|
1 <?php |
|
2 |
|
3 /* |
|
4 * Enano - an open-source CMS capable of wiki functions, Drupal-like sidebar blocks, and everything in between |
|
5 * Version 1.0.1 (Loch Ness) |
|
6 * Copyright (C) 2006-2007 Dan Fuhry |
|
7 * |
|
8 * This program is Free Software; you can redistribute and/or modify it under the terms of the GNU General Public License |
|
9 * as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. |
|
10 * |
|
11 * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied |
|
12 * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details. |
|
13 */ |
|
14 |
|
15 function page_Admin_SecurityLog() |
|
16 { |
|
17 global $db, $session, $paths, $template, $plugins; // Common objects |
|
18 if ( $session->auth_level < USER_LEVEL_ADMIN || $session->user_level < USER_LEVEL_ADMIN ) |
|
19 { |
|
20 echo '<h3>Error: Not authenticated</h3><p>It looks like your administration session is invalid or you are not authorized to access this administration page. Please <a href="' . makeUrlNS('Special', 'Login/' . $paths->nslist['Special'] . 'Administration', 'level=' . USER_LEVEL_ADMIN, true) . '">re-authenticate</a> to continue.</p>'; |
|
21 return; |
|
22 } |
|
23 |
|
24 if ( defined('ENANO_DEMO_MODE') ) |
|
25 { |
|
26 die('Security log is disabled in demo mode.'); |
|
27 } |
|
28 |
|
29 echo '<h3>System security log</h3>'; |
|
30 |
|
31 // Not calling the real fetcher because we have to paginate the results |
|
32 $offset = ( isset($_GET['offset']) ) ? intval($_GET['offset']) : 0; |
|
33 $q = $db->sql_query('SELECT COUNT(time_id) as num FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;'); |
|
34 if ( !$q ) |
|
35 $db->_die(); |
|
36 $row = $db->fetchrow(); |
|
37 $db->free_result(); |
|
38 $count = intval($row['num']); |
|
39 $q = $db->sql_unbuffered_query('SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;'); |
|
40 if ( !$q ) |
|
41 $db->_die(); |
|
42 |
|
43 $html = paginate( |
|
44 $q, |
|
45 '{time_id}', |
|
46 $count, |
|
47 makeUrlNS('Special', 'Administration', 'module=' . $paths->nslist['Admin'] . 'SecurityLog&offset=%s'), |
|
48 $offset, |
|
49 50, |
|
50 array('time_id' => 'seclog_format_inner'), |
|
51 '<div class="tblholder" style="/* max-height: 500px; clip: rect(0px,auto,auto,0px); overflow: auto; */"><table border="0" cellspacing="1" cellpadding="4" width="100%"> |
|
52 <tr><th style="width: 60%;">Type</th><th>Date</th><th>Username</th><th>IP Address</th></tr>', |
|
53 '</table></div>' |
|
54 ); |
|
55 |
|
56 echo $html; |
|
57 |
|
58 } |
|
59 |
|
60 function get_security_log($num = false) |
|
61 { |
|
62 global $db, $session, $paths, $template, $plugins; // Common objects |
|
63 if ( $session->auth_level < USER_LEVEL_ADMIN ) |
|
64 { |
|
65 $q = $db->sql_query('INSERT INTO '.table_prefix.'logs(log_type,action,time_id,edit_summary,author) VALUES("security","seclog_unauth",UNIX_TIMESTAMP(),"' . $db->escape($_SERVER['REMOTE_ADDR']) . '","' . $db->escape($session->username) . '");'); |
|
66 if ( !$q ) |
|
67 $db->_die(); |
|
68 die('Security log: unauthorized attempt to fetch. Call has been logged and reported to the administrators.'); |
|
69 } |
|
70 |
|
71 $return = '<div class="tblholder" style="/* max-height: 500px; clip: rect(0px,auto,auto,0px); overflow: auto; */"><table border="0" cellspacing="1" cellpadding="4" width="100%">'; |
|
72 $cls = 'row2'; |
|
73 $return .= '<tr><th style="width: 60%;">Type</th><th>Date</th><th>Username</th><th>IP Address</th></tr>'; |
|
74 $hash = sha1(microtime()); |
|
75 if ( defined('ENANO_DEMO_MODE') ) |
|
76 { |
|
77 require('config.php'); |
|
78 $hash = md5($dbpasswd); |
|
79 unset($dbname, $dbhost, $dbuser, $dbpasswd); |
|
80 unset($dbname, $dbhost, $dbuser, $dbpasswd); // PHP5 Zend bug |
|
81 } |
|
82 if ( defined('ENANO_DEMO_MODE') && !isset($_GET[ $hash ]) && substr($_SERVER['REMOTE_ADDR'], 0, 8) != '192.168.' ) |
|
83 { |
|
84 $return .= '<tr><td class="row1" colspan="4">Logs are recorded but not displayed for privacy purposes in the demo.</td></tr>'; |
|
85 } |
|
86 else |
|
87 { |
|
88 if(is_int($num)) |
|
89 { |
|
90 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC LIMIT '.$num.';'; |
|
91 } |
|
92 else |
|
93 { |
|
94 $l = 'SELECT action,date_string,author,edit_summary,time_id,page_text FROM '.table_prefix.'logs WHERE log_type=\'security\' ORDER BY time_id DESC, action ASC;'; |
|
95 } |
|
96 $q = $db->sql_query($l); |
|
97 while($r = $db->fetchrow()) |
|
98 { |
|
99 $return .= seclog_format_inner($r); |
|
100 } |
|
101 $db->free_result(); |
|
102 } |
|
103 $return .= '</table></div>'; |
|
104 |
|
105 return $return; |
|
106 } |
|
107 |
|
108 function seclog_format_inner($r, $f = false) |
|
109 { |
|
110 if ( is_array($f) ) |
|
111 { |
|
112 unset($r); |
|
113 $r =& $f; |
|
114 } |
|
115 global $db, $session, $paths, $template, $plugins; // Common objects |
|
116 $return = ''; |
|
117 static $cls = 'row2'; |
|
118 if ( $r['action'] == 'illegal_page' ) |
|
119 { |
|
120 list($illegal_id, $illegal_ns) = unserialize($r['page_text']); |
|
121 $url = makeUrlNS($illegal_ns, $illegal_id, false, true); |
|
122 $title = get_page_title_ns($illegal_id, $illegal_ns); |
|
123 $class = ( isPage($paths->nslist[$illegal_ns] . $illegal_id) ) ? '' : ' class="wikilink-nonexistent"'; |
|
124 $illegal_link = '<a href="' . $url . '"' . $class . ' onclick="window.open(this.href); return false;">' . $title . '</a>'; |
|
125 } |
|
126 else if ( $r['action'] == 'plugin_enable' || $r['action'] == 'plugin_disable' ) |
|
127 { |
|
128 $row['page_text'] = htmlspecialchars($row['page_text']); |
|
129 } |
|
130 $cls = ( $cls == 'row2' ) ? 'row1' : 'row2'; |
|
131 $return .= '<tr><td class="'.$cls.'">'; |
|
132 switch($r['action']) |
|
133 { |
|
134 case "admin_auth_good": $return .= 'Successful elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); $return .= "<br /><small>Authentication level: $level</small>"; } break; |
|
135 case "admin_auth_bad": $return .= 'Failed elevated authentication'; if ( !empty($r['page_text']) ) { $level = $session->userlevel_to_string( intval($r['page_text']) ); $return .= "<br /><small>Attempted auth level: $level</small>"; } break; |
|
136 case "activ_good": $return .= 'Successful account activation'; break; |
|
137 case "auth_good": $return .= 'Successful regular user logon'; break; |
|
138 case "activ_bad": $return .= 'Failed account activation'; break; |
|
139 case "auth_bad": $return .= 'Failed regular user logon'; break; |
|
140 case "sql_inject": $return .= 'SQL injection attempt<div style="max-width: 90%; clip: rect(0px,auto,auto,0px); overflow: auto; display: block; font-size: smaller;">Offending query: ' . htmlspecialchars($r['page_text']) . '</div>'; break; |
|
141 case "db_backup": $return .= 'Database backup created<br /><small>Tables: ' . $r['page_text'] . '</small>'; break; |
|
142 case "install_enano": $return .= "Installed Enano version {$r['page_text']}"; break; |
|
143 case "upgrade_enano": $return .= "Upgraded Enano to version {$r['page_text']}"; break; |
|
144 case "illegal_page": $return .= "Unauthorized viewing attempt<br /><small>Page: {$illegal_link}</small>"; break; |
|
145 case "upload_enable": $return .= "Enabled file uploads"; break; |
|
146 case "upload_disable": $return .= "Disabled file uploads"; break; |
|
147 case "magick_enable": $return .= "Enabled ImageMagick for uploaded images"; break; |
|
148 case "magick_disable": $return .= "Disabled ImageMagick for uploaded images"; break; |
|
149 case "filehist_enable": $return .= "Enabled revision tracking for uploaded files"; break; |
|
150 case "filehist_disable": $return .= "Disabled revision tracking for uploaded files"; break; |
|
151 case "magick_path": $return .= "Changed path to ImageMagick executable"; break; |
|
152 case "plugin_disable": $return .= "Disabled plugin: {$r['page_text']}"; break; |
|
153 case "plugin_enable": $return .= "Enabled plugin: {$r['page_text']}"; break; |
|
154 case "seclog_unauth": $return .= "Unauthorized attempt to call security log fetcher"; break; |
|
155 } |
|
156 $return .= '</td><td class="'.$cls.'">'.date('d M Y h:i a', $r['time_id']).'</td><td class="'.$cls.'">'.$r['author'].'</td><td class="'.$cls.'" style="cursor: pointer;" onclick="ajaxReverseDNS(this);" title="Click for reverse DNS info">'.$r['edit_summary'].'</td></tr>'; |
|
157 return $return; |
|
158 } |
|
159 |
|
160 ?> |