<?php

defined('MAXIMUS') or die ('Access denied admin sentinel MAXIMUS directly...');

/** From phpMyAdmin v2.6
 * Gets advanced authentication settings
 *
 * @global  string    the username if register_globals is on
 * @global  string    the password if register_globals is on
 * @global  array     the array of server variables if register_globals is
 *                    off
 * @global  array     the array of environment variables if register_globals
 *                    is off
 * @global  string    the username for the ? server
 * @global  string    the password for the ? server
 * @global  string    the username for the WebSite Professional server
 * @global  string    the password for the WebSite Professional server
 * @global  string    the username of the user who logs out
 *
 * @return  boolean   whether we get authentication settings or not
 *
 * @access  public
 */
function PMA_auth_check() {
  global $PHP_AUTH_USER, $PHP_AUTH_PW;
  global $REMOTE_USER, $AUTH_USER, $REMOTE_PASSWORD, $AUTH_PASSWORD;
  global $HTTP_AUTHORIZATION;

  // Grabs the $PHP_AUTH_USER variable whatever are the values of the
  // 'register_globals' and the 'variables_order' directives
  // loic1 - 2001/25/11: use the new globals arrays defined with php 4.1+
  if (empty($PHP_AUTH_USER)) {
    if (!empty($_SERVER) && isset($_SERVER['PHP_AUTH_USER'])) {
      $PHP_AUTH_USER = $_SERVER['PHP_AUTH_USER'];
    } else if (isset($REMOTE_USER)) {
      $PHP_AUTH_USER = $REMOTE_USER;
    } else if (!empty($_ENV) && isset($_ENV['REMOTE_USER'])) {
      $PHP_AUTH_USER = $_ENV['REMOTE_USER'];
    } else if (@getenv('REMOTE_USER')) {
      $PHP_AUTH_USER = getenv('REMOTE_USER');
    // Fix from Matthias Fichtner for WebSite Professional - Part 1
    } else if (isset($AUTH_USER)) {
      $PHP_AUTH_USER = $AUTH_USER;
    } else if (!empty($_ENV) && isset($_ENV['AUTH_USER'])) {
      $PHP_AUTH_USER = $_ENV['AUTH_USER'];
    } else if (@getenv('AUTH_USER')) {
      $PHP_AUTH_USER = getenv('AUTH_USER');
    }
  }
  // Grabs the $PHP_AUTH_PW variable whatever are the values of the
  // 'register_globals' and the 'variables_order' directives
  // loic1 - 2001/25/11: use the new globals arrays defined with php 4.1+
  if (empty($PHP_AUTH_PW)) {
    if (!empty($_SERVER) && isset($_SERVER['PHP_AUTH_PW'])) {
      $PHP_AUTH_PW = $_SERVER['PHP_AUTH_PW'];
    } else if (isset($REMOTE_PASSWORD)) {
      $PHP_AUTH_PW = $REMOTE_PASSWORD;
    } else if (!empty($_ENV) && isset($_ENV['REMOTE_PASSWORD'])) {
      $PHP_AUTH_PW = $_ENV['REMOTE_PASSWORD'];
    } else if (@getenv('REMOTE_PASSWORD')) {
      $PHP_AUTH_PW = getenv('REMOTE_PASSWORD');
    // Fix from Matthias Fichtner for WebSite Professional - Part 2
    } else if (isset($AUTH_PASSWORD)) {
      $PHP_AUTH_PW = $AUTH_PASSWORD;
    } else if (!empty($_ENV) && isset($_ENV['AUTH_PASSWORD'])) {
      $PHP_AUTH_PW = $_ENV['AUTH_PASSWORD'];
    } else if (@getenv('AUTH_PASSWORD')) {
      $PHP_AUTH_PW = getenv('AUTH_PASSWORD');
    }
  }
  // Gets authenticated user settings with IIS
  if (empty($PHP_AUTH_USER) && empty($PHP_AUTH_PW)
    && function_exists('base64_decode')) {
    if (!empty($HTTP_AUTHORIZATION)
      && substr($HTTP_AUTHORIZATION, 0, 6) == 'Basic ') {
      list($PHP_AUTH_USER, $PHP_AUTH_PW) = explode(':', base64_decode(substr($HTTP_AUTHORIZATION, 6)));
    } else if (!empty($_ENV)
      && isset($_ENV['HTTP_AUTHORIZATION'])
      && substr($_ENV['HTTP_AUTHORIZATION'], 0, 6) == 'Basic ') {
      list($PHP_AUTH_USER, $PHP_AUTH_PW) = explode(':', base64_decode(substr($_ENV['HTTP_AUTHORIZATION'], 6)));
    } else if (@getenv('HTTP_AUTHORIZATION')
      && substr(getenv('HTTP_AUTHORIZATION'), 0, 6) == 'Basic ') {
      list($PHP_AUTH_USER, $PHP_AUTH_PW) = explode(':', base64_decode(substr(getenv('HTTP_AUTHORIZATION'), 6)));
    }
  } // end IIS

  // Returns whether we get authentication settings or not
  if (empty($PHP_AUTH_USER)) {
    return FALSE;
  } else {
    if (get_magic_quotes_runtime()) {
      $PHP_AUTH_USER = stripslashes($PHP_AUTH_USER);
      $PHP_AUTH_PW = stripslashes($PHP_AUTH_PW);
    }
    return TRUE;
  }
} // end of the 'PMA_auth_check()' function
/*********************************************************************************************/
/* HTTP Auth code for ".$admin_file.".php protection.  Tried to make it a function call      */
/* but there are too many variables that would have to be globalized.                        */
/* Copyright 2004(c) Raven                                                                   */
/*********************************************************************************************/
if(ini_get("register_globals")) {
  $sapi_name = strtolower(php_sapi_name());
  $apass = $GLOBALS['db']->sql_numrows($GLOBALS['db']->sql_query("SELECT * FROM `".TABLE_NSNST_ADMINS."` WHERE `password_md5`=''"));
  if($apass > 0 AND $ab_config['http_auth'] == 1) {
  if (is_file('admin/modules/nukesentinel/functions.php')) {
    include_once('admin/modules/nukesentinel/functions.php');}
    absave_config("http_auth",'0');
  }
  if($ab_config['http_auth'] == 1 AND strpos($sapi_name,"cgi")===FALSE) {
    if (basename($_SERVER['PHP_SELF'], '.php')==$admin_file) {
      $allowPassageToAdmin = FALSE;
      $authresult = $GLOBALS['db']->sql_query("SELECT `login`, `password_md5` FROM `".TABLE_NSNST_ADMINS."`");
      while ($getauth = $GLOBALS['db']->sql_fetchrow($authresult)) {
        if ($PHP_AUTH_USER==$getauth['login'] AND md5($PHP_AUTH_PW)==trim($getauth['password_md5'])) {
          $allowPassageToAdmin = TRUE;
          break;
        }
      }
      if (!$allowPassageToAdmin) {
        header("WWW-Authenticate: Basic realm=Protected");
        header("HTTP/1.0 401 Unauthorized");
        die(_AB_GETOUT);
      }
    }
  }
}