432 lines
17 KiB
PHP
432 lines
17 KiB
PHP
|
<? /*
|
||
|
|
Copyright (C) 2004 by Duane Groth <duane_at_CAcert_dot_org>
|
||
|
|
|
||
|
|
This file is part of CAcert.
|
||
|
|
|
||
|
|
CAcert has been released under the CAcert Source License
|
||
|
|
which can be found included with these source files or can
|
||
|
|
be downloaded from the internet from the following address:
|
||
|
|
http://www.cacert.org/src-lic.php
|
||
|
|
|
||
|
|
CAcert is distributed WITHOUT ANY WARRANTY; without even
|
||
|
|
the implied warranty of MERCHANTABILITY or FITNESS FOR A
|
||
|
|
PARTICULAR PURPOSE. See the License for more details.
|
||
|
|
*/ ?>
|
||
|
|
<?
|
||
|
|
require_once("../includes/loggedin.php");
|
||
|
|
|
||
|
|
loadem("account");
|
||
|
|
|
||
|
|
if($type == "reallyemail")
|
||
|
|
{
|
||
|
|
$emailid = intval($_SESSION['_config']['emailid']);
|
||
|
|
$hash = mysql_escape_string(trim($_SESSION['_config']['hash']));
|
||
|
|
|
||
|
|
$res = mysql_query("select * from `disputeemail` where `id`='$emailid' and `hash`='$hash'");
|
||
|
|
if(mysql_num_rows($res) <= 0)
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo _("This dispute no longer seems to be in the database, can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
$row = mysql_fetch_assoc($res);
|
||
|
|
$oldmemid = $row['oldmemid'];
|
||
|
|
|
||
|
|
if($action == "reject")
|
||
|
|
{
|
||
|
|
mysql_query("update `disputeemail` set hash='',action='reject' where `id`='$emailid'");
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo _("You have opted to reject this dispute and the request will be removed from the database");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
if($action == "accept")
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo "<p>"._("You have opted to accept this dispute and the request will now remove this email address from the existing account, and revoke any current certificates.")."</p>";
|
||
|
|
echo "<p>"._("The following accounts have been removed:")."<br>\n";
|
||
|
|
$query = "select * from `email` where `id`='$emailid' and deleted=0";
|
||
|
|
$res = mysql_query($query);
|
||
|
|
if(mysql_num_rows($res) > 0)
|
||
|
|
{
|
||
|
|
$row = mysql_fetch_assoc($res);
|
||
|
|
echo $row['email']."<br>\n";
|
||
|
|
$query = "select `emailcerts`.`id`
|
||
|
|
from `emaillink`,`emailcerts` where
|
||
|
|
`emailid`='$emailid' and `emaillink`.`emailcertsid`=`emailcerts`.`id` and
|
||
|
|
`revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0
|
||
|
|
group by `emailcerts`.`id`";
|
||
|
|
$dres = mysql_query($query);
|
||
|
|
while($drow = mysql_fetch_assoc($dres))
|
||
|
|
mysql_query("update `emailcerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$drow['id']."'");
|
||
|
|
|
||
|
|
$do = `../scripts/runclient`;
|
||
|
|
$query = "update `email` set `deleted`=NOW() where `id`='$emailid'";
|
||
|
|
mysql_query($query);
|
||
|
|
}
|
||
|
|
mysql_query("update `disputeemail` set hash='',action='accept' where `id`='$emailid'");
|
||
|
|
$rc = mysql_num_rows("select * from `domains` where `memid`='$oldmemid' and `deleted`=0");
|
||
|
|
$rc = mysql_num_rows("select * from `email` where `memid`='$oldmemid' and `deleted`=0 and `id`!='$emailid'");
|
||
|
|
$res = mysql_query("select * from `users` where `id`='$oldmemid'");
|
||
|
|
$user = mysql_fetch_assoc($res);
|
||
|
|
if($rc == 0 && $rc2 == 0 && $_SESSION['_config']['email'] == $user['email'])
|
||
|
|
{
|
||
|
|
mysql_query("update `users` set `deleted`=NOW() where `id`='$oldmemid'");
|
||
|
|
echo _("This was the primary email on the account, and no emails or domains were left linked so the account has also been removed from the system.");
|
||
|
|
}
|
||
|
|
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if($type == "email")
|
||
|
|
{
|
||
|
|
$emailid = intval($emailid);
|
||
|
|
$hash = trim(mysql_escape_string(stripslashes($hash)));
|
||
|
|
if($emailid <= 0 || $hash == "")
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo _("Invalid request. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$res = mysql_query("select * from `disputeemail` where `id`='$emailid' and `hash`='$hash'");
|
||
|
|
if(mysql_num_rows($res) <= 0)
|
||
|
|
{
|
||
|
|
$res = mysql_query("select * from `disputeemail` where `id`='$emailid' and hash!=''");
|
||
|
|
if(mysql_num_rows($res) > 0)
|
||
|
|
{
|
||
|
|
$row = mysql_fetch_assoc($res);
|
||
|
|
mysql_query("update `disputeemail` set `attempts`='".intval($row['attempts'] + 1)."' where `id`='".$row['id']."'");
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
if($row['attempts'] >= 3)
|
||
|
|
{
|
||
|
|
echo _("Your attempt to accept or reject a disputed email is invalid due to the hash string not matching with the email ID. Your attempt has been logged and the request will be removed from the system as a result.");
|
||
|
|
mysql_query("update `disputeemail` set hash='',action='failed' where `id`='$emailid'");
|
||
|
|
} else
|
||
|
|
echo _("Your attempt to accept or reject a disputed email is invalid due to the hash string not matching with the email ID.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
} else {
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo _("Invalid request. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
$_SESSION['_config']['emailid'] = $emailid;
|
||
|
|
$_SESSION['_config']['hash'] = $hash;
|
||
|
|
$row = mysql_fetch_assoc(mysql_query("select * from `disputeemail` where `id`='$emailid'"));
|
||
|
|
$_SESSION['_config']['email'] = $row['email'];
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
includeit("4", "disputes");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
if($type == "reallydomain")
|
||
|
|
{
|
||
|
|
$domainid = intval($_SESSION['_config']['domainid']);
|
||
|
|
$hash = mysql_escape_string(trim($_SESSION['_config']['hash']));
|
||
|
|
|
||
|
|
$res = mysql_query("select * from `disputedomain` where `id`='$domainid' and `hash`='$hash'");
|
||
|
|
if(mysql_num_rows($res) <= 0)
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
echo _("This dispute no longer seems to be in the database, can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
if($action == "reject")
|
||
|
|
{
|
||
|
|
mysql_query("update `disputedomain` set hash='',action='reject' where `id`='$domainid'");
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
echo _("You have opted to reject this dispute and the request will be removed from the database");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
if($action == "accept")
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
echo "<p>"._("You have opted to accept this dispute and the request will now remove this domain from the existing account, and revoke any current certificates.")."</p>";
|
||
|
|
echo "<p>"._("The following accounts have been removed:")."<br>\n";
|
||
|
|
$query = "select * from `domains` where `id`='$domainid' and deleted=0";
|
||
|
|
$res = mysql_query($query);
|
||
|
|
if(mysql_num_rows($res) > 0)
|
||
|
|
{
|
||
|
|
echo $_SESSION['_config']['domain']."<br>\n";
|
||
|
|
mysql_query("update `domains` set `deleted`=NOW() where `id`='$domainid'");
|
||
|
|
$query = "select * from `domlink` where `domid`='$domainid'";
|
||
|
|
$res = mysql_query($query);
|
||
|
|
while($row = mysql_fetch_assoc($res))
|
||
|
|
mysql_query("update `domaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$row['certid']."' and `revoked`=0 and UNIX_TIMESTAMP(`expire`)-UNIX_TIMESTAMP() > 0");
|
||
|
|
$do = `../scripts/runserver`;
|
||
|
|
}
|
||
|
|
mysql_query("update `disputedomain` set hash='',action='accept' where `id`='$domainid'");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if($type == "domain")
|
||
|
|
{
|
||
|
|
$domainid = intval($domainid);
|
||
|
|
$hash = trim(mysql_escape_string(stripslashes($hash)));
|
||
|
|
if($domainid <= 0 || $hash == "")
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
echo _("Invalid request. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$res = mysql_query("select * from `disputedomain` where `id`='$domainid' and `hash`='$hash'");
|
||
|
|
if(mysql_num_rows($res) <= 0)
|
||
|
|
{
|
||
|
|
$res = mysql_query("select * from `disputedomain` where `id`='$domainid' and hash!=''");
|
||
|
|
if(mysql_num_rows($res) > 0)
|
||
|
|
{
|
||
|
|
$row = mysql_fetch_assoc($res);
|
||
|
|
mysql_query("update `disputedomain` set `attempts`='".intval($row['attempts'] + 1)."' where `id`='".$row['id']."'");
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
if($row['attempts'] >= 3)
|
||
|
|
{
|
||
|
|
echo _("Your attempt to accept or reject a disputed domain is invalid due to the hash string not matching with the domain ID. Your attempt has been logged and the request will be removed from the system as a result.");
|
||
|
|
mysql_query("update `disputedomain` set hash='',action='failed' where `id`='$domainid'");
|
||
|
|
} else
|
||
|
|
echo _("Your attempt to accept or reject a disputed domain is invalid due to the hash string not matching with the domain ID.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
} else {
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
echo _("Invalid request. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
$_SESSION['_config']['domainid'] = $domainid;
|
||
|
|
$_SESSION['_config']['hash'] = $hash;
|
||
|
|
$row = mysql_fetch_assoc(mysql_query("select * from `disputedomain` where `id`='$domainid'"));
|
||
|
|
$_SESSION['_config']['domain'] = $row['domain'];
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
includeit("6", "disputes");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
if($oldid == "1")
|
||
|
|
{
|
||
|
|
$email = trim(mysql_escape_string(stripslashes($dispute)));
|
||
|
|
if($email == "")
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo _("Not a valid email address. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$res = mysql_query("select * from `disputeemail` where `email`='$email' and hash!=''");
|
||
|
|
if(mysql_num_rows($res) > 0)
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
printf(_("The email address '%s' already exists in the dispute system. Can't continue."), $email);
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
unset($oldid);
|
||
|
|
$query = "select * from `email` where `email`='$email' and `deleted`=0";
|
||
|
|
$res = mysql_query($query);
|
||
|
|
if(mysql_num_rows($res) <= 0)
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
printf(_("The email address '%s' doesn't already in the system. Can't continue."), $email);
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
$row = mysql_fetch_assoc($res);
|
||
|
|
$oldmemid = $row['memid'];
|
||
|
|
$emailid = $row['id'];
|
||
|
|
if($_SESSION['profile']['id'] == $oldmemid)
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo _("You aren't allowed to dispute your own email addresses. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$res = mysql_query("select * from `users` where `id`='$oldmemid'");
|
||
|
|
$user = mysql_fetch_assoc($res);
|
||
|
|
$rc = mysql_num_rows("select * from `domains` where `memid`='$oldmemid' and `deleted`=0");
|
||
|
|
$rc = mysql_num_rows("select * from `email` where `memid`='$oldmemid' and `deleted`=0 and `id`!='$emailid'");
|
||
|
|
if($user['email'] == $email && ($rc > 0 || $rc2 > 0))
|
||
|
|
{
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
echo _("You only dispute the primary email address of an account if there is no longer any email addresses or domains linked to it.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$rnd = fopen("/dev/urandom", "r");
|
||
|
|
$hash = md5(fgets($rnd, 64));
|
||
|
|
fclose($rnd);
|
||
|
|
$query = "insert into `disputeemail` set `email`='$email',`memid`='".$_SESSION['profile']['id']."',
|
||
|
|
`oldmemid`='$oldmemid',`created`=NOW(),`hash`='$hash',`id`='$emailid',
|
||
|
|
`IP`='".$_SERVER['REMOTE_ADDR']."'";
|
||
|
|
mysql_query($query);
|
||
|
|
|
||
|
|
$body = sprintf(_("You have been sent this email as the email address '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $email)."\n\n";
|
||
|
|
$body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=email&emailid=$emailid&hash=$hash\n\n";
|
||
|
|
$body .= _("Best regards")."\n"._("CAcert.org Support!");
|
||
|
|
|
||
|
|
sendmail($email, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "returns@cacert.org", "", "CAcert Support");
|
||
|
|
|
||
|
|
showheader(_("Email Dispute"));
|
||
|
|
printf(_("The email address '%s' has been entered into the dispute system, the email address will now be sent an email which will give the recipent the option of accepting or rejecting the request, if after 2 days we haven't received a valid response for or against we will discard the request."), $email);
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
if($oldid == "2")
|
||
|
|
{
|
||
|
|
$domain = trim(mysql_escape_string(stripslashes($dispute)));
|
||
|
|
if($domain == "")
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
echo _("Not a valid Domain. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$query = "select * from `disputedomain` where `domain`='$domain' and hash!=''";
|
||
|
|
$res = mysql_query($query);
|
||
|
|
if(mysql_num_rows($res) > 0)
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
printf(_("The domain '%s' already exists in the dispute system. Can't continue."), $domain);
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
unset($oldid);
|
||
|
|
$query = "select * from `domains` where `domain`='$domain' and `deleted`=0";
|
||
|
|
$res = mysql_query($query);
|
||
|
|
if(mysql_num_rows($res) <= 0)
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
printf(_("The domain '%s' doesn't already in the system. Can't continue."), $email);
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
$row = mysql_fetch_assoc($res);
|
||
|
|
$oldmemid = $row['memid'];
|
||
|
|
if($_SESSION['profile']['id'] == $oldmemid)
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
echo _("You aren't allowed to dispute your own email addresses. Can't continue.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$domainid = $row['id'];
|
||
|
|
$_SESSION['_config']['domainid'] = $domainid;
|
||
|
|
$_SESSION['_config']['memid'] = $memid;
|
||
|
|
$_SESSION['_config']['domain'] = $domain;
|
||
|
|
$_SESSION['_config']['oldmemid'] = $oldmemid;
|
||
|
|
|
||
|
|
$addy = array();
|
||
|
|
$domtmp = escapeshellarg($domain);
|
||
|
|
$adds = explode("\n", trim(`whois $domtmp|grep \@`));
|
||
|
|
if(substr($domain, -4) == ".org" || substr($domain, -5) == ".info")
|
||
|
|
{
|
||
|
|
if(is_array($adds))
|
||
|
|
foreach($adds as $line)
|
||
|
|
{
|
||
|
|
$bits = explode(":", $line, 2);
|
||
|
|
$line = trim($bits[1]);
|
||
|
|
if(!in_array($line, $addy) && $line != "")
|
||
|
|
$addy[] = trim(mysql_escape_string(stripslashes($line)));
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
if(is_array($adds))
|
||
|
|
foreach($adds as $line)
|
||
|
|
{
|
||
|
|
$line = trim(str_replace("\t", " ", $line));
|
||
|
|
$line = trim(str_replace("(", "", $line));
|
||
|
|
$line = trim(str_replace(")", " ", $line));
|
||
|
|
|
||
|
|
$bits = explode(" ", $line);
|
||
|
|
foreach($bits as $bit)
|
||
|
|
{
|
||
|
|
if(strstr($bit, "@"))
|
||
|
|
$line = $bit;
|
||
|
|
}
|
||
|
|
if(!in_array($line, $addy) && $line != "")
|
||
|
|
$addy[] = trim(mysql_escape_string(stripslashes($line)));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
$rfc = array("root@$domain", "hostmaster@$domain", "postmaster@$domain", "admin@$domain", "webmaster@$domain");
|
||
|
|
foreach($rfc as $sub)
|
||
|
|
if(!in_array($sub, $addy))
|
||
|
|
$addy[] = $sub;
|
||
|
|
$_SESSION['_config']['addy'] = $addy;
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
includeit("5", "disputes");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
if($oldid == "5")
|
||
|
|
{
|
||
|
|
$authaddy = trim(mysql_escape_string(stripslashes($_POST['authaddy'])));
|
||
|
|
|
||
|
|
if(!in_array($authaddy, $_SESSION['_config']['addy']) || $authaddy == "")
|
||
|
|
{
|
||
|
|
showheader(_("My CAcert.org Account!"));
|
||
|
|
echo _("The address you submitted isn't a valid authority address for the domain.");
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$query = "select * from `domains` where `domain`='".$_SESSION['_config']['domain']."' and `deleted`=0";
|
||
|
|
$res = mysql_query($query);
|
||
|
|
if(mysql_num_rows($res) <= 0)
|
||
|
|
{
|
||
|
|
showheader(_("Domain Dispute!"));
|
||
|
|
printf(_("The domain '%s' isn't in the system. Can't continue."), $_SESSION['_config']['domain']);
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$domainid = intval($_SESSION['_config']['domainid']);
|
||
|
|
$memid = intval($_SESSION['_config']['memid']);
|
||
|
|
$oldmemid = intval($_SESSION['_config']['oldmemid']);
|
||
|
|
$domain = mysql_escape_string($_SESSION['_config']['domain']);
|
||
|
|
$rnd = fopen("/dev/urandom", "r");
|
||
|
|
$hash = md5(fgets($rnd, 64));
|
||
|
|
fclose($rnd);
|
||
|
|
$query = "insert into `disputedomain` set `domain`='$domain',`memid`='".$_SESSION['profile']['id']."',
|
||
|
|
`oldmemid`='$oldmemid',`created`=NOW(),`hash`='$hash',`id`='$domainid'";
|
||
|
|
mysql_query($query);
|
||
|
|
|
||
|
|
$body = sprintf(_("You have been sent this email as the domain '%s' is being disputed. You have the option to accept or reject this request, after 2 days the request will automatically be discarded. Click the following link to accept or reject the dispute:"), $domain)."\n\n";
|
||
|
|
$body .= "https://".$_SESSION['_config']['normalhostname']."/disputes.php?type=domain&domainid=$domainid&hash=$hash\n\n";
|
||
|
|
$body .= _("Best regards")."\n"._("CAcert.org Support!");
|
||
|
|
|
||
|
|
sendmail($authaddy, "[CAcert.org] "._("Dispute Probe"), $body, "support@cacert.org", "returns@cacert.org", "", "CAcert Support");
|
||
|
|
|
||
|
|
showheader(_("Domain Dispute"));
|
||
|
|
printf(_("The domain '%s' has been entered into the dispute system, the email address you choose will now be sent an email which will give the recipent the option of accepting or rejecting the request, if after 2 days we haven't received a valid response for or against we will discard the request."), $domain);
|
||
|
|
showfooter();
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
showheader(_("Domain and Email Disputes"));
|
||
|
|
includeit($id, "disputes");
|
||
|
|
showfooter();
|
||
|
|
?>
|