=$from and $ip<=$to);
}
} // End function checkIPinNetwork
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function printLoginInfo() {
// --------------
// This function prints the ftpserver, username and login information
// --------------
global $net2ftp_globals;
echo "\n";
echo "\n";
echo "\n";
// echo "\n";
echo "\n";
echo "\n";
echo "\n";
echo "\n";
echo "\n";
echo "\n";
echo "\n";
echo "\n";
} // End function printLoginInfo
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function printLoginInfo_javascript() {
// --------------
// This function prints the ftpserver, username and login information -- for javascript input
// --------------
global $net2ftp_globals;
echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
// echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
echo " d.writeln('');\n";
} // End function printLoginInfo_javascript
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function printPHP_SELF($case) {
// --------------
// This function prints $PHP_SELF, the name of the script itself
// --------------
// -------------------------------------------------------------------------
// Global variables and settings
// -------------------------------------------------------------------------
global $net2ftp_globals, $net2ftp_settings;
$ftpserver = urlEncode2($net2ftp_globals["ftpserver"]);
$ftpserverport = urlEncode2($net2ftp_globals["ftpserverport"]);
$username = urlEncode2($net2ftp_globals["username"]);
$language = urlEncode2($net2ftp_globals["language"]);
$skin = urlEncode2($net2ftp_globals["skin"]);
$ftpmode = urlEncode2($net2ftp_globals["ftpmode"]);
$passivemode = urlEncode2($net2ftp_globals["passivemode"]);
$protocol = urlEncode2($net2ftp_globals["protocol"]);
$viewmode = urlEncode2($net2ftp_globals["viewmode"]);
$sort = urlEncode2($net2ftp_globals["sort"]);
$sortorder = urlEncode2($net2ftp_globals["sortorder"]);
$state_html = urlEncode2($net2ftp_globals["state"]);
$state2_html = urlEncode2($net2ftp_globals["state2"]);
$directory_html = urlEncode2($net2ftp_globals["directory"]);
$entry_html = urlEncode2($net2ftp_globals["entry"]);
if (isset($_SESSION["net2ftp_password_encrypted_" . $net2ftp_globals["ftpserver"] . $net2ftp_globals["username"]]) == true) {
$password_encrypted = urlEncode2($_SESSION["net2ftp_password_encrypted_" . $net2ftp_globals["ftpserver"] . $net2ftp_globals["username"]]);
}
elseif (isset($net2ftp_globals["password_encrypted"]) == true) {
$password_encrypted = urlEncode2($net2ftp_globals["password_encrypted"]);
}
else {
$password_encrypted = "";
}
// From /includes/registerglobals.inc.php
$URL = $net2ftp_globals["action_url"];
// If the URL already contains parameters (?param1=value1¶m2=value2...), append &
// If not, append a ?
if (strpos($URL, "?") !== false) { $URL .= "&"; }
else { $URL .= "?"; }
// Append further parameters
if ($case == "actions") {
$URL .= "ftpserver=$ftpserver&ftpserverport=$ftpserverport&username=$username&language=$language&skin=$skin&ftpmode=$ftpmode&passivemode=$passivemode&protocol=$protocol&viewmode=$viewmode&sort=$sort&sortorder=$sortorder";
}
// Bookmark with password: go straight to the bookmarked state
elseif ($case == "bookmark_withpw") {
$URL .= "ftpserver=$ftpserver&ftpserverport=$ftpserverport&username=$username&password_encrypted=$password_encrypted&language=$language&skin=$skin&ftpmode=$ftpmode&passivemode=$passivemode&protocol=$protocol&viewmode=$viewmode&sort=$sort&sortorder=$sortorder&state=$state_html&state2=$state2_html&directory=$directory_html&entry=$entry_html";
}
// Bookmark without password: go first to the login_small state to enter the password
elseif ($case == "bookmark_withoutpw") {
$URL .= "ftpserver=$ftpserver&ftpserverport=$ftpserverport&username=$username&language=$language&skin=$skin&ftpmode=$ftpmode&passivemode=$passivemode&protocol=$protocol&viewmode=$viewmode&sort=$sort&sortorder=$sortorder&state=login_small&state2=bookmark&go_to_state=$state_html&go_to_state2=$state2_html&directory=$directory_html&entry=$entry_html";
}
// Jupload java applet: the cookie information is added to the page using javascript (/skins/blue/jupload1.template.php)
elseif ($case == "jupload") {
$URL .= "ftpserver=$ftpserver&ftpserverport=$ftpserverport&username=$username&language=$language&skin=$skin&ftpmode=$ftpmode&passivemode=$passivemode&protocol=$protocol&directory=$directory_html&state=jupload&screen=2";
}
elseif ($case == "view") {
$URL .= "ftpserver=$ftpserver&ftpserverport=$ftpserverport&username=$username&language=$language&skin=$skin&ftpmode=$ftpmode&passivemode=$passivemode&protocol=$protocol&viewmode=$viewmode&sort=$sort&sortorder=$sortorder&state=$state_html&state2=image&directory=$directory_html&entry=$entry_html";
}
elseif ($case == "createDirectoryTreeWindow") {
$URL = $net2ftp_globals["application_rootdir_url"] . "/index.php";
}
// Change skin
elseif ($case == "defaultskin") {
$URL .= "ftpserver=$ftpserver&ftpserverport=$ftpserverport&username=$username&language=$language&skin=" . $net2ftp_settings["default_skin"] . "&ftpmode=$ftpmode&passivemode=$passivemode&protocol=$protocol&viewmode=$viewmode&sort=$sort&sortorder=$sortorder&state=$state_html&state2=$state2_html&directory=$directory_html&entry=$entry_html";
}
return $URL;
} // End function printPHP_SELF
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function checkAuthorization($ftpserver, $ftpserverport, $directory, $username) {
// --------------
// This function
// checks if the FTP server is in the list of those that may be accessed
// checks if the FTP server is in the list of those that may NOT be accessed
// checks if the IP address is in the list of banned IP addresses
// checks if the FTP server port is in the allowed range
// If all is OK, then the user may continue...
// --------------
// -------------------------------------------------------------------------
// Global variables
// -------------------------------------------------------------------------
global $net2ftp_globals, $net2ftp_settings, $net2ftp_result;
// -------------------------------------------------------------------------
// Check if the FTP server is in the list of those that may be accessed
// -------------------------------------------------------------------------
if ($net2ftp_settings["allowed_ftpservers"][1] != "ALL") {
$result1 = array_search($ftpserver, $net2ftp_settings["allowed_ftpservers"]);
if ($result1 == false) {
$errormessage = __("The FTP server %1\$s is not in the list of allowed FTP servers.", $ftpserver);
setErrorVars(false, $errormessage, debug_backtrace(), __FILE__, __LINE__);
return false;
}
}
// -------------------------------------------------------------------------
// Check if the FTP server is in the list of those that may NOT be accessed
// -------------------------------------------------------------------------
if (isset($net2ftp_settings["banned_ftpservers"][1]) == true && $net2ftp_settings["banned_ftpservers"][1] != "NONE") {
$result2 = array_search($ftpserver, $net2ftp_settings["banned_ftpservers"]);
if ($result2 != false) {
$errormessage = __("The FTP server %1\$s is in the list of banned FTP servers.", $ftpserver);
setErrorVars(false, $errormessage, debug_backtrace(), __FILE__, __LINE__);
return false;
}
}
// -------------------------------------------------------------------------
// Check if the FTP server port is OK
// -------------------------------------------------------------------------
// Do not perform this check if ALL ports are allowed
if ($net2ftp_settings["allowed_ftpserverport"] != "ALL" ) {
// Report the error if another port nr has been entered than the one which is allowed
if ($ftpserverport != $net2ftp_settings["allowed_ftpserverport"]) {
$errormessage = __("The FTP server port %1\$s may not be used.", $ftpserverport);
setErrorVars(false, $errormessage, debug_backtrace(), __FILE__, __LINE__);
return false;
}
}
// -------------------------------------------------------------------------
// Check if the IP address is in the list of those that may be used
// -------------------------------------------------------------------------
if ($net2ftp_settings["allowed_addresses"][1] != "ALL") {
$result3 = false;
for ($i=1; $i<=sizeof($net2ftp_settings["allowed_addresses"]); $i++) {
if (checkIPinNetwork($net2ftp_globals["REMOTE_ADDR"], $net2ftp_settings["allowed_addresses"][$i]) == true) { $result3 = true; }
}
if ($result3 == false) {
$errormessage = __("Your IP address (%1\$s) is not in the list of allowed IP addresses.", $net2ftp_globals["REMOTE_ADDR"]);
setErrorVars(false, $errormessage, debug_backtrace(), __FILE__, __LINE__);
return false;
}
}
// -------------------------------------------------------------------------
// Check if the IP address is in the list of those that may NOT be used
// -------------------------------------------------------------------------
if (isset($net2ftp_settings["banned_addresses"][1]) == true && $net2ftp_settings["banned_addresses"][1] != "NONE") {
$result4 = false;
for ($i=1; $i<=sizeof($net2ftp_settings["banned_addresses"]); $i++) {
if (checkIPinNetwork($net2ftp_globals["REMOTE_ADDR"], $net2ftp_settings["banned_addresses"][$i]) == true) { $result4 = true; }
}
if ($result4 != false) {
$errormessage = __("Your IP address (%1\$s) is in the list of banned IP addresses.", $net2ftp_globals["REMOTE_ADDR"]);
setErrorVars(false, $errormessage, debug_backtrace(), __FILE__, __LINE__);
return false;
}
}
// -------------------------------------------------------------------------
// Check if the directory is authorised:
// 1 - Whether the current $directory name contains a banned keyword.
// 2 - If the current $directory is a subdirectory of the homedirectory.
// The rootdirectory is first checked for the current user; if this is not set,
// the default rootdirectory is checked.
// -------------------------------------------------------------------------
$result4 = checkAuthorizedDirectory($directory);
if ($net2ftp_result["success"] == false) { return false; }
if ($result4 == false) {
$net2ftp_globals["directory"] = $net2ftp_globals["homedirectory"];
$net2ftp_globals["directory_html"] = htmlEncode2($net2ftp_globals["directory"]);
$net2ftp_globals["directory_js"] = javascriptEncode2($net2ftp_globals["directory"]);
if (strlen($net2ftp_globals["directory"]) > 0) { $net2ftp_globals["printdirectory"] = $net2ftp_globals["directory"]; }
else { $net2ftp_globals["printdirectory"] = "/"; }
}
// -------------------------------------------------------------------------
// If everything is OK, return true
// -------------------------------------------------------------------------
return true;
} // end checkAuthorization
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function checkAuthorizedDirectory($directory) {
// --------------
// 1 - This function checks whether the current $directory name contains a banned
// keyword.
// 2 - It also checks if the current $directory is a subdirectory of the
// homedirectory. The rootdirectory is first checked for the current user;
// if this is not set, the default rootdirectory is checked.
// --------------
// -------------------------------------------------------------------------
// Global variables
// -------------------------------------------------------------------------
global $net2ftp_globals, $net2ftp_settings, $net2ftp_result;
// -------------------------------------------------------------------------
// 1 - Check if the directory name contains a banned keyword
// -------------------------------------------------------------------------
if (checkAuthorizedName($directory) == false) { return false; }
// -------------------------------------------------------------------------
// 2 - Check if the directory is a subdirectory of the homedirectory (set in the DB)
// -------------------------------------------------------------------------
// ----------------------------------------------
// Initial checks
// ----------------------------------------------
if ($net2ftp_settings["use_database"] != "yes" || $net2ftp_settings["check_homedirectory"] != "yes") { return true; }
// ----------------------------------------------
// Get the homedirectory from the database, then store it in a global
// variable, and from then on, don't access the database any more
// ----------------------------------------------
$net2ftp_globals["homedirectory"] = getRootdirectory();
// ----------------------------------------------
// Check if the current directory is a subdirectory of the homedirectory
// ----------------------------------------------
if (isSubdirectory($net2ftp_globals["homedirectory"], $directory) == false) { return false; }
else { return true; }
} // end checkAuthorizedDirectory
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function checkAuthorizedName($dirfilename) {
// --------------
// This function checks if the directory/file/symlink name contains a forbidden keyword
// --------------
// -------------------------------------------------------------------------
// Global variables
// -------------------------------------------------------------------------
global $net2ftp_settings;
// -------------------------------------------------------------------------
// Check
// -------------------------------------------------------------------------
if (isset($net2ftp_settings["banned_keywords"][1]) == true && $net2ftp_settings["banned_keywords"][1] != "NONE") {
for ($i=1; $i<=sizeof($net2ftp_settings["banned_keywords"]); $i++) {
if (strpos($dirfilename, $net2ftp_settings["banned_keywords"][$i]) !== false) { return false; }
}
}
return true;
} // end checkAuthorizedName
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function getRootdirectory() {
// --------------
// This function gets the user's root directory from the database and
// stores it in $net2ftp_globals["homedirectory"].
//
// If $net2ftp_globals["homedirectory"] is already filled in (cache), no connection
// is made to the DB and this value is returned.
// --------------
// -------------------------------------------------------------------------
// Global variables
// -------------------------------------------------------------------------
global $net2ftp_globals, $net2ftp_settings, $net2ftp_result;
// -------------------------------------------------------------------------
// Initial checks
// -------------------------------------------------------------------------
if ($net2ftp_settings["use_database"] != "yes" || $net2ftp_settings["check_homedirectory"] != "yes") {
$net2ftp_globals["homedirectory"] = "/";
}
// -------------------------------------------------------------------------
// Get the homedirectory from the database, then store it in a global
// variable, and from then on, don't access the database any more
// -------------------------------------------------------------------------
if (isset($net2ftp_globals["homedirectory"]) == false) {
// -------------------------------------------------------------------------
// Add slashes to variables which are used in a SQL query, and which are
// potentially unsafe (supplied by the user)
// -------------------------------------------------------------------------
$net2ftp_ftpserver_safe = addslashes($net2ftp_globals["ftpserver"]);
$net2ftp_username_safe = addslashes($net2ftp_globals["username"]);
// -------------------------------------------------------------------------
// Connect
// -------------------------------------------------------------------------
$mydb = connect2db();
if ($net2ftp_result["success"] == false) { return false; }
// -------------------------------------------------------------------------
// Get user's home directory
// -------------------------------------------------------------------------
$sqlquery1 = "SELECT homedirectory FROM net2ftp_users WHERE ftpserver = '$net2ftp_ftpserver_safe' AND username = '$net2ftp_username_safe';";
$result1 = mysql_query("$sqlquery1") or die("Unable to execute SQL SELECT query (isAuthorizedDirectory > sqlquery1) $sqlquery1");
$nrofrows1 = mysql_num_rows($result1);
if ($nrofrows1 == 0) {
$net2ftp_globals["homedirectory"] = "/";
}
elseif ($nrofrows1 == 1) {
$resultRow1 = mysql_fetch_row($result1);
$net2ftp_globals["homedirectory"] = $resultRow1[0];
}
else {
setErrorVars(false, __("Table net2ftp_users contains duplicate rows."), debug_backtrace(), __FILE__, __LINE__);
return false;
}
}
return $net2ftp_globals["homedirectory"];
} // end getRootdirectory
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function isSubdirectory($parentdir, $childdir) {
// --------------
// Returns true if the childdir is a subdirectory of the parentdir
// --------------
// If the parentdir is empty or the root directory, then the childdir is
// a the same as or a subdirectory of the parentdir
if ($parentdir == "" || $parentdir == "/" || $parentdir == "\\") { return true; }
// Strip the directories of leading and trailing slashes
$parentdir = stripDirectory($parentdir);
$childdir = stripDirectory($childdir);
$parentdir_length = strlen($parentdir);
// Check if the first characters of the childdir are different from the
// parentdir. Example:
// parentdir: /home/abc
// childdir: /home/blabla ==> false
// childdir: /home/abcd ==> continue further checks
// childdir: /home/abc/xyz ==> continue further checks
$childdir_firstchars = substr($childdir, 0, $parentdir_length);
if ($childdir_firstchars != $parentdir) { return false; }
// If the first characters of the childdir are identical to the parentdir,
// check if the first next character of the childdir name is different.
// Example:
// parentdir: /home/abc
// childdir: /home/abcd ==> false
// childdir: /home/abc/xyz ==> true
$childdir_nextchar = substr($childdir, $parentdir_length, 1);
if ($childdir_nextchar != "/" && $childdir_nextchar != "\\") { return false; }
return true;
} // end isSubdirectory
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// **************************************************************************************
// ** **
// ** **
function checkAdminUsernamePassword() {
// --------------
// This function checks the Administrator username and password.
// If one of the two is not filled in or incorrect, a header() is sent
// to redirect the user to the login_small page.
// --------------
// -------------------------------------------------------------------------
// Global variables
// -------------------------------------------------------------------------
global $net2ftp_globals, $net2ftp_settings, $net2ftp_result;
$input_admin_username = $_POST["input_admin_username"];
$input_admin_password = $_POST["input_admin_password"];
// -------------------------------------------------------------------------
// Check Admin username and password
// -------------------------------------------------------------------------
// Set the error message depending on the case
// Redirect the user to the login_small page
// No username or password filled in
if ($input_admin_username == "" || $input_admin_password == "") {
$errormessage = htmlEncode2(__("You did not enter your Administrator username or password."));
header("Location: " . $net2ftp_globals["action_url"] . "?state=login_small&state2=admin&go_to_state=" . $net2ftp_globals["state"] . "&go_to_state2=" . $net2ftp_globals["state2"] . "&errormessage=" . $errormessage);
$net2ftp_result["exit"] = true;
return false;
}
// Wrong username or password
elseif ($input_admin_username != $net2ftp_settings["admin_username"] ||
$input_admin_password != $net2ftp_settings["admin_password"]) {
$errormessage = htmlEncode2(__("Wrong username or password. Please try again."));
header("Location: " . $net2ftp_globals["action_url"] . "?state=login_small&state2=admin&go_to_state=" . $net2ftp_globals["state"] . "&go_to_state2=" . $net2ftp_globals["state2"] . "&errormessage=" . $errormessage);
$net2ftp_result["exit"] = true;
return false;
}
return true;
} // end checkAdminUsernamePassword()
// ** **
// ** **
// **************************************************************************************
// **************************************************************************************
?>