NathanGibbs3 / BASE / 590

pending completion

Build # 590

Build Type

push

travis-ci-com

Committed by

NathanGibbs3

Commit Message

20230420 Fix CI build breakage. 2

Run Details

2755 of 16977 relevant lines covered (16.23%)

21.61 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

58.77

/includes/base_auth.inc.php

<?php
// Basic Analysis and Security Engine (BASE)
// Copyright (C) 2019-2023 Nathan Gibbs
// Copyright (C) 2004 BASE Project Team
// Copyright (C) 2000 Carnegie Mellon University
//
//   For license info: See the file 'base_main.php'
//
//       Project Lead: Nathan Gibbs
// Built upon work by: Kevin Johnson & the BASE Project Team
//                     Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
//
//            Purpose: User manangement object.
//                     Role management object.
//                     Access Authoriztion routines.
//                     If the variable $Use_Auth_System = 0 (zero), Access
//                     authorization checks always pass.
//
//          Author(s): Nathan Gibbs
//                     Kevin Johnson
// Ensure the conf file has been loaded. Prevent direct access to this file.
defined( '_BASE_INC' ) or die( 'Accessing this file directly is not allowed.' );

class BaseUser {
        var $db;

        function __construct() { // PHP 5+ constructor Shim.
                // Class/Method agnostic shim code.
                $SCname = get_class();
                if ( method_exists($this, $SCname) ) {
                        $SCargs = func_get_args();
                        call_user_func_array(array($this, $SCname), $SCargs);
                }else{
                        // @codeCoverageIgnoreStart
                        // Should never execute.
                        trigger_error( // Will need to add this message to the TD.
                                "Class: $SCname No Legacy Constructor.\n",
                                E_USER_ERROR
                        );
                        // @codeCoverageIgnoreEnd
                }
        }
        function BaseUser() { // PHP 4x constructor.
                GLOBAL $DBlib_path, $DBtype, $db_connect_method, $alert_dbname,
                $alert_host, $alert_port, $alert_user, $alert_password;
                $db = NewBASEDBConnection($DBlib_path, $DBtype);
                $db->baseDBConnect(
                        $db_connect_method, $alert_dbname, $alert_host, $alert_port,
                        $alert_user, $alert_password, 1
                );
                $db->DB->SetFetchMode(ADODB_FETCH_BOTH);
                $this->db = $db;
        }
        // Core Authentication System.
        // Accepts a username and password.
        // Returns:
        //        0 if the username and pwd are correct.
        //        1 if the password is wrong.
        //        2 if the user is disabled.
        //        3 if the username doesn't exist
        function AuthenticateCore( $user = '', $pwd = '' ){
                GLOBAL $debug_mode, $et;
                $Ret = -1;
                if ( !LoadedString($user) ){ // Input Validation
                        $Ret = 3; // Needs User Name, default to nonexistent user.
                }else{
                        $db = $this->db;
                        $user = filterSql($user,1,$db); // Input sanitazation.
                        $pwd  = filterSql($pwd,1,$db);
                        $sql = "SELECT * from base_users where base_users.usr_login ='" . $user ."';";
                        $rs = $db->baseExecute($sql);
                        if (
                                $rs != false
                                && $db->baseErrorMessage() == ''
                                && $rs->baseRecordCount() > 0
                        ){ // Error Check
                                $result = $rs->baseFetchRow();
                                if ( $result['usr_enabled'] == 0 ){
                                        $Ret = 2; // User Account Disabled.
                                }else{
                                        if ( $result['usr_pwd'] == $this->cryptpassword($pwd) ){
                                                $Ret = 0; // Password OK
                                        }else{
                                                $Ret = 1; // Password Wrong
                                        }
                                }
                                $rs->baseFreeRows();
                        }else{
                                $Ret = 3;
                        }
                }
                if ( isset($et) && is_object($et) ){ // Need to TD this in Issue #11 branch.
                        $et->Mark('Authentication Check.');
                }
                return $Ret;
        }
        // Same inputs/returns as AuthenticateCore.
        // Sets the role cookie on success.
        function Authenticate( $user = '', $pwd = '' ){
                $Ret = $this->AuthenticateCore( $user, $pwd );
                if ( $Ret == 0 ){
                        $this->setRoleCookie($this->cryptpassword($pwd), $user);
                }
                return $Ret;
        }
        // Same inputs as AuthenticateCore.
        // returns "Failed" on failure or role_id on success.
        function AuthenticateNoCookie( $user = '', $pwd = '' ) {
                $Ret = $this->AuthenticateCore( $user, $pwd );
                if ( $Ret == 0 ){ // Get RoleID
                        $db = $this->db;
                        $user = filterSql($user,1,$db); // Input sanitazation.
                        $pwd  = filterSql($pwd,1,$db);
                        $sql = "SELECT role_id FROM base_users where usr_login='" . $user
                        . "' AND usr_pwd='".$this->cryptpassword($pwd)."';";
                        $rs = $db->baseExecute($sql);
                        if (
                                $rs != false
                                && $db->baseErrorMessage() == ''
                                && $rs->baseRecordCount() > 0
                        ){ // Error Check
                                $Ret = $rs->baseFetchRow();
                                $rs->baseFreeRows();
                                if ( isset($Ret[0]) ){
                                        $Ret = intval($Ret[0]);
                                }
                        }else{
                                $Ret = 'Failed';
                        }
                }else{
                        $Ret = 'Failed';
                }
                return $Ret;
        }
        // Accepts a username.
        // Returns true if user account is enabled, false otherwise.
        function isActive( $user = '' ){
                $Ret = false;
                if ( LoadedString($user) ){ // Input Validation
                        $db = $this->db;
                        $user = filterSql($user,1,$db); // Input sanitazation.
                        $sql = "SELECT usr_enabled FROM base_users WHERE usr_login ='"
                        .$user."';";
                        $rs = $db->baseExecute($sql);
                        if (
                                $rs != false
                                && $db->baseErrorMessage() == ''
                                && $rs->baseRecordCount() > 0
                        ){ // Error Check
                                $Active = $rs->baseFetchRow();
                                $rs->baseFreeRows();
                                if ( isset($Active[0]) ){
                                        if ( intval($Active[0]) == 1 ){
                                                $Ret = true;
                                        }
                                }
                        }
                }
                return $Ret;
        }
    function hasRole($roleNeeded)
    {
        // Checks which role the user has
        $role = $this->readRoleCookie();
        if (($role > $roleNeeded) || $role == 0)
        {
            // returns unauthorized
            return 0;
        }
        
        return 1;
        
    }
    
    function addUser($user, $role, $password, $name)
    {
        //adds user
        $db = $this->db;
        $sql = "SELECT * FROM base_users WHERE usr_login = '" . $user . "'";
        $exists = $db->baseExecute($sql);
        if ( $exists->baseRecordCount() > 0)
        {
            return "User Already Exists";
        }
        $cryptpassword = $this->cryptpassword($password);
        $sql = "SELECT MAX(usr_id) FROM base_users;";
        $usercount = $db->baseExecute($sql);
        $usercnt = $usercount->baseFetchRow();
        $userid = $usercnt[0] + 1;
        $sql = "INSERT INTO base_users (usr_id, usr_login, usr_pwd, role_id, usr_name, usr_enabled)";
        $sql .= "VALUES (".$userid .", '".$user."','".$cryptpassword."',".$role.",'".$name."', 1);";
        $db->baseExecute($sql, -1, -1, false);
        return _ADDEDSF;
    }
    
    function disableUser($user)
    {
        //disables user
        $db = $this->db;
        $sql = "UPDATE base_users SET usr_enabled = '0' WHERE usr_id = '" . $user . "';";
        $disabled = $db->baseExecute($sql);
        return;
    }
    
    function deleteUser($user)
    {
        //deletes the user
        $db = $this->db;
        $sql = "DELETE FROM base_users WHERE usr_id = '" . $user . "';";
        $deleted = $db->baseExecute($sql);
        return;
    }

    function enableUser($user)
    {
        //enables user
        $db = $this->db;
        $sql = "UPDATE base_users SET usr_enabled = '1' WHERE usr_id = '" . $user . "';";
        $enabled = $db->baseExecute($sql);
        return;
    }
    
    function updateUser($userarray)
    {
        /* This function accepts an array in the following format
          $userarray[0] = $userid
          $userarray[1] = $fullname
          $userarray[2] = $roleid
        */
        $db = $this->db;
        $sql = "UPDATE base_users SET usr_name = '". $userarray[1] ."', role_id = '" . $userarray[2] . "' ";
        $sql = $sql . "WHERE usr_id = '" . $userarray[0] . "'";
        $enabled = $db->baseExecute($sql);
        return;
    }
    
    function changePassword($user, $oldpassword, $newpassword)
    {
        // Changes the user's password
        $db = $this->db;
        $sql = "SELECT usr_pwd from base_users where usr_login = '" . $user ."';";
        $userRS = $db->baseExecute($sql);
        if ( $db->baseErrorMessage() != "" )
        {
            // Generic SQL error
            $error = returnErrorMessage(_NOPWDCHANGE . $db->baseErrorMessage());
            return $error;
        } elseif ($userRS->baseRecordCount() == 0)
        {
            // User doesn't exist... Someone is playing with their cookie
            $error = returnErrorMessage(_NOUSER);
            return $error;
        }
        $row = $userRS->baseFetchRow();
        $cryptoldpasswd = $this->cryptpassword($oldpassword);
        if ($cryptoldpasswd != $row[0])
        {
            // Old password doesn't match record
            $error = returnErrorMessage(_OLDPWD);
            return $error;
        }
        // Finally... lets change the password
        $sql = "UPDATE base_users SET usr_pwd='" . $this->cryptpassword($newpassword);
        $sql = $sql . "' WHERE usr_login='". $user . "';";
        $chngpwd = $db->baseExecute($sql);
        if ( $db->baseErrorMessage() != "" )
        {
            // Generic SQL error
            $error = returnErrorMessage(_PWDCANT. $db->baseErrorMessage());
            return $error;
        }
        
        return _PWDDONE;
    }
        function returnUser(){ // returns user login from role cookie
                $user = '';
                if ( isset($_COOKIE['BASERole']) ){
                        $cookievalue = $_COOKIE['BASERole'];
                        $cookiearr = explode('|', $cookievalue);
                        $user = $cookiearr[1];
                }
                return $user;
        }
        function returnUserID($user){ // Returns uid of user, false on Error.
                $Ret = false;
                if ( LoadedString($user) ){ // Input Validation
                        $db = $this->db;
                        $sql = "SELECT usr_id FROM base_users WHERE usr_login = '" . $user . "';";
                        $rs = $db->baseExecute($sql);
                        if (
                                $rs != false
                                && $db->baseErrorMessage() == ''
                                && $rs->baseRecordCount() > 0
                        ){ // Error Check
                                $usrid = $rs->baseFetchRow();
                                $rs->baseFreeRows();
                                if ( isset($usrid[0]) ){
                                        $Ret = intval($usrid[0]);
                                }
                        }
                }
                return $Ret;
        }
        function returnUsers(){
        /* returns an array of all users info
         * each array item is formatted as
         * array[] = usr_id|usr_login|role_id|usr_name|usr_enabled
        */
        $userarray = NULL;
        $db = $this->db;
        $sql = "SELECT usr_id, usr_login, role_id, usr_name, usr_enabled ";
        $sql = $sql . "FROM base_users ORDER BY usr_id;";
        $result = $db->baseExecute($sql);
        
        $i = 0;
        while ( ($myrow = $result->baseFetchRow()) && ($i < $result->baseRecordCount()) )
        {
            $userarray[$i] = $myrow[0] . "|" . $myrow[1] . "|" . $myrow[2] . "|" . $myrow[3] . "|" . $myrow[4];
            ++$i;
        }
        $result->baseFreeRows();
        return $userarray;
    }
        function returnEditUser( $userid, $XSS = 1 ){
                // Returns an array of user's info.
                // Each array item is formatted as:
                // array[0] = usr_id|usr_login|role_id|usr_name|usr_enabled
                // Returns false on Error.
                $Ret = false;
                $userid = intval($userid); // Input Validation
                if ( $userid > 0 ){
                        if ( !is_numeric($XSS) ){
                                $XSS = 1;
                        }
                        $db = $this->db;
                        $sql = "SELECT usr_id, usr_login, role_id, usr_name, usr_enabled ";
                        $sql .= "FROM base_users WHERE usr_id = '" . $userid . "';";
                        $result = $db->baseExecute($sql);
                        if ( $result != false ){ // Error Check
                                $myrow = $result->baseFetchRow();
                                $result->baseFreeRows();
                                if ( $XSS > 0 ){ // Anti XSS Output Data
                                        $myrow = XSSPrintSafe($myrow);
                                }
                                $Ret = $myrow;
                        }
                }
                return $Ret;
        }
        function roleName( $roleID, $XSS = 1 ){
        // Returns name of roleID, false on Error.
                $Ret = false;
                $roleID = intval($roleID); // Input Validation
                if ( $roleID > 0 ){
                        if ( !is_numeric($XSS) ){
                                $XSS = 1;
                        }
                        $db = $this->db;
                        $sql = "SELECT role_name FROM base_roles WHERE role_id = '" . $roleID . "';";
                        $result = $db->baseExecute($sql);
                        if ( $result != false ){ // Error Check
                                $rolename = $result->baseFetchRow();
                                $result->baseFreeRows();
                                if ( isset($rolename[0]) ){
                                        $Ret = $rolename[0];
                                }
                                if ( $XSS > 0 ){ // Anti XSS Output Data
                                        $Ret = XSSPrintSafe($Ret);
                                }
                        }
                }
                return $Ret;
        }
        function returnRoleNamesDropDown($roleid){
                // Returns an HTML drop down list with all of the role names.
                // The passed $roleid will be selected if it exists.
                $db = $this->db;
                $sql = "SELECT role_id, role_name FROM base_roles;";
                $result = $db->baseExecute($sql);
                $tmpHTML = NLI("<select name='roleID'>",7);
                $i = 0;
                while (
                        ($myrow = $result->baseFetchRow())
                        && ($i < $result->baseRecordCount())
                ){
                        $tmp = "<option value='".$myrow[0]."'";
                        $tmp .= chk_select($roleid,$myrow[0]);
                        $tmp .= '>'.XSSPrintSafe($myrow[1]).'</option>';
                        $tmpHTML .= NLI($tmp,8);
                        ++$i;
                }
                $result->baseFreeRows();
                $tmpHTML .= NLI('</select>',7);
                return $tmpHTML;
        }
    function setRoleCookie($passwd, $user)
    {
        //sets a cookie with the md5 summed passwd embedded
        $hash = md5($passwd . $user . "BASEUserRole");
        $cookievalue = $passwd . "|" . $user . "|";
        setcookie('BASERole', $cookievalue);
    }
        function readRoleCookie(){ // Reads the roleCookie and returns the role id.
                $Ret = 0;
                if ( isset($_COOKIE['BASERole']) ){ // Check cookie sanity
                        $cookievalue = $_COOKIE['BASERole'];
                        $cookiearr = explode('|', $cookievalue);
                        $user = '';
                        $pwd = '';
                        if ( isset($cookiearr[0]) ){
                                $pwd = $cookiearr[0];
                        }
                        if ( isset($cookiearr[1]) ){
                                $user = $cookiearr[1];
                        }
                        $db = $this->db;
                        $user = filterSql($user,1,$db); // Input sanitazation.
                        $pwd  = filterSql($pwd,1,$db);
                        $sql = "SELECT role_id FROM base_users where usr_login='".$user
                        ."' AND usr_pwd='".$pwd."';";
                        $result = $this->db->baseExecute($sql);
                        // Error Check
                        if ( $result != false && is_array($result->row->fields) ){
                                $Ret = $result->row->fields['role_id'];
                        }
                }
                return $Ret;
        }
        // @codeCoverageIgnoreStart
        // Why write a unit test for a builtin function wrapper.
        function cryptpassword( $password ){
                // Returns the md5 hash of supplied password.
                // Security wise this is a bad idea.
                // Opened Issue #79 to track this.
                // https://github.com/NathanGibbs3/BASE/issues/79
                $cryptpwd = md5($password);
                return $cryptpwd;
        }
        // @codeCoverageIgnoreEnd
}

class BaseRole {
        var $db;

        function __construct() { // PHP 5+ constructor Shim.
                // Class/Method agnostic shim code.
                $SCname = get_class();
                if ( method_exists($this, $SCname) ) {
                        $SCargs = func_get_args();
                        call_user_func_array(array($this, $SCname), $SCargs);
                }else{
                        // @codeCoverageIgnoreStart
                        // Should never execute.
                        trigger_error( // Will need to add this message to the TD.
                                "Class: $SCname No Legacy Constructor.\n",
                                E_USER_ERROR
                        );
                        // @codeCoverageIgnoreEnd
                }
        }
        function BaseRole() { // PHP 4x constructor.
                GLOBAL $DBlib_path, $DBtype, $db_connect_method, $alert_dbname,
                $alert_host, $alert_port, $alert_user, $alert_password;
                $db = NewBASEDBConnection($DBlib_path, $DBtype);
                $db->baseDBConnect(
                        $db_connect_method, $alert_dbname, $alert_host, $alert_port,
                        $alert_user, $alert_password, 1
                );
                $this->db = $db;
        }
    function addRole($roleid, $rolename, $desc)
    {
        //adds role
        $db = $this->db;
        $sql = "SELECT * FROM base_roles WHERE role_name = '" . $rolename . "'";
        $exists = $db->baseExecute($sql);
        if ( $exists->baseRecordCount() > 0)
        {
            return _ROLEEXIST;
        }
        $sql = "SELECT * FROM base_roles WHERE role_id = '" . $roleid . "'";
        $exists = $db->baseExecute($sql);
        if ( $exists->baseRecordCount() > 0)
        {
            return _ROLEIDEXIST;
        }
        $sql ="INSERT INTO base_roles (role_id, role_name, role_desc)";
        $sql = $sql . "VALUES (".$roleid .", '".$rolename ."','".$desc."');";
        $db->baseExecute($sql, -1, -1, false);
        return _ROLEADDED;
    }
        function returnEditRole( $roleid, $XSS = 1 ){
                // Returns an array of Role's info.
                // Each array item is formatted as:
                // array[0] = role_id|role_name|role_desc
                $Ret = false;
                $roleid = intval($roleid); // Input Validation
                if ( $roleid > 0 ){
                        if ( !is_numeric($XSS) ){
                                $XSS = 1;
                        }
                        $db = $this->db;
                        $sql = "SELECT role_id, role_name, role_desc ";
                        $sql .= "FROM base_roles WHERE role_id = '" . $roleid . "';";
                        $result = $db->baseExecute($sql);
                        if ( $result != false ){ // Error Check
                                $myrow = $result->baseFetchRow();
                                $result->baseFreeRows();
                                if ( $XSS == 1 ){ // Anti XSS Output Data
                                        $myrow = XSSPrintSafe($myrow);
                                }
                                $Ret = $myrow;
                        }
                }
                return $Ret;
        }
    function updateRole($rolearray)
    {
        /* This function accepts an array in the following format
          $rolearray[0] = $roleid
          $rolearray[1] = $role_name
          $rolearray[2] = $role_desc
        */
        $db = $this->db;
        $sql = "UPDATE base_roles SET role_name = '". $rolearray[1] ."', role_desc = '" . $rolearray[2] . "' ";
        $sql = $sql . "WHERE role_id = '" . $rolearray[0] . "'";
        $updated = $db->baseExecute($sql);
        return;
    }
    
    function deleteRole($role)
    {
        //deletes the role
        $db = $this->db;
        $sql = "DELETE FROM base_roles WHERE role_id = '" . $role . "';";
        $deleted = $db->baseExecute($sql);
        return;
    }
    
    function returnRoles()
    {
        /* returns an array of all Roles info
         * each array item is formatted as
         * array[] = role_id|role_name|role_desc
        */
        
        $db = $this->db;
        $sql = "SELECT role_id, role_name, role_desc ";
        $sql = $sql . "FROM base_roles ORDER BY role_id;";
        $result = $db->baseExecute($sql);
        
        $i = 0;
        while ( ($myrow = $result->baseFetchRow()) && ($i < $result->baseRecordCount()) )
        {
            $rolearray[$i] = $myrow[0] . "|" . $myrow[1] . "|" . $myrow[2];
            ++$i;
        }
        $result->baseFreeRows();
        return $rolearray;
    }
}
// Returns true if the role of current user is authorized.
// Redirect if valid header is given.
function AuthorizedRole( $roleneeded = 1, $header = '' ){
        GLOBAL $BASE_urlpath, $Use_Auth_System, $et;
        $Ret = false;
        if ( $Use_Auth_System != 1 ){ // Auth system off, always pass.
                $Ret = true;
        }else{ // Check role and possibly redirect.
                $BUser = new BaseUser();
                $user = $BUser->returnUser(); // User
                $UAE = $BUser->isActive($user); // User Account Enabled.
                $URN = $BUser->hasRole($roleneeded); // User role needed.
                if ( $URN == 0 || $UAE == false ){ // Not Authorized
                        $msg = ' user access';
                        if ( $user == '' ){
                                $msg = "Unauthenticated$msg";
                        }else{
                                $msg = "Unauthorized$msg: $user";
                        }
                        trigger_error($msg);
                        if ( $roleneeded >= 10000 ){ // Lock redirect :-)
                                error_log('Redirect Lock Engaged');
                                $header = 'base_denied';
                        }
                        if ( $header != '' ){
                                $ReqRE = "(base_(denied|main)|index)";
                                if ( preg_match("/^" . $ReqRE ."$/", $header) ){
                                        // Redirect to allowed locations only.
                                        error_log('Attempt Redirect');
                                        base_header("Location: $BASE_urlpath/$header.php");
                                        error_log('Redirect failed');
                                }
                        }
                }else{
                        $Ret = true;
                }
        }
        if ( is_object($et) ){ // Need to TD this in Issue #11 branch.
                $et->Mark('Authorization Check.');
        }
        return $Ret;
}
// Returns true if the passed value is part of the running script name.
function AuthorizedPage( $page = '' ){
        GLOBAL $BASE_urlpath;
        $Ret = false;
        $sc = DIRECTORY_SEPARATOR; // Issue #161
        $ReqRE = preg_quote("$BASE_urlpath$sc",'/')."$page\.php";
        if ( preg_match("/^" . $ReqRE ."$/", $_SERVER['SCRIPT_NAME']) ){
                $Ret = true;
        }
        return $Ret;
}
// Returns true if URI is set & matches URL path & running script name.
function AuthorizedURI(){
        GLOBAL $BASE_urlpath;
        $Ret = false;
        if (isset($_SERVER["REQUEST_URI"])){
                $URI = $_SERVER["REQUEST_URI"];
                $ReqRE = preg_quote($BASE_urlpath.$_SERVER['SCRIPT_NAME'],'/');
                if ( preg_match("/^" . $ReqRE ."/", $URI) ){
                        $Ret = true;
                }
        }
        return $Ret;
}
?>

1	<?php
2	// Basic Analysis and Security Engine (BASE)
3	// Copyright (C) 2019-2023 Nathan Gibbs
4	// Copyright (C) 2004 BASE Project Team
5	// Copyright (C) 2000 Carnegie Mellon University
6	//
7	// For license info: See the file 'base_main.php'
8	//
9	// Project Lead: Nathan Gibbs
10	// Built upon work by: Kevin Johnson & the BASE Project Team
11	// Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
12	//
13	// Purpose: User manangement object.
14	// Role management object.
15	// Access Authoriztion routines.
16	// If the variable $Use_Auth_System = 0 (zero), Access
17	// authorization checks always pass.
18	//
19	// Author(s): Nathan Gibbs
20	// Kevin Johnson
21	// Ensure the conf file has been loaded. Prevent direct access to this file.
22	defined( '_BASE_INC' ) or die( 'Accessing this file directly is not allowed.' );
23
24	class BaseUser {
25	var $db;
26
27	function __construct() { // PHP 5+ constructor Shim.
28	// Class/Method agnostic shim code.
29	$SCname = get_class();	260✔
30	if ( method_exists($this, $SCname) ) {	260✔
31	$SCargs = func_get_args();	260✔
32	call_user_func_array(array($this, $SCname), $SCargs);	260✔
33	}else{	78✔
34	// @codeCoverageIgnoreStart
35	// Should never execute.
36	trigger_error( // Will need to add this message to the TD.
37	"Class: $SCname No Legacy Constructor.\n",
38	E_USER_ERROR
39	);
40	// @codeCoverageIgnoreEnd
41	}
42	}	182✔
43	function BaseUser() { // PHP 4x constructor.
44	GLOBAL $DBlib_path, $DBtype, $db_connect_method, $alert_dbname,	182✔
45	$alert_host, $alert_port, $alert_user, $alert_password;	104✔
46	$db = NewBASEDBConnection($DBlib_path, $DBtype);	260✔
47	$db->baseDBConnect(	260✔
48	$db_connect_method, $alert_dbname, $alert_host, $alert_port,	182✔
49	$alert_user, $alert_password, 1	182✔
50	);	78✔
51	$db->DB->SetFetchMode(ADODB_FETCH_BOTH);	260✔
52	$this->db = $db;	260✔
53	}	182✔
54	// Core Authentication System.
55	// Accepts a username and password.
56	// Returns:
57	// 0 if the username and pwd are correct.
58	// 1 if the password is wrong.
59	// 2 if the user is disabled.
60	// 3 if the username doesn't exist
61	function AuthenticateCore( $user = '', $pwd = '' ){
62	GLOBAL $debug_mode, $et;	70✔
63	$Ret = -1;	100✔
64	if ( !LoadedString($user) ){ // Input Validation	100✔
65	$Ret = 3; // Needs User Name, default to nonexistent user.	20✔
66	}else{	6✔
67	$db = $this->db;	80✔
68	$user = filterSql($user,1,$db); // Input sanitazation.	80✔
69	$pwd = filterSql($pwd,1,$db);	80✔
70	$sql = "SELECT * from base_users where base_users.usr_login ='" . $user ."';";	80✔
71	$rs = $db->baseExecute($sql);	80✔
72	if (
73	$rs != false	40✔
74	&& $db->baseErrorMessage() == ''	80✔
75	&& $rs->baseRecordCount() > 0	80✔
76	){ // Error Check	24✔
77	$result = $rs->baseFetchRow();	60✔
78	if ( $result['usr_enabled'] == 0 ){	60✔
79	$Ret = 2; // User Account Disabled.	20✔
80	}else{	6✔
81	if ( $result['usr_pwd'] == $this->cryptpassword($pwd) ){	40✔
82	$Ret = 0; // Password OK	20✔
83	}else{	6✔
84	$Ret = 1; // Password Wrong	20✔
85	}
86	}
87	$rs->baseFreeRows();	60✔
88	}else{	18✔
89	$Ret = 3;	20✔
90	}
91	}
92	if ( isset($et) && is_object($et) ){ // Need to TD this in Issue #11 branch.	100✔
93	$et->Mark('Authentication Check.');	×
94	}
95	return $Ret;	100✔
96	}
97	// Same inputs/returns as AuthenticateCore.
98	// Sets the role cookie on success.
99	function Authenticate( $user = '', $pwd = '' ){
100	$Ret = $this->AuthenticateCore( $user, $pwd );	×
101	if ( $Ret == 0 ){	×
102	$this->setRoleCookie($this->cryptpassword($pwd), $user);	×
103	}
104	return $Ret;	×
105	}
106	// Same inputs as AuthenticateCore.
107	// returns "Failed" on failure or role_id on success.
108	function AuthenticateNoCookie( $user = '', $pwd = '' ) {
109	$Ret = $this->AuthenticateCore( $user, $pwd );	×
110	if ( $Ret == 0 ){ // Get RoleID	×
111	$db = $this->db;	×
112	$user = filterSql($user,1,$db); // Input sanitazation.	×
113	$pwd = filterSql($pwd,1,$db);	×
114	$sql = "SELECT role_id FROM base_users where usr_login='" . $user
115	. "' AND usr_pwd='".$this->cryptpassword($pwd)."';";	×
116	$rs = $db->baseExecute($sql);	×
117	if (
118	$rs != false
119	&& $db->baseErrorMessage() == ''	×
120	&& $rs->baseRecordCount() > 0	×
121	){ // Error Check
122	$Ret = $rs->baseFetchRow();	×
123	$rs->baseFreeRows();	×
124	if ( isset($Ret[0]) ){	×
125	$Ret = intval($Ret[0]);	×
126	}
127	}else{
128	$Ret = 'Failed';	×
129	}
130	}else{
131	$Ret = 'Failed';	×
132	}
133	return $Ret;	×
134	}
135	// Accepts a username.
136	// Returns true if user account is enabled, false otherwise.
137	function isActive( $user = '' ){
138	$Ret = false;	120✔
139	if ( LoadedString($user) ){ // Input Validation	120✔
140	$db = $this->db;	100✔
141	$user = filterSql($user,1,$db); // Input sanitazation.	100✔
142	$sql = "SELECT usr_enabled FROM base_users WHERE usr_login ='"	20✔
143	.$user."';";	70✔
144	$rs = $db->baseExecute($sql);	100✔
145	if (
146	$rs != false	50✔
147	&& $db->baseErrorMessage() == ''	100✔
148	&& $rs->baseRecordCount() > 0	100✔
149	){ // Error Check	30✔
150	$Active = $rs->baseFetchRow();	80✔
151	$rs->baseFreeRows();	80✔
152	if ( isset($Active[0]) ){	80✔
153	if ( intval($Active[0]) == 1 ){	80✔
154	$Ret = true;	60✔
155	}	18✔
156	}	24✔
157	}	24✔
158	}	30✔
159	return $Ret;	120✔
160	}
161	function hasRole($roleNeeded)
162	{
163	// Checks which role the user has
164	$role = $this->readRoleCookie();	40✔
165	if (($role > $roleNeeded) \|\| $role == 0)	40✔
166	{	12✔
167	// returns unauthorized
168	return 0;	×
169	}
170
171	return 1;	40✔
172
173	}
174
175	function addUser($user, $role, $password, $name)
176	{
177	//adds user
178	$db = $this->db;	×
179	$sql = "SELECT * FROM base_users WHERE usr_login = '" . $user . "'";	×
180	$exists = $db->baseExecute($sql);	×
181	if ( $exists->baseRecordCount() > 0)	×
182	{
183	return "User Already Exists";	×
184	}
185	$cryptpassword = $this->cryptpassword($password);	×
186	$sql = "SELECT MAX(usr_id) FROM base_users;";	×
187	$usercount = $db->baseExecute($sql);	×
188	$usercnt = $usercount->baseFetchRow();	×
189	$userid = $usercnt[0] + 1;	×
190	$sql = "INSERT INTO base_users (usr_id, usr_login, usr_pwd, role_id, usr_name, usr_enabled)";	×
191	$sql .= "VALUES (".$userid .", '".$user."','".$cryptpassword."',".$role.",'".$name."', 1);";	×
192	$db->baseExecute($sql, -1, -1, false);	×
193	return _ADDEDSF;	×
194	}
195
196	function disableUser($user)
197	{
198	//disables user
199	$db = $this->db;	×
200	$sql = "UPDATE base_users SET usr_enabled = '0' WHERE usr_id = '" . $user . "';";	×
201	$disabled = $db->baseExecute($sql);	×
202	return;	×
203	}
204
205	function deleteUser($user)
206	{
207	//deletes the user
208	$db = $this->db;	×
209	$sql = "DELETE FROM base_users WHERE usr_id = '" . $user . "';";	×
210	$deleted = $db->baseExecute($sql);	×
211	return;	×
212	}
213
214	function enableUser($user)
215	{
216	//enables user
217	$db = $this->db;	×
218	$sql = "UPDATE base_users SET usr_enabled = '1' WHERE usr_id = '" . $user . "';";	×
219	$enabled = $db->baseExecute($sql);	×
220	return;	×
221	}
222
223	function updateUser($userarray)
224	{
225	/* This function accepts an array in the following format
226	$userarray[0] = $userid
227	$userarray[1] = $fullname
228	$userarray[2] = $roleid
229	*/
230	$db = $this->db;	×
231	$sql = "UPDATE base_users SET usr_name = '". $userarray[1] ."', role_id = '" . $userarray[2] . "' ";	×
232	$sql = $sql . "WHERE usr_id = '" . $userarray[0] . "'";	×
233	$enabled = $db->baseExecute($sql);	×
234	return;	×
235	}
236
237	function changePassword($user, $oldpassword, $newpassword)
238	{
239	// Changes the user's password
240	$db = $this->db;	×
241	$sql = "SELECT usr_pwd from base_users where usr_login = '" . $user ."';";	×
242	$userRS = $db->baseExecute($sql);	×
243	if ( $db->baseErrorMessage() != "" )	×
244	{
245	// Generic SQL error
246	$error = returnErrorMessage(_NOPWDCHANGE . $db->baseErrorMessage());	×
247	return $error;	×
248	} elseif ($userRS->baseRecordCount() == 0)	×
249	{
250	// User doesn't exist... Someone is playing with their cookie
251	$error = returnErrorMessage(_NOUSER);	×
252	return $error;	×
253	}
254	$row = $userRS->baseFetchRow();	×
255	$cryptoldpasswd = $this->cryptpassword($oldpassword);	×
256	if ($cryptoldpasswd != $row[0])	×
257	{
258	// Old password doesn't match record
259	$error = returnErrorMessage(_OLDPWD);	×
260	return $error;	×
261	}
262	// Finally... lets change the password
263	$sql = "UPDATE base_users SET usr_pwd='" . $this->cryptpassword($newpassword);	×
264	$sql = $sql . "' WHERE usr_login='". $user . "';";	×
265	$chngpwd = $db->baseExecute($sql);	×
266	if ( $db->baseErrorMessage() != "" )	×
267	{
268	// Generic SQL error
269	$error = returnErrorMessage(_PWDCANT. $db->baseErrorMessage());	×
270	return $error;	×
271	}
272
273	return _PWDDONE;	×
274	}
275	function returnUser(){ // returns user login from role cookie
276	$user = '';	80✔
277	if ( isset($_COOKIE['BASERole']) ){	80✔
278	$cookievalue = $_COOKIE['BASERole'];	60✔
279	$cookiearr = explode('\|', $cookievalue);	60✔
280	$user = $cookiearr[1];	60✔
281	}	18✔
282	return $user;	80✔
283	}
284	function returnUserID($user){ // Returns uid of user, false on Error.
285	$Ret = false;	140✔
286	if ( LoadedString($user) ){ // Input Validation	140✔
287	$db = $this->db;	120✔
288	$sql = "SELECT usr_id FROM base_users WHERE usr_login = '" . $user . "';";	120✔
289	$rs = $db->baseExecute($sql);	120✔
290	if (
291	$rs != false	60✔
292	&& $db->baseErrorMessage() == ''	120✔
293	&& $rs->baseRecordCount() > 0	120✔
294	){ // Error Check	36✔
295	$usrid = $rs->baseFetchRow();	100✔
296	$rs->baseFreeRows();	100✔
297	if ( isset($usrid[0]) ){	100✔
298	$Ret = intval($usrid[0]);	100✔
299	}	30✔
300	}	30✔
301	}	36✔
302	return $Ret;	140✔
303	}
304	function returnUsers(){
305	/* returns an array of all users info
306	* each array item is formatted as
307	* array[] = usr_id\|usr_login\|role_id\|usr_name\|usr_enabled
308	*/
309	$userarray = NULL;	×
310	$db = $this->db;	×
311	$sql = "SELECT usr_id, usr_login, role_id, usr_name, usr_enabled ";	×
312	$sql = $sql . "FROM base_users ORDER BY usr_id;";	×
313	$result = $db->baseExecute($sql);	×
314
315	$i = 0;	×
316	while ( ($myrow = $result->baseFetchRow()) && ($i < $result->baseRecordCount()) )	×
317	{
318	$userarray[$i] = $myrow[0] . "\|" . $myrow[1] . "\|" . $myrow[2] . "\|" . $myrow[3] . "\|" . $myrow[4];	×
319	++$i;	×
320	}
321	$result->baseFreeRows();	×
322	return $userarray;	×
323	}
324	function returnEditUser( $userid, $XSS = 1 ){
325	// Returns an array of user's info.
326	// Each array item is formatted as:
327	// array[0] = usr_id\|usr_login\|role_id\|usr_name\|usr_enabled
328	// Returns false on Error.
329	$Ret = false;	120✔
330	$userid = intval($userid); // Input Validation	120✔
331	if ( $userid > 0 ){	120✔
332	if ( !is_numeric($XSS) ){	100✔
333	$XSS = 1;	20✔
334	}	6✔
335	$db = $this->db;	100✔
336	$sql = "SELECT usr_id, usr_login, role_id, usr_name, usr_enabled ";	100✔
337	$sql .= "FROM base_users WHERE usr_id = '" . $userid . "';";	100✔
338	$result = $db->baseExecute($sql);	100✔
339	if ( $result != false ){ // Error Check	100✔
340	$myrow = $result->baseFetchRow();	100✔
341	$result->baseFreeRows();	100✔
342	if ( $XSS > 0 ){ // Anti XSS Output Data	100✔
343	$myrow = XSSPrintSafe($myrow);	80✔
344	}	24✔
345	$Ret = $myrow;	100✔
346	}	30✔
347	}	30✔
348	return $Ret;	120✔
349	}
350	function roleName( $roleID, $XSS = 1 ){
351	// Returns name of roleID, false on Error.
352	$Ret = false;	120✔
353	$roleID = intval($roleID); // Input Validation	120✔
354	if ( $roleID > 0 ){	120✔
355	if ( !is_numeric($XSS) ){	100✔
356	$XSS = 1;	20✔
357	}	6✔
358	$db = $this->db;	100✔
359	$sql = "SELECT role_name FROM base_roles WHERE role_id = '" . $roleID . "';";	100✔
360	$result = $db->baseExecute($sql);	100✔
361	if ( $result != false ){ // Error Check	100✔
362	$rolename = $result->baseFetchRow();	100✔
363	$result->baseFreeRows();	100✔
364	if ( isset($rolename[0]) ){	100✔
365	$Ret = $rolename[0];	80✔
366	}	24✔
367	if ( $XSS > 0 ){ // Anti XSS Output Data	100✔
368	$Ret = XSSPrintSafe($Ret);	80✔
369	}	24✔
370	}	30✔
371	}	30✔
372	return $Ret;	120✔
373	}
374	function returnRoleNamesDropDown($roleid){
375	// Returns an HTML drop down list with all of the role names.
376	// The passed $roleid will be selected if it exists.
377	$db = $this->db;	100✔
378	$sql = "SELECT role_id, role_name FROM base_roles;";	100✔
379	$result = $db->baseExecute($sql);	100✔
380	$tmpHTML = NLI("<select name='roleID'>",7);	100✔
381	$i = 0;	100✔
382	while (
383	($myrow = $result->baseFetchRow())	100✔
384	&& ($i < $result->baseRecordCount())	100✔
385	){	30✔
386	$tmp = "<option value='".$myrow[0]."'";	100✔
387	$tmp .= chk_select($roleid,$myrow[0]);	100✔
388	$tmp .= '>'.XSSPrintSafe($myrow[1]).'</option>';	100✔
389	$tmpHTML .= NLI($tmp,8);	100✔
390	++$i;	100✔
391	}	30✔
392	$result->baseFreeRows();	100✔
393	$tmpHTML .= NLI('</select>',7);	100✔
394	return $tmpHTML;	100✔
395	}
396	function setRoleCookie($passwd, $user)
397	{
398	//sets a cookie with the md5 summed passwd embedded
399	$hash = md5($passwd . $user . "BASEUserRole");	×
400	$cookievalue = $passwd . "\|" . $user . "\|";	×
401	setcookie('BASERole', $cookievalue);	×
402	}
403	function readRoleCookie(){ // Reads the roleCookie and returns the role id.
404	$Ret = 0;	180✔
405	if ( isset($_COOKIE['BASERole']) ){ // Check cookie sanity	180✔
406	$cookievalue = $_COOKIE['BASERole'];	140✔
407	$cookiearr = explode('\|', $cookievalue);	140✔
408	$user = '';	140✔
409	$pwd = '';	140✔
410	if ( isset($cookiearr[0]) ){	140✔
411	$pwd = $cookiearr[0];	140✔
412	}	42✔
413	if ( isset($cookiearr[1]) ){	140✔
414	$user = $cookiearr[1];	120✔
415	}	36✔
416	$db = $this->db;	140✔
417	$user = filterSql($user,1,$db); // Input sanitazation.	140✔
418	$pwd = filterSql($pwd,1,$db);	140✔
419	$sql = "SELECT role_id FROM base_users where usr_login='".$user	98✔
420	."' AND usr_pwd='".$pwd."';";	98✔
421	$result = $this->db->baseExecute($sql);	140✔
422	// Error Check
423	if ( $result != false && is_array($result->row->fields) ){	140✔
424	$Ret = $result->row->fields['role_id'];	60✔
425	}	18✔
426	}	42✔
427	return $Ret;	180✔
428	}
429	// @codeCoverageIgnoreStart
430	// Why write a unit test for a builtin function wrapper.
431	function cryptpassword( $password ){
432	// Returns the md5 hash of supplied password.
433	// Security wise this is a bad idea.
434	// Opened Issue #79 to track this.
435	// https://github.com/NathanGibbs3/BASE/issues/79
436	$cryptpwd = md5($password);
437	return $cryptpwd;
438	}
439	// @codeCoverageIgnoreEnd
440	}
441
442	class BaseRole {
443	var $db;
444
445	function __construct() { // PHP 5+ constructor Shim.
446	// Class/Method agnostic shim code.
447	$SCname = get_class();	×
448	if ( method_exists($this, $SCname) ) {	×
449	$SCargs = func_get_args();	×
450	call_user_func_array(array($this, $SCname), $SCargs);	×
451	}else{
452	// @codeCoverageIgnoreStart
453	// Should never execute.
454	trigger_error( // Will need to add this message to the TD.
455	"Class: $SCname No Legacy Constructor.\n",
456	E_USER_ERROR
457	);
458	// @codeCoverageIgnoreEnd
459	}
460	}
461	function BaseRole() { // PHP 4x constructor.
462	GLOBAL $DBlib_path, $DBtype, $db_connect_method, $alert_dbname,
463	$alert_host, $alert_port, $alert_user, $alert_password;
464	$db = NewBASEDBConnection($DBlib_path, $DBtype);	×
465	$db->baseDBConnect(	×
466	$db_connect_method, $alert_dbname, $alert_host, $alert_port,
467	$alert_user, $alert_password, 1
468	);
469	$this->db = $db;	×
470	}
471	function addRole($roleid, $rolename, $desc)
472	{
473	//adds role
474	$db = $this->db;	×
475	$sql = "SELECT * FROM base_roles WHERE role_name = '" . $rolename . "'";	×
476	$exists = $db->baseExecute($sql);	×
477	if ( $exists->baseRecordCount() > 0)	×
478	{
479	return _ROLEEXIST;	×
480	}
481	$sql = "SELECT * FROM base_roles WHERE role_id = '" . $roleid . "'";	×
482	$exists = $db->baseExecute($sql);	×
483	if ( $exists->baseRecordCount() > 0)	×
484	{
485	return _ROLEIDEXIST;	×
486	}
487	$sql ="INSERT INTO base_roles (role_id, role_name, role_desc)";	×
488	$sql = $sql . "VALUES (".$roleid .", '".$rolename ."','".$desc."');";	×
489	$db->baseExecute($sql, -1, -1, false);	×
490	return _ROLEADDED;	×
491	}
492	function returnEditRole( $roleid, $XSS = 1 ){
493	// Returns an array of Role's info.
494	// Each array item is formatted as:
495	// array[0] = role_id\|role_name\|role_desc
496	$Ret = false;	120✔
497	$roleid = intval($roleid); // Input Validation	120✔
498	if ( $roleid > 0 ){	120✔
499	if ( !is_numeric($XSS) ){	100✔
500	$XSS = 1;	20✔
501	}	6✔
502	$db = $this->db;	100✔
503	$sql = "SELECT role_id, role_name, role_desc ";	100✔
504	$sql .= "FROM base_roles WHERE role_id = '" . $roleid . "';";	100✔
505	$result = $db->baseExecute($sql);	100✔
506	if ( $result != false ){ // Error Check	100✔
507	$myrow = $result->baseFetchRow();	100✔
508	$result->baseFreeRows();	100✔
509	if ( $XSS == 1 ){ // Anti XSS Output Data	100✔
510	$myrow = XSSPrintSafe($myrow);	80✔
511	}	24✔
512	$Ret = $myrow;	100✔
513	}	30✔
514	}	30✔
515	return $Ret;	120✔
516	}
517	function updateRole($rolearray)
518	{
519	/* This function accepts an array in the following format
520	$rolearray[0] = $roleid
521	$rolearray[1] = $role_name
522	$rolearray[2] = $role_desc
523	*/
524	$db = $this->db;	×
525	$sql = "UPDATE base_roles SET role_name = '". $rolearray[1] ."', role_desc = '" . $rolearray[2] . "' ";	×
526	$sql = $sql . "WHERE role_id = '" . $rolearray[0] . "'";	×
527	$updated = $db->baseExecute($sql);	×
528	return;	×
529	}
530
531	function deleteRole($role)
532	{
533	//deletes the role
534	$db = $this->db;	×
535	$sql = "DELETE FROM base_roles WHERE role_id = '" . $role . "';";	×
536	$deleted = $db->baseExecute($sql);	×
537	return;	×
538	}
539
540	function returnRoles()
541	{
542	/* returns an array of all Roles info
543	* each array item is formatted as
544	* array[] = role_id\|role_name\|role_desc
545	*/
546
547	$db = $this->db;	×
548	$sql = "SELECT role_id, role_name, role_desc ";	×
549	$sql = $sql . "FROM base_roles ORDER BY role_id;";	×
550	$result = $db->baseExecute($sql);	×
551
552	$i = 0;	×
553	while ( ($myrow = $result->baseFetchRow()) && ($i < $result->baseRecordCount()) )	×
554	{
555	$rolearray[$i] = $myrow[0] . "\|" . $myrow[1] . "\|" . $myrow[2];	×
556	++$i;	×
557	}
558	$result->baseFreeRows();	×
559	return $rolearray;	×
560	}
561	}
562	// Returns true if the role of current user is authorized.
563	// Redirect if valid header is given.
564	function AuthorizedRole( $roleneeded = 1, $header = '' ){
565	GLOBAL $BASE_urlpath, $Use_Auth_System, $et;	140✔
566	$Ret = false;	200✔
567	if ( $Use_Auth_System != 1 ){ // Auth system off, always pass.	200✔
568	$Ret = true;	20✔
569	}else{ // Check role and possibly redirect.	6✔
570	$BUser = new BaseUser();	180✔
571	$user = $BUser->returnUser(); // User	180✔
572	$UAE = $BUser->isActive($user); // User Account Enabled.	180✔
573	$URN = $BUser->hasRole($roleneeded); // User role needed.	180✔
574	if ( $URN == 0 \|\| $UAE == false ){ // Not Authorized	180✔
575	$msg = ' user access';	120✔
576	if ( $user == '' ){	120✔
577	$msg = "Unauthenticated$msg";	40✔
578	}else{	12✔
579	$msg = "Unauthorized$msg: $user";	80✔
580	}
581	trigger_error($msg);	120✔
582	if ( $roleneeded >= 10000 ){ // Lock redirect :-)	80✔
583	error_log('Redirect Lock Engaged');	20✔
584	$header = 'base_denied';	20✔
585	}	6✔
586	if ( $header != '' ){	80✔
587	$ReqRE = "(base_(denied\|main)\|index)";	20✔
588	if ( preg_match("/^" . $ReqRE ."$/", $header) ){	20✔
589	// Redirect to allowed locations only.
590	error_log('Attempt Redirect');	20✔
591	base_header("Location: $BASE_urlpath/$header.php");	20✔
592	error_log('Redirect failed');	62✔
593	}	6✔
594	}	6✔
595	}else{	24✔
596	$Ret = true;	60✔
597	}
598	}
599	if ( is_object($et) ){ // Need to TD this in Issue #11 branch.	160✔
600	$et->Mark('Authorization Check.');	20✔
601	}	6✔
602	return $Ret;	160✔
603	}
604	// Returns true if the passed value is part of the running script name.
605	function AuthorizedPage( $page = '' ){
606	GLOBAL $BASE_urlpath;	154✔
607	$Ret = false;	220✔
608	$sc = DIRECTORY_SEPARATOR; // Issue #161	220✔
609	$ReqRE = preg_quote("$BASE_urlpath$sc",'/')."$page\.php";	220✔
610	if ( preg_match("/^" . $ReqRE ."$/", $_SERVER['SCRIPT_NAME']) ){	220✔
611	$Ret = true;	20✔
612	}	6✔
613	return $Ret;	220✔
614	}
615	// Returns true if URI is set & matches URL path & running script name.
616	function AuthorizedURI(){
617	GLOBAL $BASE_urlpath;	42✔
618	$Ret = false;	60✔
619	if (isset($_SERVER["REQUEST_URI"])){	60✔
620	$URI = $_SERVER["REQUEST_URI"];	40✔
621	$ReqRE = preg_quote($BASE_urlpath.$_SERVER['SCRIPT_NAME'],'/');	40✔
622	if ( preg_match("/^" . $ReqRE ."/", $URI) ){	40✔
623	$Ret = true;	20✔
624	}	6✔
625	}	12✔
626	return $Ret;	60✔
627	}
628	?>

NathanGibbs3 / BASE / 590

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous