<?php
//
// $Id: admin.php,v 1.5 2004/11/22 10:29:51 greg_k Exp $
//

include ('header.php');
include ('permissions.inc.php');

$acl=checkacl("admin", $dbconn);
if ($acl=="Y") {
	echo "<B>User Management</b><BR>";

	switch ($op) {

	case "delete" : 
		$query="delete from users where pn_uname='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_hosts where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_notes where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_results where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_scan where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_schedule where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_user_zones where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from portscan where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_settings_users where username='$auname'";
		$result=$dbconn->execute($query);

		$query="delete from nessus_zones where username='$auname' and type='P'";
		$result=$dbconn->execute($query);

		echo "User account <b>$auname</b> and all it's assosiated jobs and reports have been deleted<BR><BR>";
		$auname="";
		$op="";
		break;
	case "add" :
		if ($pass1<>"" and $pass2<>"") {
			$pass1=md5($pass1);
			$pass2=md5($pass2);
			if ($pass1==$pass2) {
				if ($admin<>"Y") {
					$admin="N";
				}
				if ($profile<>"Y") {
					$profile="N";
				}
				if ($zones<>"Y") {
					$zones="N";
				}
				if ($nmap<>"Y") {
					$nmap="N";
				}
				if ($nessus<>"Y") {
					$nessus="N";
				}
				if ($locked<>"Y") {
					$locked="0";
				}
				else {
					$locked=5;
				}
				$query="insert into users (pn_uname, pn_email, pn_pass, admin, profile, zones, nmap, nessus, expire, locked) values ('$auname', '$aemail', '$pass1', '$admin', '$profile', '$zones', '$nmap', '$nessus', '$expire', $locked)";
				$result=$dbconn->execute($query);
				echo "User $auname has been added<br>";
			}
			else {

				echo "Can not add user, provided passwords do not match.<br>";
			}
		}
		else {
			echo "Can not add user, password can not be blank<br>";
		}
		$op="";
		break;
	case "update" :
		if ($admin<>"Y") {
			$admin="N";
		}
		if ($profile<>"Y") {
			$profile="N";
		}
		if ($zones<>"Y") {
			$zones="N";
		}
		if ($nmap<>"Y") {
			$nmap="N";
		}
		if ($nessus<>"Y") {
			$nessus="N";
		}
		if ($locked<>"Y") {
			$locked="0";
		}
		else {
			$locked=5;
		}

		$query="update users set pn_email='$aemail', admin='$admin', profile='$profile', zones='$zones', nmap='$nmap', nessus='$nessus', locked=$locked, expire='$expire' where pn_uname='$auname'";
		$result=$dbconn->execute($query);
		echo "Account has been updated<br>";
		$op="";
		break;
	case "switch" :
		$query="select pn_uname, pn_pass from users where md5(pn_uname)='$auname'";
		$result=$dbconn->execute($query);

		list($suuser, $supass) = $result->fields;

		$_SESSION['pass'] = $supass;
		$_SESSION['user'] = $suuser;

		$username=$suuser;

		echo "Successfully switched to user $suuser.<br>";
		include('footer.php');

		die();
		break;
	default :
		break;
	}

	$query="select pn_uname, pn_email, created, lastaccessed from users";
	$result=$dbconn->execute($query);
	echo "<table summary=\"User List\" border=1><tr><td>&nbsp;</td><td>&nbsp;</td><td>Login Name</td><td>Email</td><td>Created</td><td>Last Login</td><td></td></tr>";
	while(!$result->EOF) {
		list($auser, $auemail, $created, $lastaccessed) = $result->fields;
		echo "<tr>
		<td><a href=\"admin.php?op=edit&amp;auname=$auser\">Edit</a></td>
		<td><a href=\"admin.php?op=delete&amp;auname=$auser\">Del</a></td>
		<td>$auser</td><td>$auemail</td>
		<td>$created</td>
		<td>$lastaccessed</td>
		<td><a href=\"admin.php?op=switch&amp;auname=".md5($auser)."\">Switch User</a></td>
		</tr>";
		$result->MoveNext();
	}
	echo "</table>";

	if($op=="pass") {
		if ($pass1<>"" and $pass2<>"") {
			$pass1=md5($pass1);
			$pass2=md5($pass2);
			if ($pass1==$pass2) {
				$query="update users set pn_pass='$pass1' where pn_uname='$auname'";
				$result=$dbconn->execute($query);
				echo "Password has been reset<br>";
				if ($auname==$username) {
					$_SESSION['pass'] = $pass1;
				}
			}
			else {
				echo "Could not reset password for user <b>$auname</b>, provided passwords do not match.<br>";
			}
		}
		else {
			echo "Can not use a blank password<br>";
		}
		$op="";
	}
	switch ($op) {
	case "edit" :
		$query="select pn_email, admin, profile, zones, nmap, nessus, expire, locked  from users where pn_uname='$auname'";
		$result=$dbconn->execute($query);

		list($aemail, $admin, $profile, $zones, $nmap, $nessus, $expire, $locked)=$result->fields;
echo "
		<form method=\"post\" action=\"admin.php?op=update&amp;auname=$auname\">
		<b>Edit User $auname</b><br>
		<table summary=\"Edit User Details\">
		<tr>
		<td>Email</td>
		<td><input type=\"text\" name=\"aemail\" value=\"$aemail\"></td>
		</tr>
		<tr>
		<td>Permissions</td>
		<td>
		<input type=\"checkbox\" name=\"admin\" value=\"Y\" ";
		if ($admin=="Y") {echo "checked";}
		echo "> Manage Users (Admin)<BR>
		<input type=\"checkbox\" name=\"profile\" value=\"Y\" ";
		if ($profile=="Y") {echo "checked";}
		echo "> Manage Profiles<BR>
		<input type=\"checkbox\" name=\"zones\" value=\"Y\" ";
		if ($zones=="Y") {echo "checked";}
		echo "> Manage Zones and Servers<BR>
		<input type=\"checkbox\" name=\"nmap\" value=\"Y\" ";
		if ($nmap=="Y") {echo "checked";}
		echo "> Run Nmap Scans<BR>
		<input type=\"checkbox\" name=\"nessus\" value=\"Y\" ";
		if ($nessus=="Y") {echo "checked";}	
		echo "> Run Nessus Scans<BR>
		<input type=\"checkbox\" name=\"locked\" value=\"Y\" ";
		if ($locked>=5) {echo "checked";}
		echo "> Account Locked
		</td>
		</tr>
		<tr>
		<td>Account Expiration<br>
		YYYYMMDD</td>
		<td><input type=\"text\" name=\"expire\" value=\"$expire\">
		</td></tr>
		</table>

		<input type=\"submit\" name=\"submit\" value=\"Update Account\">
		</form>";


		if ($auname<>"") {
			echo "<form method=\"post\" action=\"admin.php?op=pass&amp;auname=$auname\">
			<b>Reset Password:</b><BR>
			<table summary=\"Change password\">
			<tr><td>Password:</td>
			<td><input type=\"password\" name=\"pass1\" value=\"\"></td>
			</tr>
			<tr>
			<td>Confirm Password</td>
			<td><input type=\"password\" name=\"pass2\" value=\"\"></td>
			</tr>
			</table>
			<input type=\"submit\" name=\"submit\" value=\"Reset Password\">
			</form>";
		}
		break;
	case $op=="" :
	default :
		echo "	<form method=\"post\" action=\"admin.php?op=add\">
		<table summary=\"New user details\">
		<tr><td>Username</td>
		<td><input type=\"text\" name=\"auname\" value=\"\"></td>
		</tr>
		<tr>
		<td>Email</td>
		<td><input type=\"text\" name=\"aemail\" value=\"\"></td>
		</tr>
		<tr>
		<td>Password</td>
		<td><input type=\"password\" name=\"pass1\" value=\"\"></td>
		</tr>
		<tr>
		<td>Confirm Password</td>
		<td><input type=\"password\" name=\"pass2\" value=\"\"></td>
		</tr>
		<tr>
		<td>Permissions</td>
		<td>
		<input type=\"checkbox\" name=\"admin\" value=\"Y\"> Manage Users (Admin)<BR>
		<input type=\"checkbox\" name=\"profile\" value=\"Y\" checked> Manage Profiles<BR>
		<input type=\"checkbox\" name=\"zones\" value=\"Y\" checked> Manage Zones and Servers<BR>
		<input type=\"checkbox\" name=\"nmap\" value=\"Y\" checked> Run Nmap Scans<BR>
		<input type=\"checkbox\" name=\"nessus\" value=\"Y\" checked> Run Nessus Scans<BR>
		<input type=\"checkbox\" name=\"locked\" value=\"Y\" > Account Locked
		</td>
		</tr>
		<tr>
		<td>Account Expiration<br>
		YYYYMMDD</td>
		<td><input type=\"text\" name=\"expire\" value=\"\">
		</td></tr>
		</table>";
		echo "<input type=\"submit\" name=\"submit\" value=\"Add New User\">

		</form>";
		break;
		#	default :
		#break;
		# NOTE: There is something weird happening here.
		# This is theoretically the same logic flow as the old
		# version, but it doesnt allow new users to be added.
		# need to recheck.
		# temp fix was to move the default branch of the switch
	}
}
else {
	echo "Access denied<BR>";
}
include ('footer.php');
?>
