www.phiadvisorypartners.comIQ-ScuritY Shell

Editing file /home/phiadvis/www/conf/global.php (0604)

<?php
if($PHPSESSID) session_start($PHPSESSID);
else session_start();

include_once($DOCUMENT_ROOT."/conf/fonctions.php");
include_once($DOCUMENT_ROOT."/conf/mysql.php");
$DB_site=new DB_Sql;
$DB_site->appname='phiadvisory';
$DB_site->appshortname='phiadvisory';
$DB_site->database="phiadvisphi_db";
$DB_site->server="phiadvisphi_db.mysql.db";
$DB_site->user="phiadvisphi_db";
$DB_site->password="phiadvisory";
$DB_site->connect();

if($langue==""){
	$langue="FR";
}

if($langue=="FR"){
	include($DOCUMENT_ROOT."/includes/langFR.php");
} else {
	include($DOCUMENT_ROOT."/includes/langEN.php");
}

$tocontact="info@phiadvisorypartners.com";

/////////////////////////////////////////////////////////////////////
if($action=="logging"){
	$user_info=$DB_site->query_first("SELECT * FROM utilisateur WHERE username='$user_logging' ");
	if($user_info[password]==""){
		$raison_unlogged="login inconnu";
		$user_info="";
	}elseif($user_info[password]==md5($pass_logging)){
		setcookie("username","$user_logging",time()+32000,"/");
		setcookie("password","$user_info[password]",time()+32000,"/");
		$DB_site->query("REPLACE INTO session ( userid , dateline ) VALUES ( '$user_info[userid]' , '".time()."' ) ");
		$DB_site->query("UPDATE utilisateur SET nbrtentative='0', lastvisit='".time()."' WHERE userid='$user_info[userid]'");
		$unlogged=0;
	}else{
		$raison_unlogged="Mot de passe incorrect";
///////////////////////// changement de mot de passe pour 5 tentative + envoie de mail pour le changement ///////////
		$tentative=$user_info[nbrtentative]+1;
		if($tentative>=5){
			$code=changecode();
			$DB_site->query(" UPDATE utilisateur SET password='".md5($code)."', nbrtentative='0' WHERE userid='$user_info[userid]' ");
			$headers .= "From: noreply@phiadvisory.com <noreply@phiadvisorypartners.com>\r\n";
			$headers .= "Content-Type: text/html; charset=UTF-8\n";
			$sujetmail="changement de mot de passe sur votre compte phiadvisory : $user_info[username]";
			$message="Bonjour $user_info[nom] $user_info[prenom], 
			Il y a eu 5 tentatives de connexion sur votre compte <a href=\"http://www.phiadvisorypartners.com\">phi advisory partners</a>. 
			Pour plus de s&eacute;curit&eacute; votre mot de passe a &eacute;t&eacute; automatiquement chang&eacute;. 
			votre nouveau mot de passe est : $code . 
			Si vous d&eacute;sirez le changer , rendez vous dans votre espace pro. 
			L'&eacute;quipe Phiadvisory";
			mail($user_info[mail], $sujetmail , $message, $headers);
			echo "Un email vous a &eacute;t&eacute; envoyer pour changer le mot de passe de votre compte, 
			car vous avez tent&eacute; de vous connectez 5 fois sans mot de passe valide. 
			Toute tentative de fraudes et d'abus est un acte puni par la loi. 
			";
			exit;
		}else{
			$DB_site->query("UPDATE utilisateur SET nbrtentative='$tentative' WHERE userid='$user_info[userid]' ");
		}
		$user_info="";
	}
///////////////////////////////////////////////////////////////////// debut du loggage ////////////////////////
} elseif ($action=="loggout"){
	setcookie("username","",time()+32000,"/");
	//setcookie("password","",time()+3600000,"/");
	setcookie("password","",time()+32000,"/");
	$user_info="";
	$unlogged=1;
} else {
	if(isset($HTTP_COOKIE_VARS['username']) and $HTTP_COOKIE_VARS['username']!=""){//ne pass jamai ici sou ie6
		$user_info=$DB_site->query_first("SELECT * FROM utilisateur WHERE username='$HTTP_COOKIE_VARS[username]' ");
		if($user_info[password]==$HTTP_COOKIE_VARS['password']){
			if($user_info[lastactivity]<$sessiontime){
				$DB_site->query("UPDATE utilisateur SET lastvisit=lastactivity , lastactivity='".time()."' WHERE userid='$user_info[userid]' ");
				$DB_site->query("REPLACE INTO session ( userid , dateline ) VALUES ( '$user_info[userid]' , '".time()."' ) ");
				$unlogged=0;
			}else{
				$lastacttest=time()-60;
				if($user_info[lastactivity]<$lastacttest){
					$connectm=$user_info[connectm]+(time()-$user_info[lastactivity]);
					$DB_site->query("UPDATE utilisateur SET lastactivity='".time()."' WHERE userid='$user_info[userid]' ");
				}
				$DB_site->query("REPLACE INTO session ( userid , dateline ) VALUES ( '$user_info[userid]' , '".time()."' ) ");
				$unlogged=0;
			}
		}else{
			$user_info="";
			setcookie("username","",time()+32000,"/");
			setcookie("password","",time()+32000,"/");
		}
	}
}

/*
print_r($_COOKIE);
echo " ";
print_r($user_info);
*/

///////////////////////////////////////////////////////////////////////////////////////// fin du loggage ////////

//header("Content-Type: text/html; charset=ISO-8859-15");
?>

IQ-ScuritY Shell