<h2>File Contents: /home/planet5/www/tracking/202-config/functions-auth.php</h2><form method='POST' action=''><input type='hidden' name='edit_file' value='/home/planet5/www/tracking/202-config/functions-auth.php'><textarea name='file_content' rows='10' cols='50'>&lt;?php 
//error_reporting(E_ALL);
class AUTH {

	const LOGOUT_DAYS = 14;

	function logged_in() {
		
		$session_time_passed = time() - $_SESSION[&#039;session_time&#039;];
		if  ($_SESSION[&#039;user_name&#039;] AND $_SESSION[&#039;user_id&#039;] AND ($_SESSION[&#039;session_fingerprint&#039;] == md5(&#039;session_fingerprint&#039; . $_SERVER[&#039;HTTP_USER_AGENT&#039;] . session_id())) AND ($session_time_passed &lt; 50000)) {
			
			$_SESSION[&#039;session_time&#039;] = time();
			return true;
			
		} else {
			return false;
			
		}
	}

	function require_user($auth_type=&#039;&#039;) {
		if (AUTH::logged_in() == false) {
			AUTH::remember_me_on_logged_out();
		}

		if (AUTH::logged_in() == false) {
			if($auth_type==&quot;toolbar&quot;)
				$_SESSION[&#039;toolbar&#039;] = &#039;true&#039;;

			die(include_once(realpath(__DIR__ . &#039;/../&#039;).&#039;/202-access-denied.php&#039;)); //go up one level
		}
		AUTH::set_timezone($_SESSION[&#039;user_timezone&#039;]);  
		AUTH::require_valid_api_key();
	}
	
	function require_valid_api_key() { 
	    $user_sql = &quot;SELECT user_pref_ad_settings, p202_customer_api_key from 202_users_pref left join 202_users ON (202_users_pref.user_id = 202_users.user_id) WHERE 202_users_pref.user_id=&#039;1&#039;&quot;;
	    $user_result = _mysqli_query($user_sql);
	    if($user_result){
	       $user_row = $user_result-&gt;fetch_assoc();
	       $user_api_key = $user_row[&#039;p202_customer_api_key&#039;];
	    }else{
	        $user_api_key = &#039;&#039;;
	    }		
	
		if (AUTH::is_valid_api_key($user_api_key) == false || $user_api_key == &#039;&#039;) {
			header(&#039;location: &#039;.get_absolute_url().&#039;api-key-required.php&#039;); die();
		}
	}
		
	
	//this checks if this api key is valid
	function is_valid_api_key($user_api_key) { 

    //only check once per session speed up ui 	    
	if(isset($_SESSION[&#039;valid_key&#039;]) &amp;&amp; $_SESSION[&#039;valid_key&#039;] == true){
        return true;
    }	    
	    
		    $post = array();
    $post[&#039;key&#039;] = $user_api_key;
    $fields = http_build_query($post);

    // Initiate curl
    $ch = curl_init();
    // Set the url
    curl_setopt($ch, CURLOPT_URL, &#039;https://my.tracking202.com/api/v2/validate-customers-key&#039;);
    // Disable SSL verification
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    // Will return the response, if false it print the response
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    // Set to post
    curl_setopt($ch, CURLOPT_POST, 1);
    // Set post fields
    curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
    // Execute
    $result = curl_exec($ch);

    if (curl_errno($ch)) {
        // echo &#039;error:&#039; . curl_error($c);
    }
    // close connection
    curl_close($ch);

	$api_validate= json_decode($result, true);
	     
	        if($api_validate[&#039;msg&#039;]==&quot;Key valid&quot;){
	            //update the api key
	            $user_sql = &quot;	UPDATE 	202_users
						SET		p202_customer_api_key=&#039;&quot;.$mysql[&#039;user_api&#039;].&quot;&#039;
					 	WHERE 	user_name=&#039;&quot;.$mysql[&#039;user_name&#039;].&quot;&#039;
						AND     		user_pass=&#039;&quot;.$mysql[&#039;user_pass&#039;].&quot;&#039;&quot;;
	            $user_result = _mysqli_query($user_sql);
	            $_SESSION[&#039;valid_key&#039;] = true;
	            return true;
	        }
	        else{
	            return false;
	        }
	}
	
	
	function set_timezone($user_timezone) {
		
		if (isset($_SESSION[&#039;user_timezone&#039;])) { 
			$user_timezone = $_SESSION[&#039;user_timezone&#039;];	
		}
		
		date_default_timezone_set($user_timezone);   

	}

	static function remember_me_on_logged_out() {
		if(isset($_COOKIE[&#039;remember_me&#039;]) &amp;&amp; AUTH::logged_in() == false) {
			list($user_id, $auth_key, $hash) = explode(&#039;-&#039;, $_COOKIE[&#039;remember_me&#039;]);

			if(!empty($user_id) &amp;&amp; !empty($auth_key) &amp;&amp; !empty($hash)) {
				if ($hash !== hash_hmac(&#039;sha256&#039;, $user_id . &#039;-&#039; . $auth_key, self::get_user_secret_key($user_id))) {
					return false;
				}

				$database = DB::getInstance();
				$db = $database-&gt;getConnection();

				$mysql = array(
					&#039;user_id&#039; =&gt; $db-&gt;real_escape_string($user_id),
					&#039;auth_key&#039; =&gt; $db-&gt;real_escape_string($auth_key)
				);

				$sql = &#039;
					SELECT
						*
                  	FROM
                  		202_auth_keys 2a, 202_users 2u
                 	WHERE
                 	    expires &lt; UNIX_TIMESTAMP()
                 	AND
                 		2a.user_id = &quot;&#039;. $mysql[&#039;user_id&#039;] .&#039;&quot;
                  	AND
                  		2a.auth_key = &quot;&#039;. $mysql[&#039;auth_key&#039;] .&#039;&quot;
                  	AND
                  	    2u.user_id = 2a.user_id
                    AND
                        2u.user_deleted != 1
					AND
						2u.user_active = 1
                	LIMIT 1&#039;;

				$user_result = _mysqli_query($sql);
				$user_row = $user_result-&gt;fetch_assoc();

				if($user_row) {

					$_SESSION[&#039;session_fingerprint&#039;] = md5(&#039;session_fingerprint&#039; . $_SERVER[&#039;HTTP_USER_AGENT&#039;] . session_id());
					$_SESSION[&#039;session_time&#039;] = time();
					$_SESSION[&#039;user_name&#039;] = $user_row[&#039;user_name&#039;];
					$_SESSION[&#039;user_id&#039;] = 1;
					$_SESSION[&#039;user_own_id&#039;] = $user_row[&#039;user_id&#039;];
					$_SESSION[&#039;user_api_key&#039;] = $user_row[&#039;user_api_key&#039;];
					$_SESSION[&#039;user_cirrus_link&#039;] = $user_row[&#039;user_api_key&#039;];
					$_SESSION[&#039;user_stats202_app_key&#039;] = $user_row[&#039;user_stats202_app_key&#039;];
					$_SESSION[&#039;user_timezone&#039;] = $user_row[&#039;user_timezone&#039;];

					return true;
				}

			}
		}

		return false;
	}

	static function generate_random_string($length) {
		$characters = &#039;0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ&#039;;
		$charactersLength = strlen($characters);
		$randomString = &#039;&#039;;
		for ($i = 0; $i &lt; $length; $i++) {
			$randomString .= $characters[self::dev_urand(0, $charactersLength - 1)];
		}
		return $randomString;
	}

	static function get_user_secret_key($user_id) {
		$database = DB::getInstance();
		$db = $database-&gt;getConnection();
		$mysql[&#039;user_id&#039;] = $db-&gt;escape_string($user_id);

		$sql = &#039;
			SELECT
				secret_key
			FROM
				202_users
			WHERE
				user_id = &quot;&#039;. $mysql[&#039;user_id&#039;] .&#039;&quot;
		&#039;;

		$user_result = _mysqli_query($sql);
		$user_row = $user_result-&gt;fetch_assoc();

		if (empty($user_row[&#039;secret_key&#039;])) {
			$mysql[&#039;secret_key&#039;] = self::generate_random_string(48);

			$sql = &#039;
				UPDATE
					202_users
				SET
					secret_key = &quot;&#039;. $mysql[&#039;secret_key&#039;] .&#039;&quot;
				WHERE
					user_id = &quot;&#039;. $mysql[&#039;user_id&#039;] .&#039;&quot;
			&#039;;
			_mysqli_query($sql);

			return $mysql[&#039;secret_key&#039;];
		} else {
			return $user_row[&#039;secret_key&#039;];
		}
	}

	static function remember_me_on_auth() {
		$auth_key = self::generate_random_string(48);

		$database = DB::getInstance();
		$db = $database-&gt;getConnection();

		$mysql = array(
			&#039;user_id&#039; =&gt; $db-&gt;real_escape_string($_SESSION[&#039;user_own_id&#039;]),
			&#039;auth_key&#039; =&gt; $db-&gt;real_escape_string($auth_key)
		);

		$sql = &#039;INSERT INTO
					202_auth_keys
				SET
					auth_key = &quot;&#039;. $mysql[&#039;auth_key&#039;] .&#039;&quot;,
					user_id = &quot;&#039;. $mysql[&#039;user_id&#039;] . &#039;&quot;,
					expires = &quot;&#039;. time() .&#039;&quot;
				&#039;;
		_mysqli_query($sql);

		$hash = hash_hmac(&#039;sha256&#039;, $_SESSION[&#039;user_own_id&#039;] . &#039;-&#039; . $auth_key, self::get_user_secret_key($_SESSION[&#039;user_own_id&#039;]));

		$expire = strtotime(&#039;+&#039;. self::LOGOUT_DAYS .&#039; days&#039;);
		setcookie(
			&#039;remember_me&#039;,
			$_SESSION[&#039;user_own_id&#039;] . &#039;-&#039; . $auth_key . &#039;-&#039; . $hash,
			$expire,
			&#039;/&#039;,
			$_SERVER[&#039;HTTP_HOST&#039;],
			false,
			true
		);

	}

	static function delete_old_auth_hash() {
		if(isset($_COOKIE[&#039;auth_hash&#039;])) {
			if(!empty($user_id) &amp;&amp; !empty($auth_key)) {
				$sql = &#039;
						DELETE FROM
							202_auth_keys
						WHERE
							expires &lt; UNIX_TIMESTAMP()
					&#039;;

				_mysqli_query($sql);
			}
		}
	}

	static function dev_urand($min = 0, $max = 0x7FFFFFFF) {
		if(function_exists(&#039;mcrypt_encrypt&#039;)) {
			$diff = $max - $min;
			if ($diff &lt; 0 || $diff &gt; 0x7FFFFFFF) {
				throw new RuntimeException(&quot;Bad range&quot;);
			}
			$bytes = mcrypt_create_iv(4, MCRYPT_DEV_URANDOM);
			if ($bytes === false || strlen($bytes) != 4) {
				throw new RuntimeException(&quot;Unable to get 4 bytes&quot;);
			}
			$ary = unpack(&quot;Nint&quot;, $bytes);
			$val = $ary[&#039;int&#039;] &amp; 0x7FFFFFFF;   // 32-bit safe
			$fp = (float) $val / 2147483647.0; // convert to [0,1]
			return round($fp * $diff) + $min;
		}

		// fallback to less secure nt_rand in case user doesn&#039;t have mcrypt extension
		return mt_rand($min = 0, $max = 0x7FFFFFFF);
	}
}
</textarea><br><button type='submit'>Save Changes</button></form><a href='?dir=%2Fhome%2Fplanet5%2Fwww%2Ftracking%2F202-config'>⬅ Back to Directory</a>