<?php


include ('header.php');

$query_log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_SESSION[user])."','Open servers.php')";
$result_log=$dbconn->execute($query_log);

include ('permissions.inc.php');

$acl=checkacl("zones", $dbconn);


if ($acl=="Y") {

$query_log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_SESSION[user])."','Allowed to access servers.php')";
$result_log=$dbconn->execute($query_log);


if ($item=="delete") {




	if ($op=="delete") {

		$query_log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_SESSION[user])."','".mysql_escape_string("Removed Nessus server - $nid")."')";
$result_log=$dbconn->execute($query_log);

		$query = "delete from nessus_servers where id=$nid";
		$result=$dbconn->execute($query);
		$query= "delete from nessus_server_zones where nessusid=$nid";
		$result=$dbconn->execute($query);
		echo "Nessus server has been removed";


	}
	else{
	$query = "Select name, description, hostname from nessus_servers where id=$nid";
	$result = $dbconn->execute($query);
	list($nname, $ndescription, $nhostname) = $result->fields;
	echo "Are you sure you want to remove the following Nessus server from the database?<BR>
	<B>$nname $ndescription $nhostname</B><BR>
	<A href=\"servers.php?item=delete&amp;amp;nid=$nid&amp;amp;op=delete\">Yes</a> <a href=\"servers.php\">No</a>";
	}
}

elseif ($item=="edit") {

if ($op=="updatezones") {
	for ($i = 0; $i < count($serverzones); $i++) {
        $query="delete from nessus_server_zones where zoneid=$serverzones[$i] and nessusid=$nid";
        $result=$dbconn->execute($query);
        $query="insert into nessus_server_zones (zoneid, nessusid) values ($serverzones[$i], $nid)";
        $result=$dbconn->execute($query);

         }

	echo "Zones updated"; 
	

}


elseif ($op=="editzones") {

	$query = "select t2.name, t2.id, t2.description from nessus_server_zones as t1, nessus_zones as t2 where t1.nessusid=$nid and t1.zoneid=t2.id";
	$result=$dbconn->execute($query);
	echo "<table summary=\"Zone listing\" border=1><tr><td></td><td>Name</td><td>Description</td></tr>";
	while (!$result->EOF) {
		list ($zname,$zid,$zdescription)=$result->fields;
		echo "<tr><td><a href=\"zones.php?item=edit&amp;zid=$zid\">Edit</a></td><td>$zname</td><td>$zdescription</td></tr>";

		$result->MoveNext();
	}
	echo "</table><form method=\"post\" action=\"servers.php?item=edit&amp;op=updatezones&amp;nid=$nid\">";
	$query = "select id, name from nessus_zones where type='G' or owner = '$username'";
	$result = $dbconn->Execute($query);
	echo "Network zones: <select name=\"serverzones[]\" multiple>";
	while (!$result->EOF) {
		list ($zid, $zname) = $result->fields;
		echo "<option value=\"$zid\">$zname";
		$result->MoveNext();
	}
	echo "</select><br>
		<input type=\"submit\" name=\"submit\" value=\"Add selected Zones\">
		</form>";
}

elseif ($op=="save") {

	$query = "update nessus_servers set name='$nname', description='$ndescription', hostname='$nhostname', type='$ntype', user='$nusername', password='$npassword', max_scans=$nmaxscans, port=$nport where id=$nid and owner='$username'";
	$result=$dbconn->execute($query);

	echo "Nessus server settings updated.<br>Click <a href=\"servers.php\">here</a> to review Nessus servers settings.";


}
else {

	$query="select id, name, description, hostname, port, user, password, max_scans, current_scans from nessus_servers where id=$nid and (owner='$username' or type='G')";
	$result=$dbconn->execute($query);

		list ($nid, $nname, $ndescription, $nhostname, $nport, $nusername, $npassword, $nmaxscans, $currentscans)=$result->fields;
		echo "<B>Edit Nessus Server</b><br><form method=\"post\" action=\"servers.php?item=edit&amp;nid=$nid&amp;op=save\">
	<table summary=\"Server Details\">
	<tr><td>Server ID</td><td>$nid</td></tr>
	<tr><td>Server Name:</td>
	<td><input type=\"text\" name=\"nname\" value=\"$nname\"></td>
	</tr>
	<tr><td>Server Description:</td>
	<td><input type=\"text\" name=\"ndescription\" value=\"$ndescription\"></td>
	</tr>
	<tr><td>Server Hostname/IP address:</td>
	<td><input type=\"text\" name=\"nhostname\" value=\"$nhostname\"></td>
	</tr>
	<tr><td>Nessus Port:</td>
        <td><input type=\"text\" name=\"nport\" value=\"$nport\"></td>
        </tr>
	<tr><td>Server type:</td>
	<td><select name=\"ntype\">
                <option value=\"G\" ";if ($ntype=="G") {echo "selected";} echo">Global
                <option value=\"P\" ";if ($ntype=="P") {echo "selected";} echo ">Private
                </select></td>
		</tr>
		<tr><td>Nessus Username:</td>
		<td><input type=\"text\" name=\"nusername\" value=\"$nusername\"></td>
		</tr>
		<tr><td>Nessus Password:</td>
		<td><input type=\"text\" name=\"npassword\" value=\"$npassword\"></td>
		</tr>
		<tr><td>Max number of hosts to scan:</td>
		<td><input type=\"text\" name=\"nmaxscans\" value=\"$nmaxscans\"></td>
		</tr>
		<tr><td>Current scans</td><td>$currentscans</td></tr>
		</table>
                <input type=\"submit\" name=\"submit\" value=\"Save\">
                </form>";
		echo "<a href=\"servers.php?item=edit&amp;op=editzones&amp;nid=$nid\">Add/Edit Zones</A>";





}

}


elseif ($item=="addserver") {


if($op=="save") {

	$query="Insert into nessus_servers (name, description, hostname, port, type, owner, user, password, max_scans) values ('$nname', '$ndescription', '$nhostname', $nport, '$ntype', '$username', '$nessususer', '$nessuspassword', $maxhosts)";
	$result=$dbconn->execute($query);

	echo "New Nessus server settings saved.<BR>";

} 
else {
	echo "<b>Add New Nessus Server</b><br><form method=\"POST\" action=\"servers.php?item=addserver&amp;op=save\">
		<table>
		<tr><td>Server Name:</td>
		<td><input type=\"text\" name=\"nname\" value=\"\"></td>
		</tr>
		<tr><td>Server Description:</td>
		<td><input type=\"text\" name=\"ndescription\" value=\"\"></td>
		</tr>
		<tr><td>Server Hostname/IP address:</td>
		<td><input type=\"text\" name=\"nhostname\" value=\"\"></td>
		</tr>
		<tr>
		<td>Server Port:</td>
		<td><input type=\"text\" name=\"nport\" value=\"1241\"></td>
		</tr>
		<tr><td>Server type:</td>
		<td><select name=\"ntype\">
		<option value=\"G\" selected>Global
		<option value=\"P\">Private
		</select></td>
		</tr>
		<tr>
		<td>Nessus Username:</td>
		<td><input type=\"text\" name=\"nessususer\" value=\"\"></td>
		</tr>
		<tr>
		<td>Nessus Password:</td>
		<td><input type=\"text\" name=\"nessuspassword\" value=\"\"></td>
		</tr>
		<tr>
		<td>Max number of hosts to scan:</td>
		<td><input type=\"text\" name=\"maxhosts\" value=\"\"></td>
		</tr></table>
		<input type=\"submit\" name=\"submit\" value=\"Save\">
		</form>";

}
}
else
{


$query = "select id, name, description, hostname, current_scans, max_scans, checkin_time from nessus_servers where owner='$username' or type='G'";
$result=$dbconn->Execute($query);

echo "<B>Nessus Servers</B><br><table summary=\"Server list\" border=1><tr><td></td><td></td><td>ID</td><td>Name</td><td>Description</td><td>Hostname</td><td>Check-In Time</td><td>Running Scans</td><td>Max Scans</td>";
while (!$result->EOF) {
	list ($nid, $nname, $ndescription, $nhostname, $ncurrent, $nmax, $checkin)=$result->fields;	echo "<tr><td><a href=\"servers.php?item=edit&amp;nid=$nid\">Edit</a></td>
	<td><a href=\"servers.php?item=delete&amp;nid=$nid\">Del</a></td>
	<td>$nid</td><td>$nname</td><td>$ndescription</td><td>$nhostname</td><td>$checkin</td>
	<td>$ncurrent</td><td>$nmax</td></tr>";

	$result->MoveNext();
}

	echo "</table><BR>";

	echo "<a href=\"servers.php?item=addserver\">Add new Nessus server</A>";
		
}


}
else {
	$query_log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_SESSION[user])."','Access denied to servers.php')";
$result_log=$dbconn->execute($query_log);
	echo "Access Denied!!!<br>";
}


include ('footer.php');


?>

