RanchiMall/php-mpos
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wrapped KLogger

Browse Source
This commit is contained in:
xisi 2014-02-02 11:57:06 -05:00
parent e7bace5550
commit ca1ae6ba2c
10 changed files with 78 additions and 101 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
public/include/autoloader.inc.php
View File

@ -12,9 +12,7 @@ if (empty($config['algorithm']) || $config['algorithm'] == 'scrypt') {
// Default classes
require_once(CLASS_DIR . '/debug.class.php');
require_once(INCLUDE_DIR . '/lib/KLogger.php');
if ($config['logging']['enabled']) {
$log = new KLogger($config['logging']['path']."/".$config['logging']['file'], $config['logging']['level']);
}
require_once(CLASS_DIR . '/logger.class.php');
if ($config['mysql_filter']) {
require_once(CLASS_DIR . '/strict.class.php');
}

3
public/include/classes/invitation.class.php
View File

@ -114,12 +114,14 @@ class Invitation extends Base {
}
$aData['username'] = $this->user->getUserName($account_id);
$aData['subject'] = 'Pending Invitation';
$this->log->log("info", $this->user->getUserName($account_id)." sent an invitation from [".$_SERVER['REMOTE_ADDR']."]");
if ($this->mail->sendMail('invitations/body', $aData)) {
$aToken = $this->token->getToken($aData['token'], 'invitation');
if (!$this->createInvitation($account_id, $aData['email'], $aToken['id']))
return false;
return true;
} else {
$this->log->log("warn", $this->user->getUserName($account_id)." sent an invitation but the mailing failed from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage($this->getErrorMsg('E0028'));
}
$this->setErrorMessage($this->getErrorMsg('E0029'));
@ -130,6 +132,7 @@ class Invitation extends Base {
// Instantiate class
$invitation = new invitation();
$invitation->setDebug($debug);
$invitation->setLog($log);
$invitation->setMysql($mysqli);
$invitation->setMail($mail);
$invitation->setUser($user);

29
public/include/classes/logger.class.php Normal file
View File

@ -0,0 +1,29 @@
<?php
class Logger {
private $KLogger;
private $logging = false;
public function __construct($config) {
if ($config['logging']['enabled'] && $config['logging']['level'] > 0) {
$this->KLogger = new KLogger($config['logging']['path']."/".$config['logging']['file'], $config['logging']['level']);
$this->logging = true;
}
}
public function log($type, $message) {
if ($this->logging) {
switch ($type) {
case 'info':
$this->KLogger->LogInfo($message);
break;
case 'warn':
$this->KLogger->LogWarn($message);
break;
}
return true;
} else {
return true;
}
}
}
$log = new Logger($config);
?>

4
public/include/classes/notification.class.php
View File

@ -120,9 +120,7 @@ class Notification extends Mail {
$this->setErrorMessage($this->getErrorMsg('E0047', $failed));
return $this->sqlError();
}
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo("User $account_id updated notification settings from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", "User $account_id updated notification settings from [".$_SERVER['REMOTE_ADDR']."]");
return true;
}

8
public/include/classes/payout.class.php
View File

@ -45,16 +45,12 @@ class Payout Extends Base {
if ($delete) {
return true;
} else {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo("User $account_id requested manual payout but the token deletion failed from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", "User $account_id requested manual payout but the token deletion failed from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage('Unable to delete token');
return false;
}
} else {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo("User $account_id requested manual payout using an invalid token from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", "User $account_id requested manual payout using an invalid token from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage('Invalid token');
return false;
}

118
public/include/classes/user.class.php
View File

@ -69,23 +69,17 @@ class User extends Base {
}
public function changeNoFee($id) {
$field = array('name' => 'no_fees', 'type' => 'i', 'value' => !$this->isNoFee($id));
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($id)." changed no_fees to ".$this->isNoFee($id)." from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($id)." changed no_fees to ".$this->isNoFee($id)." from [".$_SERVER['REMOTE_ADDR']."]");
return $this->updateSingle($id, $field);
}
public function setLocked($id, $value) {
$field = array('name' => 'is_locked', 'type' => 'i', 'value' => $value);
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($id)." changed is_locked to $value from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($id)." changed is_locked to $value from [".$_SERVER['REMOTE_ADDR']."]");
return $this->updateSingle($id, $field);
}
public function changeAdmin($id) {
$field = array('name' => 'is_admin', 'type' => 'i', 'value' => !$this->isAdmin($id));
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($id)." changed is_admin to ".$this->isAdmin($id)." from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($id)." changed is_admin to ".$this->isAdmin($id)." from [".$_SERVER['REMOTE_ADDR']."]");
return $this->updateSingle($id, $field);
}
public function setUserFailed($id, $value) {
@ -154,10 +148,8 @@ class User extends Base {
$lastLoginTime = $this->getLastLogin($uid);
$this->updateLoginTimestamp($uid);
$getIPAddress = $this->getUserIp($uid);
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
if ($getIPAddress !== $_SERVER['REMOTE_ADDR']) {
$this->log->LogWarn("$username has logged in with a different IP [".$_SERVER['REMOTE_ADDR']."] saved is [$getIPAddress]");
}
if ($getIPAddress !== $_SERVER['REMOTE_ADDR']) {
$this->log->log("warn", "$username has logged in with a different IP [".$_SERVER['REMOTE_ADDR']."] saved is [$getIPAddress]");
}
$setIPAddress = $this->setUserIp($uid, $_SERVER['REMOTE_ADDR']);
$this->createSession($username, $getIPAddress, $lastLoginTime);
@ -186,17 +178,13 @@ class User extends Base {
}
}
$this->setErrorMessage("Invalid username or password");
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo("$username failed login from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", "$username failed login from [".$_SERVER['REMOTE_ADDR']."]");
if ($id = $this->getUserId($username)) {
$this->incUserFailed($id);
// Check if this account should be locked
if (isset($this->config['maxfailed']['login']) && $this->getUserFailed($id) >= $this->config['maxfailed']['login']) {
$this->setLocked($id, 1);
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn("$username locked via failed logins from [".$_SERVER['REMOTE_ADDR']."] saved is [".$this->getUserIp($this->getUserId($username))."]");
}
$this->log->log("warn", "$username locked via failed logins from [".$_SERVER['REMOTE_ADDR']."] saved is [".$this->getUserIp($this->getUserId($username))."]");
if ($token = $this->token->createToken('account_unlock', $id)) {
$aData['token'] = $token;
$aData['username'] = $username;
@ -225,16 +213,12 @@ class User extends Base {
$this->setUserPinFailed($userId, 0);
return ($pin_hash === $row_pin);
}
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo($this->getUserName($userId)." incorrect pin from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", $this->getUserName($userId)." incorrect pin from [".$_SERVER['REMOTE_ADDR']."]");
$this->incUserPinFailed($userId);
// Check if this account should be locked
if (isset($this->config['maxfailed']['pin']) && $this->getUserPinFailed($userId) >= $this->config['maxfailed']['pin']) {
$this->setLocked($userId, 1);
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userId)." was locked via incorrect pins from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userId)." was locked via incorrect pins from [".$_SERVER['REMOTE_ADDR']."]");
if ($token = $this->token->createToken('account_unlock', $userId)) {
$username = $this->getUserName($userId);
$aData['token'] = $token;
@ -263,22 +247,16 @@ class User extends Base {
if ($this->checkStmt($stmt) && $stmt->bind_param('sis', $newpin, $userID, $current) && $stmt->execute()) {
if ($stmt->errno == 0 && $stmt->affected_rows === 1) {
if ($this->mail->sendMail('pin/reset', $aData)) {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo($this->getUserName($userID)." was sent a pin reset from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", $this->getUserName($userID)." was sent a pin reset from [".$_SERVER['REMOTE_ADDR']."]");
return true;
} else {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." request a pin reset but the mailing failed from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." request a pin reset but the mailing failed from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage('Unable to send mail to your address');
return false;
}
}
}
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." incorrect pin reset attempt from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." incorrect pin reset attempt from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage( 'Unable to generate PIN, current password incorrect?' );
return false;
}
@ -353,22 +331,16 @@ class User extends Base {
default:
$aData['subject'] = '';
}
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo($this->getUserName($userID)." was sent a $strType token from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", $this->getUserName($userID)." was sent a $strType token from [".$_SERVER['REMOTE_ADDR']."]");
if ($this->mail->sendMail('notifications/'.$strType, $aData)) {
return true;
} else {
$this->setErrorMessage('Failed to send the notification');
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." requested a $strType token but the mailing failed from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." requested a $strType token but the mailing failed from [".$_SERVER['REMOTE_ADDR']."]");
return false;
}
}
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." attempted to request multiple $strType tokens from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." attempted to request multiple $strType tokens from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage('A request has already been sent to your e-mail address. Please wait an hour for it to expire.');
return false;
}
@ -398,21 +370,15 @@ class User extends Base {
$tValid = $this->token->isTokenValid($userID, $strToken, 6);
if ($tValid) {
if ($this->token->deleteToken($strToken)) {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo($this->getUserName($userID)." deleted change password token from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", $this->getUserName($userID)." deleted change password token from [".$_SERVER['REMOTE_ADDR']."]");
// token deleted, continue
} else {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." change password token failed to delete from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." change password token failed to delete from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage('Token deletion failed');
return false;
}
} else {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." attempted to use an invalid change password token from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." attempted to use an invalid change password token from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage('Invalid token');
return false;
}
@ -422,16 +388,14 @@ class User extends Base {
$stmt->bind_param('sis', $new, $userID, $current);
$stmt->execute();
if ($stmt->errno == 0 && $stmt->affected_rows === 1) {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo($this->getUserName($userID)." updated password from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", $this->getUserName($userID)." updated password from [".$_SERVER['REMOTE_ADDR']."]");
return true;
}
$stmt->close();
}
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." incorrect password update attempt from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." incorrect password update attempt from [".$_SERVER['REMOTE_ADDR']."]");
$this->setErrorMessage( 'Unable to update password, current password wrong?' );
return false;
}
@ -501,21 +465,15 @@ class User extends Base {
$tValid = $this->token->isTokenValid($userID, $strToken, 5);
if ($tValid) {
if ($this->token->deleteToken($strToken)) {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo($this->getUserName($userID)." deleted account update token for [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", $this->getUserName($userID)." deleted account update token for [".$_SERVER['REMOTE_ADDR']."]");
} else {
$this->setErrorMessage('Token deletion failed');
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." updated their account details but token deletion failed from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." updated their account details but token deletion failed from [".$_SERVER['REMOTE_ADDR']."]");
return false;
}
} else {
$this->setErrorMessage('Invalid token');
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn($this->getUserName($userID)." attempted to use an invalid token account update token from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", $this->getUserName($userID)." attempted to use an invalid token account update token from [".$_SERVER['REMOTE_ADDR']."]");
return false;
}
}
@ -523,9 +481,7 @@ class User extends Base {
// We passed all validation checks so update the account
$stmt = $this->mysqli->prepare("UPDATE $this->table SET coin_address = ?, ap_threshold = ?, donate_percent = ?, email = ?, is_anonymous = ? WHERE id = ?");
if ($this->checkStmt($stmt) && $stmt->bind_param('sddsii', $address, $threshold, $donate, $email, $is_anonymous, $userID) && $stmt->execute()) {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogInfo($this->getUserName($userID)." updated their account details from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("info", $this->getUserName($userID)." updated their account details from [".$_SERVER['REMOTE_ADDR']."]");
return true;
}
// Catchall
@ -587,6 +543,9 @@ class User extends Base {
$_SESSION['AUTHENTICATED'] = '1';
// $this->user from checkUserPassword
$_SESSION['USERDATA'] = $this->user;
if ($this->config['protect_session_state']) {
$_SESSION['STATE'] = md5($_SESSION['USERDATA']['username'].$_SESSION['USERDATA']['id'].$_SERVER['HTTP_USER_AGENT']);
}
}
/**
@ -741,6 +700,7 @@ class User extends Base {
$invitation = new Invitation();
$invitation->setMysql($this->mysqli);
$invitation->setDebug($this->debug);
$invitation->setLog($this->log);
$invitation->setUser($this);
$invitation->setConfig($this->config);
if (!$invitation->setActivated($aToken['id'])) {
@ -749,6 +709,7 @@ class User extends Base {
}
if (!$this->token->deleteToken($strToken)) {
$this->setErrorMessage('Unable to remove used token');
$this->log->log("warn", "$username tried to register but the token failed to delete [".$_SERVER['REMOTE_ADDR']."]");
return false;
}
}
@ -869,12 +830,10 @@ class User extends Base {
}
$aData['username'] = $this->getUserName($this->getUserId($username, true));
$aData['subject'] = 'Password Reset Request';
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
if ($_SERVER['REMOTE_ADDR'] !== $this->getUserIp($this->getUserId($username, true))) {
$this->log->LogWarn("$username requested password reset from [".$_SERVER['REMOTE_ADDR']."] saved is [".$this->getUserIp($this->getUserId($username, true))."]");
} else {
$this->log->LogInfo("$username requested password reset from [".$_SERVER['REMOTE_ADDR']."] saved is [".$this->getUserIp($this->getUserId($username, true))."]");
}
if ($_SERVER['REMOTE_ADDR'] !== $this->getUserIp($this->getUserId($username, true))) {
$this->log->log("warn", "$username requested password reset from [".$_SERVER['REMOTE_ADDR']."] saved is [".$this->getUserIp($this->getUserId($username, true))."]");
} else {
$this->log->log("info", "$username requested password reset from [".$_SERVER['REMOTE_ADDR']."] saved is [".$this->getUserIp($this->getUserId($username, true))."]");
}
if ($this->mail->sendMail('password/reset', $aData)) {
return true;
@ -896,12 +855,11 @@ public function isAuthenticated($logout=true) {
$this->debug->append("STA " . __METHOD__, 4);
if (@$_SESSION['AUTHENTICATED'] == true &&
!$this->isLocked($_SESSION['USERDATA']['id']) &&
$this->getUserIp($_SESSION['USERDATA']['id']) == $_SERVER['REMOTE_ADDR']
$this->getUserIp($_SESSION['USERDATA']['id']) == $_SERVER['REMOTE_ADDR'] &&
(!$this->config['protect_session_state'] || ($this->config['protect_session_state'] && $_SESSION['STATE'] == md5($_SESSION['USERDATA']['username'].$_SESSION['USERDATA']['id'].$_SERVER['HTTP_USER_AGENT'])))
) return true;
// Catchall
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$this->log->LogWarn("Forcing logout, user is locked or IP changed mid session from [".$_SERVER['REMOTE_ADDR']."]");
}
$this->log->log("warn", "Forcing logout, user is locked or IP changed mid session from [".$_SERVER['REMOTE_ADDR']."] [hijack attempt?]");
if ($logout == true) $this->logoutUser();
return false;
}

1
public/include/config/security.inc.dist.php
View File

@ -8,6 +8,7 @@ $defflip = (!cfip()) ? exit(header('HTTP/1.1 401 Unauthorized')) : 1;
**/
$config['https_only'] = false;
$config['mysql_filter'] = true;
$config['protect_session_state'] = false;
/**
* Logging

4
public/include/pages/account/edit.inc.php
View File

@ -99,9 +99,7 @@ if ($user->isAuthenticated()) {
} else {
$aBalance = $transaction->getBalance($_SESSION['USERDATA']['id']);
$dBalance = $aBalance['confirmed'];
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$user->log->LogInfo($_SESSION['USERDATA']['username']." requesting manual payout from [".$_SERVER['REMOTE_ADDR']."]");
}
$user->log->log("info", $_SESSION['USERDATA']['username']." requesting manual payout from [".$_SERVER['REMOTE_ADDR']."]");
if ($dBalance > $config['txfee_manual']) {
if (!$oPayout->isPayoutActive($_SESSION['USERDATA']['id'])) {
if (!$config['csrf']['enabled'] || $config['csrf']['enabled'] && $csrftoken->valid) {

4
public/include/pages/admin/settings.inc.php
View File

@ -8,9 +8,7 @@ if (!$user->isAuthenticated() || !$user->isAdmin($_SESSION['USERDATA']['id'])) {
}
if (@$_REQUEST['do'] == 'save' && !empty($_REQUEST['data'])) {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$user->log->LogWarn($_SESSION['USERDATA']['username']." changed admin settings from [".$_SERVER['REMOTE_ADDR']."]");
}
$user->log->log("warn", @$_SESSION['USERDATA']['username']." changed admin settings from [".$_SERVER['REMOTE_ADDR']."]");
foreach($_REQUEST['data'] as $var => $value) {
$setting->setValue($var, $value);
}

4
public/index.php
View File

@ -59,9 +59,7 @@ if ($config['memcache']['enabled'] && $config['mc_antidos']['enabled']) {
$session_start = @session_start();
session_set_cookie_params(time()+$config['cookie']['duration'], $config['cookie']['path'], $config['cookie']['domain'], $config['cookie']['secure'], $config['cookie']['httponly']);
if (!$session_start) {
if ($this->config['logging']['enabled'] && $this->config['logging']['level'] > 0) {
$log->LogInfo("Forcing session id regeneration for ".$_SERVER['REMOTE_ADDR']." [hijack attempt?]");
}
$log->log("info", "Forcing session id regeneration for ".$_SERVER['REMOTE_ADDR']." [hijack attempt?]");
session_destroy();
session_regenerate_id(true);
session_start();