implemented insecure assignment.

2025-02-08 20:03:40 -07:00
parent 50a64f52eb
commit eb3e32028c
10 changed files with 358 additions and 0 deletions
@@ -0,0 +1,137 @@
+<?php
+session_start();
+require_once 'vendor/autoload.php';
+
+$dotenv = Dotenv\Dotenv::createImmutable(__DIR__);
+$dotenv->safeLoad();
+
+// Use environment variables for the database password and IP address.
+$db_pass = $_ENV['DATABASE_PASSWORD'];
+$ip_addr = $_ENV['IP_ADDRESS'];
+
+// Make some constants
+if ($_SERVER['HTTP_HOST'] == 'localhost') {
+    define('HOST', 'localhost');
+    define('USER', 'root');
+    define('PASS', $db_pass);
+    define('DB', 'insecure');
+} else {
+    define('HOST', $ip_addr);
+    define('USER', 'root');
+    define('PASS', $db_pass);
+    define('DB', 'insecure');
+}
+
+if (isset($_POST['username']) && isset($_POST['password'])) {
+    $username = $_POST['username'];
+    $password = $_POST['password'];
+
+    // Connect to the DB
+    $conn = mysqli_connect(HOST, USER, PASS, DB);
+
+    // Write a DB query
+    $sql = 'SELECT password FROM users WHERE username = "' . $username . ' ";';
+
+    // Run DB query
+    $results = mysqli_query($conn, $sql);
+
+    if (mysqli_num_rows($results) == 0) {
+        $_GET['error'] = true;
+    } else {
+        $row = mysqli_fetch_assoc($results);
+
+        if ($row['password'] == $password) {
+            $_SESSION['access'] = true;
+            $_GET['file'] = 'includes/fbi.txt';
+        } else {
+            $_GET['error'] = true;
+        }
+    }
+}
+
+if (isset($_GET['logout'])) {
+    $_SESSION['access'] = false;
+    header('Location: .');
+}
+
+?>
+
+<!doctype html>
+<html lang="en">
+
+<head>
+  <title>Spies</title>
+  <link href="css/styles.css" type="text/css" rel="stylesheet">
+  <script src="js/index.js"></script>
+</head>
+
+<body>
+<h1>View Confidential Information</h1>
+<?php
+if ($_SESSION['access'] !== true) {
+    if (isset($_GET['error']) && $_GET['error'] === true) {
+        echo '
+          <div class="card error">
+            <h5 class="error">Access Denied.</h5>
+            <p class="error">Invalid username or password.</p>
+          </div>
+        ';
+    }
+    echo '
+        <form method="post">
+          <div class="row">
+            <input name="username" type="text" placeholder="username">
+            <input name="password" type="password" placeholder="password">
+          </div>
+          <div class="row">
+            <button>Submit</button>
+            <button type="reset" class="reset">Reset</button>
+          </div>
+        </form>
+    ';
+} else if (isset($_GET['file']) && isset($_SESSION['access'])) {
+    echo '
+    <div class="card success">
+      <h5 class="success">Access Granted.</h5>
+    </div>
+    <form method="get">
+      <div class="row">
+        <button name="file" value="includes/fbi.txt">FBI</button>
+        <button name="file" value="includes/spies.txt">Spies</button>
+        <button name="logout" value="true" class="reset">Logout</button>
+      </div>
+    </form>
+  ';
+    fileRead($_GET['file']);
+}
+?>
+</body>
+</html>
+
+<?php
+function fileRead($file)
+{
+    $fs = fopen($file, 'r');
+    $string = fread($fs, filesize($file));
+    $values = explode('||>><<||', $string);
+
+    echo '
+    <table>
+      <tr>
+        <th>Agent</th>
+        <th>Codename</th>
+      </tr>
+    ';
+    foreach ($values as $v) {
+        list($a, $b) = explode(',', $v);
+
+        echo '
+              <tr>
+                <td>' . ucfirst($a) . '</td>
+                <td>' . ucwords($b) . '</td>
+              </tr>
+            ';
+    }
+    echo '</table>';
+}
+?>