Skip to content

Commit 4e65ccb

Browse files
aj-techsoulaj-techsoul
authored
Add files via upload
1 parent 3fe5620 commit 4e65ccb

6 files changed

Lines changed: 169 additions & 55 deletions

File tree

‎ELI/config.php‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,17 @@
44
//------------------------------------
55

66
# USER DATABASE
7-
$GLOBALS['USER']['config']['dbtype'] = "mysql"; // mysql,sqlite
7+
// $GLOBALS['USER']['config']['dbtype'] = "mysql"; // mysql,sqlite
8+
// $GLOBALS['USER']['config']['dbhost'] = "localhost"; // FOR SQLITE, Please mention SQLlite File Path
9+
// $GLOBALS['USER']['config']['dbuser'] = "root";
10+
// $GLOBALS['USER']['config']['dbpass'] = "";
11+
// $GLOBALS['USER']['config']['dbname'] = "";// FOR SQLITE, Please mention SQLlite File Path
12+
$GLOBALS['USER']['config']['dbtype'] = "sqlite"; // mysql,sqlite
813
$GLOBALS['USER']['config']['dbhost'] = "localhost"; // FOR SQLITE, Please mention SQLlite File Path
9-
$GLOBALS['USER']['config']['dbuser'] = "root";
10-
$GLOBALS['USER']['config']['dbpass'] = "";
11-
$GLOBALS['USER']['config']['dbname'] = "";// FOR SQLITE, Please mention SQLlite File Path
14+
$GLOBALS['USER']['config']['dbuser'] = "admin";
15+
$GLOBALS['USER']['config']['dbpass'] = "admin";
16+
$GLOBALS['USER']['config']['dbname'] = "db/cmsv3";
17+
1218

1319
# CMS Database
1420
$GLOBALS['CMS']['config']['dbtype'] = "sqlite"; // mysql,sqlite
@@ -68,8 +74,8 @@
6874
//echo date('d-m-Y h:i a'); //Returns IST
6975
//------------------------------------
7076

71-
$freepages = "REGISTER,LOGIN,SIGNUP,contact.php,partner.php,test.php";
77+
$freepages = "REGISTER,LOGIN,SIGNUP,contact.php,partner.php,test.php,tool.php";
7278

7379
// IMPORTANT TO SET
74-
$websitepath = "ELI-GROUP/ELi-PHP-Framework/";
80+
$websitepath = "rad/eli-php-framework-main/";
7581
?>

‎ELI/functions.php‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -35,28 +35,14 @@ function page($url2)
3535
<?php
3636
function csrf()
3737
{
38-
if(!isset($_SESSION)){
39-
session_start();
40-
$_SESSION['formStarted'] = true;
41-
}
42-
if (!isset($_SESSION['token']))
43-
{
44-
$token = md5(date('Y-m-d-H-i').uniqid(rand(), TRUE));
45-
$_SESSION['token'] = $token;
46-
}
47-
return @$_SESSION['token'];
38+
$s = new SECURITY;
39+
return $s->csrf();
4840
}
4941

5042
function check_csrf($csrf_got)
5143
{
52-
if ($_SESSION['token'] == $csrf_got)
53-
{
54-
return TRUE;
55-
}
56-
else
57-
{
58-
return FALSE;
59-
}
44+
$s = new SECURITY;
45+
return $s->check_csrf($csrf_got);
6046
}
6147

6248
/**

‎ELI/process/api.php‎

Lines changed: 28 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,23 @@
11
<?php
22
header("Access-Control-Allow-Origin: *");
3+
header('Cache-Control: no-cache');
34
header('Content-Type: application/json');
45

5-
$aid = base64_encode("ajib777");
6+
$aid = base64_encode("aj818");
67
$csrf_got = @$_POST['csrf'];
78
$validateEmail = false; // VALIDATE EMAIL (true/false)
89
$url = page(PAGE);
910
$v = new VALIDATOR;
1011
$db = new DATABASE;
1112
$enablelog = TRUE;
1213
$api = new API;
14+
$s = new SECURITY;
1315

16+
$validkey = false;
1417
// working on API Key
15-
$apikey_default = (isset($_REQUEST['csrf']) && strlen($_REQUEST['csrf']) == 32) ? $_REQUEST['csrf'] : $api->getDefaultAPIKey();
18+
$apikey_default = (isset($_REQUEST['csrf']) && strlen($_REQUEST['csrf']) >= 32) ? $_REQUEST['csrf'] : $api->getDefaultAPIKey();
19+
20+
// var_dump($_REQUEST['apikey'] == $apikey_default || $_SESSION['token'] == $apikey_default);
1621

1722
if(isset($_REQUEST['apikey']) && strlen(@$_REQUEST['apikey']) == 32){
1823
// check for same server use
@@ -22,28 +27,30 @@
2227
else
2328
{
2429
// Check API Key
25-
$apikey = @$_REQUEST['apikey'];
30+
$apikey = @$_REQUEST['apikey'];
2631
$chkapi = $db->query("SELECT * FROM apilicense WHERE license='$apikey' AND expirydate >= date('now')
2732
","CMS");
28-
if(count($chkapi) > 0){
29-
$validkey = true;
30-
}
31-
else
32-
{
33-
$validkey = false;
34-
}
33+
if(count($chkapi) > 0){
34+
$validkey = true;
35+
}
36+
else
37+
{
38+
$validkey = false;
39+
}
3540
}
3641
}
37-
elseif(check_csrf($apikey_default)){
42+
43+
if(check_csrf($apikey_default) || $_SESSION['token'] == $apikey_default){
3844
// same origin // csrf check
3945
$validkey = true;
4046
}
41-
else
42-
{
43-
$err['error'] = "No API Key Provided";
44-
$err['success'] = false;
45-
die(json_encode($err));
47+
48+
// FREE CASES
49+
$casefree = explode(",","currentcsrf");
50+
if(isset($url[1]) && in_array($url[1],$casefree)){
51+
$validkey = true;
4652
}
53+
// =========
4754

4855
if(!$validkey){
4956
$err['error'] = "API key is not valid";
@@ -57,6 +64,10 @@
5764

5865
switch (@$url[1]){
5966

67+
case "currentcsrf":
68+
echo $s->csrf();
69+
break;
70+
6071
case "getprofilext":
6172
if(isset($_SESSION['user']['id']) && $url[1]!=""){
6273

@@ -182,8 +193,7 @@
182193
case "test":
183194
$tbl = "users";
184195
$res = $db->query("SELECT * FROM $tbl WHERE 1");
185-
echo "<pre>";
186-
print_r($res);
196+
echo json_encode($res);
187197
break;
188198

189199

‎ELI/process/post.php‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,30 @@
44
$v = new VALIDATOR;
55
$mail = new MAILER;
66
$db = new DATABASE;
7+
$req = new REQUEST;
78
$postedpage = $page[1];
89

910

1011
switch ($postedpage)
1112
{
13+
case "addusers":
14+
$tbl = "users";
15+
$formdata = $v->need("name,email,phone,password");
16+
$formdata['password'] = md5($formdata['password']);
17+
echo $req->addrow($tbl,$formdata,$required="name,email,phone,password",$unique="id",$successmsg="Successfully added data",$failmsg="Unable to add data",$duplicatemsg="Duplicate record found");
18+
break;
19+
20+
case "editusers":
21+
$tbl = "users";
22+
$formdata = $v->need("id,name,email,phone");
23+
echo $req->updaterow($tbl,$formdata,$required="id",$unique="id",$successmsg="Successfully updated data",$failmsg="Unable to update data",$duplicatemsg="Duplicate record found");
24+
break;
25+
26+
27+
case "google":
28+
$google = new GOOGLE;
29+
$google->glogin($page[2]);
30+
break;
1231

1332
case "signup":
1433
if (isset($_POST) && $v->required_fields("name,email,phone,password,cpassword") &&
@@ -219,7 +238,7 @@
219238

220239

221240
case "delrow":
222-
if(isset($_SESSION['user']['id']) && isset($page[2]) && isset($_POST['id']) && is_numeric($_POST['id']) && check_csrf($csrf_got))
241+
if(isset($_SESSION['user']['id']) && isset($page[2]) && isset($_POST['id']) && is_numeric($_POST['id']))
223242
{
224243
$id = $_POST['id'];
225244
// DELETE

‎ELI/process/url.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88
$page = explode('/',str_replace(_BASEURL_,'',@$_GET['url']) );
99
//print_r($page);
1010

11+
12+
1113
switch ($page[0]){
1214

1315
case "p":
@@ -105,6 +107,10 @@
105107

106108
if(isset($_GET['url']) && file_exists($pageurl) && $_GET['url']!="" )
107109
{
110+
if(isset($_SESSION['ssetoken'])){
111+
unset($_SESSION['ssetoken']);
112+
}
113+
108114
if(!in_array($PG,$avoid))
109115
{
110116
if(in_array($PG, $free)){

‎ELI/process/view.php‎

Lines changed: 99 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,117 @@
11
<?php
2-
$csrf_got = @$_POST['csrf'];
2+
header("Access-Control-Allow-Origin: *");
3+
header('Content-Type: text/event-stream');
4+
header('Cache-Control: no-cache');
5+
6+
7+
$db = new DATABASE;
8+
$sse = new SSE;
9+
10+
$csrf_got = @$_REQUEST['csrf'];
311
$validateEmail = false; // VALIDATE EMAIL (true/false)
412
$url = page(PAGE);
13+
$validkey = false;
14+
15+
16+
if(check_csrf($csrf_got)){
17+
$validkey = true;
18+
}
19+
20+
// FREE CASES
21+
$casefree = explode(",","test");
22+
if(isset($url[1]) && in_array($url[1],$casefree)){
23+
$validkey = true;
24+
}
25+
// =========
26+
27+
if(!$validkey){
28+
$err['error'] = "Token is not valid";
29+
$err['success'] = false;
30+
die(json_encode($err));
31+
}
32+
533
//print_r($url);
634
switch (@$url[1]){
735

8-
// Dummy
9-
case "categorylist":
10-
echo '<option value="0">Main</option>';
11-
$db = new DATABASE;
12-
$res = $db->query("SELECT c.id,c.category FROM category as c
13-
WHERE c.pid='0' AND c.status='1'");
14-
$tpl=new TEMPLATE;
15-
$template='<option value="{{id}}">{{category}}</option>';
16-
$list=$tpl->viewer($res,$template);
36+
// dummy1
37+
case "test":
38+
$msx = '<select name="" label="All Users" multiple>';
39+
$msx .= $tmp->viewer($db->query("SELECT * FROM users"),'<option value="{{id}}">{{name}}</option>',false,true);
40+
$msx .= '</select>';
41+
42+
$sse->seepreformat($msx);
43+
break;
44+
45+
// dummy2
46+
case "tbldata":
47+
$sql = @$url[2];
48+
$tbtn = @$url[3];
49+
$sqlquery = base64_decode($sql);
50+
$token = $_SESSION["token"];
51+
$template = '<tr template="" id="row{{id}}">
52+
<td class="status-field"><span onclick="statusupdate(this)" data-value="{{status}}" data-id="{{id}}" data-action="users" class="status {{statustxt}}">{{statustxt}}</span> {{name}}</td><td>{{email}}</td><td>{{phone}}</td>
53+
<td class="elitable-actions">
54+
<span class="mdi mdi-pencil btn blue white-text small" onclick="editData(this,\'#editusersmod\',\'getdatajson\')" data-t="users" csrf="'.$token.'" data-id="{{id}}"></span>
55+
<span class="mdi mdi-close btn red white-text small" onclick="delrow(this,\'#row\')" csrf="'.$token.'" data-id="{{id}}" data-action="users"></span>
56+
</td>
57+
</tr>';
58+
59+
$templatex = str_replace('template=""',"",$template);
60+
$tbldata = $template;
61+
$tbldata .= $tmp->viewer($db->query($sqlquery),$templatex,false,true);
62+
63+
$sse->seepreformat($tbldata);
64+
break;
65+
66+
// Option Field
67+
case "optionfield":
68+
// Example: "v/optionfield/tblname/columns|id|true";
69+
$tbl = @$url[2];
70+
$col = explode("|",$url[3]);
71+
72+
$val = (isset($col[1]))?$col[1] : 'id';
73+
$txt = (isset($col[0]))?$col[0] : 'id';
74+
75+
$where = " ";
76+
if(isset($col[2]) AND $col[2] == "true"){
77+
$where .= " status='1' ";
78+
}
79+
else
80+
{
81+
$where .=" 1 ";
82+
}
83+
84+
$xmsg = '<option value=""></option>';
85+
$res = $db->query("SELECT $val,$txt FROM $tbl
86+
WHERE $where ");
87+
$template='<option value="{{'.$val.'}}">{{'.$txt.'}}</option>';
88+
$xmsg .= $tmp->viewer($res,$template,false,true);
89+
90+
$data = array(
91+
'message' => base64_encode($xmsg),
92+
'timestamp' => time()
93+
);
94+
$sse->sendSSE($data);
95+
// Simulate a delay between updates
96+
// sleep(5);
97+
1798
break;
1899

19100
default:
20-
$pageurl = VIEW."$page";
101+
$pageurl = VIEW.end($url);
21102
if(file_exists($pageurl))
22103
{
23104
include($pageurl);
24105
}
25106
else
26107
{
27-
include(VIEW.'404.php');
108+
if(file_exists(VIEW.'404.php')){
109+
include(VIEW.'404.php');
110+
}
111+
else
112+
{
113+
echo "404 Error. Page not Found";
114+
}
28115
}
29116
break;
30117
}

0 commit comments

Comments
 (0)