Merge branch 'Internal_Security' into Home

www-admin/css/lablanca.css

@@ -165,6 +165,51 @@ div#form_new_offer div#controls input{
     margin:    2em 4em 2em 4em;
 }
 
+div#section_schedule div#status_schedule table{
+	width:            100%;
+  margin:           auto;
+  border-collapse:  collapse;
+}
+
+div#section_schedule div#status_schedule table tr{
+	width: 100%;
+}
+
+div#section_schedule div#status_schedule table tr td{
+	padding: 0.3em;
+	border: 0.1em solid black;
+  text-align: center;
+}
+
+div#section_schedule div#status_schedule table tr td.time{
+	width: 25%;
+}
+
+div#section_schedule div#status_schedule table tr td.name{
+	width: 20%;
+}
+
+div#section_schedule div#status_schedule table tr td.description{
+	width: 45%;
+}
+
+div#section_schedule div#status_schedule table tr td.details{
+  width: 20%;
+}
+
+div#section_schedule div#status_schedule table tr td.details select{
+	width: 100%;
+}
+
+div#section_schedule div#status_schedule table tr td input{
+	width: 100%;
+}
+
+div#section_schedule div#status_schedule table tr td input[type='text'].short, input[type='number'].short{
+	width: 2.5em;
+	margin: 0em;
+}
+
 div.entry_schedule table.new_event{
     width:                        80%;
     margin:                        auto;

www-admin/functions.php

@@ -234,7 +234,7 @@
     
     function login($con, $user, $pass){
         session_start();
-        $q = mysqli_query($con,"SELECT id, md5(salt) AS s, username FROM user WHERE (lower(username) = lower('$user') OR lower(email) = lower('$user')) AND password = md5('$pass');");
+        $q = mysqli_query($con,"SELECT id, salt, username AS username, sha1(salt) AS s FROM user WHERE (lower(username) = lower('$user') OR lower(email) = lower('$user')) AND password = sha1(concat('$pass', sha1(salt)));");
         if (mysqli_num_rows($q) == 1){
             $r = mysqli_fetch_array($q);
             $_SESSION['id'] = $r['id'];
@@ -250,7 +250,7 @@
     
     function checkSession($con){
         session_start(['cookie_lifetime' => 1800,]);
-        $qr = mysqli_query($con, "SELECT id FROM user WHERE id = '$_SESSION[id]' AND md5(salt) = '$_SESSION[salt]';");
+        $qr = mysqli_query($con, "SELECT id FROM user WHERE id = '$_SESSION[id]' AND sha1(salt) = '$_SESSION[salt]';");
         //error_log("SELECT id FROM user WHERE id = '$_SESSION[id]' AND md5(salt) = '$_SESSION[salt]';");
         if (mysqli_num_rows($qr) == 1)
             return true;

www-admin/lablanca/calculate.php

@@ -9,16 +9,16 @@
     else{
         //Get year
         $year = date("Y");
-        
+
         //Get data to calculate
         $section = mysqli_real_escape_string($con, $_GET['section']);
-        
+
         switch ($section){
-        
+
             //Calculate header section. Only the progress window is requires
             case 'header':
                 echo "<h4>Paso 1: Cabecera de la p&aacute;gina de fiestas</h4>\n";
-//                 echo "<div class='entry status' id='status_header'>\n";
+                // echo "<div class='entry status' id='status_header'>\n";
                 echo "Estado:\n";
                 $q = mysqli_query($con, "SELECT * FROM festival WHERE year = $year;");
                 if (mysqli_num_rows($q) == 0){
@@ -50,7 +50,7 @@
                     echo "</li></ul>\n";
                 }
                 break;
-                
+
             //Calculate prices progress section.
             case 'pricesprogress':
                 echo "Estado:<ul><li>\n";
@@ -84,7 +84,7 @@
                 }
                 echo "</li></ul>\n";
                 break;
-        
+
             //Calculate offers window
             case 'pricesoffers':
                 echo "<h4>Ofertas:</h4>\n";
@@ -142,19 +142,14 @@
                         $q = mysqli_query($con, "SELECT * FROM festival_event WHERE gm = 1 AND start > str_to_date('$year-07-25 08:00:00', '%Y-%m-%d %T') AND start < str_to_date('$year-07-26 07:59:59', '%Y-%m-%d %T');");
                         break;
                     case '5':
-                    
                         break;
                     case '6':
-                    
                         break;
                     case '7':
-                    
                         break;
                     case '8':
-                    
                         break;
                     case '9':
-                    
                         break;
                     default:
                         exit(-1);

www-admin/lablanca/index.php

@@ -157,7 +157,7 @@
                     <h3><img src='/img/misc/slid-right.png' onClick='expandSchedule(25);'/>25 de julio</h4>
                     <div id='list_schedule_25' class='list_schedule'>
                     </div>
-                    Nuevo: 
+                    Nuevo:
                     <table class='new_event'>
                         <tr class='title'>
                             <th>Castellano</th>
@@ -186,7 +186,7 @@
                         <tr>
                             <td>
                                 <input type='number' value='00' id='new_event_25_start_h'/>:
-                                <input type='number' value='00' id='new_event_25_start_m'/> -- 
+                                <input type='number' value='00' id='new_event_25_start_m'/> --
                                 <input type='number' id='new_event_25_end_h'/>:
                                 <input type='number' id='new_event_25_end_m'/>
                             </td>
@@ -255,7 +255,6 @@
                 </div>
             </div>
         </div>
-        
     </body>
 </html>
 <?php } ?>

www-admin/lablanca/script.js

@@ -36,7 +36,7 @@ function saveNewOffer(year){
     var text_eu = document.getElementById('new_offer_text_eu').value;
     var days = document.getElementById('new_offer_days').value;
     var price = document.getElementById('new_offer_price').value;
-    
+
     //Validate values
     if (name_es.length == 0){
         alert("Debes introducir el nombre, al menos en castellano.");
@@ -58,7 +58,7 @@ function saveNewOffer(year){
         document.getElementById('new_offer_days').focus();
         return;
     }
-    
+
     // Encode required values
     name_es = encodeURI(name_es);
     name_en = encodeURI(name_en);
@@ -66,11 +66,11 @@ function saveNewOffer(year){
     text_es = encodeURI(text_es);
     text_en = encodeURI(text_en);
     text_eu = encodeURI(text_eu);
-    
+
     // Get page
     if(XMLHttpRequest)
         var x = new XMLHttpRequest();
-    else 
+    else
         var x = new ActiveXObject("Microsoft.XMLHTTP");
     x.open("POST", "/lablanca/insertoffer.php", true);
     var params = "year=" + year + "&name_es=" + name_es + "&name_en=" + name_en + "&name_eu=" + name_eu + "&text_es=" + text_es + "&text_en=" + text_en + "&text_eu=" + text_eu + "&price=" + price + "&days=" + days;
@@ -114,7 +114,7 @@ function calculate(section){
                 // Get page
                 if(XMLHttpRequest)
                     var x = new XMLHttpRequest();
-                else 
+                else
                     var x = new ActiveXObject("Microsoft.XMLHTTP");
                 x.open("GET", "/lablanca/calculate.php?section=pricesprogress", true);
                 x.send();
@@ -129,7 +129,7 @@ function calculate(section){
                 // Get page
                 if(XMLHttpRequest)
                     var x = new XMLHttpRequest();
-                else 
+                else
                     var x = new ActiveXObject("Microsoft.XMLHTTP");
                 x.open("GET", "/lablanca/calculate.php?section=pricesoffers", true);
                 x.send();
@@ -147,50 +147,11 @@ function calculate(section){
     }
 }
 
-function uploadHeaderImage(event, id){
-    var selectedFile = event.target.files[0];
-    
-    //Set image on page
-    var reader = new FileReader();
-    var imgtag = document.getElementById("header_img");
-    reader.onload = function(event) {
-        imgtag.src = event.target.result;
-        
-        //Upload image;
-        var formData = new FormData();
-        var file = document.getElementById('header_img_selector').files[0];
-        formData.append('img', selectedFile, selectedFile.name);
-        //for(var pair of formData.entries()) {
-        //    console.log(pair[0]+ ', '+ pair[1]); 
-        //}
-        //console.log("FD" + formData);
-        
-        // Get page
-        if(XMLHttpRequest)
-            var x = new XMLHttpRequest();
-        else 
-            var x = new ActiveXObject("Microsoft.XMLHTTP");
-        x.open("POST", "/lablanca/uploadimage.php?type=header&id=" + id, true);
-        x.onload = function(){
-        if(x.readyState == 4){
-            if(x.status == 200)
-                console.log("TRUE")
-                return true;
-            }
-            else{
-                console.log("FASLE");
-            }
-        }
-        x.send(formData);
-    };
-    reader.readAsDataURL(selectedFile);
-}
-
 function updateField(table, field, value, id, type = 'text', canBeNull = true){
     // Get page
     if(XMLHttpRequest)
         var x = new XMLHttpRequest();
-    else 
+    else
         var x = new ActiveXObject("Microsoft.XMLHTTP");
     x.open("POST", "/lablanca/execute.php", true);
     var params = "action=update&table=" + table + "&field=" + field + "&value=" + encodeURI(value) + "&id=" + id + "&type=" + type;
@@ -208,7 +169,7 @@ function deleteOffer(id){
     // Get page
     if(XMLHttpRequest)
         var x = new XMLHttpRequest();
-    else 
+    else
         var x = new ActiveXObject("Microsoft.XMLHTTP");
     x.open("POST", "/lablanca/execute.php", true);
     var params = "action=delete&table=festival_offer&id=" + id;
@@ -220,4 +181,4 @@ function deleteOffer(id){
         }
     }
     x.send(params);
-}
+}

www-admin/login.php

@@ -3,6 +3,7 @@
     $con = startdb();
     $user = mysqli_real_escape_string($con, $_POST['user']);
     $pass = mysqli_real_escape_string($con, $_POST['pass']);
+		$pass = sha1($pass);
     if (login($con, $user, $pass))
         header("Location: /main.php");
     else

www/API/v1/sendlocation.php

@@ -65,7 +65,7 @@
     $action = mysqli_real_escape_string($con, $_GET[GET_ACTION]);
 
     //Validate user
-    $q = mysqli_query($con, "SELECT id FROM user WHERE lower(username) = lower('$user') AND password = '$pass';");
+    $q = mysqli_query($con, "SELECT id FROM user WHERE (lower(username) = lower('$user') OR lower(email) = lower('$user')) AND password = sha1(concat('$pass', sha1(salt)))");
     if (mysqli_num_rows($q) == 0){
         error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
         http_response_code(403); // Forbidden

www/API/v1/sendnotification.php

@@ -100,7 +100,7 @@
     $error = "";
 
     // Validate user/pass
-    $q = mysqli_query($con, "SELECT id FROM user WHERE lower(username) = lower('$user') AND password = '$pass'");
+    $q = mysqli_query($con, "SELECT id FROM user WHERE (lower(username) = lower('$user') OR lower(email) = lower('$user')) AND password = sha1(concat('$pass', sha1(salt)))");
     if (mysqli_num_rows($q) == 0){
         error_log(":SECURITY: Reporting location with wrong credentials (IP $_SERVER[REMOTE_ADDR])");
         http_response_code(403); // Forbidden

www/ayuda/index.php

@@ -4,12 +4,13 @@
     include("../functions.php");
     $con = startdb();
     $proto = getProtocol();
-    
+    $server = "$proto$http_host";
+
     //Language
     $lang = selectLanguage();
     include("../lang/lang_" . $lang . ".php");
     
-    $cur_section = $lng['section_us'];
+    $cur_section = $lng['section_help'];
 ?>
 <!DOCTYPE html>
 <html>
@@ -17,8 +18,8 @@
         <meta content="text/html; charset=utf-8" http-equiv="content-type"/>
         <meta charset="utf-8"/>
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, minimum-scale=1">
-        <title><?php echo $lng['footer_help'];?> - Gasteizko Margolariak</title>
-        <link rel="shortcut icon" href="<?php echo "$proto$http_host/img/logo/favicon.ico";?>">
+        <title><?=$lng['footer_help']?> - Gasteizko Margolariak</title>
+        <link rel="shortcut icon" href="<?="$server/img/logo/favicon.ico";?>">
         <!-- CSS files -->
         <style>
             <?php 
@@ -40,72 +41,86 @@
             ?>
         </script>
         <!-- Meta tags -->
-        <link rel="canonical" href="<?php echo "$proto$http_host/us/"; ?>"/>
-        <link rel="author" href="<?php echo "$proto$http_host"; ?>"/>
-        <link rel="publisher" href="<?php echo "$proto$http_host"; ?>"/>
-        <meta name="description" content="<?php echo $lng['us_description'];?>"/>
-        <meta property="og:title" content="<?php echo $lng['us_title'];?> - Gasteizko Margolariak"/>
-        <meta property="og:url" content="<?php echo "$proto$http_host"; ?>"/>
-        <meta property="og:description" content="<?php echo $lng['us_description'];?>"/>
-        <meta property="og:image" content="<?php echo "$proto$http_host/img/logo/logo.png";?>"/>
-        <meta property="og:site_name" content="<?php echo $lng['us_title'];?>"/>
+        <link rel="canonical" href="<?=$server?>/us/"/>
+        <link rel="author" href="<?=$server?>"/>
+        <link rel="publisher" href="<?=$server?>"/>
+        <meta name="description" content="<?=$lng['us_description']?>"/>
+        <meta property="og:title" content="<?=$lng['us_title']?> - Gasteizko Margolariak"/>
+        <meta property="og:url" content="<?=$server?>"/>
+        <meta property="og:description" content="<?=$lng['us_description']?>"/>
+        <meta property="og:image" content="<?=$server?>/img/logo/logo.png"/>
+        <meta property="og:site_name" content="<?=$lng['us_title']?>"/>
         <meta property="og:type" content="website"/>
-        <meta property="og:locale" content="<?php echo $lang; ?>"/>
+        <meta property="og:locale" content="<?=$lang?>"/>
         <meta name="twitter:card" content="summary"/>
-        <meta name="twitter:title" content="<?php echo $lng['us_title'];?> - Gasteizko Margolariak"/>
-        <meta name="twitter:description" content="<?php echo $lng['us_description'];?>"/>
-        <meta name="twitter:image" content="<?php echo "$proto$http_host/img/logo/logo.png";?>"/>
-        <meta name="twitter:url" content="<?php echo"$proto$http_host"; ?>"/>
+        <meta name="twitter:title" content="<?=$lng['us_title']?> - Gasteizko Margolariak"/>
+        <meta name="twitter:description" content="<?=$lng['us_description']?>"/>
+        <meta name="twitter:image" content="<?=$server?>/img/logo/logo.png"/>
+        <meta name="twitter:url" content="<?=$server?>"/>
         <meta name="robots" content="index follow"/>
     </head>
     <body>
         <?php include("../header.php"); ?>
+		<div id="shortcouts_container">
+			<div class="section" id="shortcouts">
+				<h3 class='section_title'><?=$lng['help_shortcouts']?></h3>
+				<div class="entry">
+					<ul>
+						<li><a href="#section_association"><?=$lng['help_contact_title']?></a></li>
+						<li><a href="#section_license"><?=$lng['help_license_title']?></a></li>
+						<li><a href="#section_privacy"><?=$lng['help_privacy_title']?></a></li>
+						<li><a href="#section_cookie"><?=$lng['help_cookie_title']?></a></li>
+						<li><a href="#section_ads"><?=$lng['help_ad_title']?></a></li>
+					</ul>
+				</div> <!-- .entry -->
+			 </div> <!-- .section -->
+		</div> <!-- #shortcouts_container -->
         <div id="content">
             <div class="content_row">
                 <div class="content_cell">
                     <div class="section" id="section_association">
-                        <h3 class='section_title'><?php echo $lng['help_contact_title']; ?></h3>
+                        <h3 class='section_title'><?=$lng['help_contact_title']?></h3>
                         <div class="entry">
                             <table id="association">
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_register']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_register_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_register']?></td>
+                                    <td class="value"><?=$lng['help_contact_register_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_date_constitution']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_date_constitution_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_date_constitution']?></td>
+                                    <td class="value"><?=$lng['help_contact_date_constitution_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_date_inscription']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_date_inscription_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_date_inscription']?></td>
+                                    <td class="value"><?=$lng['help_contact_date_inscription_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_city']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_city_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_city']?></td>
+                                    <td class="value"><?=$lng['help_contact_city_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_territory']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_territory_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_territory']?></td>
+                                    <td class="value"><?=$lng['help_contact_territory_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_country']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_country_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_country']?></td>
+                                    <td class="value"><?=$lng['help_contact_country_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_clasification']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_clasification_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_clasification']?></td>
+                                    <td class="value"><?=$lng['help_contact_clasification_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_objectives']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_objectives_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_objectives']?></td>
+                                    <td class="value"><?=$lng['help_contact_objectives_value']?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_phone']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_phone_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_phone']?></td>
+                                    <td class="value"><?=$lng['help_contact_phone_value']; ?></td>
                                 </tr>
                                 <tr>
-                                    <td class="name"><?php echo $lng['help_contact_email']; ?></td>
-                                    <td class="value"><?php echo $lng['help_contact_email_value']; ?></td>
+                                    <td class="name"><?=$lng['help_contact_email']?></td>
+                                    <td class="value"><?=$lng['help_contact_email_value']?></td>
                                 </tr>
                             </table>
                         </div>
@@ -113,9 +128,9 @@
                 </div>
                 <div class="content_cell">
                     <div class="section" id="section_license">
-                        <h3 class='section_title'><?php echo $lng['help_license_title']; ?></h3>
+                        <h3 class='section_title'><?=$lng['help_license_title']?></h3>
                         <div class="entry">
-                            <?php echo $lng['help_license']; ?>
+                            <?=$lng['help_license']?>
                         </div>
                     </div>
                 </div>
@@ -123,17 +138,17 @@
             <div class="content_row">
                 <div class="content_cell">
                     <div class="section" id="section_privacy">
-                        <h3 class="section_title"><?php echo $lng['help_privacy_title']; ?></h3>
+                        <h3 class="section_title"><?=$lng['help_privacy_title']?></h3>
                         <div class="entry">
-                            <?php echo $lng['help_privacy']; ?>
+                            <?=$lng['help_privacy']; ?>
                         </div>
                     </div>
                 </div>
                 <div class="content_cell">
                     <div class="section" id="section_cookie">
-                        <h3 class='section_title'><?php echo $lng['help_cookie_title']; ?></h3>
+                        <h3 class='section_title'><?=$lng['help_cookie_title']?></h3>
                         <div class="entry">
-                            <?php echo $lng['help_cookie']; ?>
+                            <?=$lng['help_cookie']; ?>
                         </div>
                     </div>
                 </div>
@@ -141,9 +156,9 @@
             <div class="content_row">
                 <div class="content_cell">
                     <div class="section" id="section_ads">
-                        <h3 class="section_title"><?php echo $lng['help_ad_title']; ?></h3>
+                        <h3 class="section_title"><?=$lng['help_ad_title']?></h3>
                         <div class="entry">
-                            <?php echo $lng['help_ad']; ?>
+                            <?=$lng['help_ad']?>
                         </div>
                     </div>
                 </div>

www/css/ayuda.css

@@ -12,12 +12,29 @@ div#content div.content_row div.content_cell{
     display:    table-cell;
 }
 
+div#shortcouts_container{
+    width: 100%;
+    text-align: center;
+}
+
+div#shortcouts_container div#shortcouts{
+    width: 70%;
+    margin: auto;
+}
+
+div#shortcouts_container div#shortcouts
+
+
 div#content div.content_row div.content_cell div.section{
     width:    100%;
 }
 
-div.section div.entry{
-    min-height:    16em;
+div#content div.section div.entry{
+	padding: 1.5em;
+}
+
+div#content div.section div.entry ul li{
+	margin-top: 1em;
 }
 
 div.section div.entry table#association{

www/css/m/ayuda.css

@@ -1,3 +1,16 @@
+div#shortcouts_container{
+    width: 95%;
+    margin: auto auto 2em auto;
+}
+
+div#shortcouts_container div#shortcouts{
+    width: 100%;
+}
+
+div#shortcouts_container div#shortcouts li{
+    margin: 0.3em auto 0.3em auto;
+}
+
 div#content{
     display:    block;
 }