This repository was archived by the owner on Jul 4, 2025. It is now read-only.
-
-
Notifications
You must be signed in to change notification settings - Fork 113
Expand file tree
/
Copy pathsession-fetch.php
More file actions
101 lines (84 loc) · 4.76 KB
/
session-fetch.php
File metadata and controls
101 lines (84 loc) · 4.76 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
<?php
include '../includes/misc/autoload.phtml';
set_exception_handler(function ($exception) {
error_log("\n--------------------------------------------------------------\n");
error_log($exception);
error_log("\nRequest data:");
error_log(print_r($_POST, true));
error_log("\n--------------------------------------------------------------");
http_response_code(500);
die("Error: " . $exception->getMessage());
});
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
if ($_SESSION['role'] == "Reseller") {
die("Resellers can't access this.");
}
if (!isset($_SESSION['app'])) {
dashboard\primary\error("Application not selected");
die("Application not selected.");
}
if (isset($_POST['draw'])) {
// credits to https://makitweb.com/datatables-ajax-pagination-with-search-and-sort-php/
$draw = intval($_POST['draw']);
$row = intval($_POST['start']);
$rowperpage = intval($_POST['length']); // Rows display per page
$columnIndex = misc\etc\sanitize($_POST['order'][0]['column']); // Column index
$columnName = misc\etc\sanitize($_POST['columns'][$columnIndex]['data']); // Column name
$columnSortOrder = misc\etc\sanitize($_POST['order'][0]['dir']); // asc or desc
$searchValue = misc\etc\sanitize($_POST['search']['value']); // Search value
// whitelist certain column names and sort orders to prevent SQL injection
if (!in_array($columnName, array("id", "credential", "expiry", "validated", "ip"))) {
die("Column name is not whitelisted.");
}
if (!in_array($columnSortOrder, array("desc", "asc"))) {
die("Column sort order is not whitelisted.");
}
if (!is_null($searchValue)) {
$query = misc\mysql\query("select * from `sessions` WHERE (`id` like ? or `credential` like ? or `ip` like ? ) and app = ? order by `" . $columnName . "` " . $columnSortOrder . " limit " . $row . "," . $rowperpage, ["%" . $searchValue . "%", "%" . $searchValue . "%", "%" . $searchValue . "%", $_SESSION['app']]);
}
else {
$query = misc\mysql\query("select * from `sessions` WHERE app = ? order by `" . $columnName . "` " . $columnSortOrder . " limit " . $row . "," . $rowperpage, [$_SESSION['app']]);
}
$data = array();
while ($row = mysqli_fetch_assoc($query->result)) {
$data[] = array(
"id" => $row['id'],
"credential" => $row["credential"] ?? 'N/A',
"expiry" => '<div id="' . $row['id'] . '-expiry"><script>document.getElementById("' . $row['id'] . '-expiry").textContent=convertTimestamp(' . $row["expiry"] . ');</script></div>',
"validated" => ($row['validated'] ? 1 : 0) ? 'true' : 'false',
"ip" => '<span class="blur-sm hover:blur-none">' . ($row['ip'] ?? 'N/A') . '</span>',
"actions" =>
'<form method="POST">
<td>
<div x-data="{ open: false }" class="z-0">
<button x-on:click="open = true" class="flex items-center border border-gray-700 rounded-lg focus:opacity-60 text-white focus:text-white font-semibold rounded focus:outline-none focus:shadow-inner py-2 px-4" type="button">
<span class="mr-1">Actions</span>
<svg class="fill-current h-4 w-4" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" style="margin-top:3px">
<path d="M9.293 12.95l.707.707L15.657 8l-1.414-1.414L10 10.828 5.757 6.586 4.343 8z"/>
</svg>
</button>
<ul x-show="open" x-on:click.away="open = false" class="bg-[#09090d] text-white rounded shadow-lg absolute py-2 mt-1" style="min-width:15rem">
<li>
<button name="kill" class="block hover:opacity-60 whitespace-no-wrap py-2 px-4 hover:text-red-700"
value="' . $row["id"] . '">
Kill Session
</button>
</li>
</ul>
</div>
</tr>
</td>
</tr>
</form>',
);
}
## Response
$response = array(
"draw" => intval($draw),
"aaData" => $data
);
die(json_encode($response));
}
die("Request not from datatables, aborted.");