| 11,16 → 11,17 |
|---|
| * GLOBAL FILE PATHS * |
| *****************************************************************/ |
| define ("CONF_FILE", "/usr/local/etc/alcasar.conf"); |
| define ("DOMAIN_ALLOWED_LIST", "/usr/local/etc/alcasar-uamdomain"); |
| |
| /**************************************************************** |
| * FILE reading test * |
| *****************************************************************/ |
| $conf_files=array(CONF_FILE); |
| foreach ($conf_files as $file){ |
| if (!file_exists($file)){ |
| $conf_files = array(CONF_FILE); |
| foreach ($conf_files as $file) { |
| if (!file_exists($file)) { |
| exit("File ".$file." unknown"); |
| } |
| if (!is_readable($file)){ |
| if (!is_readable($file)) { |
| exit("You don't have read rights on the file ".$file); |
| } |
| } |
| 27,22 → 28,21 |
|---|
| /**************************************************************** |
| * Read CONF_FILE * |
| *****************************************************************/ |
| $ouvre=fopen(CONF_FILE,"r"); |
| if ($ouvre){ |
| while (!feof ($ouvre)){ |
| $tampon = fgets($ouvre, 4096); |
| if (strpos($tampon,"=")!==false){ |
| $tmp = explode("=",$tampon); |
| $conf[$tmp[0]] = $tmp[1]; |
| } |
| $file_conf = fopen(CONF_FILE, 'r'); |
| if (!$file_conf) { |
| exit('Error opening the file '.CONF_FILE); |
| } |
| while (!feof($file_conf)) { |
| $tampon = fgets($file_conf, 4096); |
| if ((strpos($tampon, '=') !== false) && (substr($tampon, 0, 1) !== '#')) { |
| $tmp = explode('=', $tampon); |
| $conf[$tmp[0]] = trim($tmp[1]); |
| } |
| }else{ |
| exit("Error opening the file ".CONF_FILE); |
| } |
| fclose($ouvre); |
| fclose($file_conf); |
| |
| $organisme = trim($conf["ORGANISM"]); |
| $domainname = trim($conf["DOMAIN"]); |
| $hostname = "alcasar.".$domainname; |
| $hostname = trim($conf["HOSTNAME"]).'.'.trim($conf["DOMAIN"]); |
| $network_pb = False; # "alcasar-watchdog.sh" changes this value if a network issue is detected |
| $diagnostic = "can't contact the default router"; # "alcasar-watchdog.sh" changes this value if a network issue is detected |
| $cert_add = "http://$hostname/certs"; |
| 64,12 → 64,11 |
|---|
| $user = explode (" ", $tab[0]); |
| |
| # Test if it's a direct connexion to ALCASAR |
| if (isset($_SERVER['HTTP_HOST'])){ |
| if (($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR']) || (preg_match ("/^alcasar$/", $_SERVER['HTTP_HOST'])) || (preg_match ("/^$hostname$/", $_SERVER['HTTP_HOST'])) || (preg_match ("/^$organisme$/", $_SERVER['HTTP_HOST']))){ |
| $direct_access=True; |
| exec("sudo /usr/sbin/ipset del not_auth_yet $remote_ip"); # del user of the ipset "not_auth_yet" to not loop |
| } |
| if (isset($_SERVER['HTTP_HOST']) && (($_SERVER['HTTP_HOST'] === $_SERVER['SERVER_ADDR']) || ($_SERVER['HTTP_HOST'] === 'alcasar') || ($_SERVER['HTTP_HOST'] === $hostname) || ($_SERVER['HTTP_HOST'] === $organisme))) { |
| $direct_access = true; |
| exec("sudo /usr/sbin/ipset del not_auth_yet $remote_ip"); # del user of the ipset "not_auth_yet" to not loop |
| } |
| |
| # Function to adapt time connexion in seconds to H,M,S |
| function secondsToDuration($seconds = null){ |
| if ($seconds == null) return ""; |
| 89,8 → 88,7 |
|---|
| if ((isset ($user[4])) && ($user[4] != "0")){ # the user is authenticated |
| if(isset($_GET['redirect'])) # if user has been warned, we redirect him to his website |
| { |
| $redir = "http://".$_GET['url']; |
| header("Location: $_GET[url]",TRUE,307); |
| header('Location: '.$_GET['url'], true, 307); |
| exit; |
| } |
| # we retrieve his three last connections |
| 159,7 → 157,7 |
|---|
| $l_logout = "<a href=\"http://$hostname:3990/logoff\">Se déconnecter d'internet</a>"; |
| } |
| else{ |
| $l_logout_explain = "Votre système ($user[5]) est en exception d'authentication.<br><br>$nb_connection_history last connections :$connection_history"; |
| $l_logout_explain = "Votre système ($user[5]) est en exception d'authentication.<br><br>$nb_connection_history dernières connexions :$connection_history"; |
| $l_logout = "Information des connexions"; |
| } |
| } |
| 172,10 → 170,10 |
|---|
| $l_acc_sms = "Auto enregistrement par SMS"; |
| $l_explain_warn = "L'administrateur a créé une archive contenant vos journaux de connexion dans le cadre d'une affaire judiciaire."; |
| if(isset($_GET['url'])){ |
| $l_continue_link = "<a href='index.php?redirect=1&url=$_GET[url]' class='button'>Je comprends et je souhaite continuer ma navigation.</a>"; |
| $l_continue_link = "<a href=\"index.php?redirect=1&url=".urlencode($_GET['url'])."\" class=\"button\">Je comprends et je souhaite continuer ma navigation.</a>"; |
| } |
| else{ |
| $l_continue_link = "<a href='index.php' class='button'>Je comprends et je souhaite continuer ma navigation.</a>"; |
| $l_continue_link = "<a href=\"index.php\" class=\"button\">Je comprends et je souhaite continuer ma navigation.</a>"; |
| } |
| $l_title_warn="Cher utilisateur, "; |
| $l_explain_warn_name="Une personne sous le nom de "; |
| 182,6 → 180,7 |
|---|
| $l_explain_warn_ip="sous cette IP : "; |
| $l_explain_warn_date="a consulté vos journaux de connexion le "; |
| $l_explain_warn_reason="Raison invoquée : "; |
| $l_uam_domain = "Sites autorisés : "; |
| } |
| else if($Language == 'pt'){ |
| $l_access_denied = "Controle de acesso"; |
| 205,7 → 204,7 |
|---|
| } |
| else{ |
| if ($user[5] != $user[0]){ # authentication exception or not |
| $l_logout_explain = "Se desejar, feche a conexão do usuário atual conectado.<br> Usuário conectado : <a href=\"http://$hostname:3990/logoff\" title=\"Disconnect user $user[5]\"><b>$user[5]</b></a><br><br>$nb_connection_history last connections :$connection_history"; |
| $l_logout_explain = "Se desejar, feche a conexão do usuário atual conectado.<br> Usuário conectado : <a href=\"http://$hostname:3990/logoff\" title=\"Disconnect user $user[5]\"><b>$user[5]</b></a><br><br>$nb_connection_history logins últimos :$connection_history"; |
| $l_logout = "<a href=\"http://$hostname:3990/logoff\">Sair da Internet</a>"; |
| } |
| else{ |
| 222,10 → 221,10 |
|---|
| $l_acc_sms = "Auto registration by SMS"; |
| $l_explain_warn = "El administrador ha creado un archivo que contiene los periódicos de inicio de sesión como parte de un proceso judicial."; |
| if(isset($_GET['url'])){ |
| $l_continue_link = "<a href='index.php?redirect=1&url=$_GET[url]' class='button'>Lo comprendo y deseo continuar mi navegación.</a>"; |
| $l_continue_link = "<a href=\"index.php?redirect=1&url=".urlencode($_GET['url'])."\" class=\"button\">Lo comprendo y deseo continuar mi navegación.</a>"; |
| } |
| else{ |
| $l_continue_link = "<a href='index.php' class='button'>Lo comprendo y deseo continuar mi navegación.</a>"; |
| $l_continue_link = "<a href=\"index.php\" class=\"button\">Lo comprendo y deseo continuar mi navegación.</a>"; |
| } |
| $l_title_warn="Estimado usuario,"; |
| $l_explain_warn_name="El usario "; |
| 232,6 → 231,7 |
|---|
| $l_explain_warn_ip="con este IP : "; |
| $l_explain_warn_date="consultó a sus registros de conexión el "; |
| $l_explain_warn_reason="con la siguiente razón : "; |
| $l_uam_domain = "Sites autorizados : "; |
| } |
| else if($Language == 'zn'){ |
| $l_access_denied = "访问控制"; |
| 272,10 → 272,10 |
|---|
| $l_acc_sms = "短信自动注册"; |
| $l_explain_warn = "管理员创建了一份可用于司法调查的连接日志文档。"; |
| if(isset($_GET['url'])){ |
| $l_continue_link = "<a href='index.php?redirect=1&url=$_GET[url]' class='button'>我明白并希望继续浏览。</a>"; |
| $l_continue_link = "<a href=\"index.php?redirect=1&url=".urlencode($_GET['url'])."\" class=\"button\">我明白并希望继续浏览。</a>"; |
| } |
| else{ |
| $l_continue_link = "<a href='index.php' class='button'>我明白并希望继续浏览。</a>"; |
| $l_continue_link = "<a href=\"index.php\" class=\"button\">我明白并希望继续浏览。</a>"; |
| } |
| $l_title_warn="亲爱的用户,"; |
| $l_explain_warn_name="一人名为"; |
| 282,6 → 282,7 |
|---|
| $l_explain_warn_ip="在此IP:"; |
| $l_explain_warn_date="查看您的连接日志于"; |
| $l_explain_warn_reason=" 如下原因:"; |
| $l_uam_domain = "授权网站 : "; |
| } |
| else if ($Language == 'ar'){ |
| $l_access_denied = "مراقبة الدخول"; |
| 344,10 → 345,10 |
|---|
| $l_explain_warn = "المسؤول أنشأ أرشيفاً تحتوي على سجلات الاتصال في إطار تحقيق قضائي"; |
| $understand_text = "أنا متفهم و أريد ان أواصل التصفح"; |
| if(isset($_GET['url'])){ |
| $l_continue_link = "<a href='index.php?redirect=1&url=$_GET[url]' class='button'>$understand_text</a>"; |
| $l_continue_link = "<a href=\"index.php?redirect=1&url=".urlencode($_GET['url'])."\" class=\"button\">$understand_text</a>"; |
| } |
| else{ |
| $l_continue_link = "<a href='index.php' class='button'>$understand_text</a>"; |
| $l_continue_link = "<a href=\"index.php\" class=\"button\">$understand_text</a>"; |
| } |
| $l_title_warn = "عزيزي المستعمل, "; |
| $l_explain_warn_name = "شخص مسمىٰ "; |
| 354,6 → 355,7 |
|---|
| $l_explain_warn_ip = "تحت هذا IP: "; |
| $l_explain_warn_date = "إطّلع على سجلات الاتصال الخاصة بك في"; |
| $l_explain_warn_reason = "السبب المسرّح به: "; |
| $l_uam_domain = ":المواقع المسموحة "; |
| } |
| else{ |
| $l_access_denied = "Access control"; |
| 394,10 → 396,10 |
|---|
| $l_acc_sms = "Auto registration by SMS"; |
| $l_explain_warn = "The administrator created an archive which contains your imputabilities logs for a judicial investigation."; |
| if(isset($_GET['url'])){ |
| $l_continue_link = "<a href='index.php?redirect=1&url=$_GET[url]' class='button'>I understand and I wish to continue.</a>"; |
| $l_continue_link = "<a href=\"index.php?redirect=1&url=".urlencode($_GET['url'])."\" class=\"button\">I understand and I wish to continue.</a>"; |
| } |
| else{ |
| $l_continue_link = "<a href='index.php' class='button'>I understand and I wish to continue.</a>"; |
| $l_continue_link = "<a href=\"index.php\" class=\"button\">I understand and I wish to continue.</a>"; |
| } |
| $l_title_warn="Dear user,"; |
| $l_explain_warn_name="Someone called "; |
| 404,6 → 406,7 |
|---|
| $l_explain_warn_ip="with this IP : "; |
| $l_explain_warn_date="has read your connexion logs at "; |
| $l_explain_warn_reason="For this reason : "; |
| $l_uam_domain = "Authorized websites : "; |
| } |
| |
| $l_title = ($direct_access ? $l_access_welcome : ($network_pb ? $l_access_unavailable : $l_access_denied)); |
| 441,25 → 444,27 |
|---|
| header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0"); |
| header("Cache-Control: post-check=0, pre-check=0", false); |
| header("Pragma: no-cache"); |
| |
| exec("sudo /usr/sbin/ipset list not_filtered | grep $remote_ip | wc -l 2>&1", $ipset_not_filtered); |
| # if user is in "ipset_not_filtered" then he must refresh its dns cache (we are in the interception process) |
| if (!$direct_access && !$display_menu && ($ipset_not_filtered[0] == '1') && (!$network_pb) && (!isset($_GET['warn']))) { |
| echo '<!doctype html><html><head><script>window.location.reload(true)</script></head><body></body></html>'; # force DNS request |
| } |
| |
| ?> |
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
| <html> |
| <head> |
| <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> |
| <title>ALCASAR - <?php echo $l_title; ?></title> |
| <meta http-equiv="Cache-control" content="no-cache"> |
| <meta http-equiv="Pragma" content="no-cache"> |
| <?php |
| echo "<style>"; |
| include("css/style_intercept.css"); |
| echo "</style>"; |
| ?> |
| |
| <script type="text/javascript"> |
| <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> |
| <title>ALCASAR - <?php echo $l_title; ?></title> |
| <meta http-equiv="Cache-control" content="no-cache"> |
| <meta http-equiv="Pragma" content="no-cache"> |
| <link rel="stylesheet" href="/css/style_intercept.css" type="text/css"> |
| <script type="text/javascript"> |
| function valoriserDiv5(param){ |
| document.getElementById("box_info").innerHTML = param.innerHTML; |
| } |
| </script> |
| </script> |
| </head> |
| <body onload="valoriserDiv5(text_conn);"> |
| <?php |
| 472,13 → 477,8 |
|---|
| } |
| } |
| else{ # the user is intercepted |
| exec("sudo /usr/sbin/ipset list not_filtered | grep $remote_ip | wc -l 2>&1", $ipset_not_filtered); |
| # if user is in "ipset_not_filtered" then he must refresh its dns cache (we are in the interception process) |
| if (($ipset_not_filtered[0] == '1') && (!$network_pb)){ |
| echo "<script>window.location.reload(true)</script>"; # force DNS request |
| } |
| # if user need to be warned that someone reads his logs |
| if (isset($_GET['warn']) && isset($_GET['url']) && $_GET['warn'] == '1'){ |
| if (isset($_GET['warn']) && isset($_GET['url']) && $_GET['warn'] == '1') { |
| echo " |
| <div id=\"cadre_titre\" class=\"titre_refus\"> |
| <p id=\"acces_controle\" class=\"titre_refus\">$l_title_warn</p>"; |
| 533,6 → 533,26 |
|---|
| <img src=\"$img_rep$img_internet\"> |
| </div>"; |
| } |
| |
| // Read the "Domain allowed" file |
| $domainAllowedHtml = ''; |
| $tab = file(DOMAIN_ALLOWED_LIST); |
| if ($tab) { // the file isn't empty |
| $domainAllowedHtml .= '<p>'.$l_uam_domain.'<br><ul>'; |
| foreach ($tab as $line) { |
| if (trim($line) !== '') { // the line isn't empty |
| $domain_allowed = explode("#", $line); |
| if (trim($domain_allowed[1]) !== '') { |
| $domain = explode('"', $domain_allowed[0]); |
| // remove every '.' from the beginning of domain |
| $domain[1] = ltrim($domain[1], '.'); |
| $domainAllowedHtml .= '<li><a href="http://'.trim($domain[1]).'">'.trim($domain_allowed[1]).'</a></li>'; |
| } |
| } |
| } |
| $domainAllowedHtml .= '</ul></p>'; |
| } |
| |
| echo " |
| <div class=\"box_menu\" id=\"box_certif\" onmouseover=\"valoriserDiv5(text_certif);\"> |
| <span>$l_install_certif</span> |
| 546,6 → 566,7 |
|---|
| <div class=\"div-cache\" id=\"text_conn\"> |
| <h2>$l_logout</h2> |
| <p>$l_logout_explain</p> |
| $domainAllowedHtml |
| <img src=\"$img_rep$img_internet\"> |
| </div> |
| <div class=\"div-cache\" id=\"text_certif\"> |
| 564,20 → 585,20 |
|---|
| } |
| else { |
| # user need to be warned that someone reads his logs |
| if(isset($_GET['warn']) && isset($_GET['url']) && $_GET['warn'] == '1'){ |
| $filename="/var/www/html/acc/backup/log_info.txt"; |
| $l_explain_warn=""; |
| if(file_exists($filename)){ |
| $fichier = fopen($filename, "r"); |
| if(isset($_GET['warn']) && isset($_GET['url']) && $_GET['warn'] === '1'){ |
| $filename = '/var/www/html/acc/backup/log_info.txt'; |
| $l_explain_warn = ''; |
| if (file_exists($filename)) { |
| $fichier = fopen($filename, 'r'); |
| $content = file($filename); |
| foreach($content as $line){ |
| $infos=explode("|||", $line); |
| $log_date=$infos[0]; |
| $log_user=$infos[1]; |
| $log_reason=$infos[2]; |
| $log_ip=$infos[3]; |
| foreach ($content as $line) { |
| $infos = explode('|||', $line); |
| $log_date = $infos[0]; |
| $log_user = $infos[1]; |
| $log_reason = $infos[2]; |
| $log_ip = $infos[3]; |
| } |
| $l_explain_warn="$l_explain_warn_name$log_user ( $l_explain_warn_ip$log_ip ) $l_explain_warn_date$log_date $l_explain_warn_reason$log_reason"; |
| $l_explain_warn = "$l_explain_warn_name$log_user ($l_explain_warn_ip$log_ip) $l_explain_warn_date$log_date.<br>$l_explain_warn_reason<br>$log_reason"; |
| } |
| else{ |
| echo "Log error!"; |