102 echo '</table></div>'; |
103 echo '</table></div>'; |
103 } |
104 } |
104 |
105 |
105 // Security log |
106 // Security log |
106 echo '<h3>Security log</h3>'; |
107 echo '<h3>Security log</h3>'; |
107 echo '<div class="tblholder" style="/* max-height: 500px; clip: rect(0px,auto,auto,0px); overflow: auto; */"><table border="0" cellspacing="1" cellpadding="4" width="100%">'; |
108 $seclog = get_security_log(5); |
108 $cls = 'row2'; |
109 echo $seclog; |
109 echo '<tr><th style="width: 60%;">Type</th><th>Date</th><th>Username</th><th>IP Address</th></tr>'; |
110 |
110 require('config.php'); |
111 echo '<p><a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'SecurityLog\'); return false;">Full security log</a></p>'; |
111 $hash = md5($dbpasswd); |
|
112 unset($dbname, $dbhost, $dbuser, $dbpasswd); |
|
113 unset($dbname, $dbhost, $dbuser, $dbpasswd); // PHP5 Zend bug |
|
114 if ( defined('ENANO_DEMO_MODE') && !isset($_GET[ $hash ]) && substr($_SERVER['REMOTE_ADDR'], 0, 8) != '192.168.' ) |
|
115 { |
|
116 echo '<tr><td class="row1" colspan="4">Logs are recorded but not displayed for privacy purposes in the demo.</td></tr>'; |
|
117 } |
|
118 else |
|
119 { |
|
120 if(isset($_GET['fulllog'])) |
|
121 { |
|
122 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;'; |
|
123 } |
|
124 else |
|
125 { |
|
126 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC LIMIT 5'; |
|
127 } |
|
128 $q = $db->sql_query($l); |
|
129 while($r = $db->fetchrow()) |
|
130 { |
|
131 if ( $r['action'] == 'illegal_page' ) |
|
132 { |
|
133 list($illegal_id, $illegal_ns) = unserialize($r['page_text']); |
|
134 $url = makeUrlNS($illegal_ns, $illegal_id, false, true); |
|
135 $title = get_page_title_ns($illegal_id, $illegal_ns); |
|
136 $class = ( isPage($paths->nslist[$illegal_ns] . $illegal_id) ) ? '' : ' class="wikilink-nonexistent"'; |
|
137 $illegal_link = '<a href="' . $url . '"' . $class . ' onclick="window.open(this.href); return false;">' . $title . '</a>'; |
|
138 } |
|
139 if($cls == 'row2') $cls = 'row1'; |
|
140 else $cls = 'row2'; |
|
141 echo '<tr><td class="'.$cls.'">'; |
|
142 switch($r['action']) |
|
143 { |
|
144 case "admin_auth_good": echo 'Successful elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Authentication level: $level</small>"; } break; |
|
145 case "admin_auth_bad": echo 'Failed elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); echo "<br /><small>Attempted auth level: $level</small>"; } break; |
|
146 case "activ_good": echo 'Successful account activation'; break; |
|
147 case "auth_good": echo 'Successful regular user logon'; break; |
|
148 case "activ_bad": echo 'Failed account activation'; break; |
|
149 case "auth_bad": echo 'Failed regular user logon'; break; |
|
150 case "sql_inject": echo 'SQL injection attempt<div style="max-width: 90%; clip: rect(0px,auto,auto,0px); overflow: auto; display: block; font-size: smaller;">Offending query: ' . htmlspecialchars($r['page_text']) . '</div>'; break; |
|
151 case "db_backup": echo 'Database backup created<br /><small>Tables: ' . $r['page_text'] . '</small>'; break; |
|
152 case "install_enano": echo "Installed Enano version {$r['page_text']}"; break; |
|
153 case "upgrade_enano": echo "Upgraded Enano to version {$r['page_text']}"; break; |
|
154 case "illegal_page": echo "Unauthorized viewing attempt<br /><small>Page: {$illegal_link}</small>"; break; |
|
155 } |
|
156 echo '</td><td class="'.$cls.'">'.date('d M Y h:i a', $r['time_id']).'</td><td class="'.$cls.'">'.$r['author'].'</td><td class="'.$cls.'" style="cursor: pointer;" onclick="ajaxReverseDNS(this);" title="Click for reverse DNS info">'.$r['edit_summary'].'</td></tr>'; |
|
157 } |
|
158 $db->free_result(); |
|
159 } |
|
160 echo '</table></div>'; |
|
161 if(!isset($_GET['fulllog'])) echo '<p><a href="#" onclick="ajaxPage(\''.$paths->nslist['Admin'].'Home&fulllog\'); return false;">Full security log</a></p>'; |
|
162 |
112 |
163 } |
113 } |
164 |
114 |
165 function page_Admin_GeneralConfig() { |
115 function page_Admin_GeneralConfig() { |
166 global $db, $session, $paths, $template, $plugins; // Common objects |
116 global $db, $session, $paths, $template, $plugins; // Common objects |
486 return; |
436 return; |
487 } |
437 } |
488 |
438 |
489 if(isset($_POST['save'])) |
439 if(isset($_POST['save'])) |
490 { |
440 { |
491 if(isset($_POST['enable_uploads'])) setConfig('enable_uploads', '1'); else setConfig('enable_uploads', '0'); |
441 if(isset($_POST['enable_uploads']) && getConfig('enable_uploads') != '1') |
492 if(isset($_POST['enable_imagemagick'])) setConfig('enable_imagemagick', '1'); else setConfig('enable_imagemagick', '0'); |
442 { |
493 if(isset($_POST['cache_thumbs'])) setConfig('cache_thumbs', '1'); else setConfig('cache_thumbs', '0'); |
443 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author) VALUES("security","upload_enable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '");'); |
494 if(isset($_POST['file_history'])) setConfig('file_history', '1'); else setConfig('file_history', '0'); |
444 if ( !$q ) |
495 if(file_exists($_POST['imagemagick_path'])) setConfig('imagemagick_path', $_POST['imagemagick_path']); |
445 $db->_die(); |
496 else echo '<span style="color: red"><b>Warning:</b> the file "'.$_POST['imagemagick_path'].'" was not found, and the ImageMagick file path was not updated.</span>'; |
446 setConfig('enable_uploads', '1'); |
|
447 } |
|
448 else if ( !isset($_POST['enable_uploads']) && getConfig('enable_uploads') == '1' ) |
|
449 { |
|
450 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author) VALUES("security","upload_disable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '");'); |
|
451 if ( !$q ) |
|
452 $db->_die(); |
|
453 setConfig('enable_uploads', '0'); |
|
454 } |
|
455 if(isset($_POST['enable_imagemagick']) && getConfig('enable_imagemagick') != '1') |
|
456 { |
|
457 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author) VALUES("security","magick_enable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '");'); |
|
458 if ( !$q ) |
|
459 $db->_die(); |
|
460 setConfig('enable_imagemagick', '1'); |
|
461 } |
|
462 else if ( !isset($_POST['enable_imagemagick']) && getConfig('enable_imagemagick') == '1' ) |
|
463 { |
|
464 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author) VALUES("security","magick_disable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '");'); |
|
465 if ( !$q ) |
|
466 $db->_die(); |
|
467 setConfig('enable_imagemagick', '0'); |
|
468 } |
|
469 if(isset($_POST['cache_thumbs'])) |
|
470 { |
|
471 setConfig('cache_thumbs', '1'); |
|
472 } |
|
473 else |
|
474 { |
|
475 setConfig('cache_thumbs', '0'); |
|
476 } |
|
477 if(isset($_POST['file_history']) && getConfig('file_history') != '1' ) |
|
478 { |
|
479 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author) VALUES("security","filehist_enable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '");'); |
|
480 if ( !$q ) |
|
481 $db->_die(); |
|
482 setConfig('file_history', '1'); |
|
483 } |
|
484 else if ( !isset($_POST['file_history']) && getConfig('file_history') == '1' ) |
|
485 { |
|
486 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author) VALUES("security","filehist_disable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '");'); |
|
487 if ( !$q ) |
|
488 $db->_die(); |
|
489 setConfig('file_history', '0'); |
|
490 } |
|
491 if(file_exists($_POST['imagemagick_path']) && $_POST['imagemagick_path'] != getConfig('imagemagick_path')) |
|
492 { |
|
493 $old = getConfig('imagemagick_path'); |
|
494 $oldnew = "{$old}||{$_POST['imagemagick_path']}"; |
|
495 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES("security","magick_path",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($oldnew) . '");'); |
|
496 if ( !$q ) |
|
497 $db->_die(); |
|
498 setConfig('imagemagick_path', $_POST['imagemagick_path']); |
|
499 } |
|
500 else if ( $_POST['imagemagick_path'] != getConfig('imagemagick_path') ) |
|
501 { |
|
502 echo '<span style="color: red"><b>Warning:</b> the file "'.htmlspecialchars($_POST['imagemagick_path']).'" was not found, and the ImageMagick file path was not updated.</span>'; |
|
503 } |
497 $max_upload = floor((float)$_POST['max_file_size'] * (int)$_POST['fs_units']); |
504 $max_upload = floor((float)$_POST['max_file_size'] * (int)$_POST['fs_units']); |
498 if ( $max_upload > 1048576 && defined('ENANO_DEMO_MODE') ) |
505 if ( $max_upload > 1048576 && defined('ENANO_DEMO_MODE') ) |
499 { |
506 { |
500 echo '<div class="error-box">Wouldn\'t want the server DoS\'ed now. Stick to under a megabyte for the demo, please.</div>'; |
507 echo '<div class="error-box">Wouldn\'t want the server DoS\'ed now. Stick to under a megabyte for the demo, please.</div>'; |
501 } |
508 } |
529 is not writable. The checkbox below has been disabled to maintain the stability of Enano.</b>'; ?></p> |
536 is not writable. The checkbox below has been disabled to maintain the stability of Enano.</b>'; ?></p> |
530 <p><label><input type="checkbox" name="cache_thumbs" <?php if(getConfig('cache_thumbs')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; elseif(!is_writable(ENANO_ROOT.'/cache/')) echo 'readonly="readonly"'; ?> /> Cache thumbnailed images</label></p> |
537 <p><label><input type="checkbox" name="cache_thumbs" <?php if(getConfig('cache_thumbs')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; elseif(!is_writable(ENANO_ROOT.'/cache/')) echo 'readonly="readonly"'; ?> /> Cache thumbnailed images</label></p> |
531 <p>Lastly, you can choose whether file history will be saved. If this option is turned on, you will be able to roll back any malicious |
538 <p>Lastly, you can choose whether file history will be saved. If this option is turned on, you will be able to roll back any malicious |
532 changes made to uploaded files, but this requires a significant amount of database storage. You should probably leave this option |
539 changes made to uploaded files, but this requires a significant amount of database storage. You should probably leave this option |
533 enabled unless you have less than 250MB of MySQL database space.</p> |
540 enabled unless you have less than 250MB of MySQL database space.</p> |
534 <p><label><input type="checkbox" name="file_history" <?php if(getConfig('file_history')=='1' && is_writable(ENANO_ROOT.'/cache/')) echo 'checked="checked"'; ?> /> Keep a history of uploaded files</label></p> |
541 <p><label><input type="checkbox" name="file_history" <?php if(getConfig('file_history')=='1') echo 'checked="checked"'; ?> /> Keep a history of uploaded files</label></p> |
535 <hr style="margin-left: 1em;" /> |
542 <hr style="margin-left: 1em;" /> |
536 <p><input type="submit" name="save" value="Save changes" style="font-weight: bold;" /></p> |
543 <p><input type="submit" name="save" value="Save changes" style="font-weight: bold;" /></p> |
537 <?php |
544 <?php |
538 echo '</form>'; |
545 echo '</form>'; |
539 } |
546 } |
549 if(isset($_GET['action'])) |
556 if(isset($_GET['action'])) |
550 { |
557 { |
551 switch($_GET['action']) |
558 switch($_GET['action']) |
552 { |
559 { |
553 case "enable": |
560 case "enable": |
|
561 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES("security","plugin_enable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($_GET['plugin']) . '");'); |
|
562 if ( !$q ) |
|
563 $db->_die(); |
554 setConfig('plugin_'.$_GET['plugin'], '1'); |
564 setConfig('plugin_'.$_GET['plugin'], '1'); |
555 break; |
565 break; |
556 case "disable": |
566 case "disable": |
557 if ( defined('ENANO_DEMO_MODE') && strstr($_GET['plugin'], 'Demo') ) |
567 if ( defined('ENANO_DEMO_MODE') && strstr($_GET['plugin'], 'Demo') ) |
558 { |
568 { |
559 echo('<h3>Error disabling plugin</h3><p>The demo lockdown plugin cannot be disabled in demo mode.</p>'); |
569 echo('<h3>Error disabling plugin</h3><p>The demo lockdown plugin cannot be disabled in demo mode.</p>'); |
560 break; |
570 break; |
561 } |
571 } |
562 if ( !in_array($_GET['plugin'], $plugins->system_plugins) ) |
572 if ( !in_array($_GET['plugin'], $plugins->system_plugins) ) |
563 { |
573 { |
|
574 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author,page_text) VALUES("security","plugin_disable",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '","' . $db->escape($_GET['plugin']) . '");'); |
|
575 if ( !$q ) |
|
576 $db->_die(); |
564 setConfig('plugin_'.$_GET['plugin'], '0'); |
577 setConfig('plugin_'.$_GET['plugin'], '0'); |
565 } |
578 } |
566 else |
579 else |
567 { |
580 { |
568 echo('<h3>Error disabling plugin</h3><p>The plugin you selected cannot be disabled because it is a system plugin.</p>'); |
581 echo('<h3>Error disabling plugin</h3><p>The plugin you selected cannot be disabled because it is a system plugin.</p>'); |