NathanGibbs3 / BASE / 627

pending completion

Build # 627

Build Type

push

travis-ci-com

Committed by

NathanGibbs3

Commit Message

Merge branch 'documentation' into devel

Run Details

1766 of 6437 relevant lines covered (27.44%)

105.91 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

/admin/base_roleadmin.php

<?php
// Basic Analysis and Security Engine (BASE)
// Copyright (C) 2019-2023 Nathan Gibbs
// Copyright (C) 2004 BASE Project Team
// Copyright (C) 2000 Carnegie Mellon University
//
//   For license info: See the file 'base_main.php'
//
//       Project Lead: Nathan Gibbs
// Built upon work by: Kevin Johnson & the BASE Project Team
//                     Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
//
//            Purpose: Role management functions (create, disable etc....)
//
//          Author(s): Nathan Gibbs
//                     Kevin Johnson

$sc = DIRECTORY_SEPARATOR;
require_once("..$sc" . "includes$sc" . 'base_krnl.php');
include("$BASE_path/includes/base_include.inc.php");
include_once("$BASE_path/base_db_common.php");
include_once("$BASE_path/base_stat_common.php");

if ( isset($_GET['action']) ){
        $Action = filterSql($_GET['action']);
}else{
        $Action = 'Invalid';
}
if ($Use_Auth_System == 1) {
        AuthorizedRole(1,'base_main');
        $cs = new CriteriaState("admin/base_roleadmin.php");
        $cs->ReadState();
        $page_title = _ROLEADMIN;
        // Html Templates
        $Umca = "base_roleadmin.php?action="; // Role Managemnt Common Action.
        $Fst = "<form action='$Umca"; // Form tag start.
        $Fct = " Method='POST'>"; // Form tag end.
        $Hrst = "<a href='$Umca"; // Href tag start.
        $Trc = NLI('</tr><tr>', 5); // Table row continue.
        // I would like to clean this up later into a display class or set of
        // functions -- Kevin
        if ( preg_match("/(delete|edit)role/", $Action) ){
                $roleid = filterSql($_GET['roleid']);
        }
        if ( preg_match("/add/", $Action) ){
                $roleid = filterSql($_POST['roleid']);
        }
        if ( preg_match("/(create|list|(edit|update)role)/", $Action) ){
                $role = new BaseRole();
                if ( class_exists('UILang') ){ // Issue 11 backport shim.
                        $hrdesc = $UIL->CWA['Desc']; // Description Header Item.
                }else{
                        $hrdesc = _FRMROLEDESC;
                }
                if ( preg_match("/(create|editrole)/", $Action) ){
                        if ( class_exists('UILang') ){ // Issue 11 backport shim.
                                $RIDesc = $UIL->ADA['DescRI'];
                        }else{
                                $RIDesc = _FRMROLEID;
                        }
                }
        }else{ // 2 vars for this?! No idea why. Will keep for now. -- Nathan
                $BRole = new BaseRole();
        }
        switch ($Action) {
                case "create"; // Display the new Role form.
                        $tdc = "<td width='25%' align='right'>";
                        $tdal = "<td align='left'>";
                        $ipt = "<input type='";
                        $form = NLI($Fst."add'".$Fct,3);
                        $form .= NLI("<table border=1 class='query'>",4);
                        $form .= NLI('<tr>',5);
                        $form .= NLI( "$tdc$RIDesc:</td>",6);
                        $form .= NLI($tdal,6);
                        $form .= NLI($ipt."text' name='roleid'/>",7);
                        $form .= NLI("</td>$Trc",6);
                        $form .= NLI($tdc._FRMROLENAME.'</td>',6);
                        $form .= NLI($tdal,6);
                        $form .= NLI($ipt."text' name='rolename'/>",7);
                        $form .= NLI("</td>$Trc",6);
                        $form .= NLI("$tdc$hrdesc:</td>",6);
                        $form .= NLI($tdal,6);
                        $form .= NLI($ipt."text' name='desc'>",7);
                        $form .= NLI("</td>$Trc",6);
                        $form .= NLI("<td colspan='2' align='center'>",6);
                        $form .= NLI(
                                $ipt."submit' name='submit' value='"._SUBMITQUERY."'/>",
                                7
                        );
                        $form .= NLI('</td>',6);
                        $form .= NLI('</tr>',5);
                        $form .= NLI('</table>',4);
                        $form .= NLI('</form>',3);
                        $pagebody = $form;
                        break;
                case "add"; // Actually add Role to DB.
                        $rolename = filterSql($_POST['rolename']);
                        $desc = filterSql($_POST['desc']);
                        $added = $BRole->addRole($roleid, $rolename, $desc);
                        $pagebody = $added;
                        break;
                case "editrole"; // Edit role form.
                        // This function accepts an array in the following format
                        // $roleinfo[0] = $rid
                        // $roleinfo[1] = $rname
                        // $roleinfo[2] = $rdesc
                        $roleinfo = $role->returnEditRole($roleid); // Anti XSS by default.
                        $rid = $roleinfo[0];
                        $ron = $roleinfo[1];
                        $rod = $roleinfo[2];
                        $tdc = "<td width='25%' align='right'>";
                        $tdal = "<td align='left'>";
                        $ipt = "<input type='";
                        $form = NLI($Fst."updaterole'".$Fct,3);
                        $form .= NLI($ipt."hidden' name='role_id' value='$rid'/>", 4);
                        $form .= NLI("<table border=1 class='query'>",4);
                        $form .= NLI('<tr>',5);
                        $form .= NLI("$tdc$RIDesc:</td>",6);
                        $form .= NLI("$tdal$rid</td>$Trc",6);
                        $form .= NLI($tdc._FRMROLENAME.'</td>',6);
                        $form .= NLI($tdal,6);
                        $form .= NLI($ipt."text' name='role_name' value='$ron' />", 7);
                        $form .= NLI("</td>$Trc",6);
                        $form .= NLI("$tdc$hrdesc:</td>",6);
                        $form .= NLI($tdal,6);
                        $form .= NLI($ipt."text' name='desc' value='$rod' />", 7);
                        $form .= NLI("</td>$Trc",6);
                        $form .= NLI("<td colspan='2' align='center'>",6);
                        $form .= NLI(
                                $ipt."submit' name='submit' value='"._UPDATEROLE."'/>",
                                7
                        );
                        $form .= NLI('</td>',6);
                        $form .= NLI('</tr>',5);
                        $form .= NLI('</table>',4);
                        $form .= NLI('</form>',3);
                        $pagebody = $form;
                        break;
                case 'updaterole'; // Updates role from above form....
                        // Setup array in this format for the updateRole function
                        // $rolearray[0] = $roleid
                        // $rolearray[1] = $rolename
                        // $rolearray[2] = $roledesc
                        $rolearray = array(
                                filterSql($_POST['role_id']),
                                filterSql($_POST['role_name']),
                                filterSql($_POST['desc']),
                        );
                        $role->updateRole($rolearray);
                        HTTP_header("Location: $Umca" . 'list');
                        break;
                case 'deleterole'; // Deletes role.
                        $BRole->deleteRole($roleid);
                        HTTP_header("Location: $Umca" . 'list');
                        break;
                case "list"; // Generate HTML Role Table.
                        if ( class_exists('UILang') ){ // Issue 11 backport shim.
                                $AcEdit = $UIL->UAA['Edit'];
                                $AcDelete = $UIL->UAA['Delete'];
                                $ridesc = $UIL->CWA['Id'];
                                $rname = $UIL->CWA['Name'];
                        }else{
                                $AcEdit = _EDIT;
                                $AcDelete = _DELETE;
                                $ridesc = _ID;
                                $rname = _NAME;
                        }
                        $roles = $role->returnRoles();
                        $thc = "<td class='plfieldhdr'";
                        $thcw5 = "$thc width='5%'>";
                        $tdac = "<td align='center'>";
                        $tduma = $tdac.$Hrst;
                        // Roles Table Display
                        $tmpHTML = FramedBoxHeader('','black',0,2);
                        $tmpHTML .= NLI("$thcw5$AcEdit</td>",4);
                        $tmpHTML .= NLI("$thcw5$AcDelete</td>",4);
                        $tmpHTML .= NLI("$thcw5$ridesc</td>",4);
                        $tmpHTML .= NLI("$thc>$rname</td>",4);
                        $tmpHTML .= NLI("$thc>$hrdesc</td>",4);
                        $tmpHTML .= NLI('</tr>',3);
                        foreach ( $roles as $row ){ // Iterate roles & build table.
                                $tmpRow = explode('|', $row);
                                // Setup Role ID URL param.
                                $urid = "role&amp;roleid=".urlencode($tmpRow[0]);
                                $tmpHTML .= NLI('<tr>',3);
                                $tmpHTML .= NLI($tduma."edit$urid'>",4);
                                $tmpHTML .= Icon('edit', "button_$AcEdit", 6);
                                $tmpHTML .= NLI('</a></td>',4);
                                $tmpHTML .= NLI($tduma."delete$urid'>",4);
                                $tmpHTML .= Icon('delete', "button_$AcDelete", 6);
                                $tmpHTML .= NLI('</a></td>',4);
                                // Anti XSS Output Data
                                $tmpRow = XSSPrintSafe($tmpRow);
                                $tmpHTML .= $tdac . $tmpRow[0] . '</td>';
                                $tmpHTML .= $tdac . $tmpRow[1] . '</td>';
                                $tmpHTML .= $tdac . $tmpRow[2] . '</td>';
                                $tmpHTML .= NLI('</tr>',3);
                        }
                        $tmpHTML .= NLI('</table>',2);
                        $pagebody = $tmpHTML;
                        break;
                default:
                        $pagebody = returnErrorMessage('Invalid Action!');
        }
        // Generate Page.
        PrintBASESubHeader(
                $page_title, $page_title, $cs->GetBackLink(), $refresh_all_pages
        );
        PrintBASEAdminMenuHeader();
        print $pagebody;
        PrintBASEAdminMenuFooter();
        PrintBASESubFooter();
}else{
        HTTP_header("Location: $BASE_urlpath/base_main.php");
}
?>

1	<?php
2	// Basic Analysis and Security Engine (BASE)
3	// Copyright (C) 2019-2023 Nathan Gibbs
4	// Copyright (C) 2004 BASE Project Team
5	// Copyright (C) 2000 Carnegie Mellon University
6	//
7	// For license info: See the file 'base_main.php'
8	//
9	// Project Lead: Nathan Gibbs
10	// Built upon work by: Kevin Johnson & the BASE Project Team
11	// Roman Danyliw <rdd@cert.org>, <roman@danyliw.com>
12	//
13	// Purpose: Role management functions (create, disable etc....)
14	//
15	// Author(s): Nathan Gibbs
16	// Kevin Johnson
17
18	$sc = DIRECTORY_SEPARATOR;	×
19	require_once("..$sc" . "includes$sc" . 'base_krnl.php');	×
20	include("$BASE_path/includes/base_include.inc.php");	×
21	include_once("$BASE_path/base_db_common.php");	×
22	include_once("$BASE_path/base_stat_common.php");	×
23
24	if ( isset($_GET['action']) ){	×
25	$Action = filterSql($_GET['action']);	×
26	}else{	×
27	$Action = 'Invalid';	×
28	}
29	if ($Use_Auth_System == 1) {	×
30	AuthorizedRole(1,'base_main');	×
31	$cs = new CriteriaState("admin/base_roleadmin.php");	×
32	$cs->ReadState();	×
33	$page_title = _ROLEADMIN;	×
34	// Html Templates
35	$Umca = "base_roleadmin.php?action="; // Role Managemnt Common Action.	×
36	$Fst = "<form action='$Umca"; // Form tag start.	×
37	$Fct = " Method='POST'>"; // Form tag end.	×
38	$Hrst = "<a href='$Umca"; // Href tag start.	×
39	$Trc = NLI('</tr><tr>', 5); // Table row continue.	×
40	// I would like to clean this up later into a display class or set of
41	// functions -- Kevin
42	if ( preg_match("/(delete\|edit)role/", $Action) ){	×
43	$roleid = filterSql($_GET['roleid']);	×
44	}
45	if ( preg_match("/add/", $Action) ){	×
46	$roleid = filterSql($_POST['roleid']);	×
47	}
48	if ( preg_match("/(create\|list\|(edit\|update)role)/", $Action) ){	×
49	$role = new BaseRole();	×
50	if ( class_exists('UILang') ){ // Issue 11 backport shim.	×
51	$hrdesc = $UIL->CWA['Desc']; // Description Header Item.	×
52	}else{	×
53	$hrdesc = _FRMROLEDESC;	×
54	}
55	if ( preg_match("/(create\|editrole)/", $Action) ){	×
56	if ( class_exists('UILang') ){ // Issue 11 backport shim.	×
57	$RIDesc = $UIL->ADA['DescRI'];	×
58	}else{	×
59	$RIDesc = _FRMROLEID;	×
60	}
61	}
62	}else{ // 2 vars for this?! No idea why. Will keep for now. -- Nathan	×
63	$BRole = new BaseRole();	×
64	}
65	switch ($Action) {	×
66	case "create"; // Display the new Role form.	×
67	$tdc = "<td width='25%' align='right'>";	×
68	$tdal = "<td align='left'>";	×
69	$ipt = "<input type='";	×
70	$form = NLI($Fst."add'".$Fct,3);	×
71	$form .= NLI("<table border=1 class='query'>",4);	×
72	$form .= NLI('<tr>',5);	×
73	$form .= NLI( "$tdc$RIDesc:</td>",6);	×
74	$form .= NLI($tdal,6);	×
75	$form .= NLI($ipt."text' name='roleid'/>",7);	×
76	$form .= NLI("</td>$Trc",6);	×
77	$form .= NLI($tdc._FRMROLENAME.'</td>',6);	×
78	$form .= NLI($tdal,6);	×
79	$form .= NLI($ipt."text' name='rolename'/>",7);	×
80	$form .= NLI("</td>$Trc",6);	×
81	$form .= NLI("$tdc$hrdesc:</td>",6);	×
82	$form .= NLI($tdal,6);	×
83	$form .= NLI($ipt."text' name='desc'>",7);	×
84	$form .= NLI("</td>$Trc",6);	×
85	$form .= NLI("<td colspan='2' align='center'>",6);	×
86	$form .= NLI(	×
87	$ipt."submit' name='submit' value='"._SUBMITQUERY."'/>",
88	7
89	);
90	$form .= NLI('</td>',6);	×
91	$form .= NLI('</tr>',5);	×
92	$form .= NLI('</table>',4);	×
93	$form .= NLI('</form>',3);	×
94	$pagebody = $form;	×
95	break;	×
96	case "add"; // Actually add Role to DB.	×
97	$rolename = filterSql($_POST['rolename']);	×
98	$desc = filterSql($_POST['desc']);	×
99	$added = $BRole->addRole($roleid, $rolename, $desc);	×
100	$pagebody = $added;	×
101	break;	×
102	case "editrole"; // Edit role form.	×
103	// This function accepts an array in the following format
104	// $roleinfo[0] = $rid
105	// $roleinfo[1] = $rname
106	// $roleinfo[2] = $rdesc
107	$roleinfo = $role->returnEditRole($roleid); // Anti XSS by default.	×
108	$rid = $roleinfo[0];	×
109	$ron = $roleinfo[1];	×
110	$rod = $roleinfo[2];	×
111	$tdc = "<td width='25%' align='right'>";	×
112	$tdal = "<td align='left'>";	×
113	$ipt = "<input type='";	×
114	$form = NLI($Fst."updaterole'".$Fct,3);	×
115	$form .= NLI($ipt."hidden' name='role_id' value='$rid'/>", 4);	×
116	$form .= NLI("<table border=1 class='query'>",4);	×
117	$form .= NLI('<tr>',5);	×
118	$form .= NLI("$tdc$RIDesc:</td>",6);	×
119	$form .= NLI("$tdal$rid</td>$Trc",6);	×
120	$form .= NLI($tdc._FRMROLENAME.'</td>',6);	×
121	$form .= NLI($tdal,6);	×
122	$form .= NLI($ipt."text' name='role_name' value='$ron' />", 7);	×
123	$form .= NLI("</td>$Trc",6);	×
124	$form .= NLI("$tdc$hrdesc:</td>",6);	×
125	$form .= NLI($tdal,6);	×
126	$form .= NLI($ipt."text' name='desc' value='$rod' />", 7);	×
127	$form .= NLI("</td>$Trc",6);	×
128	$form .= NLI("<td colspan='2' align='center'>",6);	×
129	$form .= NLI(	×
130	$ipt."submit' name='submit' value='"._UPDATEROLE."'/>",
131	7
132	);
133	$form .= NLI('</td>',6);	×
134	$form .= NLI('</tr>',5);	×
135	$form .= NLI('</table>',4);	×
136	$form .= NLI('</form>',3);	×
137	$pagebody = $form;	×
138	break;	×
139	case 'updaterole'; // Updates role from above form....	×
140	// Setup array in this format for the updateRole function
141	// $rolearray[0] = $roleid
142	// $rolearray[1] = $rolename
143	// $rolearray[2] = $roledesc
144	$rolearray = array(	×
145	filterSql($_POST['role_id']),	×
146	filterSql($_POST['role_name']),	×
147	filterSql($_POST['desc']),	×
148	);
149	$role->updateRole($rolearray);	×
150	HTTP_header("Location: $Umca" . 'list');	×
151	break;	×
152	case 'deleterole'; // Deletes role.	×
153	$BRole->deleteRole($roleid);	×
154	HTTP_header("Location: $Umca" . 'list');	×
155	break;	×
156	case "list"; // Generate HTML Role Table.	×
157	if ( class_exists('UILang') ){ // Issue 11 backport shim.	×
158	$AcEdit = $UIL->UAA['Edit'];	×
159	$AcDelete = $UIL->UAA['Delete'];	×
160	$ridesc = $UIL->CWA['Id'];	×
161	$rname = $UIL->CWA['Name'];	×
162	}else{	×
163	$AcEdit = _EDIT;	×
164	$AcDelete = _DELETE;	×
165	$ridesc = _ID;	×
166	$rname = _NAME;	×
167	}
168	$roles = $role->returnRoles();	×
169	$thc = "<td class='plfieldhdr'";	×
170	$thcw5 = "$thc width='5%'>";	×
171	$tdac = "<td align='center'>";	×
172	$tduma = $tdac.$Hrst;	×
173	// Roles Table Display
174	$tmpHTML = FramedBoxHeader('','black',0,2);	×
175	$tmpHTML .= NLI("$thcw5$AcEdit</td>",4);	×
176	$tmpHTML .= NLI("$thcw5$AcDelete</td>",4);	×
177	$tmpHTML .= NLI("$thcw5$ridesc</td>",4);	×
178	$tmpHTML .= NLI("$thc>$rname</td>",4);	×
179	$tmpHTML .= NLI("$thc>$hrdesc</td>",4);	×
180	$tmpHTML .= NLI('</tr>',3);	×
181	foreach ( $roles as $row ){ // Iterate roles & build table.	×
182	$tmpRow = explode('\|', $row);	×
183	// Setup Role ID URL param.
184	$urid = "role&roleid=".urlencode($tmpRow[0]);	×
185	$tmpHTML .= NLI('<tr>',3);	×
186	$tmpHTML .= NLI($tduma."edit$urid'>",4);	×
187	$tmpHTML .= Icon('edit', "button_$AcEdit", 6);	×
188	$tmpHTML .= NLI('</a></td>',4);	×
189	$tmpHTML .= NLI($tduma."delete$urid'>",4);	×
190	$tmpHTML .= Icon('delete', "button_$AcDelete", 6);	×
191	$tmpHTML .= NLI('</a></td>',4);	×
192	// Anti XSS Output Data
193	$tmpRow = XSSPrintSafe($tmpRow);	×
194	$tmpHTML .= $tdac . $tmpRow[0] . '</td>';	×
195	$tmpHTML .= $tdac . $tmpRow[1] . '</td>';	×
196	$tmpHTML .= $tdac . $tmpRow[2] . '</td>';	×
197	$tmpHTML .= NLI('</tr>',3);	×
198	}
199	$tmpHTML .= NLI('</table>',2);	×
200	$pagebody = $tmpHTML;	×
201	break;	×
202	default:	×
203	$pagebody = returnErrorMessage('Invalid Action!');	×
204	}
205	// Generate Page.
206	PrintBASESubHeader(	×
207	$page_title, $page_title, $cs->GetBackLink(), $refresh_all_pages	×
208	);
209	PrintBASEAdminMenuHeader();	×
210	print $pagebody;	×
211	PrintBASEAdminMenuFooter();	×
212	PrintBASESubFooter();	×
213	}else{	×
214	HTTP_header("Location: $BASE_urlpath/base_main.php");	×
215	}
216	?>

NathanGibbs3 / BASE / 627

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous