<?php

include ('header.php');


echo "<b>Vulnerability Trend Analysis</b><br>";


if ($submit=="Submit") {

//Check variables



        
	$msg1="All";
	$msg2="All";
	$msg3="All";
	$msg4="All";


	if ($type=="1") {
                $img="<img src=\"graph3.php?";
        }
        elseif ($type=="2") {
                $img="<img src=\"graph2.php?";
        }
	else {
		die("Incorrect parameter");
	}
        if ($schedule<>"") {
		if(!is_numeric($schedule)) {die("Incorrect parameter");}
		$query="select count(id) from nessus_schedule where username='$username' and id=$schedule";
		$result=$dbconn->execute($query);
		list($allowaccess)=$result->fields;
		if ($allowaccess<>1) {die("Incorrect parameter");}
                $img.="&amp;schedule=$schedule";
		$msg2="$schedule";
        }
        if ($sid<>"") {
		if(!is_numeric($sid)) {die("Incorrect parameter");}
		$query="select count(nessus_settings.id) from nessus_settings inner join nessus_settings_users on nessus_settings.id=nessus_settings_users.sid where nessus_settings_users.username='$username' and nessus_settings.id=$sid";
		$result=$dbconn->execute($query);
		list($allowaccess)=$result->fields;
		if ($allowaccess<>1) {die("Incorrect parameter");}
                $img.="&amp;sid=$sid";
		$msg3=$sid;
        }
        if ($days<>"") {
		if(!is_numeric($days) or $days<0) {die("Incorrect parameter");}
                $img.="&amp;days=$days";
		$msg4=$days;
        }
	if ($risk<>"") {
		if(!is_numeric($risk)) {die("Incorrect parameter");}
		if($risk<1 or $risk>7) {die("Incorrect parameter");}
		$img.="&amp;rrisk=$risk";
	}
	if ($ip<>"") {
                $ip=htmlspecialchars($ip);
                $ip=mysql_escape_string($ip);
		include ('validateip.inc.php');
		if (!inrange($ip, $dbconn)) {die("Incorrect parameter");}
                $img.="&amp;ip=$ip";
                $msg1=$ip;
        }


        $img.="\">";
        echo "<br>Host - $msg1<br>Days - $msg4<br>$img<br>";
}




	echo"	<form method=\"post\" action=\"trend.php\">

	<table border=1 bordercolor=\"#6797BF\" cellspacing=\"0\" cellpadding=\"0\" style=\"border-collapse: collapse\"><tr><td><b>Host</b></td><td><b>Schedule</b></td><td><b>Profile</b></td><td><b>Days</b></td><td><b>Risk</b></td><td><b>Analysis Type</b></td></tr>";

	echo "<tr><td><select name=\"ip\">
		<option value=\"\">All";

	$query="SELECT distinct host from nessus_results where username='$username' and falsepositive<>'Y' and scriptid <> 10180 and msg<>'' order by inet_aton(host)";

	$result=$dbconn->execute($query);

	while(!$result->EOF) {
		list($opt)=$result->fields;
		echo "<option value=\"$opt\"";
		if($opt==$ip) {echo " selected";}
		echo ">$opt";
		$result->MoveNext();
	}	
	echo "</select></td>
		<td><select name=\"schedule\">
		<option value=\"\">All";
	$query="SELECT name, id from nessus_schedule where username='$username' order by name";
	$result=$dbconn->execute($query);
	while(!$result->EOF) {
		list($scname, $scid)=$result->fields;
		echo "<option value=\"$scid\"";
		if ($scid==$schedule) {echo" selected";}
		echo ">$scname";
		$result->MoveNext();
	}
	echo "</select></td>
	<td><select name=\"sid\">
	<option value=\"\">All";
	$query="SELECT t1.id, t1.name from nessus_settings t1, nessus_settings_users t2 where t1.id=t2.sid and t2.username='$username' order by t1.name";
	$result=$dbconn->execute($query);
	while(!$result->EOF){
		list($prid, $prname)=$result->fields;
		echo "<option value=\"$prid\"";
		if($prid==$sid) {echo" selected";}
		echo ">$prname";
		$result->MoveNext();
	}
	echo "</select></td>
	<td><select name=\"days\">
	<option value=\"\">All";
	echo "<option value=\"2\"";if($days==2) {echo " selected";} echo ">2 Days";
	echo "<option value=\"7\"";if($days==7) {echo " selected";} echo ">7 Days";
	echo "<option value=\"10\"";if($days==10) {echo " selected";} echo ">10 Days";
	echo "<option value=\"14\"";if($days==14) {echo " selected";} echo ">14 Days";
	echo "<option value=\"30\"";if($days==30) {echo " selected";} echo ">30 Days";
	echo "<option value=\"90\"";if($days==90) {echo " selected";} echo ">90 Days";
	echo "<option value=\"180\"";if($days==180) {echo " selected";} echo ">180 Days";
	echo "<option value=\"365\"";if($days==365) {echo " selected";} echo ">365 Days";
	echo "</select></td>
	<td><select name=\"risk\">
	<option value=\"\">All";
	$query="select id, description from risk_level order by id";
	$result=$dbconn->execute($query);
	while(!$result->EOF){
		list($rid, $rname)=$result->fields;
		echo "<option value=\"$rid\"";
		if($rid==$risk) {echo " selected";}
		echo ">$rname";
		$result->MoveNext();
	}
	echo "</select></td>
	<td><select name=\"type\">
	<option value=\"1\"";if($type==1) {echo " selected";} echo ">By Scan
	<option value=\"2\"";if($type==2) {echo " selected";} echo ">By Date
	</select></td></tr></table>
	<input type=\"submit\" name=\"submit\" value=\"Submit\">
	</form>";	




include ('footer.php');

?>
