Skip to content
This repository was archived by the owner on Jul 4, 2025. It is now read-only.

Commit c5b9cc6

Browse files
Its-NetworkingIts-Networking
committed
Token Fix
1 parent bebb3c3 commit c5b9cc6

File tree

2 files changed

+118
-0
lines changed

2 files changed

+118
-0
lines changed

‎app/token-fetch.php

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
<?php
2+
3+
include '../includes/misc/autoload.phtml';
4+
5+
set_exception_handler(function ($exception) {
6+
error_log("\n--------------------------------------------------------------\n");
7+
error_log($exception);
8+
error_log("\nRequest data:");
9+
error_log(print_r($_POST, true));
10+
error_log("\n--------------------------------------------------------------");
11+
http_response_code(500);
12+
die("Error: " . $exception->getMessage());
13+
});
14+
15+
if (session_status() === PHP_SESSION_NONE) {
16+
session_start();
17+
}
18+
19+
if ($_SESSION['role'] == "Reseller") {
20+
die("Resellers can't access this.");
21+
}
22+
23+
if ($_SESSION['role'] == "Manager") {
24+
die("Managers can't access this.");
25+
}
26+
27+
if (!isset($_SESSION['app'])) {
28+
dashboard\primary\error("Application not selected");
29+
die("Application not selected.");
30+
}
31+
32+
if (isset($_POST['draw'])) {
33+
34+
// credits to https://makitweb.com/datatables-ajax-pagination-with-search-and-sort-php/
35+
36+
$draw = intval($_POST['draw']);
37+
$row = intval($_POST['start']);
38+
$rowperpage = intval($_POST['length']); // Rows display per page
39+
$columnIndex = misc\etc\sanitize($_POST['order'][0]['column']); // Column index
40+
$columnName = misc\etc\sanitize($_POST['columns'][$columnIndex]['data']); // Column name
41+
$columnSortOrder = misc\etc\sanitize($_POST['order'][0]['dir']); // asc or desc
42+
$searchValue = misc\etc\sanitize($_POST['search']['value']); // Search value
43+
44+
## Total number of records without filtering
45+
$sel = misc\mysql\query("SELECT count(1) AS allcount FROM `tokens` WHERE app = ?", [$_SESSION['app']]);
46+
$records = mysqli_fetch_assoc($sel->result);
47+
$totalRecords = $records['allcount'];
48+
49+
$totalRecordwithFilter = $totalRecords;
50+
if (!is_null($searchValue)) { // don't double query if no search value was provided
51+
## Total number of record with filtering
52+
$sel = misc\mysql\query("SELECT count(1) AS allcount FROM `tokens` WHERE 1 AND (`token` LIKE ? OR `assigned` LIKE ? OR `status` LIKE ? OR `reason` LIKE ? ) AND app = ?", ["%" . $searchValue . "%", "%" . $searchValue . "%", "%" . $searchValue . "%", "%" . $searchValue . "%", $_SESSION['app']]);
53+
$records = mysqli_fetch_assoc($sel->result);
54+
$totalRecordwithFilter = $records['allcount'];
55+
}
56+
57+
// whitelist certain column names and sort orders to prevent SQL injection
58+
if (!in_array($columnName, array("app", "token", "assigned", "banned", "reason", "hash", "type", "status"))) {
59+
die("Column name is not whitelisted.");
60+
}
61+
62+
if (!in_array($columnSortOrder, array("desc", "asc"))) {
63+
die("Column sort order is not whitelisted.");
64+
}
65+
66+
## Fetch records
67+
if (!is_null($searchValue)){
68+
$query = misc\mysql\query("SELECT * FROM `tokens` WHERE (`token` LIKE ? OR `assigned` LIKE ? OR `status` LIKE ? or `reason` LIKE ?) AND `app` = ? order by `" . $columnName . "` " . $columnSortOrder . " limit " . $row . "," . $rowperpage, ["%" . $searchValue . "%", "%" . $searchValue . "%", "%" . $searchValue . "%", $_SESSION['app']]);
69+
} else {
70+
$query = misc\mysql\query("SELECT * FROM `tokens` WHERE `app` = ? order by `" . $columnName . "` " . $columnSortOrder . " limit " . $row . "," . $rowperpage, [$_SESSION['app']]);
71+
}
72+
73+
$data = array();
74+
75+
while ($row = mysqli_fetch_assoc($query->result)) {
76+
77+
## If only one or two keys exists then we will use custom margin to fix the bugging menu
78+
$banBtns = "";
79+
if ($row['banned']) {
80+
$banBtns = '<button class="btn menu-link px-3" style="font-size:0.95rem;" name="unbankey" value="' . $row['key'] . '">Unban</button>';
81+
} else {
82+
$banBtns = '<a class="menu-link px-3" data-bs-toggle="modal" data-bs-target="#ban-key" onclick="bankey(\'' . $row["key"] . '\')">Ban</a>';
83+
}
84+
85+
$MarginManager = "";
86+
if ($totalRecordwithFilter < 2) {
87+
$MarginManager = "margin-bottom: 20px;";
88+
} else {
89+
$MarginManager = "margin-bottom: 0px;";
90+
}
91+
92+
$data[] = array(
93+
"app" => $_SESSION['name'],
94+
"token" => $row['token'],
95+
"assigned" => $row['assigned'] ?? "N\A",
96+
"banned" => '<label class="' . ($row['banned'] == 1 ? 'text-red-700' : 'text-green-700') . '">' . ($row['banned'] == 1 ? 'banned' : 'unbanned') . '</label>',
97+
"reason" => is_null($row['reason']) ? 'N/A' : $row['reason'],
98+
"hash" => is_null($row['hash']) ? 'N/A' : $row['reason'],
99+
"type" => $row['type'],
100+
"status" => $row['status'],
101+
);
102+
}
103+
104+
## Response
105+
$response = array(
106+
"draw" => intval($draw),
107+
"iTotalRecords" => $totalRecords,
108+
"iTotalDisplayRecords" => $totalRecordwithFilter,
109+
"aaData" => $data
110+
);
111+
die(json_encode($response));
112+
}
113+
114+
die("Request not from datatables, aborted.");
115+
116+
117+
?>

‎includes/misc/license.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
use misc\cache;
77
use misc\user;
88
use misc\mysql;
9+
use misc\token;
910

1011
function license_masking($mask, $int = null) // substitute random characters for upper-case and lower-case random character variables, X or x
1112
{

0 commit comments

Comments
 (0)