@ -10,7 +10,7 @@
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
@ -82,7 +82,7 @@
if($checkemail != "OK")
{
showheader(_("My CAcert.org Account!"));
if (substr($checkemail, 0, 1) == "4")
if (substr($checkemail, 0, 1) == "4")
{
echo "< p > "._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."< / p > \n";
} else {
@ -149,8 +149,13 @@
$delcount = 0;
if(array_key_exists('delid',$_REQUEST) & & is_array($_REQUEST['delid']))
{
$deltitle=false;
foreach($_REQUEST['delid'] as $id)
{
if (!$deltitle) {
echo _('The following email addresses have been removed:')."< br > \n";
$deltitle=true;
}
$id = intval($id);
$query = "select * from `email` where `id`='$id' and `memid`='".intval($_SESSION['profile']['id'])."' and
`email`!='".$_SESSION['profile']['email']."'";
@ -168,11 +173,9 @@
{
echo _("You did not select any email accounts for removal.");
}
if($delcount > 0 )
if(0 == $delcount)
{
echo _("The following accounts have been removed:")."< br > \n";
} else {
echo _("You failed to select any accounts to be removed, or you attempted to remove the default account. No action was taken.");
echo _("You did not select any accounts to be removed, or you attempted to remove the default account. No action was taken.");
}
showfooter();
@ -317,11 +320,11 @@
showfooter();
exit;
}
write_user_agreement(intval($_SESSION['profile']['id']), "CCA", "certificate creation", "", 1);
$query = "insert into emailcerts set
`CN`='$defaultemail',
`CN`='$defaultemail',
`keytype`='NS',
`memid`='".intval($_SESSION['profile']['id'])."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
@ -352,7 +355,7 @@
} else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype'] == "VI") {
if($csr == "")
$csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."\n-----END CERTIFICATE REQUEST-----\n";
if (($weakKey = checkWeakKeyCSR($csr)) !== "")
{
$id = 4;
@ -361,7 +364,7 @@
showfooter();
exit;
}
$tmpfname = tempnam("/tmp", "id4CSR");
$fp = fopen($tmpfname, "w");
fputs($fp, $csr);
@ -420,8 +423,8 @@
showfooter();
exit;
}
$query = "insert into emailcerts set
`CN`='$defaultemail',
$query = "insert into emailcerts set
`CN`='$defaultemail',
`keytype`='".sanitizeHTML($_REQUEST['keytype'])."',
`memid`='".$_SESSION['profile']['id']."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
@ -581,7 +584,7 @@
{
showheader(_("My CAcert.org Account!"));
//echo "< p > "._("Email Address given was invalid, or a test connection couldn't be made to your server, or the server rejected the email address as invalid")."< / p > \n";
if (substr($checkemail, 0, 1) == "4")
if (substr($checkemail, 0, 1) == "4")
{
echo "< p > "._("The mail server responsible for your domain indicated a temporary failure. This may be due to anti-SPAM measures, such as greylisting. Please try again in a few minutes.")."< / p > \n";
} else {
@ -658,7 +661,7 @@
// In case the CSR is missing the ---BEGIN lines, add them automatically:
$CSR = "-----BEGIN CERTIFICATE REQUEST-----\n".$CSR."\n-----END CERTIFICATE REQUEST-----\n";
}
if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
{
showheader(_("My CAcert.org Account!"));
@ -666,7 +669,7 @@
showfooter();
exit;
}
if(trim($_REQUEST['description']) != ""){
$_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
}else{
@ -717,7 +720,7 @@
showfooter();
exit;
}
if (($weakKey = checkWeakKeyCSR(file_get_contents(
$_SESSION['_config']['tmpfname']))) !== "")
{
@ -726,7 +729,7 @@
showfooter();
exit;
}
$id = 11;
if($_SESSION['_config']['0.CN'] == "" & & $_SESSION['_config']['0.subjectAltName'] == "")
{
@ -772,14 +775,14 @@
if(array_key_exists('0',$_SESSION['_config']['rowid']) & & $_SESSION['_config']['rowid']['0'] > 0)
{
$query = "insert into `domaincerts` set
$query = "insert into `domaincerts` set
`CN`='".mysql_real_escape_string($_SESSION['_config']['rows']['0'])."',
`domid`='".mysql_real_escape_string($_SESSION['_config']['rowid']['0'])."',
`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
`rootcert`='".mysql_real_escape_string($_SESSION['_config']['rootcert'])."',
`description`='".$_SESSION['_config']['description']."'";
} elseif(array_key_exists('0',$_SESSION['_config']['altid']) & & $_SESSION['_config']['altid']['0'] > 0) {
$query = "insert into `domaincerts` set
$query = "insert into `domaincerts` set
`CN`='".mysql_real_escape_string($_SESSION['_config']['altrows']['0'])."',
`domid`='".mysql_real_escape_string($_SESSION['_config']['altid']['0'])."',
`created`=NOW(),`subject`='".mysql_real_escape_string($subject)."',
@ -846,24 +849,24 @@
printf(_("Invalid ID '%s' presented, can't do anything with it.")."< br / > \n", $id);
continue;
}
$row = mysql_fetch_assoc($res);
if (($weakKey = checkWeakKeyX509(file_get_contents(
$row['crt_name']))) !== "")
{
echo $weakKey, "< br / > \n";
continue;
}
mysql_query("update `domaincerts` set `renewed`='1' where `id`='$id'");
$query = "insert into `domaincerts` set
`domid`='".$row['domid']."',
$query = "insert into `domaincerts` set
`domid`='".$row['domid']."',
`CN`='".mysql_real_escape_string($row['CN'])."',
`subject`='".mysql_real_escape_string($row['subject'])."',".
//`csr_name`='".$row['csr_name']."', // RACE CONDITION
"`created`='".$row['created']."',
`modified`=NOW(),
`modified`=NOW(),
`rootcert`='".$row['rootcert']."',
`type`='".$row['type']."',
`pkhash`='".$row['pkhash']."',
@ -948,7 +951,7 @@
foreach($_REQUEST['revokeid'] as $id)
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`revoked`) as `revoke` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
`domains`.`memid`='".$_SESSION['profile']['id']."'";
@ -979,7 +982,7 @@
foreach($_REQUEST['delid'] as $id)
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains`
$query = "select *,UNIX_TIMESTAMP(`domaincerts`.`expire`) as `expired` from `domaincerts`,`domains`
where `domaincerts`.`id`='$id' and
`domaincerts`.`domid`=`domains`.`id` and
`domains`.`memid`='".$_SESSION['profile']['id']."'";
@ -1032,7 +1035,7 @@
foreach($_REQUEST['revokeid'] as $id)
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
$res = mysql_query($query);
if(mysql_num_rows($res) < = 0)
@ -1040,24 +1043,24 @@
printf(_("Invalid ID '%s' presented, can't do anything with it.")."< br > \n", $id);
continue;
}
$row = mysql_fetch_assoc($res);
if (($weakKey = checkWeakKeyX509(file_get_contents(
$row['crt_name']))) !== "")
{
echo $weakKey, "< br / > \n";
continue;
}
mysql_query("update `emailcerts` set `renewed`='1' where `id`='$id'");
$query = "insert into emailcerts set
`memid`='".$row['memid']."',
$query = "insert into emailcerts set
`memid`='".$row['memid']."',
`CN`='".mysql_real_escape_string($row['CN'])."',
`subject`='".mysql_real_escape_string($row['subject'])."',
`keytype`='".$row['keytype']."',
`csr_name`='".$row['csr_name']."',
`created`='".$row['created']."',
`keytype`='".$row['keytype']."',
`csr_name`='".$row['csr_name']."',
`created`='".$row['created']."',
`modified`=NOW(),
`disablelogin`='".$row['disablelogin']."',
`codesign`='".$row['codesign']."',
@ -1106,7 +1109,7 @@
foreach($_REQUEST['revokeid'] as $id)
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
$query = "select *,UNIX_TIMESTAMP(`revoked`) as `revoke` from `emailcerts`
where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
$res = mysql_query($query);
if(mysql_num_rows($res) < = 0)
@ -1135,7 +1138,7 @@
foreach($_REQUEST['delid'] as $id)
{
$id = intval($id);
$query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts`
$query = "select *,UNIX_TIMESTAMP(`expire`) as `expired` from `emailcerts`
where `id`='$id' and `memid`='".$_SESSION['profile']['id']."'";
$res = mysql_query($query);
if(mysql_num_rows($res) < = 0)
@ -1271,7 +1274,7 @@
$ddres = mysql_query($ddquery);
$ddrow = mysql_fetch_assoc($ddres);
$_SESSION['profile']['points'] = $ddrow['total'];
if($_SESSION['profile']['points'] == 0)
{
$_SESSION['_config']['user']['fname'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['fname']))));
@ -1323,7 +1326,7 @@
where `id`='".$_SESSION['profile']['id']."'";
mysql_query($query);
//!!!Should be rewritten
//!!!Should be rewritten
$_SESSION['_config']['user']['otphash'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otphash']))));
$_SESSION['_config']['user']['otppin'] = trim(mysql_real_escape_string(stripslashes(strip_tags($_REQUEST['otppin']))));
if($_SESSION['_config']['user']['otphash'] != "" & & $_SESSION['_config']['user']['otppin'] != "")
@ -1534,9 +1537,9 @@
showfooter();
exit;
}
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
`keytype`='NS',
`orgid`='".$org['orgid']."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
@ -1566,7 +1569,7 @@
mysql_query("update `orgemailcerts` set `csr_name`='$CSRname' where `id`='$emailid'");
} else if($_REQUEST['keytype'] == "MS" || $_REQUEST['keytype']=="VI") {
$csr = "-----BEGIN CERTIFICATE REQUEST-----\n".clean_csr($_REQUEST['CSR'])."-----END CERTIFICATE REQUEST-----\n";
if (($weakKey = checkWeakKeyCSR($csr)) !== "")
{
$id = 17;
@ -1575,7 +1578,7 @@
showfooter();
exit;
}
$tmpfname = tempnam("/tmp", "id17CSR");
$fp = fopen($tmpfname, "w");
fputs($fp, $csr);
@ -1625,8 +1628,8 @@
if($_SESSION['_config']['rootcert'] < 1 | | $ _SESSION [ ' _config ' ] [ ' rootcert ' ] > 2)
$_SESSION['_config']['rootcert'] = 1;
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
$query = "insert into `orgemailcerts` set
`CN`='$defaultemail',
`keytype`='" . sanitizeHTML($_REQUEST['keytype']) . "',
`orgid`='".$org['orgid']."',
`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
@ -1683,29 +1686,29 @@
printf(_("Invalid ID '%s' presented, can't do anything with it.")."< br > \n", $id);
continue;
}
$row = mysql_fetch_assoc($res);
if (($weakKey = checkWeakKeyX509(file_get_contents(
$row['crt_name']))) !== "")
{
echo $weakKey, "< br / > \n";
continue;
}
mysql_query("update `orgemailcerts` set `renewed`='1' where `id`='$id'");
if($row['revoke'] > 0)
{
printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."< br > \n", $row['CN']);
continue;
}
$query = "insert into `orgemailcerts` set
`orgid`='".$row['orgid']."',
$query = "insert into `orgemailcerts` set
`orgid`='".$row['orgid']."',
`CN`='".$row['CN']."',
`subject`='".$row['subject']."',
`keytype`='".$row['keytype']."',
`csr_name`='".$row['csr_name']."',
`created`='".$row['created']."',
`keytype`='".$row['keytype']."',
`csr_name`='".$row['csr_name']."',
`created`='".$row['created']."',
`modified`=NOW(),
`codesign`='".$row['codesign']."',
`rootcert`='".$row['rootcert']."',
@ -1822,7 +1825,7 @@
if($process != "" & & $oldid == 20)
{
$CSR = clean_csr($_REQUEST['CSR']);
if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
{
$id = 20;
@ -1831,7 +1834,7 @@
showfooter();
exit;
}
if(trim($_REQUEST['description']) != ""){
$_SESSION['_config']['description']= trim(mysql_real_escape_string(stripslashes($_REQUEST['description'])));
}else{
@ -1887,7 +1890,7 @@
if($process != "" & & $oldid == 21)
{
$id = 21;
if(!file_exists($_SESSION['_config']['tmpfname']))
{
showheader(_("My CAcert.org Account!"));
@ -1895,7 +1898,7 @@
showfooter();
exit;
}
if (($weakKey = checkWeakKeyCSR(file_get_contents(
$_SESSION['_config']['tmpfname']))) !== "")
{
@ -1944,7 +1947,7 @@
if(is_array($_SESSION['_config']['rows']))
foreach($_SESSION['_config']['rows'] as $row)
$csrsubject .= "/commonName=$row";
$SAN="";
$SAN="";
if(is_array($_SESSION['_config']['altrows']))
foreach($_SESSION['_config']['altrows'] as $subalt)
{
@ -2031,29 +2034,29 @@
printf(_("Invalid ID '%s' presented, can't do anything with it.")."< br > \n", $id);
continue;
}
$row = mysql_fetch_assoc($res);
if (($weakKey = checkWeakKeyX509(file_get_contents(
$row['crt_name']))) !== "")
{
echo $weakKey, "< br / > \n";
continue;
}
mysql_query("update `orgdomaincerts` set `renewed`='1' where `id`='$id'");
if($row['revoke'] > 0)
{
printf(_("It would seem '%s' has already been revoked. I'll skip this for now.")."< br > \n", $row['CN']);
continue;
}
$query = "insert into `orgdomaincerts` set
`orgid`='".$row['orgid']."',
$query = "insert into `orgdomaincerts` set
`orgid`='".$row['orgid']."',
`CN`='".$row['CN']."',
`csr_name`='".$row['csr_name']."',
`csr_name`='".$row['csr_name']."',
`created`='".$row['created']."',
`modified`=NOW(),
`subject`='".$row['subject']."',
`modified`=NOW(),
`subject`='".$row['subject']."',
`type`='".$row['type']."',
`rootcert`='".$row['rootcert']."',
`description`='".$row['description']."'";
@ -2286,7 +2289,7 @@
if(($oldid == 29 || $oldid == 30) & & $process != "") // _("Cancel") is handled in front of account.php
{
$query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
$query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
`orgdomlink`.`orgdomid`=`orgdomains`.`id` and
`orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and
`orgdomains`.`id`='".intval($domid)."'";
@ -2294,7 +2297,7 @@
while($row = mysql_fetch_assoc($res))
mysql_query("update `orgdomaincerts` set `revoked`='1970-01-01 10:00:01' where `id`='".$row['id']."'");
$query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
$query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
`orgemaillink`.`domid`=`orgdomains`.`id` and
`orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and
`orgdomains`.`id`='".intval($domid)."'";
@ -2338,7 +2341,7 @@
$dres = mysql_query($query);
while($drow = mysql_fetch_assoc($dres))
{
$query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
$query = "select `orgdomaincerts`.`id` as `id` from `orgdomlink`, `orgdomaincerts`, `orgdomains` where
`orgdomlink`.`orgdomid`=`orgdomains`.`id` and
`orgdomaincerts`.`id`=`orgdomlink`.`orgcertid` and
`orgdomains`.`id`='".intval($drow['id'])."'";
@ -2350,7 +2353,7 @@
mysql_query("delete from `orgdomlink` where `domid`='".intval($row['id'])."'");
}
$query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
$query = "select `orgemailcerts`.`id` as `id` from `orgemailcerts`, `orgemaillink`, `orgdomains` where
`orgemaillink`.`domid`=`orgdomains`.`id` and
`orgemailcerts`.`id`=`orgemaillink`.`emailcertsid` and
`orgdomains`.`id`='".intval($drow['id'])."'";
@ -2430,8 +2433,8 @@
$row = mysql_fetch_assoc($res);
if ( !is_assurer(intval($row['id'])) )
{
$id = $oldid;
$oldid=0;
$id = $oldid;
$oldid=0;
$_SESSION['_config']['errmsg'] =
_("The user is not an Assurer yet");
} else {
@ -2565,7 +2568,7 @@
exit;
}
if($oldid == 54 || ($id == 53 & & array_key_exists('action',$_REQUEST) & & $_REQUEST['action'] != "") ||
if($oldid == 54 || ($id == 53 & & array_key_exists('action',$_REQUEST) & & $_REQUEST['action'] != "") ||
($id == 54 & & array_key_exists('action',$_REQUEST) & & $_REQUEST['action'] != "" & &
$_REQUEST['action'] != "aliases" & & $_REQUEST['action'] != "edit" & & $_REQUEST['action'] != "add"))
{
@ -2789,7 +2792,7 @@
showfooter();
exit;
}
if (($weakKey = checkWeakKeyCSR($CSR)) !== "")
{
showheader(_("My CAcert.org Account!"));
@ -2798,7 +2801,7 @@
exit;
}
$query = "insert into `domaincerts` set
$query = "insert into `domaincerts` set
`CN`='".$_SESSION['_config']['0.CN']."',
`domid`='".$_SESSION['_config']['row']['id']."',
`created`=NOW()";
@ -2862,7 +2865,7 @@
if($id == 43 & & array_key_exists('locked',$_REQUEST) & & $_REQUEST['locked'] > 0)
{
csrf_check('admactlock');
csrf_check('admactlock');
$memid = $_REQUEST['userid'] = intval($_REQUEST['locked']);
$query = "select * from `users` where `id`='$memid'";
$row = mysql_fetch_assoc(mysql_query($query));
@ -3103,7 +3106,7 @@
while($row = mysql_fetch_assoc($res))
$body .= $row['comment']."\n";
$body .= "\n";
$body .= _("Best regards")."\n";
$body .= _("CAcert Support Team");
sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");
@ -3124,7 +3127,7 @@
$body .= "\n";
$body .= _("You are welcome to try submitting another request at any time in the future, please make sure you take the reviewer comments into consideration or you risk having your application rejected again.")."\n\n";
$body .= _("Best regards")."\n";
$body .= _("CAcert Support Team");
sendmail($user['email'], "[CAcert.org] Thawte Notary Points Transfer", $body, "website-form@cacert.org", "support@cacert.org", "", "CAcert Tverify");
Wytze van der Raay
11 years ago