386 lines
12 KiB
PHP
386 lines
12 KiB
PHP
<?php
|
|
|
|
//
|
|
// Process all requests for pages in the secure area
|
|
//
|
|
$ValidAccess = 2010;
|
|
|
|
$user_ip = $_SERVER["REMOTE_ADDR"];
|
|
$displaySiteMessages = true;
|
|
|
|
|
|
$sessionName = 'hotlunch';
|
|
session_name($sessionName);
|
|
session_start();
|
|
|
|
if (!isset($sessionID)) $sessionID = session_id();
|
|
|
|
|
|
require_once("include/globals.php");
|
|
resetCache();
|
|
if ($currentURL == 'dev.hotlunches.net') ini_set('display_errors', 0);
|
|
|
|
// if ($school_num == 3) startLog("index");
|
|
|
|
|
|
// Uncomment for maintentance work
|
|
// include "maintenance.php";
|
|
|
|
|
|
//
|
|
// Ensure that the connection is via https protocol
|
|
//
|
|
if (!isset($currentURL)) $currentURL = str_replace("www.","",strtolower($_SERVER['HTTP_HOST']));
|
|
|
|
|
|
// Get sessionID parameter if it is passed
|
|
unset($sessionID);
|
|
unset($userNum);
|
|
if (array_key_exists('sid', $_GET)) $sessionID = $_GET['sid'];
|
|
if (array_key_exists('un', $_GET)) $userNum = $_GET['un'];
|
|
|
|
if (!isset($sessionID)) $sessionID = '';
|
|
if (!isset($userNum)) $userNum = 0;
|
|
|
|
|
|
//
|
|
// Determine if this is a secure URL or not
|
|
//
|
|
$baseURLs = array(
|
|
array("hotlunches.net",TRUE,'N'),
|
|
array("hotlunches.dev",TRUE,'N'),
|
|
array("fundraiserorders.com",TRUE,'N'),
|
|
array("payschoolfees.net",TRUE,'N'),
|
|
array("parentcouncil.net",TRUE,'N'),
|
|
array("schoolcouncil.net",TRUE,'N'),
|
|
|
|
array("hotlunches.ca",FALSE,'N'),
|
|
array("registrationnow.net",FALSE,'N'),
|
|
array("schoolclothingorder.com",FALSE,'N'),
|
|
array("schoolclothesorder.com",FALSE,'N'),
|
|
array("schoollunchorders.net",TRUE,'N'),
|
|
array("buyticketsnow.net",FALSE,'N'),
|
|
array("schooltripfundraising.com",FALSE,'N'),
|
|
array("schoolsuppliesorder.com",FALSE,'N'),
|
|
array("yearbookorders.net",FALSE,'N'),
|
|
array("gradfundraising.com",FALSE,'N'),
|
|
array("gradfundraising.net",FALSE,'N'),
|
|
array("milkprogram.com",FALSE,'N'),
|
|
array("schoolhotdogs.com",FALSE,'N'),
|
|
array("hotdogday.net",FALSE,'N'),
|
|
array("pizzalunchorder.com",FALSE,'N'),
|
|
array("ouronlineorders.com",FALSE,'N'),
|
|
array("ouronlineorders.net",FALSE,'N'),
|
|
array("hotlunchesonline.net",FALSE,'N'),
|
|
array("hotmealstogo.net",TRUE,'N'),
|
|
|
|
array("esns.ca",TRUE,'N'),
|
|
array("pitapitottawa.ca",TRUE,'N'),
|
|
array("pitapitmilton.ca",FALSE,'N'),
|
|
array("pitapitmississauga.ca",TRUE,'N'),
|
|
array("frenchlunch.ca",TRUE,'N'),
|
|
|
|
array("wrepac.ca",TRUE,'Y'),
|
|
array("aeslunchbox.com",TRUE,'Y'),
|
|
array("clesharks.ca",TRUE,'Y'),
|
|
array("ggpac.org",TRUE,'Y'),
|
|
array("larondepac.ca",TRUE,'Y'),
|
|
|
|
array("repas.carrefourisj.org",TRUE,'Y'),
|
|
array("repas.belle-alliance.ca",TRUE,'Y'),
|
|
);
|
|
|
|
// Set flags for current URL
|
|
$secureSite = FALSE;
|
|
$redirectWWW = 'N';
|
|
|
|
for ($i = 0; $i < count($baseURLs); $i++) {
|
|
$curl = $baseURLs[$i][0];
|
|
$sflag = $baseURLs[$i][1];
|
|
$rflag = $baseURLs[$i][2];
|
|
if (strpos($currentURL,$curl) !== FALSE) {
|
|
$secureSite = $sflag;
|
|
$redirectWWW = $rflag;
|
|
break;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
if (!isset($currentDBMode)) $currentDBMode = "Current";
|
|
|
|
if ($secureSite && ! $_SERVER['HTTPS']) {
|
|
$sparm = "";
|
|
if (isset($sessionID) && isset($userNum)) $sparm = "?sid=$sessionID&un=$userNum";
|
|
|
|
// Relocate to the secure address
|
|
if ($redirectWWW == 'N') {
|
|
header("Location: https://$currentURL/$sparm");
|
|
exit();
|
|
}
|
|
|
|
header("Location: https://www.$currentURL/$sparm");
|
|
exit();
|
|
}
|
|
else {
|
|
if (array_key_exists('HTTP_HOST', $_SERVER)) {
|
|
if (!$secureSite && $_SERVER['HTTP_HOST'] != $currentURL) {
|
|
$sparm = "";
|
|
if (isset($sessionID) && isset($userNum)) $sparm = "?sid=$sessionID&un=$userNum";
|
|
|
|
header("Location: http://$currentURL/$sparm");
|
|
exit();
|
|
}
|
|
|
|
if (!$secureSite && array_key_exists('HTTPS', $_SERVER)) {
|
|
$sparm = "";
|
|
if (isset($sessionID) && isset($userNum)) $sparm = "?sid=$sessionID&un=$userNum";
|
|
|
|
header("Location: http://$currentURL/$sparm");
|
|
exit();
|
|
}
|
|
}
|
|
}
|
|
|
|
$_SESSION['school_record'] = $school_record;
|
|
$_SESSION['db_mode'] = $currentDBMode;
|
|
|
|
|
|
header('Content-type: text/html; charset=utf8');
|
|
header("X-XSS-Protection: 1; mode=block");
|
|
header('X-Frame-Options: DENY');
|
|
header("Strict-Transport-Security: max-age=31536000; includeSubDomains");
|
|
header('X-Content-Type-Options: nosniff');
|
|
|
|
|
|
if (array_key_exists('action',$_GET)) $action = $_GET['action'];
|
|
if (array_key_exists('action',$_POST)) $action = $_POST['action'];
|
|
if (!isset($action)) $action = "";
|
|
|
|
$menuInclude = "menu.login.php";
|
|
$showFacebook = 'Y';
|
|
|
|
writeLog("action: $action");
|
|
|
|
//
|
|
// Based on the action value process the requests
|
|
//
|
|
switch (strtolower($action)) {
|
|
case 'register-form':
|
|
include "register.html";
|
|
break;
|
|
|
|
case 'register':
|
|
include "register.php";
|
|
break;
|
|
|
|
case 'show-faqs':
|
|
$menuInclude = "menu.login.php";
|
|
include "view_faqs.php";
|
|
break;
|
|
|
|
case 'show-docs':
|
|
include "view_docs.php";
|
|
break;
|
|
|
|
case 'calendar':
|
|
include "events.calendar.php";
|
|
break;
|
|
|
|
case 'support':
|
|
case 'support-submit':
|
|
$menuInclude = "menu.login.php";
|
|
include "support.form.php";
|
|
break;
|
|
|
|
case 'public-privacy-policy':
|
|
$showFacebook = 'Y';
|
|
include "privacy_policy.html";
|
|
break;
|
|
|
|
case 'terms-of-service':
|
|
include "terms_of_service.html";
|
|
break;
|
|
|
|
case 'receipt':
|
|
$action = "receipt-print";
|
|
include "receipt-print.php";
|
|
break;
|
|
|
|
case 'forgot-password':
|
|
include "forgot-password.php";
|
|
break;
|
|
|
|
case 'register-thanks':
|
|
$mode = "thanks";
|
|
include "login.html";
|
|
break;
|
|
|
|
case 'bambora-info':
|
|
include "bambora.php";
|
|
break;
|
|
|
|
|
|
case 'logout':
|
|
UserLogout();
|
|
unset($_SESSION['db_mode']);
|
|
header("Location: /");
|
|
break;
|
|
|
|
case 'form':
|
|
include "login.html";
|
|
break;
|
|
|
|
case 'login':
|
|
case 'register-login':
|
|
if (array_key_exists('login_user_name', $_POST)) writeLog($_POST['login_user_name']);
|
|
if (array_key_exists('login_password', $_POST)) writeLog($_POST['login_password']);
|
|
|
|
if (array_key_exists('login_user_name', $_POST)) $login_user_name = trim($_POST['login_user_name']);
|
|
if (array_key_exists('login_password', $_POST)) $login_password = trim($_POST['login_password']);
|
|
|
|
if ($action == 'register-login') {
|
|
if (array_key_exists('login_user_name', $_GET)) $login_user_name = db_escape_string(trim($_GET['login_user_name']));
|
|
if (array_key_exists('login_password', $_GET)) $login_password = db_escape_string(trim($_GET['login_password']));
|
|
if (array_key_exists('un', $_GET)) $unum = intval($_GET['un']);
|
|
|
|
if (!isset($login_user_name)) $login_user_name = '';
|
|
if (!isset($unum)) $unum = 0;
|
|
|
|
$results = db_query("SELECT * FROM users WHERE school_num = $base_school_num AND userid = '$login_user_name' AND record_num = $unum");
|
|
if (db_num_rows($results) == 0) unset($login_user_name);
|
|
}
|
|
|
|
if (!isset($login_user_name) || !isset($login_password)) {
|
|
$error_message = getLanguageText('ERRORMSG-LOGIN-FAILED');
|
|
if (is_array($error_message)) $error_message = $error_message[0];
|
|
header("Location: https://$currentURL/?error_message=".urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
writeLog("HERE");
|
|
if (SessionActive($sessionID,$userNum) != 1 || ! UserLoggedIn()) {
|
|
$res = ValidateUserLogin($login_user_name,$login_password);
|
|
|
|
switch ($res) {
|
|
case -1:
|
|
$error_message = array(getLanguageText('MESSAGE-INVALID-OR-MISSING-USERID'));
|
|
break;
|
|
case -2:
|
|
$error_message = array(getLanguageText('MESSAGE-INVALID-OR-MISSING-PASSWORD'));
|
|
break;
|
|
case -3:
|
|
$error_message = array(getLanguageText('MESSAGE-INVALID-USERNAME-OR-PASSWORD'));
|
|
break;
|
|
case -4:
|
|
$error_message = array(getLanguageText('ERRORMSG-USER-ACCOUNT-INACTIVE'));
|
|
break;
|
|
case -5:
|
|
$error_message = array(getLanguageText('ERRORMSG-USER-ACCOUNT-DELETED'));
|
|
break;
|
|
case -9:
|
|
$error_message = array(getLanguageText('ERRORMSG-NOT-ALLOWED-ACCESS-TO-SITE'));
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (SessionActive($sessionID,$userNum) != 1 || ! UserLoggedIn()) {
|
|
if (!isset($error_message)) {
|
|
if (array_key_exists('login_error_msg', $_SESSION) && strlen($_SESSION['login_error_msg'])) $error_message = $_SESSION['login_error_msg'];
|
|
else $error_message = getLanguageText('ERRORMSG-LOGIN-FAILED');
|
|
writeLog("error_message: $error_message");
|
|
}
|
|
if (is_array($error_message)) $error_message = $error_message[0];
|
|
header("Location: https://$currentURL/?error_message=".urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
header('Expires: Sat, 26 Jul 1997 05:00:00 GMT');
|
|
header('Last-Modified: ' . gmdate( 'D, d M Y H:i:s') . ' GMT');
|
|
header('Cache-Control: no-store, no-cache, must-revalidate');
|
|
header('Cache-Control: post-check=0, pre-check=0', false);
|
|
header('Pragma: no-cache');
|
|
|
|
case 'login-form':
|
|
default:
|
|
if ($currentURL == "help.hotlunches.net") {
|
|
header("Location: https://$currentURL/?action=public-privacy-policy");
|
|
}
|
|
|
|
if (SessionActive($sessionID,$userNum) == 1 && UserLoggedIn()) {
|
|
// Handle password changes before menu is displayed
|
|
if ($action == 'change-password') {
|
|
include "change-password.update.php";
|
|
}
|
|
|
|
// Process any inserts and updates that need to be done before the page is loaded
|
|
include "main.preprocess.php";
|
|
|
|
if ($_SESSION['UserInfo']['type'] == 'Admin') $_SESSION['UserInfo']['type'] = 'System Administrator';
|
|
|
|
$userType = "Parent";
|
|
if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
|
|
|
|
switch ($_SESSION['UserInfo']['type']) {
|
|
case 'SuperUser':
|
|
include "main.superuser.php";
|
|
break;
|
|
|
|
case 'System Administrator':
|
|
case 'Application Administrator':
|
|
include "main.admin.php";
|
|
break;
|
|
|
|
case 'Application Volunteer':
|
|
case 'Schedule Volunteer':
|
|
include "main.hotlunchvolunteer.php";
|
|
break;
|
|
|
|
case 'Administration Team':
|
|
case 'Schedule Team':
|
|
case 'Schedule Reporting':
|
|
include "main.team.php";
|
|
break;
|
|
|
|
case 'Financial':
|
|
case 'Financial Team':
|
|
include "main.financial.php";
|
|
break;
|
|
|
|
case 'Volunteer Administrator':
|
|
include "main.volunteer-admin.php";
|
|
break;
|
|
|
|
case 'Communications Administrator':
|
|
include "main.council.php";
|
|
break;
|
|
|
|
case 'Supplier':
|
|
include "main.supplier.php";
|
|
break;
|
|
|
|
case 'Volunteer':
|
|
include "main.volunteer.php";
|
|
break;
|
|
|
|
case 'Staff':
|
|
include "main.staff.php";
|
|
break;
|
|
|
|
case 'Guest':
|
|
include "main.guest.php";
|
|
break;
|
|
|
|
case 'Parent':
|
|
default:
|
|
include "main.parent.php";
|
|
break;
|
|
}
|
|
exit();
|
|
}
|
|
|
|
include "login.html";
|
|
break;
|
|
}
|
|
?>
|