";
|
|
print_logdata("log_secure", $_GET['id'], $db_data_handle);
|
|
print_logdata("log_secure_zkl", $_GET['id'], $db_data_handle);
|
|
print_logdata("log_secure_gebruiker", $_GET['id'], $db_data_handle);
|
|
print_logdata("log_secure_detail", $_GET['id'], $db_data_handle);
|
|
|
|
echo "<div align=\"right\">";
|
|
echo "selecteer:\n";
|
|
echo "<a href=\"#event_selectie\">event</a>\n";
|
|
echo "ga naar:\n";
|
|
echo "<a href=\"#logdata\">begin</a>\n";
|
|
echo "</div>\n";
|
|
}
|
|
|
|
function print_logdata($table, $id, $db_handle)
|
|
{
|
|
$logformat = array(
|
|
// print status fields as hexadecimal numbers
|
|
'log_secure' => array( 5 => "%02X" ),
|
|
'log_secure_zkl' => array( 4 => "%02X" ),
|
|
'log_secure_gebruiker' => array( 3 => "%02X" ),
|
|
'log_secure_detail' => array( 2 => "%02X" )
|
|
);
|
|
|
|
$query = "SELECT * ";
|
|
$query .= "FROM " . $table . " ";
|
|
$query .= "WHERE id=" . $id;
|
|
$result = mysql_run($query, $db_handle);
|
|
if( mysql_num_rows($result) == 0 ) return;
|
|
$n = mysql_num_fields($result);
|
|
|
|
echo "<h2>" . $table . "</h2>\n";
|
|
echo "<table class=\"DB_TABLE\">\n";
|
|
echo "<tr class=\"DB_TABLE\">";
|
|
for( $i = 0; $i < $n; $i++ ) {
|
|
$column = mysql_fetch_field($result, $i);
|
|
echo "<th class=\"DB_TABLE\">";
|
|
echo $column->name;
|
|
echo "</th>";
|
|
}
|
|
echo "</tr>\n";
|
|
while( $row = mysql_fetch_array($result) ) {
|
|
echo "<tr>";
|
|
for( $i = 0; $i < $n; $i++ ) {
|
|
echo "<td class=\"DB_TABLE\">";
|
|
if( isset($logformat[$table]) && $logformat[$table][$i] )
|
|
echo sprintf($logformat[$table][$i], $row[$i]);
|
|
else
|
|
echo $row[$i];
|
|
echo "</td>";
|
|
}
|
|
echo "</tr>\n";
|
|
}
|
|
//echo "<tr class=\"DB_TABLE\"><td class=\"DB_TABLE\" colspan=\"" . $n . "\">";
|
|
//echo "<input type=\"button\" value=\"Refresh\" onclick=\"return SelectLogFile();\">\n";
|
|
//echo "</td></tr>\n";
|
|
echo "</table>\n";
|
|
}
|
|
|
|
?>
|
|
</body>
|
|
</html>
|