diff --git a/var/www/html/admin.php b/var/www/html/admin.php index f4e001a..6da576e 100644 --- a/var/www/html/admin.php +++ b/var/www/html/admin.php @@ -11,28 +11,28 @@ if($_SERVER['REQUEST_METHOD']==='HEAD'){ exit; // headers sent, no further processing needed } echo ''; -echo 'Daniel\'s Hosting - Login'; +echo 'Daniel\'s Hosting - Admin panel'; echo ''; echo ''; echo ''; echo ''; echo '

Hosting - Admin panel

'; $error=false; -if($_SERVER['REQUEST_METHOD']==='POST' && isSet($_POST['pass']) && $_POST['pass']===ADMIN_PASSWORD){ +if($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['pass']) && $_POST['pass']===ADMIN_PASSWORD){ if(!($error=check_captcha_error())){ $_SESSION['logged_in']=true; $_SESSION['csrf_token']=sha1(uniqid()); } } if(empty($_SESSION['logged_in'])){ - echo "
"; + echo '
'; echo ""; send_captcha(); echo ""; echo '
Password
'; if($error){ echo "

$error

"; - }elseif(isSet($_POST['pass'])){ + }elseif(isset($_POST['pass'])){ echo "

Wrong password!

"; } echo '

If you disabled cookies, please re-enable them. You can\'t log in without!

'; @@ -41,54 +41,75 @@ if(empty($_SESSION['logged_in'])){ if(REQUIRE_APPROVAL){ $stmt=$db->query('SELECT COUNT(*) FROM new_account WHERE approved=0;'); $cnt=$stmt->fetch(PDO::FETCH_NUM)[0]; - echo "Approve pending sites ($cnt) | "; + echo 'Approve pending sites ($cnt) | "; } - echo "List of accounts | Delete accounts | Suspend hidden services | Edit hidden services | Logout

"; + echo 'List of accounts | Delete accounts | Suspend hidden services | Edit hidden services | Logout

'; if(empty($_REQUEST['action']) || $_REQUEST['action']==='login'){ echo '

Welcome to the admin panel!

'; - }elseif($_REQUEST['action']==='logout'){ + }elseif($_REQUEST['action'] === 'logout'){ session_destroy(); - header("Location: $_SERVER[SCRIPT_NAME]"); + header('Location: ' . basename(__FILE__)); exit; - }elseif($_REQUEST['action']==='list'){ + }elseif($_REQUEST['action'] === 'list'){ + echo '
"; echo ''; echo ''; $stmt=$db->query('SELECT users.username, onions.onion FROM users INNER JOIN onions ON (onions.user_id=users.id) ORDER BY users.username;'); + $sccounts = []; while($tmp=$stmt->fetch(PDO::FETCH_NUM)){ - echo ""; + $accounts[$tmp[0]] []= $tmp[1]; } - echo '
UsernameOnion linkAction
$tmp[0]$tmp[1].onion
'; - }elseif($_REQUEST['action']==='approve'){ - if(!empty($_POST['onion'])){ + foreach($accounts as $account => $onions){ + echo "$account"; + $first = true; + foreach($onions as $onion){ + if($first){ + $first = false; + }else{ + echo '
'; + } + echo "$onion.onion"; + } + echo ""; + } + echo ''; + }elseif(substr($_REQUEST['action'], 0, 7) === 'approve'){ + $onion = substr($_REQUEST['action'], 8); + if(!empty($onion)){ if($error=check_csrf_error()){ echo '

'.$error.'

'; }else{ $stmt=$db->prepare('UPDATE new_account INNER JOIN onions ON (onions.user_id=new_account.user_id) SET new_account.approved=1 WHERE onions.onion=?;'); - $stmt->execute([$_POST['onion']]); + $stmt->execute([$onion]); echo '

Successfully approved

'; } } + echo '
"; echo ''; echo ''; $stmt=$db->query('SELECT users.username, onions.onion FROM users INNER JOIN new_account ON (users.id=new_account.user_id) INNER JOIN onions ON (onions.user_id=users.id) WHERE new_account.approved=0 ORDER BY users.username;'); while($tmp=$stmt->fetch(PDO::FETCH_NUM)){ - echo ""; + echo ""; + } + echo '
UsernameOnion addressAction
$tmp[0]$tmp[1].onion
$tmp[0]$tmp[1].onion
'; + }elseif(substr($_REQUEST['action'], 0, 6) === 'delete'){ + $onion = ''; + if(isset($_POST['onion'])){ + $onion = $_POST['onion']; + }else{ + $onion = substr($_REQUEST['action'], 7); } - echo ''; - }elseif($_REQUEST['action']==='delete'){ echo '

Delete accouts:

'; - echo "
"; - echo ''; + echo ''; + echo ''; echo '

Onion address:

'; echo '

'; - if(!empty($_POST['onion'])){ + if(!empty($onion)){ if($error=check_csrf_error()){ echo '

'.$error.'

'; - }elseif(preg_match('~^([a-z2-7]{16}|[a-z2-7]{56})(\.onion)?$~', $_POST['onion'], $match)){ + }elseif(preg_match('~^([a-z2-7]{16}|[a-z2-7]{56})(\.onion)?$~', $onion, $match)){ $stmt=$db->prepare('SELECT user_id FROM onions WHERE onion=?;'); $stmt->execute([$match[1]]); if($user_id=$stmt->fetch(PDO::FETCH_NUM)){ @@ -102,20 +123,24 @@ if(empty($_SESSION['logged_in'])){ echo "

Invalid onion address!

"; } } - }elseif($_REQUEST['action']==='suspend'){ + }elseif(substr($_REQUEST['action'], 0, 7) === 'suspend'){ + $onion = ''; + if(isset($_POST['onion'])){ + $onion = $_POST['onion']; + }else{ + $onion = substr($_REQUEST['action'], 8); + } echo '

Suspend hidden service:

'; - echo "
"; + echo ''; echo ''; echo '

Onion address:

'; echo '

'; - if(!empty($_POST['onion'])){ + if(!empty($onion)){ if($error=check_csrf_error()){ echo '

'.$error.'

'; - }elseif(preg_match('~^([a-z2-7]{16}|[a-z2-7]{56})(\.onion)?$~', $_POST['onion'], $match)){ + }elseif(preg_match('~^([a-z2-7]{16}|[a-z2-7]{56})(\.onion)?$~', $onion, $match)){ $stmt=$db->prepare('SELECT null FROM onions WHERE onion=?;'); $stmt->execute([$match[1]]); if($stmt->fetch(PDO::FETCH_NUM)){ @@ -131,28 +156,32 @@ if(empty($_SESSION['logged_in'])){ echo "

Invalid onion address!

"; } } - }elseif(in_array($_REQUEST['action'], ['edit', 'edit_2'], true)){ + }elseif(substr($_REQUEST['action'], 0, 4) === 'edit'){ + $onion = ''; + if(isset($_POST['onion'])){ + $onion = $_POST['onion']; + }else{ + $onion = substr($_REQUEST['action'], 5); + } echo '

Edit hidden service:

'; - echo "
"; + echo ''; echo ''; echo '

Onion address:

'; echo '

'; - if(!empty($_POST['onion'])){ + if(!empty($onion)){ if($error=check_csrf_error()){ echo '

'.$error.'

'; - }elseif(preg_match('~^([a-z2-7]{16}|[a-z2-7]{56})(\.onion)?$~', $_POST['onion'], $match)){ - if($_REQUEST['action']==='edit_2'){ + }elseif(preg_match('~^([a-z2-7]{16}|[a-z2-7]{56})(\.onion)?$~', $onion, $match)){ + if(isset($_POST['num_intros'])){ $stmt=$db->prepare('SELECT version FROM onions WHERE onion=?;'); $stmt->execute([$match[1]]); if($onion=$stmt->fetch(PDO::FETCH_NUM)){ $stmt=$db->prepare('UPDATE onions SET enabled = ?, enable_smtp = ?, num_intros = ?, max_streams = ? WHERE onion=?;'); - $enabled = isset($_REQUEST['enabled']) ? 1 : 0; - $enable_smtp = isset($_REQUEST['enable_smtp']) ? 1 : 0; - $num_intros = intval($_REQUEST['num_intros']); + $enabled = isset($_POST['enabled']) ? 1 : 0; + $enable_smtp = isset($_POST['enable_smtp']) ? 1 : 0; + $num_intros = intval($_POST['num_intros']); if($num_intros<3){ $num_intros = 3; }elseif($onion[0]==2 && $num_intros>10){ @@ -160,7 +189,7 @@ if(empty($_SESSION['logged_in'])){ }elseif($num_intros>20){ $num_intros = 20; } - $max_streams = intval($_REQUEST['max_streams']); + $max_streams = intval($_POST['max_streams']); if($max_streams<0){ $max_streams = 0; }elseif($max_streams>65535){ @@ -175,7 +204,7 @@ if(empty($_SESSION['logged_in'])){ $stmt=$db->prepare('SELECT onion, enabled, enable_smtp, num_intros, max_streams, version FROM onions WHERE onion=?;'); $stmt->execute([$match[1]]); if($onion=$stmt->fetch(PDO::FETCH_NUM)){ - echo "
"; + echo ''; echo ''; echo ''; echo ''; @@ -187,7 +216,7 @@ if(empty($_SESSION['logged_in'])){ echo '>Enabled'; echo ''; echo ''; - echo ''; + echo ''; }else{ echo "

Onion address not hosted by us!

"; }
OnionEnabledSMTP enabledNr. of introsMax streams per rend circuitSave