7 Commits

10 changed files with 279 additions and 141 deletions

View File

@@ -255,7 +255,7 @@ logextra( "Host ID was found \"$host_id\"" );
$provided_host_name = urldecode( $decoded_json["host_name"] );
if ( empty( $provided_host_name ) or strlen( $provided_host_name ) < 3 or strlen( $provided_host_name ) > 50 ) {
if ( empty( $provided_host_name ) or strlen( $provided_host_name ) < 2 or strlen( $provided_host_name ) > 50 ) {
problem("host_name length is not correct");
}

View File

@@ -2,7 +2,7 @@
require "/home/hpr/php/include.php";
if ( $_SERVER['REQUEST_METHOD'] !== 'GET' ) {
naughty("438a220a58dc34c200a8669547afc66b");
naughty("438a220a58dc34c200a8669547afc66b REQUEST_METHOD not supported");
}
$num_get_args=0;
@@ -12,7 +12,7 @@ foreach($_GET as $k => $v) {
if ( $num_get_args !== 2 ){
$result = mysqli_query($connection, "SET time_zone = '+0:00';");
if (!isset($result)) {
naughty("cca6408ae1febc3f07974177b2d04375");
naughty("cca6408ae1febc3f07974177b2d04375 DB Error");
}
header("Content-type: text/csv");
@@ -26,18 +26,18 @@ if ( $num_get_args !== 2 ){
}
}
else {
naughty("2dcabda45255713ea9bf04523e804016");
naughty("2dcabda45255713ea9bf04523e804016 Query error");
}
mysqli_close($connection);
exit;
}
if ( empty($_GET["ep_num"]) or empty($_GET["status"]) ) {
naughty("32bedea129648f27701f2f2f3ff4b7b5");
naughty("32bedea129648f27701f2f2f3ff4b7b5 Empty ep_num or status");
}
if ( !in_array($_GET["status"], array('METADATA_PROCESSED','SHOW_POSTED','MEDIA_TRANSCODED','UPLOADED_TO_IA','UPLOADED_TO_RSYNC_NET','REMOVE_RESERVATION'), true ) ) {
naughty("88882bc97094e7aabf2a258756f917f5 ");
naughty("88882bc97094e7aabf2a258756f917f5 Wrong enum status");
}
else {
$status = $_GET["status"];
@@ -47,7 +47,7 @@ if ( !empty($_GET["ep_num"]) and isset( $_GET["ep_num"] ) ) {
$ep_num = intval( $_GET["ep_num"] );
}
else {
naughty("ecb0ebc5b38b4c09226ccbfce05978cb");
naughty("ecb0ebc5b38b4c09226ccbfce05978cb ep_num not correct");
}
// // SELECT MAX(ep_num) FROM `reservations` → 3627
@@ -55,7 +55,7 @@ else {
//
$result = mysqli_query($connection, 'SELECT MAX(ep_num) FROM `reservations`;');
if (!isset($result)) {
naughty("360e6381ffca736b6f12056abd7dcc7d");
naughty("360e6381ffca736b6f12056abd7dcc7d Cant get max from db");
}
$max_eps_array = mysqli_fetch_row( $result );
$max_eps = $max_eps_array[0];
@@ -63,22 +63,22 @@ mysqli_free_result($result);
$result = mysqli_query($connection, 'SELECT MIN(ep_num) FROM `reservations` WHERE ep_num > 0;');
if (!isset($result)) {
naughty("6971b6d378292e8fc9583de6082eddf4");
naughty("6971b6d378292e8fc9583de6082eddf4 Cant get min from db");
}
$min_eps_array = mysqli_fetch_row( $result );
$min_eps = $min_eps_array[0];
mysqli_free_result($result);
if ( empty( $ep_num ) ) {
naughty("6cf46a9b21e667c61b2c5bf87a7104f9 $ep_num");
naughty("6cf46a9b21e667c61b2c5bf87a7104f9 Empty ep_num");
}
if ( $ep_num < $min_eps ) {
naughty("bbcef7cd8a263dc57e85195935ad600a $ep_num < $min_eps");
naughty("bbcef7cd8a263dc57e85195935ad600a Invalid $ep_num < $min_eps");
}
if ( $ep_num > $max_eps ) {
naughty("a75115f3fa706ceee4b61971cd22b8f9 $ep_num > $max_eps");
naughty("a75115f3fa706ceee4b61971cd22b8f9 Invalid $ep_num > $max_eps");
}
// SHOW_SUBMITTED → METADATA_PROCESSED → SHOW_POSTED → MEDIA_TRANSCODED → UPLOADED_TO_IA → UPLOADED_TO_RSYNC_NET
@@ -113,19 +113,19 @@ switch ($status) {
$result = mysqli_query($connection, "SELECT ep_num FROM reservations WHERE `ep_num` = '$ep_num' AND status='$current_status';");
if (!isset($result)) {
naughty("7f2d7228ca355be6dd2a24769595b18f");
naughty("7f2d7228ca355be6dd2a24769595b18f Cant get reservation");
}
$db_ep_num_array = mysqli_fetch_row( $result );
$db_ep_num = $db_ep_num_array[0];
mysqli_free_result($result);
if ( $db_ep_num != $ep_num ){
problem("da59731c6ae6d1ce0fa2fa9fc4e1e726 $db_ep_num != $ep_num");
problem("da59731c6ae6d1ce0fa2fa9fc4e1e726 Error $db_ep_num != $ep_num");
}
$query = "UPDATE reservations SET `status` = '$status' WHERE `ep_num` = '$ep_num' AND status='$current_status';";
$result = mysqli_query($connection, $query );
if(!isset($result)) {
problem("8a76bb408877b1d33bf31ea96b6fc02f");
problem("8a76bb408877b1d33bf31ea96b6fc02f Could not UPDATE Reservation");
}
if (mysqli_errno( $connection )) {
$error = "MySQL error ".mysqli_errno( $connection).": ".mysqli_error($connection)."\n";

View File

@@ -10,53 +10,53 @@ foreach($_GET as $k => $v) {
if ( $num_get_args > 0 ){
# they didn't supply any arguments
naughty("9e756ee22b7cdcdb150a5baf167caa25 $num_get_args");
naughty("9e756ee22b7cdcdb150a5baf167caa25 No arguments provided $num_get_args");
}
if ( empty($_POST["anti_spam_question"]) ) {
naughty("0601a23e358374c293b086bb75606cca");
naughty("0601a23e358374c293b086bb75606cca You failed the anti spam question");
}
if ( strlen($_POST["anti_spam_question"]) !== 6 ) {
naughty("6f51e6e7e6820b3fdda5d4ca0df14db1");
naughty("6f51e6e7e6820b3fdda5d4ca0df14db1 You're making up spam questions");
}
if (strcasecmp('public', $_POST["anti_spam_question"]) !== 0) {
naughty("6aef421ce05e3ac34f4cd91ae3248a45");
naughty("6aef421ce05e3ac34f4cd91ae3248a45 You don't know what P is in HPR");
}
if ( ! file_exists( $comment_directory ) ) {
# Looks like the comments directory has not been created
naughty("d5342ea497f701656433e81fb5eed064");
naughty("d5342ea497f701656433e81fb5eed064 Comment file could not be created");
}
$unprocessed_comments = iterator_count(new FilesystemIterator("$comment_directory", FilesystemIterator::SKIP_DOTS));
if( $unprocessed_comments >= 10 ) {
# There has to be at least one comment here as they are calling the script, and too many is suspicious
naughty("093f42abee30e69e0e4d5125c70a0f7c");
naughty("093f42abee30e69e0e4d5125c70a0f7c Too many unprocessed comments - shutting myself down");
}
# This is to prevent anything except hits from the web form.
# Anyone wanting to script uploads can do so via ftp
if ( $_SERVER['REQUEST_METHOD'] !== 'POST' ) {
naughty("87613fc139b251b673e1dd51e378e462");
naughty("87613fc139b251b673e1dd51e378e462 Must be a POST");
}
if ( empty($_SERVER["REMOTE_ADDR"]) ) {
naughty("d7d0b6ab9689be244e1b6a8fbe6effba");
naughty("d7d0b6ab9689be244e1b6a8fbe6effba Missing remote address");
}
else {
$ip = $_SERVER["REMOTE_ADDR"];
}
if (count($_POST) !== 8) {
naughty("086fe155b0588de68fc5d9e4580254a8");
naughty("086fe155b0588de68fc5d9e4580254a8 Not correct number of fields");
}
// Basic POST Checks
if ( empty($_POST["comment_author_name"]) or strlen($_POST["comment_author_name"]) > 40 or strtolower($_POST["comment_author_name"]) == "testdog" ) {
naughty("294356cd36d3f9b75da4d8c0a6108881");
naughty("294356cd36d3f9b75da4d8c0a6108881 Your name wrong");
}
$comment_author_name = $_POST["comment_author_name"];
$comment_author_name_json = json_encode( $_POST["comment_author_name"] );
@@ -69,7 +69,7 @@ else {
}
if ( empty($_POST["comment_title"]) or strlen($_POST["comment_title"]) > 100 ) {
naughty("a89efb428cfe36996a65b371d5f4e303");
naughty("a89efb428cfe36996a65b371d5f4e303 The title is too long");
}
$comment_title = $_POST["comment_title"];
$comment_title_json = json_encode( $_POST["comment_title"] );
@@ -82,7 +82,7 @@ else {
}
if ( empty($_POST["comment_text"]) or strlen($_POST["comment_text"]) > 2000 or strpos(strtolower($_POST["comment_text"]), "outlook.con") !== false ) {
naughty("cd57ab4d7b77a131ed3deb441bd93dcd");
naughty("cd57ab4d7b77a131ed3deb441bd93dcd The comment text is too verbose. Record a show instead.");
}
$comment_text = $_POST["comment_text"];
$comment_text_json = json_encode( $_POST["comment_text"] );
@@ -95,7 +95,7 @@ else {
}
if ( empty($_POST["spammer"]) or strcmp($_POST["spammer"], "No") !== 0 ) {
naughty("b2ec68bd04cee0f64143ce4827a97e7c");
naughty("b2ec68bd04cee0f64143ce4827a97e7c You selected that you were a spammer");
}
# We check to see if the eps_id has been suplied, that it's a integer, and that it's in our range.
@@ -108,13 +108,13 @@ if (isset($_POST['eps_id'])){
$row = mysqli_fetch_array($result, MYSQLI_NUM);
$total = $row[0];
if ( !isset($result) or ( $total != 1 ) ) {
naughty("5348e3c2aee3644730c70d3f000bcb01");
naughty("5348e3c2aee3644730c70d3f000bcb01 No response from the db");
}
mysqli_free_result($result);
$result = mysqli_query($connection, 'SELECT MAX(id) as max FROM eps;');
if (!isset($result)) {
naughty("f00fb1f47affc3286aadc15038cfd5d7");
naughty("f00fb1f47affc3286aadc15038cfd5d7 Could not find the max id");
}
while ($row = mysqli_fetch_array($result)) {
$max_eps = $row['max'];
@@ -122,19 +122,19 @@ if (isset($_POST['eps_id'])){
mysqli_free_result($result);
}
else {
naughty("02c560adf1ff39b140fe8b7abe02fd31");
naughty("02c560adf1ff39b140fe8b7abe02fd31 Commenting on a non existant show is odd");
}
if ( intval($eps_id) <= 0 ){
naughty("2903eeac51bb479edb428ae3c896671c");
naughty("2903eeac51bb479edb428ae3c896671c Commenting on a non show with ID less than zero is odd");
}
if ( intval($eps_id) > $max_eps ){
naughty("54aa65c12ba71f3dfc451ff5bc82c798");
naughty("54aa65c12ba71f3dfc451ff5bc82c798 Commenting on a show that is more than our posted episodes is odd");
}
if ( intval($eps_id) === 0 ) {
naughty("11fe1f9b76bf9f30e6a3a784832cb738");
naughty("11fe1f9b76bf9f30e6a3a784832cb738 Commenting on a show zero is odd");
}
else {
$eps_id = intval($eps_id);
@@ -155,16 +155,16 @@ if ($result = mysqli_query($connection, $query)) {
}
}
else {
naughty("c34561d684ad97241c95a1287688638b");
naughty("c34561d684ad97241c95a1287688638b Could not get the hosts from the db");
}
mysqli_free_result($result);
if ( empty($_POST["hostid"]) or intval($_POST["hostid"]) != $host_id ) {
naughty("b4d71481b7055272728094292fd2a562");
naughty("b4d71481b7055272728094292fd2a562 Cant find that host id");
}
if ( empty($_POST["justification"]) or strlen($_POST["justification"]) > 200 or strlen($_POST["justification"]) < 20) {
naughty("156d2d2d5780bd7f4a750f7c162b3394");
naughty("156d2d2d5780bd7f4a750f7c162b3394 You need to have a sufficently long justification.");
}
# Checks to see how old the show is
@@ -173,7 +173,7 @@ list ($current_episode_date, $current_episode_number) = GetLatestPublishedShow($
if ( ( $eps_id <= $current_episode_number ) and ( $eps_id >= ( $current_episode_number - 20 ) ) ) {
if ( strcmp($_POST["justification"], "No justification is asked for or required.") !== 0 ) {
naughty("9357d78bf73b03ee2dd902a4c975f91d");
naughty("9357d78bf73b03ee2dd902a4c975f91d You're saying No justification on a show that requires justification");
}
else {
$justification = "Current Comment";
@@ -183,7 +183,7 @@ if ( ( $eps_id <= $current_episode_number ) and ( $eps_id >= ( $current_episode_
else {
if ( strcmp($_POST["justification"], "No justification is asked for or required.") === 0 ) {
print ">" . $_POST["justification"] ."< eps_id: $eps_id, current_episode_number: $current_episode_number, ";
naughty("df4af9bdd0302f672d6311c76bdc461a");
naughty("df4af9bdd0302f672d6311c76bdc461a A current comment should not require Justification");
}
else {
$justification = $_POST["justification"];
@@ -199,7 +199,7 @@ else {
}
if ( empty($_SERVER["REMOTE_ADDR"]) ) {
naughty("611144d4c0d575fffbf8f3ef11f8ad68");
naughty("611144d4c0d575fffbf8f3ef11f8ad68 Missing REMOTE_ADDR");
}
else {
$ip = $_SERVER["REMOTE_ADDR"];
@@ -216,7 +216,7 @@ $timestamp = $timestamp;
$timestamp_json = json_encode($timestamp);
$comment_key_json = json_encode( $key );
if ( file_exists( $comment_file ) ) {
naughty("ef5d14b33b262bfbf5d40544fdeb9ec3");
naughty("ef5d14b33b262bfbf5d40544fdeb9ec3 File already exists");
}
$comment_data = "{
@@ -233,7 +233,7 @@ $comment_data = "{
file_put_contents($comment_file, $comment_data );
if ( filesize( $comment_file ) > 4000 ) {
naughty("56e00e793a27168511d1cfda11d3bc55");
naughty("56e00e793a27168511d1cfda11d3bc55 Filesize is too big");
}
$user_agent = preg_replace('/ \(/', "\n", $_SERVER["HTTP_USER_AGENT"] );

View File

@@ -349,7 +349,7 @@ article > p,
2px 4px 4px var(--shadow-cards);
transition: 0.3s;
flex: 1 0 100%;
overflow-x: scroll;
overflow: auto;
padding-bottom: 1rem;
}
.lane > article:hover,
@@ -363,7 +363,7 @@ article > p,
margin-right: 1rem;
}
.lane > article > header,
.lane > article > h3 {
.lane > article > h3:first-child {
background: var(--background-secondary);
padding: 1.5rem 1rem 1rem 1rem;
margin: 0;
@@ -371,12 +371,25 @@ article > p,
font-size: 1.45rem;
color: var(--background-primary);
}
.lane > article > header > .index-link {
float: right;
}
.lane.stack > article {
border-radius: 0.5rem;
border: thin solid var(--background-secondary);
max-width: calc(100vw - 12px);
}
.lane.stack > article > header,
.lane.stack > article > h3:first-child {
border-top-left-radius: 0.5rem;
border-top-right-radius: 0.5rem;
}
.lane > article > header a,
.lane > article > h3 a {
.lane > article > h3:first-child a {
color: var(--link-secondary);
}
.lane > article > header a:hover,
.lane > article > h3:hover {
.lane > article > h3:first-child:hover {
color: var(--link-secondary-hover);
}
.lane.stack> * > header * {
@@ -595,8 +608,8 @@ fieldset > table td input[type="radio"] {
}
#youtube {
--video-ratio: calc(390 / 640);
width: min(calc(95vw + 0px), 640px);
height: min(calc(calc(95vw + 0px) * var(--video-ratio)), 320px);
width: min(calc(89vw + 0px), 640px);
height: min(calc(calc(89vw + 0px) * var(--video-ratio)), 390px);
}
#upload_method pre {
max-width: 80vw;
@@ -828,3 +841,39 @@ fieldset > table td input[type="radio"] {
max-width: 30%;
}
}
@media (prefers-color-scheme: dark) {
:root {
--link-primary: #bbdfe7;
--link-header-hover: #b54c08; /* original --link-primary-hover */;
--link-primary-hover: var(--link-secondary-hover);
--background-primary: #4d4d4d; /* HPR Grey */
--text-primary: #dfdfdf /*#fffff7#fafafa#fbfbee #dfdfdf */;
--banner-text-primary: #b6b6b6;
--shadow-secondary-color: hsl(0, 0%, 40%);
--input-border-primary: var(--shadow-secondary-color);
--lane-button-color: #d5e6ea;
}
body > header {
background-image: url("/images/main-header-background-dark.png");
background-color: #22545a;
}
img {
filter: brightness(0.70);
}
a.lane-button {
background-image: url("/images/lane-button-background-dark.png");
color: var(--lane-button-color);
}
a.lane-button img {
filter: none;
}
.lane > article > header {
color: var(--text-secondary);
}
#title a:hover {
color: var(--link-header-hover);
}
#hosts td:nth-child(-n+2) {
color: var(--text-primary);
}
}

File diff suppressed because one or more lines are too long

After

Width:  |  Height:  |  Size: 96 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 529 KiB

View File

@@ -112,24 +112,24 @@ if (isset($_GET['id'])){
}
if ( strval( intval( $id ) ) != strval( $id ) ) {
naughty("e015b7c89da03385a9156d3e5d2eb25d");
naughty("e015b7c89da03385a9156d3e5d2eb25d The id is not a integer");
}
if ( intval( $id ) <= 0 ) {
naughty("1493a07dec01a006d11bf43d2f17e5aa");
naughty("1493a07dec01a006d11bf43d2f17e5aa The ID is less than or equal to one");
}
if ( $num_get_args > 2 ) {
naughty("79543dbb498ec47404aaed4d56bdc22b");
naughty("79543dbb498ec47404aaed4d56bdc22b The number of arguments is greater than 2");
}
if ( intval($id) > 9999 ) {
naughty("f1f531c768f64404cb00437254b06d71");
naughty("f1f531c768f64404cb00437254b06d71 The id is too high");
}
if ( $id != 9999 ) {
if ( isset( $show_array[$id] ) ) {
naughty("2227263ac7171aca3214d155dec539ad");
naughty("2227263ac7171aca3214d155dec539ad The id is still too high");
}
}
}

View File

@@ -10,23 +10,23 @@ $total = $row[0];
if(!isset($total) or $total > 150 ) {
# This seems to indicate that we are under an attack as we never get 5 shows in the one day from different hosts.
# A host doing bulk upload will need to do them one by one
naughty("5971624889258aefb44e5f7bf8dffbd4");
naughty("5971624889258aefb44e5f7bf8dffbd4 Too many requests - shutting down");
}
# This is to prevent anything except hits from the web form.
if ( $_SERVER['REQUEST_METHOD'] !== 'POST' ) {
naughty("19e9019c9615f755aec834000892ee9e");
naughty("19e9019c9615f755aec834000892ee9e Request method is not POST");
}
if ( empty($_SERVER["REMOTE_ADDR"]) ) {
naughty("9bb147a251e8db132dafa93d98f8487f");
naughty("9bb147a251e8db132dafa93d98f8487f The REMOTE_ADDR is missing");
}
else {
$ip = $_SERVER["REMOTE_ADDR"];
}
if (count($_POST) !== 2) {
naughty("02de1aef3b9490a417c39170d8f06028");
naughty("02de1aef3b9490a417c39170d8f06028 The post contains the incorrect number of entries");
}
# This will check to see if there are any existing requests from this ip address
@@ -36,58 +36,58 @@ $db = mysqli_fetch_array($result, MYSQLI_ASSOC);
if ( empty($db["ip"]) ) {
# the request did not come via the web form
naughty("2162941738512bfdb1d21f288ee7cdb4");
naughty("2162941738512bfdb1d21f288ee7cdb4 There is no reservation available for this ip");
}
if ( strtotime($db['timestamp']) >= $_SERVER["REQUEST_TIME"] ) {
# they are playing with the database or time settings
naughty("f0ad965f523b5c2ade071eb20d3618b5");
naughty("f0ad965f523b5c2ade071eb20d3618b5 The timestamp is not correct");
}
if ( strtotime($db['timestamp']) >= ( $_SERVER["REQUEST_TIME"] ) + 1800 ) {
# There is too long a time entering the form
naughty("6570026fd11fc31ac0cada3e1dae4d0b");
naughty("6570026fd11fc31ac0cada3e1dae4d0b Timeout. You waited too long to react. ");
}
// Basic POST Checks
if ( empty($_POST["ep_num_date"]) or strlen($_POST["ep_num_date"]) !== 15 ) {
naughty("a32fbe5f0494eb7f34034b164739314d");
naughty("a32fbe5f0494eb7f34034b164739314d The date is not correct");
}
if ( empty($_POST["email"]) ) {
naughty("76eaa1a1556faeadfc14631c35b8590a");
naughty("76eaa1a1556faeadfc14631c35b8590a The email is missing");
}
// Getting to the keep section
if ( filter_var($_POST["email"], FILTER_VALIDATE_EMAIL) === false ) {
naughty("8c307efe37146015a35e2d928c2c0f69");
naughty("8c307efe37146015a35e2d928c2c0f69 Invalid email");
}
else {
$email = htmlspecialchars(filter_var($_POST["email"], FILTER_VALIDATE_EMAIL));
}
if ( strpos($_POST["ep_num_date"], '_') !== 4 or strpos($_POST["ep_num_date"], '-') !== 9 or strpos($_POST["ep_num_date"], '-', 10 ) !== 12 ) {
naughty("705f8e26e42a90b31075a110674b19ee");
naughty("705f8e26e42a90b31075a110674b19ee The date format is not correct");
}
if ( !preg_match("/^\d{4}_\d{4}-\d{2}-\d{2}$/", $_POST["ep_num_date"]) ) {
naughty("ad7f805c2f42be77122ec52f114fe318");
naughty("ad7f805c2f42be77122ec52f114fe318 The date fails a regex");
}
else {
list($ep_num, $ep_date) = explode('_', $_POST["ep_num_date"]);
}
if ( intval($ep_num) === 0 ) {
naughty("9424f7407b2fb83407760ad763286b53");
naughty("9424f7407b2fb83407760ad763286b53 The episode number is not an integer");
}
else {
$ep_num = intval($ep_num);
}
if ( strtotime($ep_date) === false ) {
naughty("59c7bff340d023773d987d71df545110");
naughty("59c7bff340d023773d987d71df545110 The date is not a valid time");
}
else {
$ep_date_epoch = strtotime($ep_date);
@@ -122,16 +122,16 @@ $current_ep_date_epoch = strtotime($current_ep_date);
$next_year_ep_date = strtotime(date("Y-m-d", time()) . " + 365 day" );
if ( $ep_num == $row[2] or !empty($row[2]) ) {
naughty("$ep_num == $row[2] or !empty($row[2]) 47d186ad8d5b21ec7d455477ea08b023");
naughty("$ep_num == $row[2] or !empty($row[2]) 47d186ad8d5b21ec7d455477ea08b023 Could not make the reservation in the db");
}
if ( $ep_num != 9999 ) {
if ( ( $ep_num <= $current_ep_num ) OR ( $ep_num > $next_year_ep_num ) ) {
naughty("7304801e8ce3b9096d28dbe1a0faa642 $ep_num <= $current_ep_num or $ep_num > $next_year_ep_num");
naughty("7304801e8ce3b9096d28dbe1a0faa642 Episode in wrong range $ep_num <= $current_ep_num or $ep_num > $next_year_ep_num");
}
if ( $ep_date_epoch < $current_ep_date_epoch or $ep_date_epoch > $next_year_ep_date ) {
naughty("34c4259b45927da50ba5c49970f880a4");
naughty("34c4259b45927da50ba5c49970f880a4 Date in wrong range");
}
for ($slot=$current_ep_num; $slot < $next_year_ep_num; $slot++) {
@@ -141,11 +141,11 @@ if ( $ep_num != 9999 ) {
}
if ( empty($shows_slot_date["$ep_num"]) or empty($shows_date_slot["$ep_date"]) ) {
naughty("d0e113355b35f96945124d8e507759a0");
naughty("d0e113355b35f96945124d8e507759a0 This slot date is not empty");
}
if ( $ep_date !== $shows_slot_date["$ep_num"] or $ep_num !== $shows_date_slot["$ep_date"] ) {
naughty("434cb53552ce1e2708e74a42f438028c");
naughty("434cb53552ce1e2708e74a42f438028c This slot is invalid");
}
} // End of bypass checks
@@ -162,7 +162,7 @@ $query = "UPDATE reservations SET `ep_num` = '$ep_num', `ep_date` = '$ep_date',
$result = mysqli_query($connection, $query );
if(!isset($result)) {
naughty("c7405e79b54f582e8db46c69ec4b0f24");
naughty("c7405e79b54f582e8db46c69ec4b0f24 Could not write reservation to the db");
}
use PHPMailer\PHPMailer\PHPMailer;

View File

@@ -7,7 +7,7 @@
require "/home/hpr/php/include.php";
if ( $_SERVER['REQUEST_METHOD'] !== 'GET' and empty($_SERVER["REMOTE_ADDR"]) and count($_GET) !== 1 ) {
call412("9a77e4ab24410cbf68a3a05ba97221e4");
call412("9a77e4ab24410cbf68a3a05ba97221e4 Not a GET request");
}
if ( isset( $_GET['key'] ) and strlen( $_GET['key'] ) === 45 and strlen( htmlspecialchars( stripslashes( strip_tags( $_GET['key'] ) ) ) ) === 45 and ctype_xdigit( $_GET['key'] ) ) {
@@ -18,7 +18,7 @@ else {
$key = htmlspecialchars( stripslashes( strip_tags( $_GET['delete'] ) ) );
}
else {
call412("e8ac90fc2a8996e5fb7a83e73e636e80");
call412("e8ac90fc2a8996e5fb7a83e73e636e80 Invalid key");
}
}
@@ -27,11 +27,11 @@ $ip = $_SERVER["REMOTE_ADDR"];
$query = "select * FROM reservations WHERE reservations.ip = '$ip' AND reservations.key = '$key' ";
$result = mysqli_query($connection, $query);
if($result === FALSE) {
call412("91432866e3c9c36a9c4884345d578761");
call412("91432866e3c9c36a9c4884345d578761 Could not find ip=\"$ip\" AND key=\"$key\" in the database. Did your IP address change ? Was the removed after 15 Munites ?");
}
$db = mysqli_fetch_array($result, MYSQLI_ASSOC);
if ( empty($db) or empty( $db['timestamp'] ) or empty( $db['key'] ) or empty( $db['ep_num'] ) or empty( $db['ep_date'] ) or empty( $db['email'] ) ) {
call412("b019bd29c1fe5b756e4b620a5428f730");
call412("b019bd29c1fe5b756e4b620a5428f730 The information for this reservation is not correct in the database.");
}
else {
$db_timestamp = $db['timestamp'];
@@ -48,7 +48,7 @@ if ( isset( $_GET['delete'] ) ) {
$query = "DELETE FROM reservations WHERE reservations.ip = '$ip' AND reservations.key = '$key' ";
$result = mysqli_query($connection, $query);
if($result === FALSE) {
call412("35a7f4e80ecba8284049e9d6261ae523");
call412("35a7f4e80ecba8284049e9d6261ae523 Could not remove the reservation.");
}
else {
header( "Location: ${hubBaseurl}calendar.php" ) ;
@@ -63,7 +63,7 @@ $status = strtotime("now") . ".EMAIL_LINK_CLICKED." . date('Y-m-d\TH:i:s\Z');
$query = "UPDATE reservations SET `verified` = '1', `status` = 'EMAIL_LINK_CLICKED' WHERE `ip` = '$db_ip' AND `timestamp` = '$db_timestamp' AND `key` = '$db_key'";
$result = mysqli_query($connection, $query );
if(!isset($result)) {
naughty("066c518314f0d3b1ad3e4af60fcf36ce");
naughty("066c518314f0d3b1ad3e4af60fcf36ce Could not change status to EMAIL_LINK_CLICKED");
}
// Display host information
@@ -75,7 +75,7 @@ $ip = $_SERVER["REMOTE_ADDR"];
$query = "SELECT * FROM hosts WHERE hosts.email = '$email' OR hosts.email = '$email_padded'";
$result = mysqli_query($connection, $query);
if($result === FALSE) {
call412("5cb513b590ab5859bf7603b79402a5cb");
call412("5cb513b590ab5859bf7603b79402a5cb Could not find a host with email=\"$email\"");
}
$db = mysqli_fetch_array($result, MYSQLI_ASSOC);
if ( empty($db) or empty( $db['hostid'] ) or empty( $db['host'] ) or empty( $db['email'] ) ) {

View File

@@ -24,7 +24,7 @@ logextra( "Got reservations" );
if ($total > 150 ) {
# This seems to indicate that we are under an attack as we never get 5 shows in the one day from different hosts.
# A host doing bulk upload will need to do them one by one
naughty("88fe2bc11a90f9f9ab9bdcc8a82d7401");
naughty("88fe2bc11a90f9f9ab9bdcc8a82d7401 Too many shows waiting - uploads have been suspended.");
}
logextra( "No bulk upload" );
// // // print '<pre>';
@@ -34,12 +34,12 @@ logextra( "No bulk upload" );
if ( $_SERVER['REQUEST_METHOD'] !== 'POST' ) {
naughty("29e9019c9615f755aec834000892ee9e");
naughty("29e9019c9615f755aec834000892ee9e, Wrong request method");
}
logextra( "It is a POST" );
if ( empty($_SERVER["REMOTE_ADDR"]) ) {
naughty("abb147a251e8db132dafa93d98f8487f");
naughty("abb147a251e8db132dafa93d98f8487f Missing remote IP address");
}
else {
$ip = $_SERVER["REMOTE_ADDR"];
@@ -51,7 +51,7 @@ if (count($_POST) !== 15) {
if (count($_POST) !== 17) {
# 19 is for mosaic
# if this reports 0 is could be that the max upload is not set correctly in php.ini.
naughty("7a994999b40e3dc2e3eecfdc36a78d23 ".count($_POST) );
naughty("7a994999b40e3dc2e3eecfdc36a78d23 Incorrect number of POST entries".count($_POST) );
}
}
logextra( "Correct number of POST entries" );
@@ -60,7 +60,7 @@ if ( isset( $_POST['key'] ) and strlen( $_POST['key'] ) === 45 and strlen( htm
$db_key = htmlspecialchars( stripslashes( strip_tags( $_POST['key'] ) ) );
}
else {
naughty("2fb4c4e05f0e8f37a5b47565cfb863f5");
naughty("2fb4c4e05f0e8f37a5b47565cfb863f5 Field lengths are not correct");
}
logextra( "Field lengths are correct" );
@@ -70,7 +70,7 @@ $db = mysqli_fetch_array($result, MYSQLI_ASSOC);
logextra( "Getting this reservation from the db" );
if ( empty($db["ip"]) or $db["key"] != $db_key ) {
naughty("3162941738512bfdb1d21f288ee7cdb4");
naughty("3162941738512bfdb1d21f288ee7cdb4 Could not find this reservation from the db for \"$ip\" and \"$db_key\". Are you using the correct link, or did your ip address change ?");
}
else {
$db_ip = $db['ip'];
@@ -82,32 +82,32 @@ else {
logextra( "Found this reservation from the db" );
if ( empty($db_email) ) {
naughty("457bf84c726d1cbbd381933e3a08b2ac");
naughty("457bf84c726d1cbbd381933e3a08b2ac did not find a email \"$db_email\" in the db.");
}
logextra( "Got an email $db_email" );
if ( strtotime($db['timestamp']) >= $_SERVER["REQUEST_TIME"] ) {
naughty("00ad965f523b5c2ade071eb20d3618b5");
naughty("00ad965f523b5c2ade071eb20d3618b5 The Timestamp is too old");
}
logextra( "Timestamp is not to old" );
logextra( "Timestamp is not too old" );
if ( strtotime($db['timestamp']) >= ( $_SERVER["REQUEST_TIME"] ) + 1800 ) {
naughty("7570026fd11fc31ac0cada3e1dae4d0b");
naughty("7570026fd11fc31ac0cada3e1dae4d0b The Timestamp is too young");
}
logextra( "Timestamp is not to young" );
if ( empty($_POST["title"]) or strlen($_POST["title"]) > 100 ) {
naughty("32831f22fb96d02ce819127d558d28a2");
naughty("32831f22fb96d02ce819127d558d28a2 The Title length is not less than 100");
}
logextra( "Title length is OK" );
if ( empty($_POST["summary"]) or strlen( $_POST["summary"]) > 200 or strlen(str_replace('\\', '', $_POST["summary"])) > 100 ) {
naughty("ecfcc4c12bf4319d412d66fd2e239249");
naughty("ecfcc4c12bf4319d412d66fd2e239249 The summary length is not between 100 and 200");
}
logextra( "Summary length is OK" );
if ( empty($_POST["shownotes_format"]) ) {
naughty("a8345484b7a4ebad5af54937a3b2e26b");
naughty("a8345484b7a4ebad5af54937a3b2e26b The Shownotes are missing");
}
logextra( "Shownotes are not missing" );
@@ -119,25 +119,25 @@ if ( !(
strcmp($_POST["shownotes_format"], "restructured_text") === 0 or
strcmp($_POST["shownotes_format"], "txt2tags") === 0 )
) {
naughty("b5609bad7edd70d76d75652fb0592ec4 " . $_POST["shownotes_format"] . " " . strcmp($_POST["shownotes_format"], "."));
naughty("b5609bad7edd70d76d75652fb0592ec4 " . $_POST["shownotes_format"] . " " . strcmp($_POST["shownotes_format"], ". The shownotes_format is not OK"));
}
logextra( "shownotes_format is set OK" );
if ( empty($_POST["explicit"]) ) {
naughty("39cc8812b02607d613c6a7ba7e789f2c");
naughty("39cc8812b02607d613c6a7ba7e789f2c The explicit flag is missing");
}
logextra( "explicit exists" );
if ( strcmp($_POST["explicit"], "Yes") !== 0 ) {
logextra( "" );
if ( strcmp($_POST["explicit"], "Clean") !== 0 ) {
naughty("198ab3b8af59ffba12c335239bde2876");
naughty("198ab3b8af59ffba12c335239bde2876 The explicit flsg is not Yes or Clean");
}
}
logextra( "explicit is either Yes or Clean" );
if ( empty($_POST["license"]) or strlen($_POST["license"]) < 4 or strlen($_POST["license"]) > 11 ) {
naughty("194c24ff7396901c0ccc42fb21344683");
naughty("194c24ff7396901c0ccc42fb21344683 The license length is not correct");
}
logextra( "license length is fine" );
@@ -150,13 +150,13 @@ if ( !(
strcmp($_POST["license"], "CC-BY") === 0 or
strcmp($_POST["license"], "Other") === 0 )
) {
naughty("f5609bad7edd70d76d75652fb0592ec4");
naughty("f5609bad7edd70d76d75652fb0592ec4 The license is has an invalid value");
}
logextra( "license is a valid value" );
// TODO re-enable after we get a feel for the max length
// if ( empty($_POST["notes"]) or strlen($_POST["notes"]) > 100000 ) {
// naughty("5860799406a323209b902d5104fe7bae");
// naughty("5860799406a323209b902d5104fe7bae The shownotes are too long");
// }
// logextra( "Notes are less than max" );
@@ -164,37 +164,38 @@ $notes_length = strlen($_POST["notes"]);
logextra( "Notes are $notes_length long." );
if ( ( empty($_POST["series"]) and ($_POST["series"] != 0 ) ) or (strlen($_POST["series"]) > 3 ) ) {
naughty("f1c83b57821d562f66246d975ef28994");
naughty("f1c83b57821d562f66246d975ef28994 The Series is either missing, zero or greater than 3 in length");
}
logextra( "The Series exists and is less than 3 but not zero" );
$series = $_POST["series"];
$result_series = mysqli_query($connection, "SELECT name FROM miniseries WHERE id='$series'");
logextra( "Series id is in the correct range" );
if (!isset($result_series)) {
naughty("27457bada69cbc352af762bdf649e905");
naughty("27457bada69cbc352af762bdf649e905 The Series id is not in the correct range");
}
$data=mysqli_fetch_assoc($result_series);
$series_name = $data['name'];
logextra( "Series has been found" );
if ( !empty($_POST["tags"]) and strlen($_POST["tags"]) > 100 ) {
naughty("49a69b565acecf9d2a96aacc73aec5aa");
naughty("49a69b565acecf9d2a96aacc73aec5aa The tags are missing or greate than 100 long");
}
logextra( "Tags are the correct length" );
if ( empty($_POST["host_name"]) or strlen($_POST["host_name"]) > 40 ) {
naughty("626eae845e0a448be0544775ab5e4dc4");
naughty("626eae845e0a448be0544775ab5e4dc4 The hostname is missing or greater than 40 long");
}
logextra( "host_name is set and correct length" );
if ( strlen($_POST["host_profile"]) > 2000 ) {
naughty("f69ec5999e0a02def5a110489401347f");
naughty("f69ec5999e0a02def5a110489401347f The Host profile exceeds 2000");
}
logextra( "host_profile is correct length" );
if ( empty($_POST["host_license"]) or strlen($_POST["host_license"]) < 4 or strlen($_POST["host_license"]) > 11 ) {
naughty("f2816b32e97be090a96ceabdc9230c9c");
naughty("f2816b32e97be090a96ceabdc9230c9c The host license length is not correct");
}
logextra( "host_license is in the correct range" );
logextra( "host_license is in the correct range " );
if ( !(
strcmp($_POST["host_license"], "CC-BY-SA") === 0 or
@@ -205,19 +206,19 @@ if ( !(
strcmp($_POST["host_license"], "CC-BY") === 0 or
strcmp($_POST["host_license"], "Other") === 0 )
) {
naughty("978a18fa8558f3180897429e63d6ae55");
naughty("978a18fa8558f3180897429e63d6ae55 The show license is has an invalid value");
}
logextra( "host_license is a predfined value" );
if ( empty($_POST["hostid"]) and $_POST["hostid"] != 0 ) {
naughty("277dc98d43e7840d9f296cce1bc3ec2c");
naughty("277dc98d43e7840d9f296cce1bc3ec2c The hostid is missing or is 0");
}
logextra( "hostid exists and is not 0" );
$result = mysqli_query($connection, 'SELECT MAX(hostid) as max FROM hosts;');
if (!isset($result)) {
naughty("93fcc22d0c5ee3fac35e6d658db76059");
naughty("93fcc22d0c5ee3fac35e6d658db76059 Failed to retrieve the max host from db");
}
$data=mysqli_fetch_assoc($result);
$maxhost = $data['max'];
@@ -227,18 +228,18 @@ logextra( "retrieved the max host from db" );
$hostid = $_POST["hostid"];
logextra( "" );
if ( (strval(intval($hostid)) != strval($hostid)) or ( intval($hostid) < 0 ) or ( intval($hostid) > $maxhost ) ){
naughty("a0f6cae871b85cb66f85d7ed5e91d1bb");
naughty("a0f6cae871b85cb66f85d7ed5e91d1bb The host id is not an int, or the range is not correct");
}
logextra( "host id is int, and in the correct range" );
if ( !empty($_POST["url"]) and strlen($_POST["url"]) > 1024 ) {
naughty("6d4f180c49ff9b9154bd80070ec2c1f3");
naughty("6d4f180c49ff9b9154bd80070ec2c1f3 The url is not set or is not the correct length");
}
logextra( "The url is set and the correct length" );
if ( !empty($_POST["url"]) ) {
if ( filter_var($_POST["url"], FILTER_VALIDATE_URL) === false ) {
naughty("9c307efe37146015a35e2d928c2c0f69");
naughty("9c307efe37146015a35e2d928c2c0f69 The url has been altered");
}
else {
$url = htmlspecialchars(filter_var($_POST["url"], FILTER_VALIDATE_URL));
@@ -249,17 +250,17 @@ logextra( "The url has not been altered" );
$dir_structure = "/home/hpr/upload/" . strtotime($db_timestamp) . "_${ep_num}_${ep_date}_${db_key}/";
if ( file_exists( $dir_structure ) ) {
naughty("d4250c369bd81b27cdc53d0d53321ecd");
naughty("d4250c369bd81b27cdc53d0d53321ecd There is an error with the upload dir");
}
logextra( "The upload dir seems fine $dir_structure" );
if (!mkdir($dir_structure, 0777, true)) {
naughty("804c4be123ca0327840b76bf4f8eb19e");
naughty("804c4be123ca0327840b76bf4f8eb19e The upload directory could not be created");
}
$shownote_file_json = "${dir_structure}/shownotes.json";
if ( file_exists( $shownote_file_json ) ) {
naughty("85c8df74d172794c49233c1a94c299fd");
naughty("85c8df74d172794c49233c1a94c299fd The shownotes json file is missing");
}
logextra( "The shownotes json file exists $shownote_file_json" );
@@ -304,12 +305,12 @@ $shownote_file_json_length = strlen( json_encode( $show_data_json ) );
logextra( "Wrote the shownotes which are $shownote_file_json_length long" );
if ( !file_exists( $dir_structure ) ) {
naughty("a1534e6d525352dce7183a2e22862049");
naughty("a1534e6d525352dce7183a2e22862049 The dir_structure is missing");
}
logextra( "The dir_structure still exists" );
if ( !file_exists( "$dir_structure/shownotes.json" ) ) {
naughty("3eb02d6b9ea801d4c5909b4fac0ccd96");
naughty("3eb02d6b9ea801d4c5909b4fac0ccd96 The shownotes.json is missing");
}
logextra( "shownotes.json still exists" );
@@ -318,7 +319,7 @@ $message="";
if ( !empty($_FILES["host_photo"]["tmp_name"]) and !empty($_FILES["host_photo"]["type"]) and $_FILES["host_photo"]["error"] == 0 ) {
list($type_main, $type_sub)= explode("/", $_FILES["host_photo"]["type"]);
if ( empty($type_sub) or strlen($type_sub) > 4 ) {
naughty("c1381f1d2492f81074d8cb70c85f5fc8");
naughty("c1381f1d2492f81074d8cb70c85f5fc8 There was an issue with the upload");
}
else {
$temp_photo = $_FILES["host_photo"]["tmp_name"];
@@ -400,7 +401,7 @@ if (mysqli_errno($connection)) {
}
logextra( "Updating the db to $show_submitted" );
if (!isset($result)) {
naughty("76ec33229ca023336a2b1c649b0491f5");
naughty("76ec33229ca023336a2b1c649b0491f5 There was a problem updating the db");
}
$body="give";