/home/techb158/workloadmatch.com/workloadmatch.com/api
Edit: /home/techb158/workloadmatch.com/workloadmatch.com/api/api_functions.php (20510B)
prepare("SELECT Teacher_ID
FROM Teacher_Profile
WHERE Email = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id);
$stmt->fetch();
//header('Location: reset.php?error='.$stmt->num_rows);
//exit();
if ($stmt->num_rows == 1) {
$_SESSION['UserDB'] = "Teacher_Profile";
$_SESSION['Profile_ID'] = "Teacher_ID";
return true;
}
}
}
/*
function login($email, $password, $mysqli) {
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
if (checkuser($email, $mysqli)) {
$UserDB = $_SESSION['UserDB'];
$UA = 1;
// Using prepared statements means that SQL injection is not possible.
$query = "SELECT * FROM $UserDB Where Email = '".$email."' AND User_Access = '".$UA."'";
$result = $mysqli->query($query);
$Managers = $result->fetch_assoc();
$ID = $Managers['User_Access'];
$prof_lang = $Managers['prof_lang'];
if ($ID == 1) {
$Profile_ID = $_SESSION['Profile_ID'];
if ($stmt = $mysqli->prepare("SELECT $Profile_ID,User_Name, Password, salt
FROM $UserDB
WHERE Email = ? LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
// get variables from result.
$stmt->bind_result($user_id, $username, $db_password, $salt);
$stmt->fetch();
// hash the password with the unique salt.
$password = hash('sha512', $password . $salt);
if ($stmt->num_rows == 1) {
//echo $db_password .'=+='. $password;
//$Managers_ID= $db_password .'=+='. $password;
//header('Location: api_process_login.php?error='.$Managers_ID.'');
//exit();
// If the user exists we check if the account is locked
// from too many login attempts
if (checkbrute($user_id, $mysqli) == true) {
//header("Location: ../error.php?err=error: your account is locked");
echo "error: your account is locked";
exit();
//return false;
}else{
// Check if the password in the database matches
// the password the user submitted.
if ($db_password == $password) {
// Password is correct!
// Get the user-agent string of the user.
$user_browser = $_SERVER['HTTP_USER_AGENT'];
// XSS protection as we might print this value
$user_id = preg_replace("/[^0-9]+/", "", $user_id);
$_SESSION['user_id'] = $user_id;
$_SESSION['myusername'] = $username;
// XSS protection as we might print this value
$username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);
$_SESSION['username'] = $username;
$_SESSION['User_type'] = $UserDB;
$_SESSION['login_string'] = hash('sha512', $password . $user_browser);
//$registersw=mysql_query("UPDATE Client set Login_Time='" . $datetime . "',User_IP='" . $ip . "', User_agent='" . $agent . "' where ID='".$user_id."'");
$LoginDate =date("Y/m/d");
$LoginTime =date('H:i:s');
$logins=1;
$context = stream_context_create(
array(
"http" => array(
"header" => "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"
)
)
);
$HTML = file_get_contents("https://whatismyipaddress.com/ip/$ip", false,$context);
preg_match_all('/
(.*?)<\/th> | (.*?)<\/td>/s', $HTML, $Matches, PREG_SET_ORDER);
$isp=$Matches[5][2]; //Videotron Ltee
$city=$Matches[14][2]; //Saint-Lambert
$state=$Matches[13][2]; // Quebec
$zipcode=$Matches[17][2]; //Postal Code
$country=$Matches[12][2]; //Canada
$Continent=$Matches[11][2]; //North America
if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time)
VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) {
}
$Token_User= mb_strtoupper(strval(bin2hex(openssl_random_pseudo_bytes(16))));
$_SESSION['Token_User'] = $Token_User;
if (!$mysqli->query("UPDATE $UserDB SET Login_Time = '$datetime', User_IP='$ip', User_agent='$agent', ISP='$isp', Token_User='$Token_User' WHERE ID = '$user_id'")) {
}
// Login successful.
return true;
} else {
// Password is not correct
// We record this attempt in the database
$now = time();
if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time)
VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) {
//header("Location: ../error.php?err=Database error: login_attempts");
echo "Database error: login_attempts";
exit();
}
//if (!$mysqli->query("INSERT INTO Login_log(User_ID, time)
// VALUES ('$user_id', '$now')")) {
// header("Location: ../error.php?err=Database error: login_attempts");
// exit();
//}
return false;
}
}
} else {
// No user exists.
return false;
}
} else {
// Could not create a prepared statement
//header("Location: ../error.php?err=Database error: cannot prepare statement X");
echo "Database error: cannot prepare statement";
exit();
}
}else{
//header("Location: ../error.php?err=error: Access denid");
echo "Database error: Access denid";
exit();
}
}else{
// Could not create a prepared statement
//header("Location: ../index.php?err=error: you are not allow to login");
echo "error: you are not allow to login";
exit();
}
}
*/
function checkbrute($user_id, $mysqli) {
// Get timestamp of current time
$now = time();
// All login attempts are counted from the past 2 hours.
$valid_attempts = $now - (2 * 60 * 60);
$UserDB = $_SESSION['UserDB'];
if ($stmt = $mysqli->prepare("SELECT time
FROM Login_log
WHERE User_ID = ? AND time > '$valid_attempts' AND User_Type = '$UserDB'")) {
$stmt->bind_param('i', $user_id);
// Execute the prepared query.
$stmt->execute();
$stmt->store_result();
// If there have been more than 5 failed logins
if ($stmt->num_rows > 5) {
return true;
} else {
return false;
}
} else {
// Could not create a prepared statement
//header("Location: ../error.php?err=Database error: cannot prepare statement 1");
echo "Database error: cannot prepare statement 1";
exit();
}
}
function login_check($mysqli) {
//sec_session_start();
// Check if all session variables are set
if (isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
$user_id = $_SESSION['user_id'];
$login_string = $_SESSION['login_string'];
$username = $_SESSION['username'];
$Profile_ID = $_SESSION['Profile_ID'];
$UserDB = $_SESSION['UserDB'];
// Get the user-agent string of the user.
$user_browser = $_SERVER['HTTP_USER_AGENT'];
if ($stmt = $mysqli->prepare("SELECT Password
FROM $UserDB
WHERE $Profile_ID = ? LIMIT 1")) {
// Bind "$user_id" to parameter.
$stmt->bind_param('i', $user_id);
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();
if ($stmt->num_rows == 1) {
// If the user exists get variables from result.
$stmt->bind_result($password);
$stmt->fetch();
$login_check = hash('sha512', $password . $user_browser);
if ($login_check == $login_string) {
// Logged In!!!!
return true;
} else {
// Not logged in
return false;
}
} else {
// Not logged in
return false;
}
} else {
// Could not prepare statement
//header("Location: ../error.php?err=Database error: cannot prepare statement 2");
echo "Database error: cannot prepare statement 2";
exit();
}
} else {
// Not logged in
return false;
}
}
function login($email, $password, $mysqli) {
$ip = $_SERVER["REMOTE_ADDR"];
$agent = $_SERVER["HTTP_USER_AGENT"];
$datetime = date("Y/m/d") . ' ' . date('H:i:s');
if (checkuser($email, $mysqli)) {
$UserDB = $_SESSION['UserDB'];
$UA = 1;
$query = "SELECT * FROM $UserDB WHERE Email = '".$email."' AND User_Access = '".$UA."'";
$result = $mysqli->query($query);
$Managers = $result->fetch_assoc();
$ID = $Managers['User_Access'];
$prof_lang = $Managers['prof_lang'];
if ($ID == 1) {
$Profile_ID = $_SESSION['Profile_ID'];
if ($stmt = $mysqli->prepare("SELECT $Profile_ID, User_Name, Password, salt FROM $UserDB WHERE Email = ? LIMIT 1")) {
$stmt->bind_param('s', $email);
$stmt->execute();
$stmt->store_result();
$stmt->bind_result($user_id, $username, $db_password, $salt);
$stmt->fetch();
// If you are using client-side hashing, remove the rehash:
// $password = hash('sha512', $password . $salt);
if ($stmt->num_rows == 1) {
if (checkbrute($user_id, $mysqli) == true) {
echo "error: your account is locked";
exit();
} else {
// Compare the received client-side hash directly
if ($db_password == $password) {
$user_browser = $_SERVER['HTTP_USER_AGENT'];
$user_id = preg_replace("/[^0-9]+/", "", $user_id);
$_SESSION['user_id'] = $user_id;
$_SESSION['myusername'] = $username;
$username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);
$_SESSION['username'] = $username;
$_SESSION['User_type'] = $UserDB;
$_SESSION['login_string'] = hash('sha512', $password . $user_browser);
// ... additional code for login logging, etc.
if (!$mysqli->query("UPDATE $UserDB SET Login_Time = '$datetime', User_IP='$ip', User_agent='$agent' WHERE ID = '$user_id'")) {
}
$LoginDate =date("Y/m/d");
$LoginTime =date('H:i:s');
$logins=1;
//$context = stream_context_create(
// array(
// "http" => array(
// "header" => "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36"
// )
// )
//);
//
//$HTML = file_get_contents("https://whatismyipaddress.com/ip/$ip", false,$context);
//preg_match_all('/ | (.*?)<\/th> | (.*?)<\/td>/s', $HTML, $Matches, PREG_SET_ORDER);
//
//$isp=$Matches[5][2]; //Videotron Ltee
//$city=$Matches[14][2]; //Saint-Lambert
//$state=$Matches[13][2]; // Quebec
//$zipcode=$Matches[17][2]; //Postal Code
//$country=$Matches[12][2]; //Canada
//$Continent=$Matches[11][2]; //North America
// Set a stream context with a User-Agent header (if needed)
$context = stream_context_create([
"http" => [
"header" => "User-Agent: Mozilla/5.0 (compatible; YourAppName/1.0)"
]
]);
// Try to retrieve IP info from ipapi.co
$ipApiUrl = "https://ipapi.co/{$ip}/json/";
$ipInfo = @file_get_contents($ipApiUrl, false, $context);
$isp = "Unknown";
$city = "Unknown";
$state = "Unknown";
$zipcode = "Unknown";
$country = "Unknown";
$Continent = "Unknown";
if ($ipInfo !== false) {
$ipData = json_decode($ipInfo, true);
if (is_array($ipData)) {
$isp = isset($ipData['org']) ? $ipData['org'] : "Unknown";
$city = isset($ipData['city']) ? $ipData['city'] : "Unknown";
$state = isset($ipData['region']) ? $ipData['region'] : "Unknown";
$zipcode = isset($ipData['postal']) ? $ipData['postal'] : "Unknown";
$country = isset($ipData['country_name']) ? $ipData['country_name'] : "Unknown";
// ipapi.co does not directly provide a continent value
}
} else {
// Log an error if needed
error_log("Unable to retrieve IP information from ipapi.co for $ip. Using default values.");
}
// Now you can use $isp, $city, $state, $zipcode, $country, $Continent safely.
// For example:
echo "ISP: " . $isp . "
";
echo "City: " . $city . "
";
echo "State: " . $state . "
";
echo "Zipcode: " . $zipcode . "
";
echo "Country: " . $country . "
";
echo "Continent: " . $Continent . "
";
if ($insertstmt = $mysqli->prepare("INSERT INTO Logged_In_Machine (Clients_ID, IP_Address, User_Agent, Account_Status, Login_Date, Login_Time, ISP) VALUES (?, ?, ?, ?, ?, ?, ?)")) {
$insertstmt->bind_param('sssssss',$user_id,$ip,$agent,$logins,$LoginDate,$LoginTime,$isp);
if (! $insertstmt->execute()) {
}
}
$Token_User= mb_strtoupper(strval(bin2hex(openssl_random_pseudo_bytes(16))));
$_SESSION['Token_User'] = $Token_User;
if (!$mysqli->query("UPDATE $UserDB SET Login_Date = '$datetime', User_IP='$ip', User_agent='$agent', ISP='$isp', Token_User='$Token_User' WHERE Teacher_ID = '$user_id'")) {
}
return true;
} else {
$now = time();
if (!$mysqli->query("INSERT INTO Login_log(User_ID, User_Type, Date_Time, User_IP, User_agent, Time)
VALUES ('$user_id', '$UserDB', '$datetime', '$ip', '$agent', '$now')")) {
}
// Record failed login attempts, etc.
return false;
}
}
} else {
return false;
}
} else {
echo "Database error: cannot prepare statement";
exit();
}
} else {
echo "Database error: Access denied";
exit();
}
} else {
echo "error: you are not allowed to login";
exit();
}
}
function esc_url($url) {
if ('' == $url) {
return $url;
}
$url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%@$\|*\'()\\x80-\\xff]|i', '', $url);
$strip = array('%0d', '%0a', '%0D', '%0A');
$url = (string) $url;
$count = 1;
while ($count) {
$url = str_replace($strip, '', $url, $count);
}
$url = str_replace(';//', '://', $url);
$url = htmlentities($url);
$url = str_replace('&', '&', $url);
$url = str_replace("'", ''', $url);
if ($url[0] !== '/') {
// We're only interested in relative links from $_SERVER['PHP_SELF']
return '';
} else {
return $url;
}
}
function encrypt_decrypt($action, $string) {
$output = false;
$encrypt_method = "AES-256-CBC";
$secret_key = '6LdWMB8UAAAAAE1IgbcbI47oAAxIMRWZ9KS-zysf';
$secret_iv = '6LdWMB8UAAAAACRZ6smoOM0D71bIWP0f2H8o9Fo-';
// hash
$key = hash('sha256', $secret_key);
// iv - encrypt method AES-256-CBC expects 16 bytes - else you will get a warning
$iv = substr(hash('sha256', $secret_iv), 0, 16);
if ( $action == 'encrypt' ) {
$output = openssl_encrypt($string, $encrypt_method, $key, 0, $iv);
$output = base64_encode($output);
} else if( $action == 'decrypt' ) {
$output = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv);
}
return $output;
}
function addinfo($page, $mysqli){
// mysql_query("SET NAMES 'utf8'");
// ########################################################
// ######### check if counter exsist and update ###########
// ########################################################
$query = "SELECT page FROM hits WHERE page = '".$page."'";
$result = $mysqli->query($query);
$Managers = $result->fetch_assoc();
if ($result->num_rows != 0) {
//A counter for this page already exsists. Now we have to update it.
$mysqli->query("UPDATE hits SET count = count+1 WHERE page = '".$page."'");
}else{
$act=1;
// This page did not exsist in the counter database. A new counter must be created for this page.
if ($insert_stmt = $mysqli->prepare("INSERT INTO hits (page, count) VALUES (?, ?)")) {
$insert_stmt->bind_param('ss',$page,$act);
if (! $insert_stmt->execute()) {
}
}
}
// ####################################################
// ######### add IP and user-agent and time ###########
// ####################################################
// gather user data
$ip= $_SERVER["REMOTE_ADDR"];
$agent =$_SERVER["HTTP_USER_AGENT"];
$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
$query = "SELECT ip_address FROM info WHERE ip_address = '".$ip."'";
$result = $mysqli->query($query);
$Managers = $result->fetch_assoc();
if ($result->num_rows == 0) {
// if not , add it.
if ($insert_stmt = $mysqli->prepare("INSERT INTO info (ip_address, user_agent, datetime) VALUES (?, ?, ?)")) {
$insert_stmt->bind_param('sss', $ip, $agent, $datetime);
if (! $insert_stmt->execute()) {
}
}
}
// ***************************************************************
// ** delete the first entry in $dbtableinfo if rows > $maxrows **
// ***************************************************************
//mysqli_close($link);
} |