"); echoln(" Certificate error?"); echoln("
"); } layout("account-bottom", $ldap); layout("page-top", $ldap); echoln(" Home > "); #echoln("Office > "); echoln("Statutory > "); echoln("".$setup['MenuName'].""); } } function page_footer($nohtml=false) { global $ldap; if( !$nohtml ) { layout("page-bottom", $ldap); layout("bottom", $ldap); } $ldap->__destruct(); } function layout($part, $ldap=null) { $parts = array(); $parts[] = "login"; $parts[] = "top"; $parts[] = "menu-top"; $parts[] = "menu-bottom"; $parts[] = "account-top"; $parts[] = "account-anonymous"; $parts[] = "account-loggedin"; $parts[] = "account-bottom"; $parts[] = "page-top"; $parts[] = "page-bottom"; $parts[] = "bottom"; $parts[] = "all"; if( in_array($part, $parts) ) { if( $part=="top" ) { header("Content-Type: text/html; charset=UTF-8"); } if( $fd=fopen(LAYOUTPATHABS.$_SESSION['layout']."/".$part.".html", "r") ) { $search = array(); $replace = array(); $search[] = "%PHP_SELF%"; $replace[] = $_SERVER['PHP_SELF']; if( isset($_SESSION['sess_name']) ) { $search[] = "%USERNAME%"; $replace[] = $_SESSION['sess_name']; $search[] = "%RAWENCODEUSERNAME%"; $replace[] = rawurlencode($_SESSION['sess_name']); } $search[] = "%LAYOUTDIR%"; $replace[] = LAYOUTPATHABS.$_SESSION['layout']."/"; $search[] = "%QUERY_STRING%"; $replace[] = preg_replace("/logout/", "", $_SERVER['QUERY_STRING']); if( $ldap==null ) { $search[] = "%AUTH_SYSTEM_NAME%"; $replace[] = "aegee.org"; $search[] = "%AUTH_REGISTRATION_URL%"; $replace[] = "http://www.aegee.org/"; }else { $search[] = "%AUTH_SYSTEM_NAME%"; $replace[] = $ldap->getSystemName(); $search[] = "%AUTH_REGISTRATION_URL%"; $replace[] = $ldap->getRegistrationUrl(); } while( !feof($fd) ) { echoln( str_replace($search, $replace, fgets($fd, 4096)), false, true ); } fclose ($fd); } }else { // Not valid } } function layout_img($img) { $imgs=array(); $imgs[]="previous.gif"; $imgs[]="next.gif"; $imgs[]="list.gif"; if( in_array($img, $imgs) ) { return "./layout/".$_SESSION['layout']."/image/".$img; }else { // Not valid return ""; } } function layout_menu($item) { layout("menu-top"); echoln("\t\t\t\t\t\t\t\t\t\t".$item); layout("menu-bottom"); } /* admin_header($empty=false) * Show the page header * @param: empty: when true, do not output anything if login is ok (useful for downloads or images) * @return: - */ function admin_header($nomenu=false, $nohtml=false) { global $ldap, $LDAPTRANS, $setup; ssl_redirect(); // always switch to https // Check login if( $setup['AuthSystem']=="" ) { $setup['AuthSystem'] = "None"; } $authClass = "Auth".$setup['AuthSystem']; require_once("./include/".$authClass.".php"); $ldap = new $authClass(); if( isset($_GET['logout']) AND $_SESSION['sess_uid']!=0 ) { //Do logout dolog("login", "'".$_SESSION['sess_name']."' logged out", "info"); $layout=$_SESSION['layout']; $_SESSION=array(); $_SESSION['layout']=$layout; } if( !isset($_SESSION['sess_uid']) OR $_SESSION['sess_uid']<1 ) { // Check login if( (isset($_POST['username']) && isset($_POST['password'])) && (($auth_ldap=$ldap->auth($_POST['username'], $_POST['password'])) || ($auth_mysql=(@mysql_num_rows(doquery("SELECT `uid` FROM `users` WHERE `user`='".addslashes($_POST['username'])."' AND `password`='".md5($_POST['password'])."'"))==1))) ) { // user/password ok, now check if user has admin access $query="SELECT `uid`, `user`, `password`, `role_id`, `privstatementagree` FROM `users` WHERE `user`='".addslashes($_POST['username'])."'"; if( @mysql_num_rows( $res=doquery($query) )==1 ) { // admin access granted $row = mysql_fetch_array($res); $_SESSION['sess_uid'] = $row['uid']; $_SESSION['sess_name'] = $row['user']; $_SESSION['sess_role_id'] = $row['role_id']; $query2 = "SELECT `id`, `name` FROM `functions` "; $query2.= "LEFT JOIN `function_roles` ON `function_roles`.`function_id`=`functions`.`id` "; $query2.= "WHERE `role_id`=".$row['role_id']; $functions = array(); if( @mysql_num_rows( $res2=doquery($query2) )>0 ) { while( $row2 = mysql_fetch_assoc($res2) ) { $functions[ $row2['id'] ] = $row2['name']; } } if( $row['privstatementagree']=="yes" ) { $_SESSION['sess_functions'] = $functions; }else { // User did not agree to privacy statement yet $_SESSION['sess_functions'] = array(); $_SESSION['privstatementagree'] = "ask"; $_SESSION['privstatementagree_functions'] = $functions; } dolog("login", "'".$_SESSION['sess_name']."' logged in from ".$_SERVER["REMOTE_ADDR"]." via ".($auth_ldap?"LDAP":($auth_mysql?"MySQL":"unknown access DB")), "info"); if( $auth_ldap AND $row['password']!=md5($_POST['password']) ) { // MySQL password different than LDAP -> update $query = "UPDATE `users` SET `password`='".addslashes(md5($_POST['password']))."' WHERE `uid`=".$row['uid']; if( doquery($query) ) { dolog("login", "Saved password for '".$_SESSION['sess_name']."' in MySQL.", "info"); }else { dolog("login", "Failed saving password for '".$_SESSION['sess_name']."' in MySQL.", "error"); } } }else { // No access to admin page layout("login"); exit(); } }else { // Wrong user/password layout("login"); exit(); } } if( isset($_SESSION['privstatementagree']) && $_SESSION['privstatementagree']=="ask" ) { if( $_SERVER['REQUEST_METHOD']=="POST" AND isset($_POST['agreeprivstatement']) ) { $_SESSION['sess_functions'] = $_SESSION['privstatementagree_functions']; $_SESSION['privstatementagree'] = NULL; $_SESSION['privstatementagree_access'] = NULL; dolog("login", "'".$_SESSION['sess_name']."' agreed to privacy statement", "info"); $query = "UPDATE `users` SET `privstatementagree`='yes' WHERE `uid`=".addslashes($_SESSION['sess_uid']); doquery($query); }else { if( basename($_SERVER['PHP_SELF'])!="index.php" ) { // Only the index.php file can show the privacy statement, redirect there header("Status: 301"); header("Location: ./"); } } } // Load the selection boxes (which participant type to show) get_selection(); // User logged in if( !$nohtml ) { echoln(""); echoln(""); echoln(" "); echoln(" "); echoln(" "); echoln(" "); echoln(" "); echoln("| ");
echoln("User: ".$_SESSION['sess_name']." [Logout]");
// Help
if( isset($_REQUEST['show']) ) {
echoln("");
}else {
echoln("");
}
if( count($_SESSION['sess_functions'])>0 ) {
// Selections
echoln(" Selection: [Change] "); echoln("
Overviews: "); echoln("
Totals and statistics: "); echoln("
Registration: "); echoln("
Administrator: "); echoln("
+: opens in new window"); echoln(" *: independent of selection"); echoln(" #: open and hide menu"); // Copyright echoln(" "); echoln(" Created by Wim van Ravesteijn | ");
echoln(" "); } } } /* admin_footer($empty=false) * Show the page footer * @param: empty: when true, do not output anything if login is ok (useful for downloads or images) * @return: - */ function admin_footer($nomenu=false, $nohtml=false) { global $ldap; if( !$nohtml ) { if( !$nomenu ) { echoln(" | "); echoln("