<?php
//
// $Id: settings.php,v 1.6 2004/11/18 23:25:47 greg_k Exp $
//
include ('header.php');

$query_log="insert into log (ip, username, action) values('$_SERVER[REMOTE_ADDR]','".mysql_escape_string($_SESSION[user])."','Open settings.php')";
$result_log=$dbconn->execute($query_log);

include ('permissions.inc.php');

$acl=checkacl("profile", $dbconn);

if ($acl!="Y") {
    echo "Access Denied!!!<br>";
}
else {

    $query = "select count(*) from nessus_plugins";
    $result=$dbconn->execute($query);
    list($pluginscount)=$result->fields;

    if ($pluginscount==0) {
        die ("<h2>Please run updateplugins.pl script first before using web interface.</h2>");
    }



    if ($item=="new") {

        echo "<form method=\"post\" action=\"settings.php?item=save\">
        Name: <input type=\"text\" name=\"sname\" value=\"\"><BR>
        Description: <input type=\"text\" name=\"sdescription\" value=\"\"><BR>
        Type: <select name=\"stype\">
        <option value=\"G\" selected>Global
        <option value=\"P\">Private
        </select><BR>
        Autoenable plugins option:
        <select name=\"sautoenable\">
        <option value=\"N\">None
        <option value=\"C\">Autoenable by category
        <option value=\"F\">Autoenable by family
        </select><BR><BR>";
        $query="select * from nessus_category order by name";
        $result = $dbconn->execute($query);

        echo "<B>Autoenable plugins in categories:</B><BR><table summary=\"Category Listing\" border=1 cellspacing=\"0\" cellpadding=\"0\" style=\"border-collapse: collapse\"><tr><td><b>Category</b></td><td><b>Enable All</b></td><td><b>Enable New</b></td><td><b>Disable New</b></td><td><b>Disable All</b></td><td><b>Intelligen</b></td></tr>";
        while (!$result->EOF) {
            list($cid, $category)=$result->fields;
            echo "<tr><td>$category</td>
            <td><input type=\"radio\" name=\"c_$cid\" value=\"1\" checked></td>
            <td><input type=\"radio\" name=\"c_$cid\" value=\"2\"></td>
            <td><input type=\"radio\" name=\"c_$cid\" value=\"3\"></td>
            <td><input type=\"radio\" name=\"c_$cid\" value=\"4\"></td>
            <td><input type=\"radio\" name=\"c_$cid\" value=\"5\"></td>
            </tr>";
            $result->MoveNext();
        }
        echo "</table>";

        $query="select * from nessus_family order by name";
        $result=$dbconn->execute($query);

        echo "<B>Autoenable plugins in Families:</B><BR><table summary=\"Family Listing\" border=1 cellspacing=\"0\" cellpadding=\"0\" style=\"border-collapse: collapse\"><tr><td><b>Family</b></td><td><b>Enable All</b></td><td><b>Enable New</b></td><td><b>Disable New</b></td><td><b>Disable All</b></td><td><b>Intelligent</b></td></tr>";

        while (!$result->EOF) {
            list ($fid, $family)=$result->fields;
            echo "<tr><td>$family</td>
            <td><input type=\"radio\" name=\"f_$fid\" value=\"1\" checked></td>
            <td><input type=\"radio\" name=\"f_$fid\" value=\"2\"></td>
            <td><input type=\"radio\" name=\"f_$fid\" value=\"3\"></td>
            <td><input type=\"radio\" name=\"f_$fid\" value=\"4\"></td>
            <td><input type=\"radio\" name=\"f_$fid\" value=\"5\"></td>
            </tr>";
            $result->MoveNext();
        }
        echo "</table>
        <input type=\"submit\" name=\"submit\" value=\"Save\">
        </form>";

    }

    elseif ($item=="save") {
        $query="select count(name) from nessus_settings where name='$sname'";
        $result=$dbconn->execute($query);
        list($count)=$result->fields;
        if ($count>0) {
            echo "Can't create new profile, duplicate profile name $sname exists.";
        }
        else {
            $query="insert into nessus_settings (name, description, autoenable, type, owner) values ('$sname', '$sdescription', '$sautoenable', '$stype', '$username')";
            $result=$dbconn->execute($query);
            $query = "select id from nessus_settings where name='$sname'";
            $result=$dbconn->execute($query);
            list ($sid)=$result->fields;


            $query="insert into nessus_settings_users (sid, username) values ($sid, '$username')";
            $result=$dbconn->execute($query);


            reset ($HTTP_POST_VARS);   // if form method="post"

            while (list($key, $value) = each ($HTTP_POST_VARS)) {

                if (substr($key,0,2)=="f_") {
                    $type=substr($key,0,1);
                    $key=substr($key, 2);
                    $query="insert into nessus_settings_family  values($sid, $key, $value)";
                    $results=$dbconn->Execute($query);
                }
                elseif (substr($key,0,2)=="c_") {
                    $type=substr($key,0,1);
                    $key=substr($key, 2);
                    $query="insert into nessus_settings_category  values($sid, $key, $value)";
                    $results=$dbconn->Execute($query);


                }
            }

            $query="select count(*) from nessus_settings_preferences where sid=$sid";
            $result=$dbconn->execute($query);
            list($count)=$result->fields;
            if (!$count>0) {

                $query="insert into nessus_settings_preferences select $sid as sid, id, nessus_id, value, category, type from nessus_preferences";
                $result=$dbconn->execute($query);

            }
            $query = "select count(*) from nessus_settings_plugins where sid=$sid";
            $result=$dbconn->execute($query);
            list($count)=$result->fields;
            if (!$count>0) {

                $query = "insert into nessus_settings_plugins select id, $sid as sid, enabled, category, family from nessus_plugins where deleted is null";
                $result=$dbconn->execute($query);


            }

            if ($sautoenable=="C") {
                $query="select t1.cid, t1.status from nessus_settings_category as t1, nessus_category as t2 where sid=$sid";
                $result=$dbconn->execute($query);

                while (!$result->EOF) {
                    list($cid, $catstatus)=$result->fields;
                    if ($catstatus==4) {
                        $query1="update nessus_settings_plugins set enabled='N' where category=$cid and sid=$sid";
                        $result1=$dbconn->execute($query1);
                    }
                    elseif ($catstatus==1) {
                        $query1="update nessus_settings_plugins set enabled='Y' where category=$cid and sid=$sid";
                        $result1=$dbconn->execute($query1);
                    }
                    $result->MoveNext();
                }
            }
            elseif($sautoenable=="F") {
                $query="select t1.fid, t1.status from nessus_settings_family as t1, nessus_category as t2 where sid=$sid";
                $result=$dbconn->execute($query);

                while (!$result->EOF) {
                    list($fid, $catstatus)=$result->fields;
                    if ($catstatus==4) {
                        $query1="update nessus_settings_plugins set enabled='N' where family=$fid and sid=$sid";
                        $result1=$dbconn->execute($query1);
                    }
                    elseif ($catstatus==1) {
                        $query1="update nessus_settings_plugins set enabled='Y' where family=$fid and sid=$sid";
                        $result1=$dbconn->execute($query1);
                    }
                    $result->MoveNext();
                }
            }
            echo "Step 1. Done - Profile $sname created!!!<BR>
            Step 2.  <a href=\"settings.php?item=editusers&amp;sid=$sid\">Edit Profile Users</a></br>
            Step 3. <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1\">Edit profile details</A>";

        }
    }
    elseif ($item=="edit") {

        if ($page==1) {

            $query="select name, description from nessus_settings where id=$sid";
            $result=$dbconn->execute($query);
            list($sname, $sdescription)=$result->fields;
            echo "Profile: $sname - $sdescription<br>";


            if ($prefs=="1" or $prefs=="") {

                echo "<A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=1\">Preferences</A> |
                <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=3\">Plugins</A> |
                <a href=\"settings.php?item=editusers&amp;sid=$sid\">Edit Users</a> |
                <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=4\">View Configuration File</a><BR><BR>";


                $sql = "SELECT t.nessusgroup, t.nessus_id, t.field, t.type, t.value, n.value, t.category
                       FROM nessus_preferences_defaults t
                       LEFT JOIN nessus_settings_preferences n
                       ON t.nessus_id = n.nessus_id
                       and n.sid = $sid
                       order by category desc, nessusgroup, nessus_id";
                $result=$dbconn->execute($sql);
                $counter = 0;


                if ($submit=="save") {
				# Check to see if this is the owner doing the change
                    $foo = $dbconn->execute("select owner from nessus_settings where id = $sid");
                    list ($myowner)=$foo->fields;
                    if ($myowner <> $username) {
                        die ("Access denied: You do not own this profile\n");
                    }

                    while(!$result->EOF) {
                        $counter++;
                        $vname = "form".$counter;
                        list ($nessusgroup, $nessus_id, $field, $type, $default, $value, $category) = $result->fields;
                        updatedb($nessus_id, $$vname, $dbconn, $type, $category, $sid);
                        $result->MoveNext();
                    }

				# find all records in the nessus_settings_preferences table that
				# have no matching value in nessus_preferences_defaults
				# and delete them from nessus_preferences

                    $sql = "select n.nessus_id from nessus_settings_preferences n
                           left join nessus_preferences_defaults t
                           on n.nessus_id = t.nessus_id
                           where t.nessus_id is null";
                    $result=$dbconn->execute($sql);

                    while(!$result->EOF) {
                        list ($pleasedeleteme) = $result->fields;
                        $sql2 = "delete from nessus_settings_preferences
                                where nessus_id = \"$pleasedeleteme\"";
                        $result2=$dbconn->execute($sql2);
                        $result->MoveNext();
                    }




                    echo "Nessus settings saved, please proceed to the <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=3\">Plugins Selection</A> page<BR>";

                }
                else {
                    $lastvalue = "";
                    print "<form method=\"post\" action=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=1\">";
                    while(!$result->EOF) {
                        $counter++;
                        list ($nessusgroup, $nessus_id, $field, $type, $default, $value, $category) = $result->fields;
                        if ($nessusgroup != $lastvalue) {
                            print "<b>$nessusgroup</b><br>";
                            $lastvalue = $nessusgroup;
                        }
                        $vname = "form".$counter;
                        print formprint($field, $vname, $type, $default, $value);
                        $result->MoveNext();
                    }

                    echo "<INPUT type=\"submit\" name=\"submit\" value=\"save\">
                    </form>";
                }
            }

            elseif ($prefs=="4") {

                echo "<A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=1\">Preferences</A> |
                <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=3\">Plugins</A> |
                <a href=\"settings.php?item=editusers&amp;sid=$sid\">Edit Users</a> |
                <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=4\">View Configuration File</a><BR><BR>";

                echo "<TEXTAREA rows=15 cols=80 ># This file was automagically created by Inprotect\n\n";

                $query="SELECT t1.id, t1.enabled from nessus_settings_plugins as t1, plugins as t2 where t1.id=t2.id and t2.category ='scanner' and t1.sid=$sid order by id";
                $result=$dbconn->Execute($query);
                echo "begin(SCANNER_SET)\n";
                while (!$result->EOF) {
                    list ($id, $enabled) = $result->fields;
                    $enabled1="yes";
                    if ($enabled=="N") $enabled1="no";
                    echo " $id = $enabled1\n";

                    $result->MoveNext();
                }

                echo "end(SCANNER_SET)\n\n";



                $query="Select nessus_id, value from nessus_settings_preferences where category='SERVER_PREFS' and sid=$sid";
                $result=$dbconn->Execute($query);

                echo "begin(SERVER_PREFS)\n";

                while (!$result->EOF) {
                    list( $nessus_id, $value)=$result->fields;

                    echo " $nessus_id = $value\n";

                    $result->MoveNext();
                }

                echo "end(SERVER_PREFS)\n\n";


                $query="Select nessus_id, value from nessus_settings_preferences where category='PLUGINS_PREFS' and sid=$sid";
                $result=$dbconn->Execute($query);

                echo "begin(PLUGINS_PREFS)\n";

                while (!$result->EOF) {
                    list( $nessus_id, $value)=$result->fields;

                    echo " $nessus_id = $value\n";

                    $result->MoveNext();
                }

                echo "end(PLUGINS_PREFS)\n\n";


                $query="SELECT t1.id, t1.enabled from nessus_settings_plugins as t1, plugins as t2 where t1.id=t2.id and t2.category <>'scanner' and t1.sid=$sid order by id";
                $result=$dbconn->Execute($query);
                echo "begin(PLUGIN_SET)\n";
                while (!$result->EOF) {
                    list ($id, $enabled) = $result->fields;
                    $enabled1="yes";
                    if ($enabled=="N") $enabled1="no";
                    echo " $id = $enabled1\n";

                    $result->MoveNext();
                }

                echo "end(PLUGIN_SET)\n\n";
                echo "</TEXTAREA>";
            }

            elseif ($prefs=="3") {

                echo "<A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=1\">Preferences</A> |
                <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=3\">Plugins</A> |
                <a href=\"settings.php?item=editusers&amp;sid=$sid\">Edit Users</a> |
                <A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=4\">View Configuration File</a>";

                if ($saveplugins=="Save") {


                    reset ($HTTP_POST_VARS);   // if form method="post"


                    $result=$dbconn->Execute("Update nessus_settings_plugins set enabled='N' where sid=$sid");

                    while (list($key, $value) = each ($HTTP_POST_VARS)) {

                        if (substr($key,0,3)=="PID") {
                            $key=substr($key, 3);

                            $results=$dbconn->Execute("Update nessus_settings_plugins set enabled='Y' where ID=$key and sid=$sid");

                        }
                    }

                }


                if ($AllPlugins=="Enable All") {
                    $result=$dbconn->Execute("Update nessus_settings_plugins set enabled='Y' where sid=$sid"); }

                if ($NonDOS=="Enable Non DOS") {
                    $query="select id from nessus_category where name='denial'";
                    $result=$dbconn->execute($query);
                    list ($cid)=$result->fields;
                    $query = "update nessus_settings_plugins set enabled='N' where sid=$sid and category=$cid";
                    $result=$dbconn->execute($query);
                    $query="select id from nessus_category where name='destructive_attack'";
                    $result=$dbconn->execute($query);
                    list ($cid)=$result->fields;
                    $query = "update nessus_settings_plugins set enabled='N' where sid=$sid and category=$cid";
                    $result=$dbconn->execute($query);



                }

                if ($DisableAll=="Disable All") {
                    $query="update nessus_settings_plugins set enabled='N' where sid=$sid";
                    $result=$dbconn->execute($query);
                }

                $query="select autoenable from nessus_settings where id=$sid";
                $result=$dbconn->execute($query);
                list($sautoenable)= $result->fields;

                if ($sautoenable=="C") {
                    $query="select t1.cid, t1.status from nessus_settings_category as t1, nessus_category as t2 where sid=$sid";
                    $result=$dbconn->execute($query);

                    while (!$result->EOF) {
                        list($cid, $catstatus)=$result->fields;
                        if ($catstatus==4) {
                            $query1="update nessus_settings_plugins set enabled='N' where category=$cid and sid=$sid";
                            $result1=$dbconn->execute($query1);
                        }
                        elseif ($catstatus==1) {
                            $query1="update nessus_settings_plugins set enabled='Y' where category=$cid and sid=$sid";
                            $result1=$dbconn->execute($query1);
                        }
                        $result->MoveNext();
                    }
                }
                elseif($sautoenable=="F") {
                    $query="select t1.fid, t1.status from nessus_settings_family as t1, nessus_category as t2 where sid=$sid";
                    $result=$dbconn->execute($query);

                    while (!$result->EOF) {
                        list($fid, $catstatus)=$result->fields;
                        if ($catstatus==4) {
                            $query1="update nessus_settings_plugins set enabled='N' where family=$fid and sid=$sid";
                            $result1=$dbconn->execute($query1);
                        }
                        elseif ($catstatus==1) {
                            $query1="update nessus_settings_plugins set enabled='Y' where family=$fid and sid=$sid";
                            $result1=$dbconn->execute($query1);
                        }
                        $result->MoveNext();
                    }


                }


                //Check for new plugins
                //	$query="select nessus_plugins.id, nessus_plugins.family, nessus_plugins.category
                //		from nessus_plugins
                //		left join nessus_settings_plugins on nessus_plugins.id=nessus_settings_plugins.id
                //		where nessus_plugins.deleted is not null and nessus_settings_plugins.sid=$sid";
                //	$result=$dbconn->execute($query);



                echo "<form method=\"post\" action=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=3\">";
                echo "<table>
                <tr><td colspan=2><b>Plugins</b></td></tr>";

                $result=$dbconn->Execute("Select count(id) plugincount from nessus_settings_plugins where sid=$sid");
                list($pcount)=$result->fields;
                $result=$dbconn->Execute("Select count(id) plugincount from nessus_settings_plugins where enabled='Y' and sid=$sid");
                list($penabled)=$result->fields;

                echo "<tr><td colspan=2>$pcount Nessus plugins available, $penabled - enabled</td></tr>\n"; echo "<tr><td colspan=2>
                <input type=\"submit\" name=\"saveplugins\" value=\"Save\">
                <input type=\"submit\" name=\"AllPlugins\" value=\"Enable All\">
                <input type=\"submit\" name=\"NonDOS\" value=\"Enable Non DOS\">
                <input type=\"submit\" name=\"DisableAll\" value=\"Disable All\"></td></tr>";

                $result=$dbconn->execute("select name from nessus_family order by name");
                echo "<tr><td colspan=2><b>";
                while(list($family)=$result->fields) {
                    echo "<a href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1&amp;prefs=3#$family\">$family</a><br>";
                    $result->MoveNext();
                }
                echo "</b></td></tr>";

                $result=$dbconn->Execute("Select id, name from nessus_family order by name");
                while (list($fid, $family)=$result->fields) {
                    echo "<tr><td colspan=2><b><a name=\"$family\">$family</a></b><hr></td></tr>\n";

                    $result1=$dbconn->Execute("Select t1.id, t1.name, t1.category, t2.enabled from plugins as t1, nessus_settings_plugins as t2 where t2.family=$fid and t1.id=t2.id and t2.sid=$sid order by t1.name");
                    while(list($pid, $pname, $pcategory, $penabled)=$result1->fields) {
                        echo "<tr><td align=\"right\"><INPUT type=checkbox name=\"PID$pid\" ";
                        if ($penabled=="Y") {
                            echo "checked ";
                        }
                        echo "id=$pid></td><td><a target=\"_blank\" href=\"lookup.php?id=$pid\">$pname</a> | $pcategory</td></tr>\n";
                        $result1->MoveNext();
                    }


                    $result->MoveNext();
                }


                echo "</table>";
                echo "<input type=\"submit\" name=\"saveplugins\" value=\"Save\"></form>";

                $result->Close;
            }
        }
        else {
            if ($submit=="Edit") {

                echo "<A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1\">Edit Details</a> <a href=\"settings.php?item=editusers&amp;sid=$sid\">Edit Users</a><BR>";

                $query = "select * from nessus_settings where id=$sid";
                $result=$dbconn->execute($query);

                echo "<form method=\"post\" action=\"settings.php?item=update&amp;sid=$sid\">";
                list ($sid, $sname, $sdescription, $sautoenable, $stype, $sowner)=$result->fields;

                echo "Name: <input type=\"text\" name=\"sname\" value=\"$sname\"><BR>
                Description: <input type=\"text\" name=\"sdescription\" value=\"$sdescription\"><BR>
                Type: <select name=\"stype\">
                <option value=\"G\" ";
                if ($stype=="G") { echo "selected";}
                echo ">Global";
                echo "<option value=\"P\" ";
                if ($stype=="P") { echo "selected";}
                echo ">Private";
                echo "</select><BR>
                Autoenable options:
                <SELECT name=\"sautoenable\">
                <option value=\"N\"";
                if ($sautoenable=="N") { echo " selected";}
                echo ">None
                <option value=\"C\"";
                if ($sautoenable=="C") { echo " selected";}
                echo ">Autoenable by category
                <option value=\"F\"";
                if ($sautoenable=="F") { echo " selected";}
                echo ">Autoenable by family
                </select><BR><BR>";
                echo "<B>Autoenable plugins in categories:</B><BR>";
                $query = "select t1.cid, t2.name, t1.status from nessus_settings_category as t1, nessus_category as t2 where t1.sid=$sid and t1.cid=t2.id order by t2.name";
                $result = $dbconn->execute($query);
                echo "<table border=1 bordercolor=\"#6797BF\" cellspacing=\"0\" cellpadding=\"0\" style=\"border-collapse: collapse\"><tr><td>Name</td><td>Enable All</td><td>Enable New</td><td>Disable New</td><td>Disable All</td><td>Intelligent</td></tr>";

                while (!$result->EOF) {
                    list ($cid, $name, $status) = $result->fields;
                    echo "<tr><td>$name</td>";
                    echo "<td><input type=\"radio\" name=\"c_$cid\" value=\"1\" ";
                    if ($status==1) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"c_$cid\" value=\"2\" ";
                    if ($status==2) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"c_$cid\" value=\"3\" ";
                    if ($status==3) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"c_$cid\" value=\"4\" ";
                    if ($status==4) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"c_$cid\" value=\"5\" ";
                    if ($status==5) {echo "checked";}
                    echo "></td></tr>";
                    $result->MoveNext();
                }
                echo "</table><BR>";
                $query = "select t1.fid, t2.name, t1.status from nessus_settings_family as t1, nessus_family as t2 where t1.sid=$sid and t1.fid=t2.id order by t2.name";
                $result = $dbconn->execute($query);
                echo "<B>Autoenable plugins in families:</B><BR>
                <table border=1 bordercolor=\"#6797BF\" cellspacing=\"0\" cellpadding=\"0\" style=\"border-collapse: collapse\"><tr><td>Name</td><td>Enable All</td><td>Enable New</td><td>Disable New</td><td>Disable All</td><td>Intelligent</td></tr>";

                while (!$result->EOF) {
                    list ($fid, $name, $status) = $result->fields;
                    echo "<tr><td>$name</td>";
                    echo "<td><input type=\"radio\" name=\"f_$fid\" value=\"1\" ";
                    if ($status==1) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"f_$fid\" value=\"2\" ";
                    if ($status==2) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"f_$fid\" value=\"3\" ";
                    if ($status==3) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"f_$fid\" value=\"4\" ";
                    if ($status==4) {echo "checked";}
                    echo "></td>";
                    echo "<td><input type=\"radio\" name=\"f_$fid\" value=\"5\" ";
                    if ($status==5) {echo "checked";}
                    echo "></td></tr>";
                    $result->MoveNext();


                }
                echo "</table><BR>";

                echo "<input type=\"submit\" name=\"submit\" value=\"Update\">
                </form>";

            }
            elseif ($delete=="Delete") {

                if ($op=="delete") {
                    $query = "delete from nessus_settings where id=$sid";
                    $result=$dbconn->execute($query);
                    $query="delete from nessus_settings_preferences where sid=$sid";
                    $result=$dbconn->execute($query);
                    $query="delete from nessus_settings_plugins where sid=$sid";
                    $result=$dbconn->execute($query);
                    $query = "delete from nessus_settings_family where sid=$sid";
                    $result=$dbconn->execute($query);
                    $query = "delete from nessus_settings_category where sid=$sid";
                    $result=$dbconn->execute($query);

                    echo "Profile has been deleted<BR>";;

                }
                else {
                    echo "Do you want to delete this profile?<BR>
                    <a href=\"settings.php\">No</A> | <a href=\"settings.php?item=edit&amp;sid=$sid&amp;delete=Delete&amp;op=delete\">Yes</a>";
                }

            }
        }


    }


    elseif ($item=="update") {
	# Check to see if this is the owner doing the change
        $result = $dbconn->execute("select owner from nessus_settings where id = $sid");
        list ($myowner)=$result->fields;
        if ($myowner <> $username) {
            die ("Access denied: You do not own this profile\n");
        }


        $query = "update nessus_settings set name='$sname', description='$sdescription', type='$stype', autoenable='$sautoenable' where id=$sid";
        $result=$dbconn->execute($query);

        reset ($HTTP_POST_VARS);   // if form method="post"

        while (list($key, $value) = each ($HTTP_POST_VARS)) {


            if (substr($key,0,2)=="f_") {
                $type=substr($key,0,1);
                $key=substr($key, 2);
                $query="update nessus_settings_family set status=$value where sid=$sid and fid=$key";
                $results=$dbconn->Execute($query);
            }
            elseif(substr($key,0,2)=="c_") {
                $type=substr($key,0,1);
                $key=substr($key, 2);
                $query="update nessus_settings_category set status=$value where sid=$sid and cid=$key";
                $results=$dbconn->Execute($query);


            }
        }

        if ($sautoenable=="C") {
            $query="select t1.cid, t1.status from nessus_settings_category as t1, nessus_category as t2 where sid=$sid";
            $result=$dbconn->execute($query);

            while (!$result->EOF) {
                list($cid, $catstatus)=$result->fields;
                if ($catstatus==4) {
                    $query1="update nessus_settings_plugins set enabled='N' where category=$cid and sid=$sid";
                    $result1=$dbconn->execute($query1);
                }
                elseif ($catstatus==1) {
                    $query1="update nessus_settings_plugins set enabled='Y' where category=$cid and sid=$sid";
                    $result1=$dbconn->execute($query1);
                }
                $result->MoveNext();
            }
        }
        elseif($sautoenable=="F") {
            $query="select t1.fid, t1.status from nessus_settings_family as t1, nessus_category as t2 where sid=$sid";
            $result=$dbconn->execute($query);

            while (!$result->EOF) {
                list($fid, $catstatus)=$result->fields;
                if ($catstatus==4) {
                    $query1="update nessus_settings_plugins set enabled='N' where family=$fid and sid=$sid";
                    $result1=$dbconn->execute($query1);
                }
                elseif ($catstatus==1) {
                    $query1="update nessus_settings_plugins set enabled='Y' where family=$fid and sid=$sid";
                    $result1=$dbconn->execute($query1);
                }
                $result->MoveNext();
            }
        }
        echo "Profile updated<BR>";
    }
    elseif ($item=="editusers" & checkacl("admin", $dbconn)=="Y") {
        echo "<A href=\"settings.php?item=edit&amp;sid=$sid&amp;page=1\">Edit Details</a> <a href=\"settings.php?item=editusers&amp;sid=$sid\">Edit Users</a><BR>";

        $query="select name from nessus_settings where id=$sid";
        $result=$dbconn->execute($query);
        echo "<b>".$result->fields[0]." Profile Users</B></br>";


        if ($op=="add") {

            for ($i = 0; $i < count($susers); $i++) {
                $query="delete from nessus_settings_users where sid=$sid and username='$susers[$i]'";
                $result=$dbconn->execute($query);
                $query="insert into nessus_settings_users (sid, username) values ($sid, '$susers[$i]')";
                $result=$dbconn->execute($query);
            }

        }


        if ($op=="del") {

            $query="delete from nessus_settings_users where id=$uid";
            $result=$dbconn->execute($query);

        }
        $query="select id, username from nessus_settings_users where sid=$sid order by username";
        $result=$dbconn->execute($query);

        echo "<table border=\"1\"><tr><td>&nbsp;</td><td>User</td></tr>";

        while(!$result->EOF) {
            list($suid, $uname)=$result->fields;

            echo "<tr><td><a href=\"settings.php?item=editusers&amp;sid=$sid&amp;op=del&amp;uid=$suid\">Del</a></td><td>$uname</td></tr>";

            $result->MoveNext();
        }

        echo "</table>";

        echo "<form method=\"post\" action=\"settings.php?item=editusers&amp;op=add&amp;sid=$sid\">
        <b>Users:</b><br>
        <select name=\"susers[]\" size=\"3\" multiple>";

        $query="select pn_uname from users order by pn_uname";
        $result=$dbconn->execute($query);

        while(!$result->EOF) {
            list($uname)=$result->fields;
            echo "<option value=\"$uname\"> $uname";
            $result->MoveNext();
        }

        echo "</select><br>
        <input type=\"submit\" name=\"submit\" value=\"Add Users\">
        </form>";


    }

    else {


        $query="select id, name, description from nessus_settings where owner = '$username' or type = 'G' order by name";
        $result=$dbconn->execute($query);

        echo "Scanner Profiles<br>
        Please select profile to edit:
        <form method=\"post\" action=\"settings.php?item=edit\">
        <select name=\"sid\">";
        while (!$result->EOF) {
            list($sid, $sname, $sdescription)=$result->fields;

            echo "<option value=\"$sid\">$sname - $sdescription";

            $result->MoveNext();
        }
        echo "</select><BR>
        <input type=\"submit\" name=\"submit\" value=\"Edit\">
        <input type=\"submit\" name=\"delete\" value=\"Delete\">
        </form><BR>
        <a href=\"settings.php?item=new\">Create New Profile</a> |
        <a href=\"defaults.php\">Edit default profile</A>";
    }
}


include ('footer.php');

function updatedbold($fieldname, $fieldvalue, $dbconn, $type, $sid) {


    if ($type=="C" and $fieldvalue=="") {
        $fieldvalue="no";
    }

    $query= "Update nessus_settings_preferences set value='$fieldvalue', type='$type' where id='$fieldname' and sid=$sid";
    $result=$dbconn->execute($query);

}

function updatedb($nessus_id, $fieldvalue, $dbconn, $type, $category, $sid) {
    if ($type=="C" and $fieldvalue=="") {
        $fieldvalue="no";
    }

    $sql = "select count(*) from nessus_settings_preferences where sid = $sid and nessus_id = \"$nessus_id\"";
    $result=$dbconn->execute($sql);

    list($existing)=$result->fields;
    if ($existing == 0) {
		# Do an insert statement
        $sql = "insert nessus_settings_preferences set nessus_id = \"$nessus_id\", value=\"$fieldvalue\", type=\"$type\", category=\"$category\", sid=$sid";
    }
    else {
        $sql = "update nessus_settings_preferences set value=\"$fieldvalue\", type=\"$type\", category=\"$category\" where nessus_id = \"$nessus_id\" and sid = $sid";
    }
    $result=$dbconn->execute($sql);
}





function get_field($fieldname, $dbconn, $sid) {

    $query="Select value, type from nessus_settings_preferences where id='$fieldname' and sid=$sid";
    $result=$dbconn->execute($query);
    $type=$result->fields[1];
    $value=$result->fields[0];

    if ($type=="C") {

        $retstr="<INPUT type=\"checkbox\" name=\"$fieldname\" value=\"yes\"";
        if ($value=="yes") {
            $retstr.=" checked>";
        }
        else {

            $retstr.=">";
        }

    }
    elseif ($type=="T") {
        $retstr="<INPUT type=\"text\" name=\"$fieldname\" value=\"$value\">";

    }

    elseif($type=="P") {
        $retstr="<INPUT type=\"password\" name=\"$fieldname\" value=\"$value\">";

    }
    elseif($type="R") {
        $retstr="";
        $query= "select value, description from nessus_multiple where id='$fieldname'";
        $result=$dbconn->execute($query);
        while(!$result->EOF) {
            list($rvalue, $descr)=$result->fields;

            $retstr.="<INPUT type=\"radio\" name=\"$fieldname\" value=\"$rvalue\"";
            if ($rvalue==$value) {

                $retstr.=" checked";
            }
            $retstr.="> $descr<BR>";


            $result->MoveNext();
        }

    }
    //		$retstr.=fieldlink($fieldname, $dbconn);

    return $retstr;


}

function fieldlink($fieldname, $dbconn) {
    /* This function will return a url that maps to a link to the edgeos knowledgebase for the item being displayed */
    /* Assumptions: DBVersion must be set to x.xx */
    /* This should be checked once the code is cleaned a bit */

    $fieldquery = "select edgeos, label from nessus_preferences where id = '$fieldname' limit 1";
    $fieldresult = $dbconn->execute($fieldquery);
    list($edgeos,$label)=$fieldresult->fields;
    if ($edgeos > 0) {
        if ($label == "") {
            $returnvalue = "^$edgeos^";
        }
        else {
            $returnvalue = " <A href=\"http://www.edgeos.com/nessuskb/details.php?option_id=$edgeos\">$label</A> ";
        }
    }
    else {
        /* Weird cases here */
        $returnvalue = "^";
    }
    return $returnvalue;
}


function formprint($field, $vname, $type, $default, $value) {
	# The pseudocode below will load a default value for an undefined field
	# to help make it easier for new fields to be added into the structure
	#
    $retstr = "";
    if ( is_null($value)) {
        if ($type == "R") {
            $value = explode(";", $default);
            $value = $value[0];
        }
        else {
            $value = $default;
        }
    }

    if ($type == "C") {
		# Checkbox code here
        $retstr="$field <INPUT type=\"checkbox\" name=\"$vname\" value=\"yes\"";
        if ($value=="yes") {
            $retstr.=" checked";
        }
        $retstr.="><BR>";
    }
    elseif ($type == "R") {
		# Radio button code here
        $retstr="$field <BR>";
        $array = explode(";", $default);
        foreach($array as $myoption) {
            $retstr.="<INPUT type=\"radio\" name=\"$vname\" value=\"$myoption\"";
            if ($value == $myoption) {
                $retstr.=" checked";
            }
            $retstr.="> $myoption<BR>";
        }
    }
    elseif ($type == "P") {
		# Password code here
        $retstr="$field <INPUT type=\"password\" name=\"$vname\" value=\"$value\"><BR>";
    }
    else {
		# Assume it is a text box
        $retstr="$field <INPUT type=\"text\" name=\"$vname\" value=\"$value\"><BR>";
    }
    $retstr .= "\n";
    return $retstr;
}
?>

