View | Details | Raw Unified
Collapse All | Expand All

(-) jffnms-0.8.3dfsg.1~/htdocs/admin/adm/test.php (-1 lines)
Line 1    Link Here  
<? phpinfo(); ?>
(-) jffnms-0.8.3dfsg.1~/htdocs/auth.php (-5 lines)
 Lines 46-56    Link Here  
		    session_start();
		    session_start();
		}
		}

            

              
		if (($jffnms_version=="0.0.0") && ($_SERVER["REMOTE_ADDR"]=="128.30.52.13")) { //W3C Validator

              
            

            

              
		    $_REQUEST["user"]="admin";

              
            

            

              
		    $_REQUEST["pass"]="admin";

              
            

            

              
		}

              
            

            

              
		

              
            

        
		if (!isset($_SESSION["authentification"]))
		if (!isset($_SESSION["authentification"]))

        
		    $authentification = $jffnms->authenticate ($_REQUEST["user"],$_REQUEST["pass"],true,"from ".$_SERVER["REMOTE_ADDR"]);
		    $authentification = $jffnms->authenticate ($_REQUEST["user"],$_REQUEST["pass"],true,"from ".$_SERVER["REMOTE_ADDR"]);

        



(-) jffnms-0.8.3dfsg.1~/lib/api.classes.inc.php
      (-3 / +5 lines)




  

    

    

       Lines 677-683
       
    
  Link Here 
    

  

        
    	    $auth_type = 1;
    	    $auth_type = 1;

        
	    $cant_auth = 0;
	    $cant_auth = 0;

        
	    
	    

            

              
	    if (isset($user) && isset($pass)) {

              
	    if (preg_match("/^[\w\@\.]{0,20}$/", $user) && isset($pass)) {

            

        
		$query_auth = "select id as auth_user_id, usern as auth_user_name, passwd, fullname as auth_user_fullname from auth where usern = '$user'";
		$query_auth = "select id as auth_user_id, usern as auth_user_name, passwd, fullname as auth_user_fullname from auth where usern = '$user'";

        
		$result_auth = db_query ($query_auth);
		$result_auth = db_query ($query_auth);

        
		$cant_auth = db_num_rows($result_auth);
		$cant_auth = db_num_rows($result_auth);

  

    

    

       Lines 693-710
       
    
  Link Here 
    

  

        
	    } 
	    } 

        
    
    

        
	    if (($auth==0) && ($cant_auth == 0)){  //not found in DB
	    if (($auth==0) && ($cant_auth == 0)){  //not found in DB

            

              
		if (isset($user) && isset($pass)) {

              

            

            

              

              
		if (preg_match("/^[\w\@\.]{0,20}$/", $user) && isset($pass)) {

            

        
    		    $query_auth = "select id as auth_user_id, username as auth_user_name, name as auth_user_fullname from clients where username= '$user' and password = '$pass'";
    		    $query_auth = "select id as auth_user_id, username as auth_user_name, name as auth_user_fullname from clients where username= '$user' and password = '$pass'";

        
		    $result_auth = db_query ($query_auth);
		    $result_auth = db_query ($query_auth);

        
		    $auth = db_num_rows( $result_auth);
		    $auth = db_num_rows( $result_auth);

        
		}
		}

            

              
              
		

            

        
		if ($auth==1) { 
		if ($auth==1) { 

        
		    $reg = db_fetch_array($result_auth);
		    $reg = db_fetch_array($result_auth);

        
		    $auth_type = 2;
		    $auth_type = 2;

        
		}
		}

        
	    }
	    }

        
	    
	    

            

              
	    if (($log_event==true) && (!empty($user)))

              
	    if (($log_event==true) && preg_match("/^[\w\@\.]{0,20}$/", $user))

            

        
		insert_event(date("Y-m-d H:i:s",time()),get_config_option("jffnms_internal_type"),1,"Login",(($auth==1)?"successful":"failed"),$user,$log_event_info,"",0);
		insert_event(date("Y-m-d H:i:s",time()),get_config_option("jffnms_internal_type"),1,"Login",(($auth==1)?"successful":"failed"),$user,$log_event_info,"",0);

        
	    
	    

        
	    unset ($reg["passwd"]);
	    unset ($reg["passwd"]);