<?php
//
// $Id: defaults.php,v 1.3 2004/11/18 22:59:13 greg_k Exp $
//

/***********************************************************/
/* last update: 12.20.2002				   */
/* --------------------------------------------------------*/
/*		    Inprotect			    	   */
/* --------------------------------------------------------*/
/* Copyright (C) 2002 Inprotect.com			   */
/*							   */
/* This program is free software; you can redistribute it  */
/* and/or modify it under the terms of version 2 of the    */
/* GNU General Public License as published by the Free     */
/* Software Foundation.				    	   */
/* This program is distributed in the hope that it will be */
/* useful, but WITHOUT ANY WARRANTY; without even the      */
/* implied warranty of MERCHANTABILITY or FITNESS FOR A    */
/* PARTICULAR PURPOSE. See the GNU General Public License  */
/* for more details.					   */
/*							   */
/* You should have received a copy of the GNU General      */
/* Public License along with this program; if not, write   */
/* to the Free Software Foundation, Inc., 59 Temple Place, */
/* Suite 330, Boston, MA 02111-1307 USA			   */
/*							   */
/* Contact Information:					   */
/* Alex Zimin (alex@inprotect.com)			   */
/* http://www.inprotect.com				   */
/***********************************************************/
/* See the README.txt and/or help files for more	   */
/* information on how to use & config.			   */
/* See the LICENSE.txt file for more information on the    */
/* License this software is distributed under.		   */
/*							   */
/* This program is intended for use in an authorized       */
/* manner only, and the author can not be held liable for  */
/* anything done with this program, code, or items	   */
/* discovered with this program's use.			   */
/***********************************************************/

include ('header.php');
include ('permissions.inc.php');

$acl=checkacl("profile", $dbconn);
if ($acl!="Y") {
    echo "Access Denied!!!";
}
else {
    echo "<center><B>Nessus Scanner Settings</B></center><hr>";
    if ($prefs=="1" or $prefs=="") {

        echo "<A href=\"defaults.php?prefs=1\">Preferences</A> | ";
        echo "<A href=\"defaults.php?prefs=3\">Plugins</A> | ";
        echo "<A href=\"defaults.php?prefs=4\">View Configuration File</a><BR><BR>";

        $sql = "SELECT t.nessusgroup, t.nessus_id, t.field, t.type, t.value, n.value, t.category
               FROM nessus_preferences_defaults t
               LEFT JOIN nessus_preferences n
               ON t.nessus_id = n.nessus_id
               order by category desc, nessusgroup, nessus_id";
        $result=$dbconn->execute($sql);
        $counter = 0;

        if ($submit=="save") {
            while(!$result->EOF) {
                $counter++;
                $vname = "form".$counter;
                list ($nessusgroup, $nessus_id, $field, $type, $default, $value, $category) = $result->fields;
                updatedb($nessus_id, $$vname, $dbconn, $type, $category);
                $result->MoveNext();
            }

			# find all records in the nessus_preferences table that 
			# have no matching value in nessus_preferences_defaults
			# and delete them from nessus_preferences

            $sql = "select n.nessus_id from nessus_preferences n
                   left join nessus_preferences_defaults t
                   on n.nessus_id = t.nessus_id
                   where t.nessus_id is null";
            $result=$dbconn->execute($sql);

            while(!$result->EOF) {
                list ($pleasedeleteme) = $result->fields;

                $sql2 = "delete from nessus_preferences
                        where nessus_id = \"$pleasedeleteme\"";
                $result2=$dbconn->execute($sql2);

                $result->MoveNext();
            }

            echo "Nessus settings saved, please proceede to the <A href=\"defaults.php?prefs=3\">Plugins Selection</A> page<BR>";
        }
        else {
            $lastvalue = "";
            print "<form method=\"post\" action=\"defaults.php?prefs=1\">";
            while(!$result->EOF) {
                $counter++;
                list ($nessusgroup, $nessus_id, $field, $type, $default, $value, $category) = $result->fields;
                if ($nessusgroup != $lastvalue) {
                    print "<b>$nessusgroup</b><br>";
                    $lastvalue = $nessusgroup;
                }
                $vname = "form".$counter;
                print formprint($field, $vname, $type, $default, $value);
                $result->MoveNext();
            }

            echo "<INPUT type=\"submit\" name=\"submit\" value=\"save\">
            </form>
            ";
        }
    }
    elseif ($prefs=="4") {

        echo "<A href=\"defaults.php?prefs=1\">Preferences</A> | <A href=\"defaults.php?prefs=3\">Plugins</A> | <A href=\"defaults.php?prefs=4\">View Configuration File</a><BR><BR>";
        echo "<TEXTAREA rows=15 cols=80 >\n# This file was automagically created by Inprotect\n\n";

        $query="SELECT t1.* from nessus_plugins as t1, plugins as t2 where t1.id=t2.id and t2.category ='scanner' order by id";
        $result=$dbconn->Execute($query);
        echo "begin(SCANNER_SET)\n";
        while (!$result->EOF) {
            list ($id, $enabled) = $result->fields;
            $enabled1="yes";
            if ($enabled=="N") $enabled1="no";
            echo " $id = $enabled1\n";

            $result->MoveNext();
        }
        echo "end(SCANNER_SET)\n\n";



        $query="Select nessus_id, value from nessus_preferences where category='SERVER_PREFS'";
        $result=$dbconn->Execute($query);

        echo "begin(SERVER_PREFS)\n";

        while (!$result->EOF) {
            list( $nessus_id, $value)=$result->fields;

            echo " $nessus_id = $value\n";

            $result->MoveNext();
        }

        echo "end(SERVER_PREFS)\n\n";


        $query="Select nessus_id, value from nessus_preferences where category='PLUGINS_PREFS'";
        $result=$dbconn->Execute($query);

        echo "begin(PLUGINS_PREFS)\n";

        while (!$result->EOF) {
            list( $nessus_id, $value)=$result->fields;

            echo " $nessus_id = $value\n";

            $result->MoveNext();
        }

        echo "end(PLUGINS_PREFS)\n\n";


        $query="SELECT t1.* from nessus_plugins as t1, plugins as t2 where t1.id=t2.id and t2.category <>'scanner' order by id";
        $result=$dbconn->Execute($query);
        echo "begin(PLUGIN_SET)\n";
        while (!$result->EOF) {
            list ($id, $enabled) = $result->fields;
            $enabled1="yes";
            if ($enabled=="N") $enabled1="no";
            echo " $id = $enabled1\n";

            $result->MoveNext();
        }

        echo "end(PLUGIN_SET)\n\n";
        echo "</TEXTAREA>";
    }

    elseif ($prefs=="3") {
        echo "<A href=\"defaults.php?prefs=1\">Preferences</A> |
        <A href=\"defaults.php?prefs=3\">Plugins</A> | <A href=\"defaults.php?prefs=4\">View Configuration File</a>";

        if ($submit=="submit") {
            reset ($HTTP_POST_VARS);   // if form method="post"

            $result=$dbconn->Execute("Update nessus_plugins set enabled='N'");

            while (list($key, $value) = each ($HTTP_POST_VARS)) {
                if (substr($key,0,3)=="PID") {
                    $key=substr($key, 3);
                    $results=$dbconn->Execute("Update nessus_plugins set enabled='Y' where ID=$key");
                }
            }
        }
        if ($AllPlugins=="Enable All") {
            $result=$dbconn->Execute("Update nessus_plugins set enabled='Y'"); }

        if ($NonDOS=="Enable Non DOS") {
            $result=$dbconn->Execute("Update nessus_plugins set enabled='N'");

            $result=$dbconn->Execute("select id from plugins where category<>'denial' and category<>'destructive_attack'");
            while (list($enableid)=$result->fields) {
                $result1=$dbconn->Execute("Update nessus_plugins set enabled='Y' where id=$enableid");
                $result->MoveNext();
            }
        }
        echo "<form method=\"post\" action=\"defaults.php?prefs=3\">";
        echo "<table>
        <tr><td colspan=2>Plugins</td></tr>";

        $result=$dbconn->Execute("Select count(id) plugincount from plugins");
        list($pcount)=$result->fields;
        $result=$dbconn->Execute("Select count(id) plugincount from nessus_plugins where enabled='Y'");
        list($penabled)=$result->fields;

        echo "<tr><td colspan=2>$pcount Nessus plugins available, $penabled - enabled</td></tr>\n";
        echo "<tr><td colspan=2><input type=\"submit\" name=\"AllPlugins\" value=\"Enable All\"><input type=\"submit\" name=\"NonDOS\" value=\"Enable Non DOS\"></td></tr>";


        $result=$dbconn->Execute("Select distinct family from plugins where family<>'' order by family");
        while (list($family)=$result->fields) {
            echo "<tr><td colspan=2><b>$family</b><hr></td></tr>\n";

            $result1=$dbconn->Execute("Select t1.id, t1.name, t1.category, t2.enabled from plugins as t1, nessus_plugins as t2 where t1.family='$family' and t1.id=t2.id order by t1.name");
            while(list($pid, $pname, $pcategory, $penabled)=$result1->fields) {
                echo "<tr><td align=\"right\"><INPUT type=checkbox name=\"PID$pid\" ";
                if ($penabled=="Y") {
                    echo "checked ";
                }
                echo "id=$pid></td><td><a target=\"_new\" href=\"lookup.php?id=$pid\">$pname</a> | $pcategory</td></tr>\n";
                $result1->MoveNext();
            }
            $result->MoveNext();
        }

        echo "</table>";
        echo "<input type=\"submit\" name=\"submit\" value=\"submit\"></form>";

        $result->Close;
    }
}


include("footer.php");

function updatedb($nessus_id, $fieldvalue, $dbconn, $type, $category) {
    if ($type=="C" and $fieldvalue=="") {
        $fieldvalue="no";
    }

    $sql = "select count(*) from nessus_preferences where nessus_id = \"$nessus_id\"";
    $result=$dbconn->execute($sql);

    list($existing)=$result->fields;
    if ($existing == 0) {
		# Do an insert statement
        $sql = "insert nessus_preferences set nessus_id = \"$nessus_id\", value=\"$fieldvalue\", type=\"$type\", category=\"$category\"";
    }
    else {
        $sql = "update nessus_preferences set value=\"$fieldvalue\", type=\"$type\", category=\"$category\" where nessus_id = \"$nessus_id\"";
    }
    $result=$dbconn->execute($sql);
}


function formprint($field, $vname, $type, $default, $value) {
	# The pseudocode below will load a default value for an undefined field
	# to help make it easier for new fields to be added into the structure
	#
    $retstr = "";
    if ( is_null($value)) {
        if ($type == "R") {
            $value = explode(";", $default);
            $value = $value[0];
        }
        else {
            $value = $default;
        }
    }

    if ($type == "C") {
		# Checkbox code here
        $retstr="$field <INPUT type=\"checkbox\" name=\"$vname\" value=\"yes\"";
        if ($value=="yes") {
            $retstr.=" checked";
        }
        $retstr.="><BR>";
    }
    elseif ($type == "R") {
		# Radio button code here
        $retstr="$field <BR>";
        $array = explode(";", $default);
        foreach($array as $myoption) {
            $retstr.="<INPUT type=\"radio\" name=\"$vname\" value=\"$myoption\"";
            if ($value == $myoption) {
                $retstr.=" checked";
            }
            $retstr.="> $myoption<BR>";
        }
    }
    elseif ($type == "P") {
		# Password code here
        $retstr="$field <INPUT type=\"password\" name=\"$vname\" value=\"$value\"><BR>";
    }
    else {
		# Assume it is a text box
        $retstr="$field <INPUT type=\"text\" name=\"$vname\" value=\"$value\"><BR>";
    }
    $retstr .= "\n";
    return $retstr;
}
?>

