Avans/InternetRadio-Website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Store in GIT

Browse Source
This commit is contained in:
kennyboy55
2026-06-17 15:46:26 +02:00
parent 47150cc7ca
commit 876ad89e72
134 changed files with 31034 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manage/php/device/alarm_add.php
+35
View File
@@ -0,0 +1,35 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$name = $_POST['name'];
$time = $_POST['time'];
$stream = $_POST['stream'];
//Check if stream is allowed
$sql = "SELECT `name` FROM `stream` WHERE `dev_id`=$deviceid AND `id`=$stream";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("alarms", "You are not allowed to use that stream");
}
//Remove seconds
$time = substr($time, 0, 5);
//Check time
if(!preg_match("/(2[0-3]|[01][0-9]):([0-5][0-9])/", $time))
{
error("alarms", "Invalid time");
}
$time .= ":00";
//Add alarm
$sql = "INSERT INTO `alarm` (`dev_id`, `name`, `time`, `stream`) VALUES ($deviceid, '$name', '$time', $stream)";
ExecQuery($mysqli, $sql);
success("alarms", "The alarm has been added");
?>
manage/php/device/alarm_delete.php
+22
View File
@@ -0,0 +1,22 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$alarm = $_POST['id'];
//Check if user is allowed to delete
$sql = "SELECT `id` FROM `alarm` WHERE `dev_id`=$deviceid AND `id`=$alarm";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("alarms", "You are not allowed to delete that alarm");
}
//Delete alarm
$sql = "DELETE FROM `alarm` WHERE `id`=$alarm";
ExecQuery($mysqli, $sql);
success("alarms", "The alarm has been deleted");
?>
manage/php/device/alarm_edit.php
+45
View File
@@ -0,0 +1,45 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$alarm = $_POST['id'];
$name = $_POST['name'];
$time = $_POST['time'];
$stream = $_POST['stream'];
//Check if alarms editing is allowed
$sql = "SELECT `name` FROM `alarm` WHERE `dev_id`=$deviceid AND `id`=$alarm";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("alarms", "You are not allowed to edit that alarm");
}
//Check if stream is allowed
$sql = "SELECT `name` FROM `stream` WHERE `dev_id`=$deviceid AND `id`=$stream";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("alarms", "You are not allowed to use that stream");
}
//Remove seconds
$time = substr($time, 0, 5);
//Check time
if(!preg_match("/(2[0-3]|[01][0-9]):([0-5][0-9])/", $time))
{
error("alarms", "Invalid time");
}
$time .= ":00";
//Add alarm
$sql = "UPDATE `alarm` SET `name`='$name', `time`='$time', `stream`=$stream WHERE `id`=$alarm";
ExecQuery($mysqli, $sql);
success("alarms", "The alarm has been updated");
?>
manage/php/device/device_add.php
+35
View File
@@ -0,0 +1,35 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$device = $_POST['device'];
//Validate Device ID
if(strlen($device) != 6)
{
error("devices", "Device ID invalid");
}
$sql = "SELECT `id` FROM `device` WHERE `dev_id`='" . $device . "' AND `user`=0";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("devices", "Device ID invalid");
}
$code = $email . "~" . $device . "~";
$code .= RandomString(96 - strlen($code));
$code = str_rot13($code);
$sql = "UPDATE user SET `code`='$code' WHERE `id`=$userid";
ExecQuery($mysqli, $sql);
$msg = "Hello " . $username . ",\n\n";
$msg .= "Please verify your new device by clicking the link below.\n";
$msg .= "<a href='http://lipa.kvewijk.nl/manage/php/session/verify.php?code=" . urlencode($code) . "'>Verify</a>";
sendMail($email, "Verify Device", $msg);
success("devices", "An email has been sent to " . $email . " for verification");
?>
manage/php/device/device_edit.php
+25
View File
@@ -0,0 +1,25 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$device = $_POST['device'];
$name = $_POST['name'];
$location = $_POST['location'];
$description = $_POST['description'];
//Check if allowed to edit
$sql = "SELECT `id` FROM `device` WHERE `dev_id`='$device' AND `user`=$userid";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("devices", "You are not allowed to edit that device");
}
//Update the device
$sql = "UPDATE `device` SET `name`='$name', `location`='$location', `description`='$description' WHERE `dev_id`='$device'";
ExecQuery($mysqli, $sql);
success("devices", "The device has been updated");
?>
manage/php/device/device_select.php
+24
View File
@@ -0,0 +1,24 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$device = $_GET['id'];
//Check if user has access to device
$sql = "SELECT `id` FROM `device` WHERE `user`=$userid AND `dev_id`='$device'";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("devices", "You cannot select that device");
}
$result = $query->fetch_assoc();
$id = $result['id'];
//Select device
$sql = "UPDATE `session` SET `dev_id`=$id WHERE `id`=$sessionid";
ExecQuery($mysqli, $sql);
success("devices", "Device selection has changed to " . $device);
?>
manage/php/device/schedule_add.php
+48
View File
@@ -0,0 +1,48 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$name = $_POST['name'];
$time = $_POST['time'];
$duration = $_POST['duration'];
$stream = $_POST['stream'];
//Check if stream is allowed
$sql = "SELECT `name` FROM `stream` WHERE `dev_id`=$deviceid AND `id`=$stream";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("schedules", "You are not allowed to use that stream");
}
//Remove seconds
$time = substr($time, 0, 5);
//Check time
if(!preg_match("/(2[0-3]|[01][0-9]):([0-5][0-9])/", $time))
{
error("schedules", "Invalid time");
}
$time .= ":00";
//Remove seconds
$duration = substr($duration, 0, 5);
//Check duration
if(!preg_match("/(2[0-3]|[01][0-9]):([0-5][0-9])/", $duration))
{
error("schedules", "Invalid duration");
}
$duration .= ":00";
//Add alarm
$sql = "INSERT INTO `schedule` (`dev_id`, `name`, `time`, `duration`, `stream`) VALUES ($deviceid, '$name', '$time', '$duration', $stream)";
ExecQuery($mysqli, $sql);
success("schedules", "The schedule has been added");
?>
manage/php/device/schedule_delete.php
+22
View File
@@ -0,0 +1,22 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$schedule = $_POST['id'];
//Check if user is allowed to delete
$sql = "SELECT `id` FROM `schedule` WHERE `dev_id`=$deviceid AND `id`=$schedule";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("schedules", "You are not allowed to delete that schedule");
}
//Delete schedule
$sql = "DELETE FROM `schedule` WHERE `id`=$schedule";
ExecQuery($mysqli, $sql);
success("schedules", "The schedule has been deleted");
?>
manage/php/device/schedule_edit.php
+58
View File
@@ -0,0 +1,58 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$schedule = $_POST['id'];
$name = $_POST['name'];
$time = $_POST['time'];
$duration = $_POST['duration'];
$stream = $_POST['stream'];
//Check if alarms editing is allowed
$sql = "SELECT `name` FROM `schedule` WHERE `dev_id`=$deviceid AND `id`=$schedule";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("schedules", "You are not allowed to edit that schedule");
}
//Check if stream is allowed
$sql = "SELECT `name` FROM `stream` WHERE `dev_id`=$deviceid AND `id`=$stream";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("schedules", "You are not allowed to use that stream");
}
//Remove seconds
$time = substr($time, 0, 5);
//Check time
if(!preg_match("/(2[0-3]|[01][0-9]):([0-5][0-9])/", $time))
{
error("schedules", "Invalid time");
}
$time .= ":00";
//Remove seconds
$duration = substr($duration, 0, 5);
//Check duration
if(!preg_match("/(2[0-3]|[01][0-9]):([0-5][0-9])/", $duration))
{
error("schedules", "Invalid duration");
}
$duration .= ":00";
//Add alarm
$sql = "UPDATE `schedule` SET `name`='$name', `time`='$time', `duration`='$duration', `stream`=$stream WHERE `id`=$schedule";
ExecQuery($mysqli, $sql);
success("schedules", "The schedule has been updated");
?>
manage/php/device/stream_add.php
+31
View File
@@ -0,0 +1,31 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
require("stream_verify.php");
$name = $_POST['name'];
$ip = $_POST['ip'];
$port = $_POST['port'];
$path = $_POST['path'];
//Fix input
$ip = rtrim($ip, "/");
$ip = ltrim($ip, "http://");
$ip = ltrim($ip, "https://");
$path = ltrim($path, "/");
//Check if stream is valid
$resp = stream_verify($ip, $port, $path);
if($resp === false)
{
error("streams", "Invalid stream");
}
$ip = $resp;
//Add stream
$sql = "INSERT INTO `stream` (`dev_id`, `name`, `ip`, `port`, `path`) VALUES ($deviceid, '$name', '$ip', '$port', '$path')";
ExecQuery($mysqli, $sql);
success("streams", "The stream has been added");
?>
manage/php/device/stream_delete.php
+22
View File
@@ -0,0 +1,22 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
$stream = $_POST['id'];
//Check if user is allowed to delete
$sql = "SELECT `id` FROM `stream` WHERE `dev_id`=$deviceid AND `id`=$stream";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("streams", "You are not allowed to delete that stream");
}
//Delete stream
$sql = "DELETE FROM `stream` WHERE `id`=$stream";
ExecQuery($mysqli, $sql);
success("streams", "The stream has been deleted");
?>
manage/php/device/stream_edit.php
+41
View File
@@ -0,0 +1,41 @@
<?php
require("../../../inc/connect.php");
require("../../../inc/session.php");
require("stream_verify.php");
$stream = $_POST['id'];
$name = $_POST['name'];
$ip = $_POST['ip'];
$port = $_POST['port'];
$path = $_POST['path'];
//Check if stream editing is allowed
$sql = "SELECT `name` FROM `stream` WHERE `dev_id`=$deviceid AND `id`=$stream";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("streams", "You are not allowed to edit that stream");
}
//Fix input
$ip = rtrim($ip, "/");
$ip = ltrim($ip, "http://");
$ip = ltrim($ip, "https://");
$path = ltrim($path, "/");
//Check if stream is valid
$resp = stream_verify($ip, $port, $path);
if($resp === false)
{
error("streams", "Invalid stream");
}
$ip = $resp;
//Update stream
$sql = "UPDATE `stream` SET `name`='$name', `ip`='$ip', `port`='$port', `path`='$path' WHERE `id`=$stream";
ExecQuery($mysqli, $sql);
success("streams", "The stream has been updated");
?>
manage/php/device/stream_verify.php
+57
View File
@@ -0,0 +1,57 @@
<?php
function stream_verify($ip, $port, $path)
{
if(filter_var($ip, FILTER_VALIDATE_IP) === false) {
$temp = getAddresses_www( $ip);
if(count($temp) == 0)
return false;
else
$ip = $temp[0];
}
$response = get_headers("http://" . $ip . ":" . $port . "/" . $path);
if(get_http_response_code($response) != 200 && !if_http_audio($response))
{
return false;
}
else
{
return $ip;
}
}
function get_http_response_code($headers) {
return substr($headers[0], 9, 3);
}
function if_http_audio($headers) {
$type = substr($headers[3], 14);
$arr = explode("/", $type);
return $arr[0] == "audio";
}
function getAddresses($domain) {
$records = dns_get_record($domain);
$res = array();
foreach ($records as $r) {
if ($r['host'] != $domain) continue; // glue entry
if (!isset($r['type'])) continue; // DNSSec
if ($r['type'] == 'A') $res[] = $r['ip'];
if ($r['type'] == 'AAAA') $res[] = $r['ipv6'];
}
return $res;
}
function getAddresses_www($domain) {
$res = getAddresses($domain);
if (count($res) == 0) {
$res = getAddresses('www.' . $domain);
}
return $res;
}
?>
manage/php/session/change_password.php
+49
View File
@@ -0,0 +1,49 @@
<?php
//Load required scripts
require('../../../inc/connect.php');
require('../../../inc/session.php');
require('../../../inc/crypt.php');
//Get username and password
$password_current = $_POST['password_current'];
$password1 = $_POST['password1'];
$password2 = $_POST['password2'];
$sql = "SELECT `password` FROM `user` WHERE `id`=$userid";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("account", "An error occured");
}
$result = $query->fetch_assoc();
$password_hash = $result['password'];
if(!password_verify($password_current, $password_hash))
{
error("account", "Your current password is incorrect");
}
if($password_current == $password1)
{
error("account", "Your current password does not differ from the new password");
}
if($password1 != $password2)
{
error("account", "Your new passwords do not match");
}
//Logout everywhere else
$sql = "DELETE FROM `session` WHERE `user`=$userid AND `id`<>$sessionid";
ExecQuery($mysqli, $sql);
//Change password
$password_hash = password_hash($password1, PASSWORD_BCRYPT);
$sql = "UPDATE `user` SET `password`='$password_hash' WHERE `id`=$userid";
ExecQuery($mysqli, $sql);
success("account", "Your password has been changed");
?>
manage/php/session/forgot.php
+38
View File
@@ -0,0 +1,38 @@
<?php
//Load required scripts
require('../../../inc/connect.php');
require('../../../inc/crypt.php');
//Get username and password
$email = $_POST['email'];
$sql = "SELECT `id`, `username` FROM `user` WHERE `email`='$email'";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("login", "No account found with that email address");
}
$result = $query->fetch_assoc();
$username = $result['username'];
$id = $result['id'];
$password = RandomString(8);
$password_hash = password_hash($password, PASSWORD_BCRYPT);
$sql = "UPDATE `user` SET `password`='$password_hash' WHERE `id`=$id";
ExecQuery($mysqli, $sql);
//Logout everywhere else
$sql = "DELETE FROM `session` WHERE `user`=$id";
ExecQuery($mysqli, $sql);
$msg = "Dear $username,\n\n";
$msg .= "Your password has been reset.\nEvery active session has been logged out.\n";
$msg .= "New password: <b>" . $password . "</b>";
sendMail($email, "Password reset", $msg);
success("login", "Your password has been reset, an email has been sent to " . $email);
?>
manage/php/session/login.php
+67
View File
@@ -0,0 +1,67 @@
<?php
//Load required scripts
require('../../../inc/connect.php');
require('../../../inc/crypt.php');
//Get username and password
$username = $_POST['username'];
$password = $_POST['password'];
$remember = isset($_POST['remember']) ? $_POST['remember'] : 0;
//Check if user exists
$sql = "SELECT `id`, `password`, `verified` FROM `user` WHERE `username`='" . $username . "'";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1){
logout("Username or password incorrect");
}
else
{
//Check if password is correct
$result = $query->fetch_assoc();
$verified = $result['verified'];
$password_hash = $result['password'];
if(!password_verify($password, $password_hash)){
logout("Username or password incorrect");
}
else if($verified == 0)
{
logout('Your email has not yet been verified');
}
else
{
//Get user ID, IP
$id = $result['id'];
$ip = $_SERVER['REMOTE_ADDR'];
//Set default device
$sql = "SELECT `id` FROM `device` WHERE `user`=$id LIMIT 0,1";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
$deviceid = 0;
}
else
{
$result = $query->fetch_assoc();
$deviceid = $result['id'];
}
$sessionid = RandomString(60);
//Update Session ID, Last Login, IP in database
$sql = "INSERT INTO session (`user`, `session`, `time`, `remember`, `ip`, `dev_id`, `dev_type`) VALUES ($id, '$sessionid', NOW(), $remember, '$ip', $deviceid, 'Browser')";
ExecQuery($mysqli, $sql);
//Set Session ID
setSession($sessionid);
//Reroute user to dashboard
success("devices", "You have succesfully logged in.");
}
}
?>
manage/php/session/logout.php
+18
View File
@@ -0,0 +1,18 @@
<?php
require('../../../inc/connect.php');
$error = isset($_GET['error']) ? $_GET['error'] : 'You have succesfully logged out';
if(isSession())
{
$sessionid = getSession();
$sql = "DELETE FROM session WHERE `session`='" . $sessionid . "'";
ExecQuery($mysqli, $sql);
destroySession();
}
$link = ROOT . "login?error=" . $error;
header("Location: $link");
?>
manage/php/session/logout_session.php
+27
View File
@@ -0,0 +1,27 @@
<?php
require('../../../inc/connect.php');
require('../../../inc/session.php');
$id = $_POST['id'];
//Check if user owns session
$sql = "SELECT `id` FROM `session` WHERE `user`=$userid AND `id`=$id";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("account", "You cannot manage that session");
}
//Check if it is not a remembered session
if($remember == 1)
{
error("account", "You cannot manage your sessions from a remembered login");
}
//Delete session
$sql = "DELETE FROM `session` WHERE `id`=$id";
ExecQuery($mysqli, $sql);
success("account", "The session has been logged out");
?>
manage/php/session/register.php
+69
View File
@@ -0,0 +1,69 @@
<?php
require('../../../inc/connect.php');
require('../../../inc/crypt.php');
$username = $_POST['username'];
$email = $_POST['email'];
$password1 = $_POST['password1'];
$password2 = $_POST['password2'];
$device = $_POST['device'];
//Validate Device ID
if(strlen($device) != 6)
{
error("login", "Device ID invalid");
}
$sql = "SELECT `id` FROM `device` WHERE `dev_id`='" . $device . "' AND `user`=0";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("login", "Device ID invalid");
}
//Validate email
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
error("login", "Invalid email address");
}
$sql = "SELECT `id` FROM `user` WHERE `email`='" . $email . "' AND verified=1";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows >= 1)
{
error("login", "Email address is already in use.");
}
//Validate username
$sql = "SELECT `id` FROM `user` WHERE `username`='" . $username . "'";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows >= 1)
{
error("login", "Username is already in use.");
}
//Validate password
if($password1 != $password2)
{
error("login", "Passwords do not match");
}
$password_hash = password_hash($password1, PASSWORD_BCRYPT);
$code = $email . "~" . $device . "~";
$code .= RandomString(96 - strlen($code));
$code = str_rot13($code);
$sql = "INSERT INTO user (`username`, `password`, `email`, `code`) VALUES ('$username', '$password_hash', '$email', '$code')";
ExecQuery($mysqli, $sql);
$msg = "Hello " . $username . ",\n\n";
$msg .= "Please verify your LiPaccount by clicking the link below.\n";
$msg .= "<a href='http://lipa.kvewijk.nl/manage/php/session/verify.php?code=" . urlencode($code) . "'>Verify</a>";
sendMail($email, "Verify LiPaccount", $msg);
success("login", "An email has been sent to " . $email . " for verification");
?>
manage/php/session/verify.php
+63
View File
@@ -0,0 +1,63 @@
<?php
require('../../../inc/connect.php');
//Decode code
$code = urldecode($_GET['code']);
$temp = str_rot13($code) or die(error("login", "An error occured"));
$spl = explode("~", $temp);
$email = $spl[0];
$device = $spl[1];
//Validate
if(strlen($device) != 6 || !filter_var($email, FILTER_VALIDATE_EMAIL))
{
error("login", "An error occured");
}
//Check if device id already bound -> delete account
$sql = "SELECT `id` FROM device WHERE `dev_id`='$device' AND `user`=0";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
//Check if email already verified
$sql = "SELECT `id` FROM user WHERE `email`='$email' AND `verified`=1";
$query = ExecQuery($mysqli, $sql);
$str = "";
if($query->num_rows < 1)
{
$sql = "DELETE FROM user WHERE `email`='$email' AND `code`='$code'";
ExecQuery($mysqli, $sql);
$str = ", account registration has been cancelled";
}
error("login", "This device has already been bound to an account" . $str);
}
//Check if email matches code to verify integrity
$sql = "SELECT `id` FROM user WHERE `email`='$email' AND `code`='$code'";
$query = ExecQuery($mysqli, $sql);
if($query->num_rows < 1)
{
error("login", "Verification failed");
}
$uid = $query->fetch_assoc()['id'];
//Account has passed all the checks, verify
$sql = "UPDATE user SET `verified`=1, `code`='' WHERE `id`=$uid";
ExecQuery($mysqli, $sql);
$sql = "UPDATE device SET `user`=$uid WHERE `dev_id`='$device'";
ExecQuery($mysqli, $sql);
success("login", "The verification has succeeded");
?>