'.$page_title.'

$value) { $eviltext = '[#|:~!()&%$^?<>`*\;\[\]\{\}\/\\\\]'; $value = trim($value); if (eregi($eviltext, $value)) { //$value = ereg_replace($eviltext,'',$value); } if (strlen($value) > 60) { $value = substr($value, 0, 60); } $value = mysql_real_escape_string ($value); $_POST[$key] = $value; //echo "\r\n\r\n"; } $_POST['refcode'] = substr($_POST['refcode'], 0, 5); $_POST['zip'] = substr($_POST['zip'], 0, 5); // GRAB IP, SET TIME RANGE FOR LOGONS if (getenv("HTTP_CLIENT_IP")) { $ip = getenv("HTTP_CLIENT_IP"); } else if(getenv("HTTP_X_FORWARDED_FOR")) { $ip = getenv("HTTP_X_FORWARDED_FOR"); } else if(getenv("REMOTE_ADDR")) { $ip = getenv("REMOTE_ADDR"); } else { $ip = "UNKNOWN"; } $date = date("Y-m-d"); require_once ($db_path.'/access.php'); // Connect to the db. // VALIDATE EMAIL $email_invalid = 0; $email1 = $_POST['email_address']; $email2 = $_POST['email_confirm']; //echo "\r\n \r\n"; if (empty($email1) || empty($email2)) { $message = 'Please provide an email addresses'; $message .= "\r\n\r\n"; $email_invalid = 1; } else if ($email1 != $email2) { $message = 'Email addresses do not match'; $email_invalid = 1; } else if (!filter_var($email1, FILTER_VALIDATE_EMAIL) || !filter_var($email2, FILTER_VALIDATE_EMAIL)) { $message = 'Email address is invalid'; $email_invalid = 1; } if ($email_invalid != 1) { // CHECK THE BANNED IP LIST $query = 'SELECT ip FROM events WHERE ip="'.$ip.'" '. 'AND timestamp LIKE "'.$date.'%" AND event_type="99"'; $result = @mysql_query ($query); // Run the query. $count = mysql_num_rows($result); // CHECK FOR ADMIN OVERRIDE $query2 = 'SELECT ip FROM events WHERE ip="'.$ip.'" '. 'AND timestamp LIKE "'.$date.'%" AND event_type="98"'; $result2 = @mysql_query ($query2); // Run the query. $count2 = mysql_num_rows($result2); if (($count > 0) && ($count2 == 0)) { $message = 'TOO MANY FAILURES - LOGON DISABLED'; // LOG THE FAILED ATTEMPT $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"3", "'.$ref.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. } else { $zip = substr($_POST['zip'], 0, 3); $ref = $_POST['refcode']; $queryx = "SELECT user, password_clear as pass, email FROM users WHERE reference_code = '$ref' ". "AND zip LIKE '{$zip}%' AND user_year = $year"; $resultx = @mysql_query ($queryx); // Run the query. $countx = @mysql_num_rows($resultx); //echo "\r\n\r\n"; if ($countx == 0) { $message = 'Invalid Reference Code or ZIP Code'; // LOG THE FAILED ATTEMPT $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"2", "'.$ref.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. // CHECK FOR MULTIPLE FAILED ATTEMPTS $check_query = 'SELECT ip FROM events WHERE ip="'.$ip.'" AND '. 'timestamp LIKE "'.$date.'%" AND event_type="2"'; $check_result = @mysql_query ($check_query); // Run the query. $check_count = @mysql_num_rows($check_result); if ($check_count > 10) { // BLOCK IP $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"99", "'.$ref.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. //$disable_query = 'UPDATE users SET disabled=1 where user="'.$u.'"'; //$result = @mysql_query ($disable_query); // Run the query. } } if ($countx == 1) { while ($row = mysql_fetch_array ($resultx, MYSQL_ASSOC)) { if ($row['disabled'] == 1) { $message = 'Account Disabled'; // LOG THE FAILED ATTEMPT $querykeys = 'event_type, user, ip, timestamp'; $queryvalues = '"3", "'.$ref.'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. } else { $success = 1; // LOG THE EVENT $querykeys = 'event_type, user, user_id, ip, timestamp'; $queryvalues = '"11", "'.$ref.'", "'.$row['user_id'].'", "'.$ip.'", NOW()'; $log_query = "INSERT INTO events ($querykeys) VALUES ($queryvalues)"; $log_result = @mysql_query ($log_query); // Run the query. if ($email1 != $row['email']) { $query1 = "INSERT INTO user_updates (user, email, update_year, date_updated) ". "VALUES ('".$row['user']."','".$email1."', '$year', NOW() )"; $result1 = @mysql_query ($query1); // Run the query. //echo "\r\n\r\n"; } // PREPARE EMAIL $mail_to = $email1; //$mail_to = "jmagdych@borealis.gi"; $mail_from = 'Borealis Proxy Voting '; $subject = '[BOREALIS ONLINE PROXY] - Logon Information'; $emessage .= "--------------------------------------------------\r\n"; $emessage .= "USERNAME: ".$row['user']."\r\n"; $emessage .= "PASSWORD: ".$row['pass']."\r\n"; $emessage .= "--------------------------------------------------\r\n"; $emessage .= "You may log on to vote your proxy now at:\r\n"; $emessage .= "https://www.borealis.gi/proxy".$year."/ \r\n"; mail($mail_to, $subject, $emessage, "From:$mail_from\n"); //Cc:jmagdych@borealis.gi\n"); } } } } @mysql_close(); // Close the database connection. } } $_SESSION['year'] = $year; $_SESSION['user'] = ''; $_SESSION['user_id'] = ''; $_SESSION['company'] = ''; $_SESSION['logon'] = ''; $_SESSION['auth_level'] = 0; echo ' '.$page_title.' '; exit(); ?>