<?php

include('header.php');

include ('permissions.inc.php');

$acl=checkacl("zones", $dbconn);


if ($acl=="Y") {

include ('validateip.inc.php');


if ($item=="delete") {

	if ($op=="delete") {

		$query="delete from nessus_zones where id=$zid";
		$result=$dbconn->execute($query);
		$query="delete from nessus_zone_ranges where zoneid=$zid";
		$result=$dbconn->execute($query);
		echo "Zone has been deleted";


	}
	else {
	$query = "select name, description from nessus_zones where id=$zid";
	$result = $dbconn->execute($query);
	list ($zname, $zdescription) = $result->fields;
	echo "Are you sure you want to remove the following zone?<BR>
	<B>$zname - $zdescription<BR>
	<a href=\"zones.php?item=delete&amp;zid=$zid&amp;op=delete\">Yes</A> <a href=\"zones.php\">No</a>";

	}
}


elseif ($item=="add") {

if ($op=="save") {
	$query="INSERT into nessus_zones (name, description, type, owner) values ('$zonename', '$zonedescription', '$zonetype', '$username')";
	$result=$dbconn->execute($query);

	echo "Zone added<BR>Please click <a href=\"zones.php\">here</a> to go to the main network zones menu.";


}
else {


echo "<b>Add New Network Zone</b><br><form method=\"POST\" action=\"zones.php?item=add&amp;op=save\">
	<table>
	<tr><td>Zone Name:</td>
	<td><input type=\"text\" name=\"zonename\" value=\"\"><td>
	</tr>
	<tr><td>Zone Description:</td>
	<td><input type=\"text\" name=\"zonedescription\" value=\"\"><td>
	</tr>
	<tr><td>Zone Type:</td>
	<td><select name=\"zonetype\">
	<option value=\"G\" selected>Global
	<option value=\"P\">Private
	</select></td>
	</tr></table>
	<input type=\"submit\" name=\"submit\" value=\"Add Zone\">
	</form>";
}


}
elseif ($item=="edit") {

if ($op=="delserver") {
	$query="delete from nessus_server_zones where nessusid=$nid and zoneid=$zid";
	$result=$dbconn->execute($query);

}

if ($op=="delrange") {
		$query="delete from nessus_zone_ranges where id=$netid";
		$result=$dbconn->execute($query);
		$netid="";	
	}

if ($op=="addservers") {

	for ($i = 0; $i < count($nessusservers); $i++) {
	$query="delete from nessus_server_zones where zoneid=$zid and nessusid=$nessusservers[$i]";
	$result=$dbconn->execute($query);
	$query="insert into nessus_server_zones (zoneid, nessusid) values ($zid, $nessusservers[$i])";
	$result=$dbconn->execute($query);

	 }



}


if ($op=="addrange") {
	if (validateip($range_start)==1 and validateip($range_end)==1) {

	if ($netid=="") {
	$query="Insert into  nessus_zone_ranges (zoneid, range_start, range_end) values ($zid, inet_aton('$range_start'), inet_aton('$range_end'))";

	}
	else {
		$query="update nessus_zone_ranges set range_start=inet_aton('$range_start'), range_end=inet_aton('$range_end') where zoneid=$zid and id=$netid";
	$netid="";
	}

	$result=$dbconn->execute($query); 

	}

}


	$query="select name from nessus_zones where owner='$username' and id=$zid";
	$result=$dbconn->execute($query);
	list($zname)=$result->fields;

	echo "<B>$zname Zone Details</b></br><br>";


      $netrange="";

        if ($netid<>"") {
                $query="select inet_ntoa(range_start), inet_ntoa(range_end) from nessus_zone_ranges where zoneid=$zid and id=$netid order by range_start ASC";
                $result=$dbconn->execute($query);
                list($range_start, $range_end)=$result->fields;
		$netedit=$netid;
//              $query="delete from nessus_zone_ranges where id=$netid";
//              $result=$dbconn->execute($query);

        }




	$query="Select t1.id, t1.zoneid, inet_ntoa(t1.range_start), inet_ntoa(t1.range_end) from nessus_zone_ranges as t1, nessus_zones as t2 where t1.zoneid=t2.id and (t2.owner='$username' or t2.type='G') and t1.zoneid=$zid order by t1.range_start";
	$result=$dbconn->Execute($query);



	echo "<table><tr><td valign=\"top\"><B>Zone Network Ranges</b><br>";
	echo "<table border=1><tr><td></td><td></td><td>Network/Range</td></tr>";
	while (!$result->EOF) {
		list ($netid, $zoneid, $drange_start, $drange_end)=$result->fields;
		echo "<tr><td><a href=\"zones.php?item=edit&amp;zid=$zid&amp;netid=$netid&amp;op=netedit\">Edit</a></td>
		<td><a href=\"zones.php?item=edit&amp;op=delrange&amp;netid=$netid&amp;zid=$zid\">Del</a></td>
		<td>$drange_start-$drange_end</td></tr>";
		$result->MoveNext();

	}

	 
	echo "</table></td>
	<td valign=\"top\"><b>Zone Nessus Servers</b></br>";
	$query="select t3.id, t3.name, t3.hostname from nessus_server_zones as t1, nessus_zones as t2, nessus_servers as t3 where t1.nessusid=t3.id and t1.zoneid=t2.id and t2.id=$zid order by t3.name";
	$result=$dbconn->Execute($query);
	echo "<table border=1><tr><td></td><td></td><td>Name</td><td>Hostname</td></tr>";
	while (!$result->EOF) {
		list ($nid, $nname, $nhostname) = $result->fields;
		echo "<tr><td><a href=\"servers.php?item=edit&amp;nid=$nid\">Edit</a></td>
		<td><a href=\"zones.php?item=edit&amp;op=delserver&amp;nid=$nid&amp;zid=$zid\">Del</a></td>
		<td>$nname</td><td>$nhostname</td></tr>";

		$result->MoveNext();
	

	}
	echo "</table></td></tr></table><BR>
	<form method=\"Post\" action=\"zones.php?item=edit&amp;op=addrange&amp;zid=$zid&amp;netid=$netedit\">
	Network Range/IP Address:<br>
	<input type=\"text\" name=\"range_start\" value=\"$range_start\"> - <input type=\"text\" name=\"range_end\" value=\"$range_end\"><br>
	<input type=\"submit\" name=\"submit\" value=\"Add Range\">
	</form>";
	echo "<form method=\"post\" action=\"zones.php?item=edit&amp;op=addservers&amp;zid=$zid\">
	<table>
	<tr>
	<td valign=\"top\">Nessus servers:</td><td> ";
	$query="select id, name, hostname from nessus_servers where type='G' or owner='$username' order by name";
	$result=$dbconn->execute($query);
	echo "<select align=\"top\" name=\"nessusservers[]\" size=\"3\" multiple>";
	while (!$result->EOF) {

		list ($nid, $nname, $nhostname)=$result->fields;
		echo "<option value=\"$nid\">$nname - $nhostname";

		$result->MoveNext();

	}
	echo "</select></td>
	</tr></table>
		<input type=\"submit\" name=\"submit\" value=\"Add servers\">
		</form>";

}

elseif ($item=="editzone") {

	if ($op=="save") {

	$query="update nessus_zones set name='$zname', description='$zdescription' where id=$zid and owner='$username'";
	$result=$dbconn->execute($query);
	echo "Zone - $zname has been updated.</br>Plesa click <a href=\"zones.php\">here</a> to return to the main Network Zones page.";

	}
	else {
	
	$query="select name, description from nessus_zones where owner='$username' and id=$zid";
	$result=$dbconn->execute($query);
//	while (!$result->EOF) {
		list($zname, $zdescription) = $result->fields;
//		$result->MoveNext();
//	}

	echo "<B>Edit Zone</B><br><a href=\"zones.php?item=edit&amp;zid=$zid\">Zone Details</a> <a href=\"zones.php?item=editusers&amp;zid=$zid\">Edit Zone Users</a><br><form method=\"POST\" action=\"zones.php?item=editzone&amp;op=save&amp;zid=$zid\">
	<table>
	<tr><td>Name</td>
	<td><input type=\"text\" name=\"zname\" value=\"$zname\"></td>
	</tr>
	<tr><td>Description</td>
	<td><input type=\"text\" name=\"zdescription\" value=\"$zdescription\"></td>
	</tr>
	</table>
	<input type=\"submit\" name=\"submit\" value=\"Save\">";


	}


}

elseif($item=="editusers") {



	if ($op=="adduser") {
		for ($i = 0; $i < count($zoneusers); $i++) {
        $query="delete from nessus_user_zones where zid=$zid and username='$zoneusers[$i]'";
        $result=$dbconn->execute($query);
        $query="insert into nessus_user_zones (zid, username) values ($zid, '$zoneusers[$i]')";
        $result=$dbconn->execute($query);

         }
	
	}


	if ($op=="delete") {

                $query="delete from nessus_user_zones where id=$uid";
                $result=$dbconn->execute($query);

        }


	$query="select name from nessus_zones where id=$zid and owner='$username'";
	$result=$dbconn->execute($query);
	list($zname)=$result->fields;

	echo "<B>$zname Zone users</B>";

	$query="select id, username from nessus_user_zones where zid=$zid order by username";
	$result=$dbconn->execute($query);

	echo "<table border=1><tr><td>&nbsp;</td><td>User</td></tr>";
	while (!$result->EOF) {
		list($uid, $uname, $uzid)=$result->fields;
		echo "<tr><td><a href=\"zones.php?item=editusers&amp;op=delete&amp;uid=$uid&amp;zid=$zid\">Del</a></td><td>$uname</td></tr>";

		$result->MoveNext();
	}
	echo "</table>";

	$query="select pn_uname from users order by pn_uname";
	$result=$dbconn->execute($query);
	echo "<form method=\"post\" action=\"zones.php?item=editusers&amp;op=adduser&amp;zid=$zid\">";
	echo "<select name=\"zoneusers[]\" size=\"4\" multiple>";
	while (!$result->EOF) {
		list($uname)=$result->fields;
		echo "<option value=\"$uname\"> $uname"; 

		$result->MoveNext();
	}
	echo "</select><br>
		<input type=\"submit\" name=\"submit\" value=\"Add Users\">
		</form>";


}


else {

echo "<B>Network Zones Setup</B><BR>";

$query="SELECT * from nessus_zones where owner='$username' or type='G'";
$result=$dbconn->execute($query);

echo "<table border=1><tr><td></td><td></td><td>Zone Name</td><td>Description</td></tr>";

while (!$result->EOF) {
	list($zoneid, $zonename, $zonedescription, $zonetype, $zoneowner)=$result->fields;
	echo "<tr><td><A href=\"zones.php?item=editzone&amp;zid=$zoneid\">Edit</A></td>
	<td><a href=\"zones.php?item=delete&amp;zid=$zoneid\">Del</a></td>
	<td>$zonename</td><td>$zonedescription</td></tr>";

$result->MoveNext();


}

echo "</table>";

echo "<a href=\"zones.php?item=add\">Add new zone</A>";


}








}
else {
	echo "Access Denied!!!<br>";

}



include ('footer.php');
?>

