<?php
$admin = 'admin';
$admin_pw = 'admin';
$include_dir = "../include";
$settings_dir = "../settings";
define("_SECURE",1); // define secure constant
$template_dir = "../".$templ_dir."";
$template_path = "$template_dir/$template";
$result = '';
// if Intrusion Detection System should be used
if ($use_ids == 1){
require_once ("$include_dir/ids_handler.php");
//IDS detected an attack?
if (strlen($result) > 13) {
// get impact of intrusion
$len = strpos($result, "<")-13;
$res = trim(substr($result, '13', $len));
if ($res >= $ids_warn) {
echo "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">
<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8' />
<meta http-equiv='expires' content='0'>
<meta http-equiv='pragma' content='no-cache'>
<title>Sphider-plus administrator tools</title>
<link rel='stylesheet' type='text/css' href='$template_path/adminstyle.css' />
<script type='text/javascript' src='confirm.js'></script>
<script type='text/javascript'>
function JumpBottom () {
window.scrollTo(0,1000);
}
</script>
</head>
<body>
<br /><br />
<div class='headline cntr'>
IDS result message
</div>
<br /><br />
$result
<br />
<div class='cntr warnadmin'>
<br />
Further input blocked by the Sphider-plus supervisor, because the
<br /><br />
Intrusion Detection System noticed the above attempt to attack this search engine.
<br /><br />
</div>
<div class='headline cntr'>
</div>
<br /><br />
</body>
</html>
";
die();
}
}
}
if (!session_id()) {
session_start();
}
if (isset($_POST['user']) && isset($_POST['pass'])) {
$username = substr(trim($_POST['user']),0,255);
// prevent SQL-injection
$username = str_replace('\\','\\\\', $username);
$username = str_replace('"','\"', $username);
// prevent XSS-attack, Shell-execute and JavaScript execution
if (preg_match("/cmd|CREATE|DELETE|DROP|eval|EXEC|File|INSERT|printf/i",$username)) {
$username = '';
}
if (preg_match("/LOCK|PROCESSLIST|SELECT|shell|SHOW|SHUTDOWN/i",$username)) {
$username = '';
}
if (preg_match("/SQL|SYSTEM|TRUNCATE|UNION|UPDATE|DUMP/i",$username)) {
$username = '';
}
if (preg_match("/java|vbscri|embed|onclick|onmouseover|onfocus/i",$username)) {
$username = '';
}
$password = substr(trim($_POST['pass']),0,255);
// prevent SQL-injection
//$password = str_replace('\\','\\\\', $password);
//$password = str_replace('"','\"', $password);
// prevent XSS-attack, Shell-execute and JavaScript execution
if (preg_match("/cmd|CREATE|DELETE|DROP|eval|EXEC|File|INSERT|printf/i",$password)) {
$password = '';
}
if (preg_match("/LOCK|PROCESSLIST|SELECT|shell|SHOW|SHUTDOWN/i",$password)) {
$password = '';
}
if (preg_match("/SQL|SYSTEM|TRUNCATE|UNION|UPDATE|DUMP/i",$password)) {
$password = '';
}
if (preg_match("/java|vbscri|embed|onclick|onmouseover|onfocus/i",$password)) {
$password = '';
}
if (($username == $admin) && ($password ==$admin_pw)) {
$_SESSION['admin'] = $username;
$_SESSION['admin_pw'] = $password;
}
header("Location: admin.php");
} elseif (
(isset($_SESSION['admin']) && isset($_SESSION['admin_pw']) &&$_SESSION['admin'] == $admin && $_SESSION['admin_pw'] == $admin_pw ) || ($_SERVER['REMOTE_ADDR']=="")
) {
} else {
echo " <noscript>
<div id='main'>
<h1 class='cntr warn'>
<br />
Attention: Your browser does not support JavaScript.
<br /><br />
You will not get full functionality of Sphider-plus Administrator.
<br /><br />
</h1>
</div>
</noscript>
<h1 class='cntr'>Sphider-plus v.$plus_nr</h1>
<br />
<br />
<div class='panel x3'>
<form class='txt' action='auth.php' method='post'>
<fieldset><legend>[ Sphider Admin Login ]</legend>
<label for='user'>[ Name ]</label>
<input type='text' name='user' id='user' size='15' maxlength='255' title='Required - Enter your user name here' onfocus='this.value=\"\"' value=''/>
<label for='pass'>[ Password ]</label>
<input type='password' name='pass' id='pass' size='15' maxlength='255' title='Required - Enter your password here' onfocus='this.value=\"\"' value=''/>
</fieldset>
<fieldset><legend>[ Log In ]</legend>
<input class='sbmt' type='submit' id='submit' value=' Login »» ' title='Click to confirm'/>
</fieldset>
</form>
</div>
<br />
<br />
</body>
</html>
";
exit();
}
?>