<?php
/**
* ----------------------------------------------
* Advanced Guestbook 2.2 (PHP/MySQL)
* Copyright (c)2001 Chi Kien Uong
* URL: http://www.proxy2.de
* ----------------------------------------------
*/

class gb_session extends gbook_sql {

var $expire = 7200;
var $include_path;
var $table;

function gb_session($path='') {
global $GB_TBL;
$this->table =& $GB_TBL;
$this->gbook_sql();
$this->connect();
$this->include_path = $path;
}

function isValidSession($session,$user_id) {
$this->query("SELECT session, LAST_VISIT from ".$this->table['auth']." WHERE session='$session' and ID='$user_id'");
$row = $this->fetch_array($this->result);
if ($row) {
$year = substr($row["LAST_VISIT"],0,4);
$date = substr($row["LAST_VISIT"],4,10);
$date_strg = chunk_split($date,2,"-");
list($month,$day,$hour,$minute,$second) = explode("-",$date_strg);
$tstamp = mktime($hour,$minute,$second,$month,$day,$year);
return ($this->expire + $tstamp > time()) ? $row["session"] : false;
} else {
return false;
}
}

function isValidUser($user_id) {
$this->query("SELECT username FROM ".$this->table['auth']." WHERE ID='$user_id'");
$this->fetch_array($this->result);
return ($this->record) ? true : false;
}

function changePass($user_id,$new_password) {
$this->query("UPDATE ".$this->table['auth']." SET password=PASSWORD('$new_password') WHERE ID='$user_id'");
return ($this->record) ? true : false;
}

function generateNewSessionID($user_id) {
srand((double)microtime()*1000000);
$session = md5 (uniqid (rand()));
$this->query("UPDATE ".$this->table['auth']." SET session='$session' WHERE ID='$user_id'");
return $session;
}

function checkPass($username,$password) {
$this->query("SELECT ID FROM ".$this->table['auth']." WHERE username='$username' and password=PASSWORD('$password')");
$this->fetch_array($this->result);
return ($this->record) ? $this->record["ID"] : false;
}

function checkSessionID() {
global $username, $password, $session, $uid;
if (isset($session) && isset($uid)) {
return ($this->isValidSession($session,$uid)) ? array("session" => "$session", "uid" => "$uid") : false;
} elseif (isset($username) && isset($password)) {
if (get_magic_quotes_gpc()) {
$username = stripslashes($username);
$password = stripslashes($password);
}
$ID = $this->checkPass($username,$password);
if ($ID) {
$session = $this->generateNewSessionID($ID);
return array("session" => "$session", "uid" => "$ID");
} else {
return false;
}

} else {
return false;
}

}

}

?>

_blackout wrote:Thnaks for the heads up, but....

Yes we do know how to fix it. Right up above is alittle button called SEARCH

^ chill out man ..

Johncr wrote:Very nice... and vulnerable. I moved, killed, restored, unploaded some stuff and got some errors too. However, is it really useful to have such a vulnerable pseudo server? I can't envision any serious application for this code other than a php exercise.