diff --git a/.github/workflows/pr_notification.yml b/.github/workflows/pr_notification.yml
deleted file mode 100644
index de44c8b..0000000
--- a/.github/workflows/pr_notification.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Pull Request Notification
-
-on:
- pull_request_target:
- types:
- - opened
-
-jobs:
- notify:
- uses: KeyAuth/.github/.github/workflows/pr_notification_global.yml@main
- secrets:
- DISCORD_PR: ${{ secrets.DISCORD_PR }}
diff --git a/.gitignore b/.gitignore
index ea9cf22..02e9551 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,45 +1,55 @@
# Nelson Cybersecurity LLC
# keyauth.cc
-
# private
api/admin/
+
+# private
api/discord/
+
+# private
api/upgrade/
+
+# private
api/status/
-api/dashboard/
-app/pages/admin-panel.php
-app/pages/upgrade.php
-app/pages/support.php
-changeEmail/
-changeUsername/
-deleteAccount/
-forgot/
-owner/
-paddle/
-purge-redis/
-reset/
-resetUser/
-whoami/
-vendor/
-login/accShare/
-login/emailVerify/
-sitemap.xml
-includes/credentials.php
-includes/redis.php
-app/pages/application-functions.php
-app/pages/application-prompts.php
-app/pages/bug-bounty.php
-app/pages/forms.php
-app/pages/staff-panel.php
# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
api/reseller/
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
api/seller/
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
panel/
+
+#private
+app/pages/admin-panel.php
+
+#private
+app/pages/upgrade.php
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
app/pages/manage-accs.php
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
app/pages/reseller-balance.php
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
app/pages/reseller-licenses.php
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
app/pages/reseller-users.php
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
app/pages/seller-settings.php
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
app/pages/seller-logs.php
+
+# purchase KeyAuth enterprise for these files https://shop.keyauth.cc/product/6361c20e415e9
app/pages/webloader.php
+
+# contains MySQL credentials, discord webhooks, and API keys
+includes/connection.php
+
+# contains Redis password
+/includes/redis.php
\ No newline at end of file
diff --git a/README.md b/README.md
index 6a8df11..179b8c1 100644
--- a/README.md
+++ b/README.md
@@ -1,23 +1,19 @@
-# KeyAuth Source Code -> Please star :star2:
-
-> [!WARNING]
-> AS OF JANUARY 29th, 2024 - THIS REPOSITORY IS NO LONGER BEING UPDATED!
-
-[KeyAuth](https://keyauth.win) is an open source authentication system with [cloud-hosted subscriptions](https://keyauth.win/app/?page=upgrade) available as well.
+# KeyAuth-Source-Code
+KeyAuth is an open source authentication system with cloud-hosted subscriptions available aswell https://keyauth.cc
*You're not allowed to sell KeyAuth. source made avaliable only for you to use*
-To submit a suggestion or a bug, please go to https://keyauth.cc/app/?page=forms and submit a form!
+View #suggestions and #bugs channel in Discord server if you want to suggest new feature or submit bug https://discord.gg/keyauth
[](https://www.codefactor.io/repository/github/keyauth/keyauth-source-code)
-[](https://t.me/KeyAuth)
+[](https://discord.com/invite/keyauth)
[](https://twitter.com/KeyAuth)
-[](https://keyauth.cc)
+[](https://keyauth.cc)
## Bugs ##
-If the default example that isn't added to your software isn't functioning how it should, please go to https://keyauth.cc/app/?page=forms and submit a bug report in the `Report a Bug` modal.
+If the default example not added to your software isn't functioning how it should, please join the Discord server https://discord.gg/keyauth and submit the issue in the `#bugs` channel.
However, we do **NOT** provide support for adding KeyAuth to your project. If you can't figure this out you should use Google or YouTube to learn more about the programming language you want to sell a program in.
@@ -46,12 +42,12 @@ Thank you for your compliance, we work hard on the development of KeyAuth and do
- Redis
- PHP
-No setup support given to non-enterprise users. However for $79.99 you can purchase access to the source code of paid features (developer and seller plan features), setup support 1-on-1 with the owner of KeyAuth, and a tutorial video on how to host KeyAuth for 100% free forever (good preformance & secure also)
+No setup support given to non-enterprise users. However for $79.99 you can purchase access to the source code of paid features (developer and seller plan features), setup support one-on-one with the Founder of KeyAuth, and a tutorial video on how to host KeyAuth for 100% free forever (good preformance & secure also)
-Purchase enterprise today --> https://keyauth.win/app/?page=upgrade
+Purchase enterprise today --> https://shop.keyauth.cc/product/6361c20e415e9
-## Updates ##
+Some pages such as the API endpoint that upgrades users after they purchase a subscription have been omitted to prevent violation of the license (No Commercial Access Allowed)
-https://keyauth.canny.io/changelog
+## Updates ##
-Looking for a Discord bot made by the KeyAuth & RestoreCord founder that you can use to backup your Discord members, server settings, and messages? Go to https://vaultcord.com
+https://headwayapp.co/keyauth-changelog/
diff --git a/api/1.0/index.php b/api/1.0/index.php
index 7c56d9a..72422c4 100644
--- a/api/1.0/index.php
+++ b/api/1.0/index.php
@@ -1,37 +1,19 @@
getMessage());
- die(json_encode(array("success" => false, "message" => "Error: " . $errorMsg)));
-});
-
-if(empty($_POST['ownerid'])) {
- die(json_encode(array("success" => false, "message" => "No OwnerID specified. Select app & copy code snippet from https://keyauth.cc/app/")));
-}
-
-if(empty($_POST['name'])) {
- die(json_encode(array("success" => false, "message" => "No app name specified. Select app & copy code snippet from https://keyauth.cc/app/")));
-}
-
-if(strlen(hex2bin($_POST['ownerid'])) != 10) {
- die(json_encode(array("success" => false, "message" => "OwnerID should be 10 characters long. Select app & copy code snippet from https://keyauth.cc/app/")));
+if (isset($_SERVER['HTTP_CDN_HOST'])) { // custom domains https://www.youtube.com/watch?v=a2SROFJ0eYc
+ $row = misc\cache\fetch('KeyAuthApp:' . misc\etc\sanitize($_SERVER['HTTP_CDN_HOST']), "SELECT * FROM `apps` WHERE `customDomainAPI` = '" . misc\etc\sanitize($_SERVER['HTTP_CDN_HOST']) . "'", 0);
+} else {
+ $ownerid = misc\etc\sanitize(hex2bin($_POST['ownerid'])); // ownerid of account that owns application
+ $name = misc\etc\sanitize(hex2bin($_POST['name'])); // application name
+ $row = misc\cache\fetch('KeyAuthApp:' . $name . ':' . $ownerid, "SELECT * FROM `apps` WHERE `ownerid` = '$ownerid' AND `name` = '$name'", 0);
}
-$ownerid = misc\etc\sanitize(hex2bin($_POST['ownerid'])); // ownerid of account that owns application
-$name = misc\etc\sanitize(hex2bin($_POST['name'])); // application name
-$row = misc\cache\fetch('KeyAuthApp:' . $name . ':' . $ownerid, "SELECT * FROM `apps` WHERE `ownerid` = ? AND `name` = ?", [$ownerid, $name], 0);
-
if ($row == "not_found") {
die("KeyAuth_Invalid");
}
@@ -48,8 +30,6 @@
$appdisabled = $row['appdisabled'];
$hashcheck = $row['hashcheck'];
$serverhash = $row['hash'];
-$sessionexpiry = $row['session'];
-$forceHwid = $row['forceHwid'];
$banned = $row['banned'];
$owner = $row['owner'];
@@ -66,11 +46,14 @@
$noactivesubs = $row['noactivesubs'];
$hwidblacked = $row['hwidblacked'];
$pausedsub = $row['pausedsub'];
+$keyexpired = $row['keyexpired'];
$vpnblocked = $row['vpnblocked'];
$keybanned = $row['keybanned'];
$userbanned = $row['userbanned'];
$sessionunauthed = $row['sessionunauthed'];
$hashcheckfail = $row['hashcheckfail'];
+$sessionexpiry = $row['session'];
+$killOtherSessions = $row['killOtherSessions'];
// why using null coalescing operators? because if I add a field and it's not in redis cache, it'll be NULL
$loggedInMsg = $row['loggedInMsg'] ?? "Logged in!";
@@ -78,8 +61,7 @@
$unTooShort = $row['unTooShort'] ?? "Username too short, try longer one.";
$pwLeaked = $row['pwLeaked'] ?? "This password has been leaked in a data breach (not from us), please use a different one.";
$chatHitDelay = $row['chatHitDelay'] ?? "Chat slower, you've hit the delay limit";
-$minHwid = $row['minHwid'] ?? 20;
-
+
if ($banned) {
die(api\v1_0\Encrypt(json_encode(array(
"success" => false,
@@ -87,25 +69,18 @@
)), $secret));
}
-if ($_GET['host'] == "keyauth.business") {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Please tell the developer of this program to use latest API domain. This domain is old, it will expire in a month."
- )), $secret));
-}
-
switch (hex2bin($_POST['type'])) {
case 'init':
$ip = api\shared\primary\getIp();
if ($vpnblock) {
if (api\shared\primary\vpnCheck($ip)) {
- $row = misc\cache\fetch('KeyAuthWhitelist:' . $secret . ':' . $ip, "SELECT 1 FROM `whitelist` WHERE `ip` = ? AND `app` = ?", [$ip, $secret], 0);
- if ($row == "not_found") {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "$vpnblocked"
- )), $secret));
- }
+ $row = misc\cache\fetch('KeyAuthWhitelist:' . $secret . ':' . $ip, "SELECT 1 FROM `whitelist` WHERE `ip` = '$ip' AND `app` = '$secret'", 0);
+ if($row == "not_found") {
+ die(api\v1_0\Encrypt(json_encode(array(
+ "success" => false,
+ "message" => "$vpnblocked"
+ )), $secret));
+ }
}
}
@@ -139,7 +114,8 @@
if ($hashcheck) {
if (strpos($serverhash, $hash) === false) {
if (is_null($serverhash)) {
- misc\mysql\query("UPDATE `apps` SET `hash` = ? WHERE `secret` = ?", [$hash, $secret]);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "UPDATE `apps` SET `hash` = '$hash' WHERE `secret` = '$secret'");
misc\cache\purge('KeyAuthApp:' . $name . ':' . $ownerid); // flush cache for application so new hash takes precedent
} else {
die(api\v1_0\Encrypt(json_encode(array(
@@ -151,51 +127,30 @@
}
$enckey = misc\etc\sanitize(api\v1_0\Decrypt($_POST['enckey'], $secret));
+ $sessionid = misc\etc\generateRandomString();
+ // session init
+ $time = time() + $sessionexpiry;
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "INSERT INTO `sessions` (`id`, `app`, `expiry`, `created_at`, `enckey`,`ip`) VALUES ('$sessionid','$secret', '$time', '".time()."', '$enckey', '$ip')");
- $newSession = false;
- $duplicateSession = misc\cache\select("KeyAuthSessionDupe:$secret:$ip");
- if($duplicateSession) {
- $sessionid = $duplicateSession;
- $updateSession = misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("enckey" => $enckey));
- if(!$updateSession) {
- $sessionid = misc\etc\generateRandomString();
- $newSession = true;
- }
- }
- else {
- $sessionid = misc\etc\generateRandomString();
- $newSession = true;
- }
-
- // $row = misc\cache\fetch('KeyAuthAppStats:' . $secret, "SELECT (SELECT COUNT(1) FROM `users` WHERE `app` = ?) AS 'numUsers', (SELECT COUNT(1) FROM `sessions` WHERE `app` = ? AND `validated` = 1 AND `expiry` > ?) AS 'numOnlineUsers', (SELECT COUNT(1) FROM `keys` WHERE `app` = ?) AS 'numKeys' FROM dual", [$secret, $secret, time(), $secret], 0, 3600);
+ $row = misc\cache\fetch('KeyAuthAppStats:' . $secret, "SELECT(select count(1) FROM `users` WHERE `app` = '$secret') AS 'numUsers',(select count(1) FROM `sessions` WHERE `app` = '$secret' AND `validated` = 1 AND `expiry` > " . time() . ") AS 'numOnlineUsers',(select count(1) FROM `keys` WHERE `app` = '$secret') AS 'numKeys';", 0, 1800);
- $numUsers = "N/A - Use fetchStats() function in latest example";
- $numOnlineUsers = "N/A - Use fetchStats() function in latest example";
- $numKeys = "N/A - Use fetchStats() function in latest example";
+ $numUsers = $row['numUsers'];
+ $numOnlineUsers = $row['numOnlineUsers'];
+ $numKeys = $row['numKeys'];
- echo api\v1_0\Encrypt(json_encode(array(
+ die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
"message" => "Initialized",
"sessionid" => $sessionid,
"appinfo" => array(
- "numUsers" => "$numUsers",
- "numOnlineUsers" => "$numOnlineUsers",
- "numKeys" => "$numKeys",
- "version" => "$currentver",
+ "numUsers" => $numUsers,
+ "numOnlineUsers" => $numOnlineUsers,
+ "numKeys" => $numKeys,
+ "version" => $currentver,
"customerPanelLink" => "https://keyauth.cc/panel/$owner/$name/"
)
- )), $secret);
-
- fastcgi_finish_request();
-
- if($newSession) {
- misc\cache\insert("KeyAuthState:$secret:$sessionid", serialize(array("credential" => NULL, "enckey" => $enckey, "validated" => 0)), $sessionexpiry);
- $time = time() + $sessionexpiry;
- misc\mysql\query("INSERT INTO `sessions` (`id`, `app`, `expiry`, `created_at`, `enckey`,`ip`) VALUES (?, ?, ?, ?, ?, ?)", [$sessionid, $secret, $time, time(), $enckey, $ip]);
- $session = api\shared\primary\getSession($sessionid, $secret);
- $enckey = $session["enckey"];
- misc\cache\insert("KeyAuthSessionDupe:$secret:$ip", $sessionid, $sessionexpiry);
- }
+ )), $secret));
case 'register':
// retrieve session info
@@ -206,27 +161,13 @@
// Read in username
$username = misc\etc\sanitize(api\v1_0\Decrypt($_POST['username'], $enckey));
- if(strlen($username) > 70) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Username must be shorter than 70 characters"
- )), $enckey));
- }
-
// Read in license key
$checkkey = misc\etc\sanitize(api\v1_0\Decrypt($_POST['key'], $enckey));
- if(strlen($checkkey) > 70) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Key must be shorter than 70 characters"
- )), $enckey));
- }
-
// Read in password
$password = misc\etc\sanitize(api\v1_0\Decrypt($_POST['pass'], $enckey));
-
- // Read in email
+
+ // Read in email
$email = misc\etc\sanitize(api\v1_0\Decrypt($_POST['email'], $enckey));
// Read in hwid
@@ -261,8 +202,9 @@
)), $enckey));
case 'key_banned':
if (strpos($keybanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `keys` WHERE `app` = ? AND `key` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `keys` WHERE `app` = '$secret' AND `key` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$keybanned = str_replace("{reason}", $reason, $keybanned);
}
@@ -281,8 +223,13 @@
"message" => "$nosublevel"
)), $enckey));
default:
- misc\mysql\query("UPDATE `sessions` SET `credential` = ?,`validated` = 1 WHERE `id` = ? AND `app` = ?", [$username, $sessionid, $secret]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $username));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$username' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `credential` = '$username',`validated` = 1 WHERE `id` = '$sessionid' AND `app` = '$secret'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -301,21 +248,22 @@
// Read in key
$checkkey = misc\etc\sanitize(api\v1_0\Decrypt($_POST['key'], $enckey));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
// search for key
- $query = misc\mysql\query("SELECT `banned`, `expires`, `status`, `level` FROM `keys` WHERE `key` = ? AND `app` = ?", [$checkkey, $secret]);
+ $result = mysqli_query($link, "SELECT `banned`, `expires`, `status`, `level` FROM `keys` WHERE `key` = '$checkkey' AND `app` = '$secret'");
// check if key exists
- if ($query->num_rows < 1) {
+ if (mysqli_num_rows($result) < 1) {
die(api\v1_0\Encrypt(json_encode(array(
"success" => false,
"message" => "$keynotfound"
)), $enckey));
}
// if key does exist
- elseif ($query->num_rows > 0) {
+ elseif (mysqli_num_rows($result) > 0) {
// get key info
- while ($row = mysqli_fetch_array($query->result)) {
+ while ($row = mysqli_fetch_array($result)) {
$expires = $row['expires'];
$status = $row['status'];
$level = $row['level'];
@@ -329,11 +277,11 @@
"message" => "$keyused"
)), $enckey));
}
-
+
if (!is_null($banned)) {
- if (strpos($keybanned, '{reason}') !== false) {
- $keybanned = str_replace("{reason}", $banned, $keybanned);
- }
+ if (strpos($keybanned, '{reason}') !== false) {
+ $keybanned = str_replace("{reason}", $banned, $keybanned);
+ }
die(api\v1_0\Encrypt(json_encode(array(
"success" => false,
"message" => "$keybanned"
@@ -343,8 +291,8 @@
// add current time to key time
$expiry = $expires + time();
- $query = misc\mysql\query("SELECT `name` FROM `subscriptions` WHERE `app` = ? AND `level` = ?", [$secret, $level]);
- $subName = mysqli_fetch_array($query->result)['name'];
+ $result = mysqli_query($link, "SELECT `name` FROM `subscriptions` WHERE `app` = '$secret' AND `level` = '$level'");
+ $subName = mysqli_fetch_array($result)['name'];
$resp = misc\user\extend($username, $subName, $expiry, 0, $secret);
switch ($resp) {
@@ -365,9 +313,9 @@
)), $enckey));
case 'success':
// set key to used, and set usedby
- misc\mysql\query("UPDATE `keys` SET `status` = 'Used', `usedon` = ?, `usedby` = ? WHERE `key` = ? AND `app` = ?", [time(), $username, $checkkey, $secret]);
+ mysqli_query($link, "UPDATE `keys` SET `status` = 'Used', `usedon` = '" . time() . "', `usedby` = '$username' WHERE `key` = '$checkkey' AND `app` = '$secret'");
misc\cache\purge('KeyAuthKeys:' . $secret . ':' . $checkkey);
- misc\cache\purge('KeyAuthSubs:' . $secret . ':' . $username);
+ misc\cache\purge('KeyAuthSubs:' . $secret . ':' . $username);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
"message" => "Upgraded successfully"
@@ -395,20 +343,6 @@
// Read in password
$password = misc\etc\sanitize(api\v1_0\Decrypt($_POST['pass'], $enckey));
- if(strlen($hwid) < $minHwid && !is_null($hwid)) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "HWID must be {$minHwid} or more characters, change this in app settings."
- )), $enckey));
- }
-
- if($forceHwid && is_null($hwid)) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Force HWID is enabled, disable in app settings if you want to use blank HWIDs"
- )), $enckey));
- }
-
$resp = api\v1_0\login($username, $password, $hwid, $secret, $hwidenabled);
switch ($resp) {
case 'un_not_found':
@@ -423,8 +357,9 @@
)), $enckey));
case 'user_banned':
if (strpos($userbanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `users` WHERE `app` = ? AND `username` = ?", [$secret, $username]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `users` WHERE `app` = '$secret' AND `username` = '$username'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$userbanned = str_replace("{reason}", $reason, $userbanned);
}
@@ -453,8 +388,13 @@
"message" => "$noactivesubs"
)), $enckey));
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ? AND `app` = ?", [$username, $sessionid, $secret]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $username));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$username' WHERE `id` = '$sessionid' AND `app` = '$secret'");
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$username' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -469,33 +409,13 @@
$enckey = $session["enckey"];
$checkkey = misc\etc\sanitize(api\v1_0\Decrypt($_POST['key'], $enckey));
- if(strlen($checkkey) > 70) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Key must be shorter than 70 characters"
- )), $enckey));
- }
-
$hwid = misc\etc\sanitize(api\v1_0\Decrypt($_POST['hwid'], $enckey));
- if(strlen($hwid) < $minHwid && !is_null($hwid)) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "HWID must be {$minHwid} or more characters, change this in app settings."
- )), $enckey));
- }
-
- if($forceHwid && is_null($hwid)) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Force HWID is enabled, disable in app settings if you want to use blank HWIDs"
- )), $enckey));
- }
-
$resp = api\v1_0\login($checkkey, $checkkey, $hwid, $secret, $hwidenabled);
switch ($resp) {
case 'un_not_found':
break; // user not registered yet or user was deleted
+
case 'hwid_mismatch':
die(api\v1_0\Encrypt(json_encode(array(
"success" => false,
@@ -503,8 +423,9 @@
)), $enckey));
case 'user_banned':
if (strpos($userbanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `users` WHERE `app` = ? AND `username` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `users` WHERE `app` = '$secret' AND `username` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$userbanned = str_replace("{reason}", $reason, $userbanned);
}
@@ -533,8 +454,13 @@
"message" => "$noactivesubs"
)), $enckey));
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$checkkey, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $checkkey));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$checkkey' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$checkkey' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -572,8 +498,9 @@
)), $enckey));
case 'key_banned':
if (strpos($keybanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `keys` WHERE `app` = ? AND `key` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `keys` WHERE `app` = '$secret' AND `key` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$keybanned = str_replace("{reason}", $reason, $keybanned);
}
@@ -592,8 +519,13 @@
"message" => "$nosublevel"
)), $enckey));
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$checkkey, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $checkkey));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$checkkey' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$checkkey' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -605,7 +537,7 @@
$session = api\shared\primary\getSession($sessionid, $secret);
$enckey = $session["enckey"];
- $rows = misc\cache\fetch('KeyAuthOnlineUsers:' . $secret, "SELECT DISTINCT CONCAT(LEFT(`credential`, 10), IF(LENGTH(`credential`) > 10, REPEAT('*', LENGTH(`credential`) - 10), '')) AS `credential` FROM `sessions` WHERE `validated` = 1 AND `app` = ?", [$secret], 1, 1800);
+ $rows = misc\cache\fetch('KeyAuthOnlineUsers:' . $secret, "SELECT DISTINCT `credential` FROM `sessions` WHERE `validated` = 1 AND `app` = '$secret'", 1, 1800);
if ($rows == "not_found") {
die(api\v1_0\Encrypt(json_encode(array(
@@ -633,42 +565,11 @@
$var = misc\etc\sanitize(api\v1_0\Decrypt($_POST['var'], $enckey));
$data = misc\etc\sanitize(api\v1_0\Decrypt($_POST['data'], $enckey));
- if(is_null($var)) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "No variable name provided"
- )), $enckey));
- }
-
- if(is_null($data)) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "No variable data provided"
- )), $enckey));
- }
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
- if(strlen($data) > 500) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Variable data must be 500 characters or less"
- )), $enckey));
- }
-
- $row = misc\cache\fetch('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"], "SELECT `data`, `readOnly` FROM `uservars` WHERE `name` = ? AND `user` = ? AND `app` = ?", [$var, $session["credential"], $secret], 0);
-
- if ($row != "not_found") {
- $readOnly = $row["readOnly"];
- if ($readOnly) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Variable is read only"
- )), $enckey));
- }
- }
+ mysqli_query($link, "REPLACE INTO `uservars` (`name`, `data`, `user`, `app`) VALUES ('$var', '$data', '" . $session["credential"] . "', '$secret')");
- $query = misc\mysql\query("REPLACE INTO `uservars` (`name`, `data`, `user`, `app`) VALUES (?, ?, ?, ?)", [$var, $data, $session["credential"], $secret]);
-
- if ($query->affected_rows != 0) {
+ if (mysqli_affected_rows($link) != 0) {
misc\cache\purge('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"]);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
@@ -693,7 +594,7 @@
$var = misc\etc\sanitize(api\v1_0\Decrypt($_POST['var'], $enckey));
- $row = misc\cache\fetch('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"], "SELECT `data`, `readOnly` FROM `uservars` WHERE `name` = ? AND `user` = ? AND `app` = ?", [$var, $session["credential"], $secret], 0);
+ $row = misc\cache\fetch('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"], "SELECT `data` FROM `uservars` WHERE `name` = '$var' AND `user` = '" . $session["credential"] . "' AND `app` = '$secret'", 0);
if ($row == "not_found") {
die(api\v1_0\Encrypt(json_encode(array(
@@ -715,7 +616,7 @@
$enckey = $session["enckey"];
$varid = misc\etc\sanitize(api\v1_0\Decrypt($_POST['varid'], $enckey));
- $row = misc\cache\fetch('KeyAuthVar:' . $secret . ':' . $varid, "SELECT `msg`, `authed` FROM `vars` WHERE `varid` = ? AND `app` = ?", [$varid, $secret], 0);
+ $row = misc\cache\fetch('KeyAuthVar:' . $secret . ':' . $varid, "SELECT `msg`, `authed` FROM `vars` WHERE `varid` = '$varid' AND `app` = '$secret'", 0);
if ($row == "not_found") {
die(api\v1_0\Encrypt(json_encode(array(
"success" => false,
@@ -748,7 +649,7 @@
$hwid = misc\etc\sanitize(api\v1_0\Decrypt($_POST['hwid'], $enckey));
$ip = api\shared\primary\getIp();
- $row = misc\cache\fetch('KeyAuthBlacklist:' . $secret . ':' . $ip . ':' . $hwid, "SELECT 1 FROM `bans` WHERE (`hwid` = ? OR `ip` = ?) AND `app` = ?", [$hwid, $ip, $secret], 0);
+ $row = misc\cache\fetch('KeyAuthBlacklist:' . $secret . ':' . $ip . ':' . $hwid, "SELECT 1 FROM `bans` WHERE (`hwid` = '$hwid' OR `ip` = '$ip') AND `app` = '$secret'", 0);
if ($row != "not_found") {
die(api\v1_0\Encrypt(json_encode(array(
@@ -774,9 +675,9 @@
}
$channel = misc\etc\sanitize(api\v1_0\Decrypt($_POST['channel'], $enckey));
- $rows = misc\cache\fetch('KeyAuthChatMsgs:' . $secret . ':' . $channel, "SELECT `author`, `message`, `timestamp` FROM `chatmsgs` WHERE `channel` = ? AND `app` = ?", [$channel, $secret], 1);
+ $rows = misc\cache\fetch('KeyAuthChatMsgs:' . $secret . ':' . $channel, "SELECT `author`, `message`, `timestamp` FROM `chatmsgs` WHERE `channel` = '$channel' AND `app` = '$secret'", 1);
- if ($rows == "not_found") {
+ if ($rows == "not_found") {
$rows = [];
}
@@ -796,23 +697,24 @@
"message" => "$sessionunauthed"
)), $enckey));
}
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
$channel = misc\etc\sanitize(api\v1_0\Decrypt($_POST['channel'], $enckey));
- $query = misc\mysql\query("SELECT `delay` FROM `chats` WHERE `name` = ? AND `app` = ?", [$channel, $secret]);
+ $result = mysqli_query($link, "SELECT `delay` FROM `chats` WHERE `name` = '$channel' AND `app` = '$secret'");
- if ($query->num_rows < 1) {
+ if (mysqli_num_rows($result) < 1) {
die(api\v1_0\Encrypt(json_encode(array(
"success" => false,
"message" => "Chat channel not found"
)), $enckey));
}
- $row = mysqli_fetch_array($query->result);
+ $row = mysqli_fetch_array($result);
$delay = $row['delay'];
$credential = $session["credential"];
- $query = misc\mysql\query("SELECT `timestamp` FROM `chatmsgs` WHERE `author` = ? AND `channel` = ? AND `app` = ? ORDER BY `id` DESC LIMIT 1", [$credential, $channel, $secret]);
+ $result = mysqli_query($link, "SELECT `timestamp` FROM `chatmsgs` WHERE `author` = '$credential' AND `channel` = '$channel' AND `app` = '$secret' ORDER BY `id` DESC LIMIT 1");
- $row = mysqli_fetch_array($query->result);
+ $row = mysqli_fetch_array($result);
$time = $row['timestamp'];
if (time() - $time < $delay) {
@@ -822,9 +724,9 @@
)), $enckey));
}
- $query = misc\mysql\query("SELECT `time` FROM `chatmutes` WHERE `user` = ? AND `app` = ?", [$credential, $secret]);
- if ($query->num_rows != 0) {
- $row = mysqli_fetch_array($query->result);
+ $result = mysqli_query($link, "SELECT `time` FROM `chatmutes` WHERE `user` = '$credential' AND `app` = '$secret'");
+ if (mysqli_num_rows($result) != 0) {
+ $row = mysqli_fetch_array($result);
$unmuted = $row["time"];
$unmuted = date("F j, Y, g:i a", $unmuted);
die(api\v1_0\Encrypt(json_encode(array(
@@ -834,32 +736,14 @@
}
$message = misc\etc\sanitize(api\v1_0\Decrypt($_POST['message'], $enckey));
-
- if (is_null($message)) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Message can't be blank"
- )), $enckey));
- }
-
- if(strlen($message) > 2000) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Message too long!"
- )), $enckey));
- }
-
- misc\mysql\query("INSERT INTO `chatmsgs` (`author`, `message`, `timestamp`, `channel`,`app`) VALUES (?, ?, ?, ?, ?)", [$credential, $message, time(), $channel, $secret]);
- misc\mysql\query("DELETE FROM `chatmsgs` WHERE `app` = ? AND `channel` = ? AND `id` NOT IN ( SELECT `id` FROM ( SELECT `id` FROM `chatmsgs` WHERE `channel` = ? AND `app` = ? ORDER BY `id` DESC LIMIT 50) foo );", [$secret, $channel, $channel, $secret]);
+ mysqli_query($link, "INSERT INTO `chatmsgs` (`author`, `message`, `timestamp`, `channel`,`app`) VALUES ('$credential','$message','" . time() . "','$channel','$secret')");
+ mysqli_query($link, "DELETE FROM `chatmsgs` WHERE `app` = '$secret' AND `channel` = '$channel' AND `id` NOT IN ( SELECT `id` FROM ( SELECT `id` FROM `chatmsgs` WHERE `channel` = '$channel' AND `app` = '$secret' ORDER BY `id` DESC LIMIT 50) foo );");
misc\cache\purge('KeyAuthChatMsgs:' . $secret . ':' . $channel);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
"message" => "Successfully sent chat message"
)), $enckey));
case 'log':
- // client isn't expecting a response body, just flush output right away so program can move on to rest of the code quicker
- fastcgi_finish_request();
-
// retrieve session info
$sessionid = misc\etc\sanitize(hex2bin($_POST['sessionid']));
$session = api\shared\primary\getSession($sessionid, $secret);
@@ -871,28 +755,11 @@
$msg = misc\etc\sanitize(api\v1_0\Decrypt($_POST['message'], $enckey));
- if(is_null($msg)) {
- die();
- }
-
- if(strlen($msg) > 275) {
- die("Log data too long");
- }
-
$pcuser = misc\etc\sanitize(api\v1_0\Decrypt($_POST['pcuser'], $enckey));
if (is_null($webhook)) {
- $roleCheck = misc\cache\fetch('KeyAuthSellerCheck:' . $owner, "SELECT `role`,`expires` FROM `accounts` WHERE `username` = ?", [$owner], 0);
- if($roleCheck['role'] == "tester") {
- $query = misc\mysql\query("SELECT count(*) AS 'numLogs' FROM `logs` WHERE `logapp` = ?",[$secret]);
- $row = mysqli_fetch_array($query->result);
- $numLogs = $row["numLogs"];
- if($numLogs >= 20) {
- die();
- }
- }
-
- misc\mysql\query("INSERT INTO `logs` (`logdate`, `logdata`, `credential`, `pcuser`,`logapp`) VALUES (?, ?, NULLIF(?, ''), NULLIF(?, ''), ?)", [$currtime, $msg, $credential, $pcuser, $secret]);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "INSERT INTO `logs` (`logdate`, `logdata`, `credential`, `pcuser`,`logapp`) VALUES ('$currtime','$msg',NULLIF('$credential', ''),NULLIF('$pcuser', ''),'$secret')");
die();
}
@@ -903,6 +770,13 @@
$ip = api\shared\primary\getIp();
$json_data = json_encode([
+ // Username
+ "username" => "KeyAuth",
+
+ // Avatar URL.
+ // Uncoment to replace image set in webhook
+ "avatar_url" => "https://cdn.keyauth.cc/front/assets/img/favicon.png",
+
// Embeds Array
"embeds" => [
[
@@ -948,7 +822,7 @@
$webid = misc\etc\sanitize(api\v1_0\Decrypt($_POST['webid'], $enckey));
- $row = misc\cache\fetch('KeyAuthWebhook:' . $secret . ':' . $webid, "SELECT `baselink`, `useragent`, `authed` FROM `webhooks` WHERE `webid` = ? AND `app` = ?", [$webid, $secret], 0);
+ $row = misc\cache\fetch('KeyAuthWebhook:' . $secret . ':' . $webid, "SELECT `baselink`, `useragent`, `authed` FROM `webhooks` WHERE `webid` = '$webid' AND `app` = '$secret'", 0);
if ($row == "not_found") {
die(api\v1_0\Encrypt(json_encode(array(
"success" => false,
@@ -976,7 +850,7 @@
$params = misc\etc\sanitize(api\v1_0\Decrypt($_POST['params'], $enckey));
$body = api\v1_0\Decrypt($_POST['body'], $enckey);
$contType = misc\etc\sanitize(api\v1_0\Decrypt($_POST['conttype'], $enckey));
-
+
$url = $baselink .= urldecode($params);
$ch = curl_init($url);
@@ -1005,7 +879,7 @@
$fileid = misc\etc\sanitize(api\v1_0\Decrypt($_POST['fileid'], $enckey));
- $row = misc\cache\fetch('KeyAuthFile:' . $secret . ':' . $fileid, "SELECT `name`, `url`, `authed` FROM `files` WHERE `app` = ? AND `id` = ?", [$secret, $fileid], 0);
+ $row = misc\cache\fetch('KeyAuthFile:' . $secret . ':' . $fileid, "SELECT `name`, `url`, `authed` FROM `files` WHERE `app` = '$secret' AND `id` = '$fileid'", 0);
if ($row == "not_found") {
die(api\v1_0\Encrypt(json_encode(array(
@@ -1028,8 +902,8 @@
)), $enckey));
}
}
-
- ini_set('memory_limit', '-1');
+
+ ini_set('memory_limit', '-1');
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
@@ -1063,26 +937,20 @@
"message" => "$sessionunauthed"
)), $enckey));
}
+
+ $reason = misc\etc\sanitize($_POST['reason']) ?? "User banned from triggering ban function in the client";
- $reason = misc\etc\sanitize($_POST['reason']) ?? "User banned from triggering ban function in the client";
-
- if(strlen($reason) > 99) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Reason must be 99 characters or less"
- )), $enckey));
- }
-
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
$hwid = misc\etc\sanitize(api\v1_0\Decrypt($_POST['hwid'], $enckey));
if (!empty($hwid)) {
- misc\blacklist\add($hwid, "Hardware ID", $secret);
+ misc\blacklist\add($hwid, "Hardware ID", $secret);
}
$ip = api\shared\primary\getIp();
- misc\blacklist\add($ip, "IP Address", $secret);
+ misc\blacklist\add($ip, "IP Address", $secret);
- misc\mysql\query("UPDATE `users` SET `banned` = ? WHERE `username` = ? AND `app` = ?", [$reason, $credential, $secret]);
+ mysqli_query($link, "UPDATE `users` SET `banned` = '$reason' WHERE `username` = '$credential'");
- if ($query->affected_rows != 0) {
+ if (mysqli_affected_rows($link) != 0) {
misc\cache\purge('KeyAuthUser:' . $secret . ':' . $credential);
die(api\v1_0\Encrypt(json_encode(array(
"success" => true,
@@ -1112,48 +980,48 @@
"message" => "Session is validated."
)), $enckey));
}
- case 'changeUsername':
+ case 'changeUsername':
// retrieve session info
$sessionid = misc\etc\sanitize(hex2bin($_POST['sessionid']));
$session = api\shared\primary\getSession($sessionid, $secret);
$enckey = $session["enckey"];
-
- if (!$session["validated"]) {
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "$sessionunauthed"
- )), $enckey));
+
+ if (!$session["validated"]) {
+ die(api\v1_0\Encrypt(json_encode(array(
+ "success" => false,
+ "message" => "$sessionunauthed"
+ )), $enckey));
}
$credential = $session["credential"];
-
- $resp = misc\user\changeUsername($credential, $_POST['newUsername'], $secret);
- switch ($resp) {
- case 'already_used':
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Username already used!"
- )), $enckey));
- case 'failure':
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Failed to change username!"
- )), $enckey));
- case 'success':
- misc\session\killSingular($sessionid, $secret);
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => true,
- "message" => "Successfully changed username, user logged out."
- )), $enckey));
- default:
- die(api\v1_0\Encrypt(json_encode(array(
- "success" => false,
- "message" => "Unhandled Error! Contact us if you need help"
- )), $enckey));
- }
+
+ $resp = misc\user\changeUsername($credential, $_POST['newUsername'], $secret);
+ switch($resp) {
+ case 'already_used':
+ die(api\v1_0\Encrypt(json_encode(array(
+ "success" => false,
+ "message" => "Username already used!"
+ )), $enckey));
+ case 'failure':
+ die(api\v1_0\Encrypt(json_encode(array(
+ "success" => false,
+ "message" => "Failed to change username!"
+ )), $enckey));
+ case 'success':
+ misc\session\killSingular($sessionid, $secret);
+ die(api\v1_0\Encrypt(json_encode(array(
+ "success" => true,
+ "message" => "Successfully changed username, user logged out."
+ )), $enckey));
+ default:
+ die(api\v1_0\Encrypt(json_encode(array(
+ "success" => false,
+ "message" => "Unhandled Error! Contact us if you need help"
+ )), $enckey));
+ }
default:
die(json_encode(array(
"success" => false,
"message" => "Unhandled Type"
)));
-}
+}
\ No newline at end of file
diff --git a/api/1.1/index.php b/api/1.1/index.php
index 40dd0e9..b2c0769 100644
--- a/api/1.1/index.php
+++ b/api/1.1/index.php
@@ -1,38 +1,20 @@
getMessage());
- die(json_encode(array("success" => false, "message" => "Error: " . $errorMsg)));
-});
-
-if(empty(($_POST['ownerid'] ?? $_GET['ownerid']))) {
- die(json_encode(array("success" => false, "message" => "No OwnerID specified. Select app & copy code snippet from https://keyauth.cc/app/")));
-}
+error_reporting(0); // disable useless warnings, should turn this on if you need to debug a problem
-if(empty(($_POST['name'] ?? $_GET['name']))) {
- die(json_encode(array("success" => false, "message" => "No app name specified. Select app & copy code snippet from https://keyauth.cc/app/")));
-}
+include '../../includes/misc/autoload.phtml';
+include '../../includes/api/shared/autoload.phtml';
+include '../../includes/api/1.0/autoload.phtml';
-if(strlen(($_POST['ownerid'] ?? $_GET['ownerid'])) != 10) {
- die(json_encode(array("success" => false, "message" => "OwnerID should be 10 characters long. Select app & copy code snippet from https://keyauth.cc/app/")));
+if (isset($_SERVER['HTTP_CDN_HOST'])) { // custom domains https://www.youtube.com/watch?v=a2SROFJ0eYc
+ $row = misc\cache\fetch('KeyAuthApp:' . misc\etc\sanitize($_SERVER['HTTP_CDN_HOST']), "SELECT * FROM `apps` WHERE `customDomainAPI` = '" . misc\etc\sanitize($_SERVER['HTTP_CDN_HOST']) . "'", 0);
+} else {
+ $ownerid = misc\etc\sanitize($_POST['ownerid'] ?? $_GET['ownerid']); // ownerid of account that owns application
+ $name = misc\etc\sanitize($_POST['name'] ?? $_GET['name']); // application name
+ $row = misc\cache\fetch('KeyAuthApp:' . $name . ':' . $ownerid, "SELECT * FROM `apps` WHERE `ownerid` = '$ownerid' AND `name` = '$name'", 0);
}
-$ownerid = misc\etc\sanitize($_POST['ownerid'] ?? $_GET['ownerid']); // ownerid of account that owns application
-$name = misc\etc\sanitize($_POST['name'] ?? $_GET['name']); // application name
-$row = misc\cache\fetch('KeyAuthApp:' . $name . ':' . $ownerid, "SELECT * FROM `apps` WHERE `ownerid` = ? AND `name` = ?", [$ownerid, $name], 0);
-
if ($row == "not_found") {
die("KeyAuth_Invalid");
}
@@ -49,8 +31,6 @@
$appdisabled = $row['appdisabled'];
$hashcheck = $row['hashcheck'];
$serverhash = $row['hash'];
-$sessionexpiry = $row['session'];
-$forceHwid = $row['forceHwid'];
$banned = $row['banned'];
$owner = $row['owner'];
@@ -67,11 +47,14 @@
$noactivesubs = $row['noactivesubs'];
$hwidblacked = $row['hwidblacked'];
$pausedsub = $row['pausedsub'];
+$keyexpired = $row['keyexpired'];
$vpnblocked = $row['vpnblocked'];
$keybanned = $row['keybanned'];
$userbanned = $row['userbanned'];
$sessionunauthed = $row['sessionunauthed'];
$hashcheckfail = $row['hashcheckfail'];
+$sessionexpiry = $row['session'];
+$killOtherSessions = $row['killOtherSessions'];
// why using null coalescing operators? because if I add a field and it's not in redis cache, it'll be NULL
$loggedInMsg = $row['loggedInMsg'] ?? "Logged in!";
@@ -79,7 +62,6 @@
$unTooShort = $row['unTooShort'] ?? "Username too short, try longer one.";
$pwLeaked = $row['pwLeaked'] ?? "This password has been leaked in a data breach (not from us), please use a different one.";
$chatHitDelay = $row['chatHitDelay'] ?? "Chat slower, you've hit the delay limit";
-$minHwid = $row['minHwid'] ?? 20;
if ($banned) {
die(json_encode(array(
@@ -93,13 +75,13 @@
$ip = api\shared\primary\getIp();
if ($vpnblock) {
if (api\shared\primary\vpnCheck($ip)) {
- $row = misc\cache\fetch('KeyAuthWhitelist:' . $secret . ':' . $ip, "SELECT 1 FROM `whitelist` WHERE `ip` = ? AND `app` = ?", [$ip, $secret], 0);
- if ($row == "not_found") {
- die(json_encode(array(
- "success" => false,
- "message" => "$vpnblocked"
- )));
- }
+ $row = misc\cache\fetch('KeyAuthWhitelist:' . $secret . ':' . $ip, "SELECT 1 FROM `whitelist` WHERE `ip` = '$ip' AND `app` = '$secret'", 0);
+ if($row == "not_found") {
+ die(json_encode(array(
+ "success" => false,
+ "message" => "$vpnblocked"
+ )));
+ }
}
}
@@ -118,7 +100,7 @@
}
$ver = misc\etc\sanitize($_POST['ver'] ?? $_GET['ver']);
- if (!empty($ver)) {
+ if (is_numeric($ver)) {
if ($ver != $currentver) {
// auto-update system
die(json_encode(array(
@@ -134,7 +116,8 @@
if ($hashcheck) {
if (strpos($serverhash, $hash) === false) {
if (is_null($serverhash)) {
- misc\mysql\query("UPDATE `apps` SET `hash` = ? WHERE `secret` = ?", [$hash, $secret]);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "UPDATE `apps` SET `hash` = '$hash' WHERE `secret` = '$secret'");
misc\cache\purge('KeyAuthApp:' . $name . ':' . $ownerid); // flush cache for application so new hash takes precedent
} else {
die(json_encode(array(
@@ -145,48 +128,41 @@
}
}
- $newSession = false;
- $duplicateSession = misc\cache\select("KeyAuthSessionDupe:$secret:$ip");
- if($duplicateSession) {
- $sessionid = $duplicateSession;
- $updateSession = misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 0));
- if(!$updateSession) {
- $sessionid = misc\etc\generateRandomString();
- $newSession = true;
- }
- }
- else {
- $sessionid = misc\etc\generateRandomString();
- $newSession = true;
+ $enckey = NULL;
+
+ $row = misc\cache\fetch('KeyAuthStateDuplicates:' . $secret . ':' . $ip, "SELECT `id`, `expiry` FROM `sessions` WHERE `app` = '$secret' AND `ip` = '$ip' AND `validated` = 0 AND `expiry` > " . time() . " LIMIT 1", 0);
+ if ($row != "not_found") {
+ $sessionid = $row['id'];
+ goto dupe;
}
-
- // $row = misc\cache\fetch('KeyAuthAppStats:' . $secret, "SELECT (SELECT COUNT(1) FROM `users` WHERE `app` = ?) AS 'numUsers', (SELECT COUNT(1) FROM `sessions` WHERE `app` = ? AND `validated` = 1 AND `expiry` > ?) AS 'numOnlineUsers', (SELECT COUNT(1) FROM `keys` WHERE `app` = ?) AS 'numKeys' FROM dual", [$secret, $secret, time(), $secret], 0, 3600);
- $numUsers = "N/A - Use fetchStats() function in latest example";
- $numOnlineUsers = "N/A - Use fetchStats() function in latest example";
- $numKeys = "N/A - Use fetchStats() function in latest example";
+ $sessionid = misc\etc\generateRandomString();
+ // session init
+ $time = time() + $sessionexpiry;
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "INSERT INTO `sessions` (`id`, `app`, `expiry`, `created_at`, `enckey`, `ip`) VALUES ('$sessionid','$secret', '$time', '".time()."', NULLIF('$enckey', ''), '$ip')");
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
+
+ dupe:
+
+ $row = misc\cache\fetch('KeyAuthAppStats:' . $secret, "SELECT(select count(1) FROM `users` WHERE `app` = '$secret') AS 'numUsers',(select count(1) FROM `sessions` WHERE `app` = '$secret' AND `validated` = 1 AND `expiry` > " . time() . ") AS 'numOnlineUsers',(select count(1) FROM `keys` WHERE `app` = '$secret') AS 'numKeys';", 0, 1800);
- echo json_encode(array(
+ $numUsers = $row['numUsers'];
+ $numOnlineUsers = $row['numOnlineUsers'];
+ $numKeys = $row['numKeys'];
+
+ die(json_encode(array(
"success" => true,
"message" => "Initialized",
"sessionid" => $sessionid,
"appinfo" => array(
- "numUsers" => "$numUsers",
- "numOnlineUsers" => "$numOnlineUsers",
- "numKeys" => "$numKeys",
- "version" => "$currentver",
+ "numUsers" => $numUsers,
+ "numOnlineUsers" => $numOnlineUsers,
+ "numKeys" => $numKeys,
+ "version" => $currentver,
"customerPanelLink" => "https://keyauth.cc/panel/$owner/$name/"
)
- ));
-
- fastcgi_finish_request();
-
- if($newSession) {
- misc\cache\insert("KeyAuthState:$secret:$sessionid", serialize(array("credential" => NULL, "enckey" => NULL, "validated" => 0)), $sessionexpiry);
- $time = time() + $sessionexpiry;
- misc\mysql\query("INSERT INTO `sessions` (`id`, `app`, `expiry`, `created_at`, `ip`) VALUES (?, ?, ?, ?, ?)", [$sessionid, $secret, $time, time(), $ip]);
- misc\cache\insert("KeyAuthSessionDupe:$secret:$ip", $sessionid, $sessionexpiry);
- }
+ )));
case 'register':
// retrieve session info
@@ -196,27 +172,13 @@
// Read in username
$username = misc\etc\sanitize($_POST['username'] ?? $_GET['username']);
- if(strlen($username) > 70) {
- die(json_encode(array(
- "success" => false,
- "message" => "Username must be shorter than 70 characters"
- )));
- }
-
// Read in license key
$checkkey = misc\etc\sanitize($_POST['key'] ?? $_GET['key']);
- if(strlen($checkkey) > 70) {
- die(json_encode(array(
- "success" => false,
- "message" => "Key must be shorter than 70 characters"
- )));
- }
-
// Read in password
$password = misc\etc\sanitize($_POST['pass'] ?? $_GET['pass']);
-
- // Read in email
+
+ // Read in email
$email = misc\etc\sanitize($_POST['email'] ?? $_GET['email']);
// Read in hwid
@@ -251,8 +213,9 @@
)));
case 'key_banned':
if (strpos($keybanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `keys` WHERE `app` = ? AND `key` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `keys` WHERE `app` = '$secret' AND `key` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$keybanned = str_replace("{reason}", $reason, $keybanned);
}
@@ -271,10 +234,16 @@
"message" => "$nosublevel"
)));
default:
- misc\mysql\query("UPDATE `sessions` SET `credential` = ?,`validated` = 1 WHERE `id` = ?", [$username, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $username));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$username' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `credential` = '$username',`validated` = 1 WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
$ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
die(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -292,12 +261,13 @@
// Read in key
$checkkey = misc\etc\sanitize($_POST['key'] ?? $_GET['key']);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
// search for key
- $query = misc\mysql\query("SELECT `banned`, `expires`, `status`, `level` FROM `keys` WHERE `key` = ? AND `app` = ?", [$checkkey, $secret]);
+ $result = mysqli_query($link, "SELECT `banned`, `expires`, `status`, `level` FROM `keys` WHERE `key` = '$checkkey' AND `app` = '$secret'");
// check if key exists
- if ($query->num_rows < 1) {
+ if (mysqli_num_rows($result) < 1) {
die(json_encode(array(
"success" => false,
"message" => "$keynotfound"
@@ -305,10 +275,10 @@
}
// if key does exist
- elseif ($query->num_rows > 0) {
+ elseif (mysqli_num_rows($result) > 0) {
// get key info
- while ($row = mysqli_fetch_array($query->result)) {
+ while ($row = mysqli_fetch_array($result)) {
$expires = $row['expires'];
$status = $row['status'];
$level = $row['level'];
@@ -324,9 +294,9 @@
}
if (!is_null($banned)) {
- if (strpos($keybanned, '{reason}') !== false) {
- $keybanned = str_replace("{reason}", $banned, $keybanned);
- }
+ if (strpos($keybanned, '{reason}') !== false) {
+ $keybanned = str_replace("{reason}", $banned, $keybanned);
+ }
die(json_encode(array(
"success" => false,
"message" => "$keybanned"
@@ -336,8 +306,8 @@
// add current time to key time
$expiry = $expires + time();
- $query = misc\mysql\query("SELECT `name` FROM `subscriptions` WHERE `app` = ? AND `level` = ?", [$secret, $level]);
- $subName = mysqli_fetch_array($query->result)['name'];
+ $result = mysqli_query($link, "SELECT `name` FROM `subscriptions` WHERE `app` = '$secret' AND `level` = '$level'");
+ $subName = mysqli_fetch_array($result)['name'];
$resp = misc\user\extend($username, $subName, $expiry, 0, $secret);
switch ($resp) {
@@ -358,9 +328,9 @@
)));
case 'success':
// set key to used, and set usedby
- misc\mysql\query("UPDATE `keys` SET `status` = 'Used', `usedon` = ?, `usedby` = ? WHERE `key` = ? AND `app` = ?", [time(), $username, $checkkey, $secret]);
+ mysqli_query($link, "UPDATE `keys` SET `status` = 'Used', `usedon` = '" . time() . "', `usedby` = '$username' WHERE `key` = '$checkkey'");
misc\cache\purge('KeyAuthKeys:' . $secret . ':' . $checkkey);
- misc\cache\purge('KeyAuthSubs:' . $secret . ':' . $username);
+ misc\cache\purge('KeyAuthSubs:' . $secret . ':' . $username);
die(json_encode(array(
"success" => true,
"message" => "Upgraded successfully"
@@ -389,21 +359,7 @@
// optional param for web loader
$token = misc\etc\sanitize($_POST['token'] ?? $_GET['token']);
-
- if(strlen($hwid) < $minHwid && !is_null($hwid)) {
- die(json_encode(array(
- "success" => false,
- "message" => "HWID must be {$minHwid} or more characters, change this in app settings."
- )));
- }
-
- if($forceHwid && is_null($hwid)) {
- die(json_encode(array(
- "success" => false,
- "message" => "Force HWID is enabled, disable in app settings if you want to use blank HWIDs"
- )));
- }
-
+
$resp = api\v1_0\login($username, $password, $hwid, $secret, $hwidenabled, $token);
switch ($resp) {
case 'un_not_found':
@@ -418,8 +374,9 @@
)));
case 'user_banned':
if (strpos($userbanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `users` WHERE `app` = ? AND `username` = ?", [$secret, $username]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `users` WHERE `app` = '$secret' AND `username` = '$username'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$userbanned = str_replace("{reason}", $reason, $userbanned);
}
@@ -448,10 +405,16 @@
"message" => "$noactivesubs"
)));
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$username, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $username));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$username' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$username' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
$ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
die(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -465,33 +428,13 @@
$session = api\shared\primary\getSession($sessionid, $secret);
$checkkey = misc\etc\sanitize($_POST['key'] ?? $_GET['key']);
- if(strlen($checkkey) > 70) {
- die(json_encode(array(
- "success" => false,
- "message" => "Key must be shorter than 70 characters"
- )));
- }
-
$hwid = misc\etc\sanitize($_POST['hwid'] ?? $_GET['hwid']);
- if(strlen($hwid) < $minHwid && !is_null($hwid)) {
- die(json_encode(array(
- "success" => false,
- "message" => "HWID must be {$minHwid} or more characters, change this in app settings."
- )));
- }
-
- if($forceHwid && is_null($hwid)) {
- die(json_encode(array(
- "success" => false,
- "message" => "Force HWID is enabled, disable in app settings if you want to use blank HWIDs"
- )));
- }
-
$resp = api\v1_0\login($checkkey, $checkkey, $hwid, $secret, $hwidenabled);
switch ($resp) {
case 'un_not_found':
break; // user not registered yet or user was deleted
+
case 'hwid_mismatch':
die(json_encode(array(
"success" => false,
@@ -499,8 +442,9 @@
)));
case 'user_banned':
if (strpos($userbanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `users` WHERE `app` = ? AND `username` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `users` WHERE `app` = '$secret' AND `username` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$userbanned = str_replace("{reason}", $reason, $userbanned);
}
@@ -529,10 +473,16 @@
"message" => "$noactivesubs"
)));
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$checkkey, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $checkkey));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$checkkey' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$checkkey' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
$ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
die(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -570,8 +520,9 @@
)));
case 'key_banned':
if (strpos($keybanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `keys` WHERE `app` = ? AND `key` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `keys` WHERE `app` = '$secret' AND `key` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$keybanned = str_replace("{reason}", $reason, $keybanned);
}
@@ -590,10 +541,16 @@
"message" => "$nosublevel"
)));
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$checkkey, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $checkkey));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$checkkey' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$checkkey' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
$ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
die(json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
@@ -604,7 +561,7 @@
$sessionid = misc\etc\sanitize($_POST['sessionid'] ?? $_GET['sessionid']);
$session = api\shared\primary\getSession($sessionid, $secret);
- $rows = misc\cache\fetch('KeyAuthOnlineUsers:' . $secret, "SELECT DISTINCT CONCAT(LEFT(`credential`, 10), IF(LENGTH(`credential`) > 10, REPEAT('*', LENGTH(`credential`) - 10), '')) AS `credential` FROM `sessions` WHERE `validated` = 1 AND `app` = ?", [$secret], 1, 1800);
+ $rows = misc\cache\fetch('KeyAuthOnlineUsers:' . $secret, "SELECT DISTINCT `credential` FROM `sessions` WHERE `validated` = 1 AND `app` = '$secret'", 1, 1800);
if ($rows == "not_found") {
die(json_encode(array(
@@ -630,43 +587,10 @@
$var = misc\etc\sanitize($_POST['var'] ?? $_GET['var']);
$data = misc\etc\sanitize($_POST['data'] ?? $_GET['data']);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "REPLACE INTO `uservars` (`name`, `data`, `user`, `app`) VALUES ('$var', '$data', '" . $session["credential"] . "', '$secret')");
- if(is_null($var)) {
- die(json_encode(array(
- "success" => true,
- "message" => "No variable name provided"
- )));
- }
-
- if(is_null($data)) {
- die(json_encode(array(
- "success" => true,
- "message" => "No variable data provided"
- )));
- }
-
- if(strlen($data) > 500) {
- die(json_encode(array(
- "success" => true,
- "message" => "Variable data must be 500 characters or less"
- )));
- }
-
- $row = misc\cache\fetch('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"], "SELECT `data`, `readOnly` FROM `uservars` WHERE `name` = ? AND `user` = ? AND `app` = ?", [$var, $session["credential"], $secret], 0);
-
- if ($row != "not_found") {
- $readOnly = $row["readOnly"];
- if ($readOnly) {
- die(json_encode(array(
- "success" => true,
- "message" => "Variable is read only"
- )));
- }
- }
-
- $query = misc\mysql\query("REPLACE INTO `uservars` (`name`, `data`, `user`, `app`) VALUES (?, ?, ?, ?)", [$var, $data, $session["credential"], $secret]);
-
- if ($query->affected_rows != 0) {
+ if (mysqli_affected_rows($link) != 0) {
misc\cache\purge('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"]);
die(json_encode(array(
"success" => true,
@@ -690,7 +614,7 @@
$var = misc\etc\sanitize($_POST['var'] ?? $_GET['var']);
- $row = misc\cache\fetch('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"], "SELECT `data`, `readOnly` FROM `uservars` WHERE `name` = ? AND `user` = ? AND `app` = ?", [$var, $session["credential"], $secret], 0);
+ $row = misc\cache\fetch('KeyAuthUserVar:' . $secret . ':' . $var . ':' . $session["credential"], "SELECT `data` FROM `uservars` WHERE `name` = '$var' AND `user` = '" . $session["credential"] . "' AND `app` = '$secret'", 0);
if ($row == "not_found") {
die(json_encode(array(
@@ -712,7 +636,7 @@
$varid = misc\etc\sanitize($_POST['varid'] ?? $_GET['varid']);
- $row = misc\cache\fetch('KeyAuthVar:' . $secret . ':' . $varid, "SELECT `msg`, `authed` FROM `vars` WHERE `varid` = ? AND `app` = ?", [$varid, $secret], 0);
+ $row = misc\cache\fetch('KeyAuthVar:' . $secret . ':' . $varid, "SELECT `msg`, `authed` FROM `vars` WHERE `varid` = '$varid' AND `app` = '$secret'", 0);
if ($row == "not_found") {
die(json_encode(array(
@@ -746,7 +670,7 @@
$hwid = misc\etc\sanitize($_POST['hwid'] ?? $_GET['hwid']);
$ip = api\shared\primary\getIp();
- $row = misc\cache\fetch('KeyAuthBlacklist:' . $secret . ':' . $ip . ':' . $hwid, "SELECT 1 FROM `bans` WHERE (`hwid` = ? OR `ip` = ?) AND `app` = ?", [$hwid, $ip, $secret], 0);
+ $row = misc\cache\fetch('KeyAuthBlacklist:' . $secret . ':' . $ip . ':' . $hwid, "SELECT 1 FROM `bans` WHERE (`hwid` = '$hwid' OR `ip` = '$ip') AND `app` = '$secret'", 0);
if ($row != "not_found") {
die(json_encode(array(
@@ -771,9 +695,9 @@
}
$channel = misc\etc\sanitize($_POST['channel'] ?? $_GET['channel']);
- $rows = misc\cache\fetch('KeyAuthChatMsgs:' . $secret . ':' . $channel, "SELECT `author`, `message`, `timestamp` FROM `chatmsgs` WHERE `channel` = ? AND `app` = ?", [$channel, $secret], 1);
+ $rows = misc\cache\fetch('KeyAuthChatMsgs:' . $secret . ':' . $channel, "SELECT `author`, `message`, `timestamp` FROM `chatmsgs` WHERE `channel` = '$channel' AND `app` = '$secret'", 1);
- if ($rows == "not_found") {
+ if ($rows == "not_found") {
$rows = [];
}
@@ -794,21 +718,22 @@
}
$channel = misc\etc\sanitize($_POST['channel'] ?? $_GET['channel']);
- $query = misc\mysql\query("SELECT `delay` FROM `chats` WHERE `name` = ? AND `app` = ?", [$channel, $secret]);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `delay` FROM `chats` WHERE `name` = '$channel' AND `app` = '$secret'");
- if ($query->num_rows < 1) {
+ if (mysqli_num_rows($result) < 1) {
die(json_encode(array(
"success" => false,
"message" => "Chat channel not found"
)));
}
- $row = mysqli_fetch_array($query->result);
+ $row = mysqli_fetch_array($result);
$delay = $row['delay'];
$credential = $session["credential"];
- $query = misc\mysql\query("SELECT `timestamp` FROM `chatmsgs` WHERE `author` = ? AND `channel` = ? AND `app` = ? ORDER BY `id` DESC LIMIT 1", [$credential, $channel, $secret]);
+ $result = mysqli_query($link, "SELECT `timestamp` FROM `chatmsgs` WHERE `author` = '$credential' AND `channel` = '$channel' AND `app` = '$secret' ORDER BY `id` DESC LIMIT 1");
- $row = mysqli_fetch_array($query->result);
+ $row = mysqli_fetch_array($result);
$time = $row['timestamp'];
if (time() - $time < $delay) {
@@ -818,9 +743,9 @@
)));
}
- $query = misc\mysql\query("SELECT `time` FROM `chatmutes` WHERE `user` = ? AND `app` = ?", [$credential, $secret]);
- if ($query->num_rows != 0) {
- $row = mysqli_fetch_array($query->result);
+ $result = mysqli_query($link, "SELECT `time` FROM `chatmutes` WHERE `user` = '$credential' AND `app` = '$secret'");
+ if (mysqli_num_rows($result) != 0) {
+ $row = mysqli_fetch_array($result);
$unmuted = $row["time"];
$unmuted = date("F j, Y, g:i a", $unmuted);
die(json_encode(array(
@@ -830,32 +755,14 @@
}
$message = misc\etc\sanitize($_POST['message'] ?? $_GET['message']);
-
- if (is_null($message)) {
- die(json_encode(array(
- "success" => false,
- "message" => "Message can't be blank"
- )));
- }
-
- if(strlen($message) > 2000) {
- die(json_encode(array(
- "success" => false,
- "message" => "Message too long!"
- )));
- }
-
- misc\mysql\query("INSERT INTO `chatmsgs` (`author`, `message`, `timestamp`, `channel`,`app`) VALUES (?, ?, ?, ?, ?)", [$credential, $message, time(), $channel, $secret]);
- misc\mysql\query("DELETE FROM `chatmsgs` WHERE `app` = ? AND `channel` = ? AND `id` NOT IN ( SELECT `id` FROM ( SELECT `id` FROM `chatmsgs` WHERE `channel` = ? AND `app` = ? ORDER BY `id` DESC LIMIT 50) foo );", [$secret, $channel, $channel, $secret]);
+ mysqli_query($link, "INSERT INTO `chatmsgs` (`author`, `message`, `timestamp`, `channel`,`app`) VALUES ('$credential','$message','" . time() . "','$channel','$secret')");
+ mysqli_query($link, "DELETE FROM `chatmsgs` WHERE `app` = '$secret' AND `channel` = '$channel' AND `id` NOT IN ( SELECT `id` FROM ( SELECT `id` FROM `chatmsgs` WHERE `channel` = '$channel' AND `app` = '$secret' ORDER BY `id` DESC LIMIT 50) foo );");
misc\cache\purge('KeyAuthChatMsgs:' . $secret . ':' . $channel);
die(json_encode(array(
"success" => true,
"message" => "Successfully sent chat message"
)));
case 'log':
- // client isn't expecting a response body, just flush output right away so program can move on to rest of the code quicker
- fastcgi_finish_request();
-
// retrieve session info
$sessionid = misc\etc\sanitize($_POST['sessionid'] ?? $_GET['sessionid']);
$session = api\shared\primary\getSession($sessionid, $secret);
@@ -866,28 +773,11 @@
$msg = misc\etc\sanitize($_POST['message'] ?? $_GET['message']);
- if(is_null($msg)) {
- die();
- }
-
- if(strlen($msg) > 275) {
- die("Log data too long");
- }
-
$pcuser = misc\etc\sanitize($_POST['pcuser'] ?? $_GET['pcuser']);
if (is_null($webhook)) {
- $roleCheck = misc\cache\fetch('KeyAuthSellerCheck:' . $owner, "SELECT `role`,`expires` FROM `accounts` WHERE `username` = ?", [$owner], 0);
- if($roleCheck['role'] == "tester") {
- $query = misc\mysql\query("SELECT count(*) AS 'numLogs' FROM `logs` WHERE `logapp` = ?",[$secret]);
- $row = mysqli_fetch_array($query->result);
- $numLogs = $row["numLogs"];
- if($numLogs >= 20) {
- die();
- }
- }
-
- misc\mysql\query("INSERT INTO `logs` (`logdate`, `logdata`, `credential`, `pcuser`,`logapp`) VALUES (?, ?, NULLIF(?, ''), NULLIF(?, ''), ?)", [$currtime, $msg, $credential, $pcuser, $secret]);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "INSERT INTO `logs` (`logdate`, `logdata`, `credential`, `pcuser`,`logapp`) VALUES ('$currtime','$msg',NULLIF('$credential', ''),NULLIF('$pcuser', ''),'$secret')");
die();
}
@@ -898,6 +788,13 @@
$ip = api\shared\primary\getIp();
$json_data = json_encode([
+ // Username
+ "username" => "KeyAuth",
+
+ // Avatar URL.
+ // Uncoment to replace image set in webhook
+ "avatar_url" => "https://cdn.keyauth.cc/front/assets/img/favicon.png",
+
// Embeds Array
"embeds" => [
[
@@ -943,7 +840,7 @@
$session = api\shared\primary\getSession($sessionid, $secret);
$webid = misc\etc\sanitize($_POST['webid'] ?? $_GET['webid']);
- $row = misc\cache\fetch('KeyAuthWebhook:' . $secret . ':' . $webid, "SELECT `baselink`, `useragent`, `authed` FROM `webhooks` WHERE `webid` = ? AND `app` = ?", [$webid, $secret], 0);
+ $row = misc\cache\fetch('KeyAuthWebhook:' . $secret . ':' . $webid, "SELECT `baselink`, `useragent`, `authed` FROM `webhooks` WHERE `webid` = '$webid' AND `app` = '$secret'", 0);
if ($row == "not_found") {
die(json_encode(array(
"success" => false,
@@ -998,7 +895,7 @@
$fileid = misc\etc\sanitize($_POST['fileid'] ?? $_GET['fileid']);
- $row = misc\cache\fetch('KeyAuthFile:' . $secret . ':' . $fileid, "SELECT `name`, `url`, `authed` FROM `files` WHERE `app` = ? AND `id` = ?", [$secret, $fileid], 0);
+ $row = misc\cache\fetch('KeyAuthFile:' . $secret . ':' . $fileid, "SELECT `name`, `url`, `authed` FROM `files` WHERE `app` = '$secret' AND `id` = '$fileid'", 0);
if ($row == "not_found") {
die(json_encode(array(
@@ -1021,8 +918,8 @@
)));
}
}
-
- ini_set('memory_limit', '-1');
+
+ ini_set('memory_limit', '-1');
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
@@ -1056,25 +953,19 @@
"message" => "$sessionunauthed"
)));
}
+
+ $reason = misc\etc\sanitize($_POST['reason'] ?? $_GET['reason']) ?? "User banned from triggering ban function in the client";
- $reason = misc\etc\sanitize($_POST['reason'] ?? $_GET['reason']) ?? "User banned from triggering ban function in the client";
-
- if(strlen($reason) > 99) {
- die(json_encode(array(
- "success" => false,
- "message" => "Reason must be 99 characters or less"
- )));
- }
-
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
$hwid = misc\etc\sanitize($_POST['hwid'] ?? $_GET['hwid']);
if (!empty($hwid)) {
misc\blacklist\add($hwid, "Hardware ID", $secret);
}
$ip = api\shared\primary\getIp();
- misc\blacklist\add($ip, "IP Address", $secret);
+ misc\blacklist\add($ip, "IP Address", $secret);
- misc\mysql\query("UPDATE `users` SET `banned` = ? WHERE `username` = ? AND `app` = ?", [$reason, $credential, $secret]);
- if ($query->affected_rows != 0) {
+ mysqli_query($link, "UPDATE `users` SET `banned` = '$reason' WHERE `username` = '$credential'");
+ if (mysqli_affected_rows($link) != 0) {
misc\cache\purge('KeyAuthUser:' . $secret . ':' . $credential);
die(json_encode(array(
"success" => true,
@@ -1103,11 +994,11 @@
"message" => "Session is validated."
)));
}
- case 'changeUsername':
+ case 'changeUsername':
$sessionid = misc\etc\sanitize($_POST['sessionid'] ?? $_GET['sessionid']);
$session = api\shared\primary\getSession($sessionid, $secret);
-
- if (!$session["validated"]) {
+
+ if (!$session["validated"]) {
die(json_encode(array(
"success" => false,
"message" => "$sessionunauthed"
@@ -1115,31 +1006,31 @@
}
$credential = $session["credential"];
-
- $resp = misc\user\changeUsername($credential, $_POST['newUsername'] ?? $_GET['newUsername'], $secret);
- switch ($resp) {
- case 'already_used':
- die(json_encode(array(
- "success" => false,
- "message" => "Username already used!"
- )));
- case 'failure':
- die(json_encode(array(
- "success" => false,
- "message" => "Failed to change username!"
- )));
- case 'success':
- misc\session\killSingular($sessionid, $secret);
- die(json_encode(array(
- "success" => true,
- "message" => "Successfully changed username, user logged out."
- )));
- default:
- die(json_encode(array(
- "success" => false,
- "message" => "Unhandled Error! Contact us if you need help"
- )));
- }
+
+ $resp = misc\user\changeUsername($credential, $_POST['newUsername'] ?? $_GET['newUsername'], $secret);
+ switch($resp) {
+ case 'already_used':
+ die(json_encode(array(
+ "success" => false,
+ "message" => "Username already used!"
+ )));
+ case 'failure':
+ die(json_encode(array(
+ "success" => false,
+ "message" => "Failed to change username!"
+ )));
+ case 'success':
+ misc\session\killSingular($sessionid, $secret);
+ die(json_encode(array(
+ "success" => true,
+ "message" => "Successfully changed username, user logged out."
+ )));
+ default:
+ die(json_encode(array(
+ "success" => false,
+ "message" => "Unhandled Error! Contact us if you need help"
+ )));
+ }
default:
die(json_encode(array(
"success" => false,
diff --git a/api/1.2/index.php b/api/1.2/index.php
index 7c701e5..575c3dc 100644
--- a/api/1.2/index.php
+++ b/api/1.2/index.php
@@ -1,42 +1,19 @@
getMessage());
- die(json_encode(array("success" => false, "message" => "Error: " . $errorMsg)));
-});
-
-if(empty(($_POST['ownerid'] ?? $_GET['ownerid']))) {
- die(json_encode(array("success" => false, "message" => "No OwnerID specified. Select app & copy code snippet from https://keyauth.cc/app/")));
-}
-
-if(empty(($_POST['name'] ?? $_GET['name']))) {
- die(json_encode(array("success" => false, "message" => "No app name specified. Select app & copy code snippet from https://keyauth.cc/app/")));
-}
-
-if(strlen(($_POST['ownerid'] ?? $_GET['ownerid'])) != 10) {
- die(json_encode(array("success" => false, "message" => "OwnerID should be 10 characters long. Select app & copy code snippet from https://keyauth.cc/app/")));
+if (isset($_SERVER['HTTP_CDN_HOST'])) { // custom domains https://www.youtube.com/watch?v=a2SROFJ0eYc
+ $row = misc\cache\fetch('KeyAuthApp:' . misc\etc\sanitize($_SERVER['HTTP_CDN_HOST']), "SELECT * FROM `apps` WHERE `customDomainAPI` = '" . misc\etc\sanitize($_SERVER['HTTP_CDN_HOST']) . "'", 0);
+} else {
+ $ownerid = misc\etc\sanitize($_POST['ownerid'] ?? $_GET['ownerid']); // ownerid of account that owns application
+ $name = misc\etc\sanitize($_POST['name'] ?? $_GET['name']); // application name
+ $row = misc\cache\fetch('KeyAuthApp:' . $name . ':' . $ownerid, "SELECT * FROM `apps` WHERE `ownerid` = '$ownerid' AND `name` = '$name'", 0);
}
-if (misc\cache\rateLimit("KeyAuthAppLimit:" . ($_POST['ownerid'] ?? $_GET['ownerid']), 1, 60, 200)) {
- die(json_encode(array("success" => false, "message" => "This application has sent too many requests. Try again in a minute.")));
-}
-
-$ownerid = misc\etc\sanitize($_POST['ownerid'] ?? $_GET['ownerid']); // ownerid of account that owns application
-$name = misc\etc\sanitize($_POST['name'] ?? $_GET['name']); // application name
-$row = misc\cache\fetch('KeyAuthApp:' . $name . ':' . $ownerid, "SELECT * FROM `apps` WHERE `ownerid` = ? AND `name` = ?", [$ownerid, $name], 0);
-
if ($row == "not_found") {
die("KeyAuth_Invalid");
}
@@ -53,10 +30,6 @@
$appdisabled = $row['appdisabled'];
$hashcheck = $row['hashcheck'];
$serverhash = $row['hash'];
-$sessionexpiry = $row['session'];
-$forceEncryption = $row['forceEncryption'];
-$forceHwid = $row['forceHwid'];
-$tokensystem = $row['tokensystem'];
$banned = $row['banned'];
$owner = $row['owner'];
@@ -73,12 +46,15 @@
$noactivesubs = $row['noactivesubs'];
$hwidblacked = $row['hwidblacked'];
$pausedsub = $row['pausedsub'];
+$keyexpired = $row['keyexpired'];
$vpnblocked = $row['vpnblocked'];
$keybanned = $row['keybanned'];
$userbanned = $row['userbanned'];
$sessionunauthed = $row['sessionunauthed'];
$hashcheckfail = $row['hashcheckfail'];
-$invalid_token = $row['tokeninvalid'];
+$sessionexpiry = $row['session'];
+$killOtherSessions = $row['killOtherSessions'];
+$forceEncryption = $row['forceEncryption'];
// why using null coalescing operators? because if I add a field and it's not in redis cache, it'll be NULL
$loggedInMsg = $row['loggedInMsg'] ?? "Logged in!";
@@ -86,19 +62,6 @@
$unTooShort = $row['unTooShort'] ?? "Username too short, try longer one.";
$pwLeaked = $row['pwLeaked'] ?? "This password has been leaked in a data breach (not from us), please use a different one.";
$chatHitDelay = $row['chatHitDelay'] ?? "Chat slower, you've hit the delay limit";
-$minHwid = $row['minHwid'] ?? 20;
-
-if($ownerid == "hTmfnZOYPe") {
- $response = json_encode(array(
- "success" => false,
- "message" => "Jao é um golpista, prova aqui https://keyauth.cc/jao/"
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
-}
if ($banned) {
die(json_encode(array(
@@ -109,18 +72,6 @@
switch ($_POST['type'] ?? $_GET['type']) {
case 'init':
- if(strlen($_POST['enckey']) > 35) {
- $response = json_encode(array(
- "success" => false,
- "message" => "The paramater \"enckey\" is too long. Must be 35 characters or less."
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
- }
-
if ($forceEncryption) {
if (!isset($_POST['enckey']) && !isset($_GET['enckey'])) {
$response = json_encode(array(
@@ -137,18 +88,18 @@
$ip = api\shared\primary\getIp();
if ($vpnblock) {
if (api\shared\primary\vpnCheck($ip)) {
- $row = misc\cache\fetch('KeyAuthWhitelist:' . $secret . ':' . $ip, "SELECT 1 FROM `whitelist` WHERE `ip` = ? AND `app` = ?", [$ip, $secret], 0);
- if ($row == "not_found") {
- $response = json_encode(array(
- "success" => false,
- "message" => "$vpnblocked"
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
- }
+ $row = misc\cache\fetch('KeyAuthWhitelist:' . $secret . ':' . $ip, "SELECT 1 FROM `whitelist` WHERE `ip` = '$ip' AND `app` = '$secret'", 0);
+ if($row == "not_found") {
+ $response = json_encode(array(
+ "success" => false,
+ "message" => "$vpnblocked"
+ ));
+
+ $sig = hash_hmac('sha256', $response, $secret);
+ header("signature: {$sig}");
+
+ die($response);
+ }
}
}
@@ -176,93 +127,8 @@
die($response);
}
- if ($tokensystem) {
-
- list($token, $thash) = [misc\etc\sanitize($_POST["token"] ?? $_GET["token"]) , misc\etc\sanitize($_POST["thash"] ?? $_GET["thash"])];
-
- if (!isset($token)) {
-
- $response = json_encode(array(
- "success" => false,
- "message" => "Token Must Be Provided"
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
- }
-
- if (!isset($thash)) {
- $response = json_encode(array(
- "success" => false,
- "message" => "Hash Must Be Provided"
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
- }
-
- $verification = misc\token\checktoken("check_data", $token, $secret, null, $thash);
-
- switch ($verification) {
- case str_contains($verification, 'token_blacklisted'):
- $reason = str_ireplace("token_blacklisted, ", "", $verification);
- $response = json_encode(array(
- "success" => false,
- "message" => "The Token Has Been Blacklisted For The Following Reason: " . $reason . " Contact Application Developer If This Is A Mistake"
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
- case 'invalid_token':
-
- $response = json_encode(array(
- "success" => false,
- "message" => $invalid_token
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
-
- case 'hash_mismatch':
-
- $response = json_encode(array(
- "success" => false,
- "message" => "Token File Hashes Must Be The Same"
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
-
- case 'success':
- break;
-
- default:
-
- $response = json_encode(array(
- "success" => false,
- "message" => "Unknown Error Occured"
- ));
-
- $sig = hash_hmac('sha256', $response, $secret);
- header("signature: {$sig}");
-
- die($response);
-
- }
- }
-
$ver = misc\etc\sanitize($_POST['ver'] ?? $_GET['ver']);
- if (!empty($ver)) {
+ if (is_numeric($ver)) {
if ($ver != $currentver) {
// auto-update system
$response = json_encode(array(
@@ -283,7 +149,8 @@
if ($hashcheck) {
if (strpos($serverhash, $hash) === false) {
if (is_null($serverhash)) {
- misc\mysql\query("UPDATE `apps` SET `hash` = ? WHERE `secret` = ?", [$hash, $secret]);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "UPDATE `apps` SET `hash` = '$hash' WHERE `secret` = '$secret'");
misc\cache\purge('KeyAuthApp:' . $name . ':' . $ownerid); // flush cache for application so new hash takes precedent
} else {
$response = json_encode(array(
@@ -300,56 +167,47 @@
}
$enckey = !is_null($_POST['enckey'] ?? $_GET['enckey']) ? misc\etc\sanitize($_POST['enckey'] ?? $_GET['enckey']) . "-" . $secret : NULL;
- $newSession = false;
- $duplicateSession = misc\cache\select("KeyAuthSessionDupe:$secret:$ip");
- if($duplicateSession) {
- $sessionid = $duplicateSession;
-
- $updateSession = misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 0, "enckey" => $enckey));
- if(!$updateSession) {
- $sessionid = misc\etc\generateRandomString();
- $newSession = true;
+ $sessionid = misc\etc\generateRandomString();
+
+ if (is_null($enckey)) {
+ $row = misc\cache\fetch('KeyAuthStateDuplicates:' . $secret . ':' . $ip, "SELECT `id`, `expiry` FROM `sessions` WHERE `app` = '$secret' AND `ip` = '$ip' AND `validated` = 0 AND `expiry` > " . time() . " LIMIT 1", 0);
+ if ($row != "not_found") {
+ $sessionid = $row['id'];
+ goto dupe;
}
}
- else {
- $sessionid = misc\etc\generateRandomString();
- $newSession = true;
- }
+ // session init
+ $time = time() + $sessionexpiry;
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ mysqli_query($link, "INSERT INTO `sessions` (`id`, `app`, `expiry`, `created_at`, `enckey`, `ip`) VALUES ('$sessionid','$secret', '$time', '".time()."', NULLIF('$enckey', ''), '$ip')");
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
+
+ dupe:
- // $row = misc\cache\fetch('KeyAuthAppStats:' . $secret, "SELECT (SELECT COUNT(1) FROM `users` WHERE `app` = ?) AS 'numUsers', (SELECT COUNT(1) FROM `sessions` WHERE `app` = ? AND `validated` = 1 AND `expiry` > ?) AS 'numOnlineUsers', (SELECT COUNT(1) FROM `keys` WHERE `app` = ?) AS 'numKeys' FROM dual", [$secret, $secret, time(), $secret], 0, 3600);
+ $row = misc\cache\fetch('KeyAuthAppStats:' . $secret, "SELECT(select count(1) FROM `users` WHERE `app` = '$secret') AS 'numUsers',(select count(1) FROM `sessions` WHERE `app` = '$secret' AND `validated` = 1 AND `expiry` > " . time() . ") AS 'numOnlineUsers',(select count(1) FROM `keys` WHERE `app` = '$secret') AS 'numKeys';", 0, 1800);
- $numUsers = "N/A - Use fetchStats() function in latest example";
- $numOnlineUsers = "N/A - Use fetchStats() function in latest example";
- $numKeys = "N/A - Use fetchStats() function in latest example";
+ $numUsers = $row['numUsers'];
+ $numOnlineUsers = $row['numOnlineUsers'];
+ $numKeys = $row['numKeys'];
$resp = json_encode(array(
"success" => true,
"message" => "Initialized",
"sessionid" => $sessionid,
"appinfo" => array(
- "numUsers" => "$numUsers",
- "numOnlineUsers" => "$numOnlineUsers",
- "numKeys" => "$numKeys",
- "version" => "$currentver",
+ "numUsers" => $numUsers,
+ "numOnlineUsers" => $numOnlineUsers,
+ "numKeys" => $numKeys,
+ "version" => $currentver,
"customerPanelLink" => "https://keyauth.cc/panel/$owner/$name/"
),
- "newSession" => $newSession,
- "nonce" => misc\etc\generateRandomString(32)
+ "nonce" => misc\etc\generateRandomString(32)
));
$sig = !is_null($enckey) ? hash_hmac('sha256', $resp, $secret) : 'No encryption key supplied';
header("signature: {$sig}");
- echo $resp;
-
- fastcgi_finish_request();
-
- if($newSession) {
- misc\cache\insert("KeyAuthState:$secret:$sessionid", serialize(array("credential" => NULL, "enckey" => $enckey, "validated" => 0)), $sessionexpiry);
- $time = time() + $sessionexpiry;
- misc\mysql\query("INSERT INTO `sessions` (`id`, `app`, `expiry`, `created_at`, `enckey`, `ip`) VALUES (?, ?, ?, ?, NULLIF(?, ''), ?)", [$sessionid, $secret, $time, time(), $enckey, $ip]);
- misc\cache\insert("KeyAuthSessionDupe:$secret:$ip", $sessionid, $sessionexpiry);
- }
+ die($resp);
case 'register':
// retrieve session info
@@ -360,44 +218,18 @@
// Read in username
$username = misc\etc\sanitize($_POST['username'] ?? $_GET['username']);
- if(strlen($username) > 70) {
- $response = json_encode(array(
- "success" => false,
- "message" => "Username must be shorter than 70 characters"
- ));
-
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
- header("signature: {$sig}");
-
- die($response);
- }
-
// Read in license key
$checkkey = misc\etc\sanitize($_POST['key'] ?? $_GET['key']);
- if(strlen($checkkey) > 70) {
- $response = json_encode(array(
- "success" => false,
- "message" => "Key must be shorter than 70 characters"
- ));
-
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
- header("signature: {$sig}");
-
- die($response);
- }
-
// Read in password
$password = misc\etc\sanitize($_POST['pass'] ?? $_GET['pass']);
-
- // Read in email
+
+ // Read in email
$email = misc\etc\sanitize($_POST['email'] ?? $_GET['email']);
// Read in hwid
$hwid = misc\etc\sanitize($_POST['hwid'] ?? $_GET['hwid']);
- $registerSuccess = false;
-
$resp = api\v1_0\register($username, $checkkey, $password, $email, $hwid, $secret);
switch ($resp) {
case 'username_taken':
@@ -431,9 +263,10 @@
));
break;
case 'key_banned':
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
if (strpos($keybanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `keys` WHERE `app` = ? AND `key` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ $result = mysqli_query($link, "SELECT `banned` FROM `keys` WHERE `app` = '$secret' AND `key` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$keybanned = str_replace("{reason}", $reason, $keybanned);
}
@@ -455,28 +288,28 @@
));
break;
default:
- $registerSuccess = true;
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$username' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `credential` = '$username',`validated` = 1 WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
+ $ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
$response = json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
"info" => $resp,
- "nonce" => misc\etc\generateRandomString(32)
+ "nonce" => misc\etc\generateRandomString(32)
));
break;
}
$sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
header("signature: {$sig}");
- echo $response;
-
- fastcgi_finish_request();
-
- if ($registerSuccess) {
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $username));
- misc\mysql\query("UPDATE `sessions` SET `credential` = ?,`validated` = 1 WHERE `id` = ?", [$username, $sessionid]);
- }
- die();
+ die($response);
case 'upgrade':
// retrieve session info
$sessionid = misc\etc\sanitize($_POST['sessionid'] ?? $_GET['sessionid']);
@@ -489,12 +322,13 @@
// Read in key
$checkkey = misc\etc\sanitize($_POST['key'] ?? $_GET['key']);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
// search for key
- $query = misc\mysql\query("SELECT `banned`, `expires`, `status`, `level` FROM `keys` WHERE `key` = ? AND `app` = ?", [$checkkey, $secret]);
+ $result = mysqli_query($link, "SELECT `banned`, `expires`, `status`, `level` FROM `keys` WHERE `key` = '$checkkey' AND `app` = '$secret'");
// check if key exists
- if ($query->num_rows < 1) {
+ if (mysqli_num_rows($result) < 1) {
$response = json_encode(array(
"success" => false,
"message" => "$keynotfound"
@@ -507,10 +341,10 @@
}
// if key does exist
- elseif ($query->num_rows > 0) {
+ elseif (mysqli_num_rows($result) > 0) {
// get key info
- while ($row = mysqli_fetch_array($query->result)) {
+ while ($row = mysqli_fetch_array($result)) {
$expires = $row['expires'];
$status = $row['status'];
$level = $row['level'];
@@ -531,9 +365,9 @@
}
if (!is_null($banned)) {
- if (strpos($keybanned, '{reason}') !== false) {
- $keybanned = str_replace("{reason}", $banned, $keybanned);
- }
+ if (strpos($keybanned, '{reason}') !== false) {
+ $keybanned = str_replace("{reason}", $banned, $keybanned);
+ }
$response = json_encode(array(
"success" => false,
"message" => "$keybanned"
@@ -548,8 +382,8 @@
// add current time to key time
$expiry = $expires + time();
- $query = misc\mysql\query("SELECT `name` FROM `subscriptions` WHERE `app` = ? AND `level` = ?", [$secret, $level]);
- $subName = mysqli_fetch_array($query->result)['name'];
+ $result = mysqli_query($link, "SELECT `name` FROM `subscriptions` WHERE `app` = '$secret' AND `level` = '$level'");
+ $subName = mysqli_fetch_array($result)['name'];
$resp = misc\user\extend($username, $subName, $expiry, 0, $secret);
switch ($resp) {
@@ -573,13 +407,13 @@
break;
case 'success':
// set key to used, and set usedby
- misc\mysql\query("UPDATE `keys` SET `status` = 'Used', `usedon` = ?, `usedby` = ? WHERE `key` = ? AND `app` = ?", [time(), $username, $checkkey, $secret]);
+ mysqli_query($link, "UPDATE `keys` SET `status` = 'Used', `usedon` = '" . time() . "', `usedby` = '$username' WHERE `key` = '$checkkey'");
misc\cache\purge('KeyAuthKeys:' . $secret . ':' . $checkkey);
- misc\cache\purge('KeyAuthSubs:' . $secret . ':' . $username);
+ misc\cache\purge('KeyAuthSubs:' . $secret . ':' . $username);
$response = json_encode(array(
"success" => true,
"message" => "Upgraded successfully",
- "nonce" => misc\etc\generateRandomString(32)
+ "nonce" => misc\etc\generateRandomString(32)
));
break;
default:
@@ -612,30 +446,6 @@
// optional param for web loader
$token = misc\etc\sanitize($_POST['token'] ?? $_GET['token']);
- if(strlen($hwid) < $minHwid && !is_null($hwid)) {
- $response = json_encode(array(
- "success" => false,
- "message" => "HWID must be {$minHwid} or more characters, change this in app settings."
- ));
-
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
- header("signature: {$sig}");
-
- die($response);
- }
-
- if($forceHwid && is_null($hwid)) {
- $response = json_encode(array(
- "success" => false,
- "message" => "Force HWID is enabled, disable in app settings if you want to use blank HWIDs"
- ));
-
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
- header("signature: {$sig}");
-
- die($response);
- }
-
$resp = api\v1_0\login($username, $password, $hwid, $secret, $hwidenabled, $token);
switch ($resp) {
case 'un_not_found':
@@ -652,8 +462,9 @@
break;
case 'user_banned':
if (strpos($userbanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `users` WHERE `app` = ? AND `username` = ?", [$secret, $username]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `users` WHERE `app` = '$secret' AND `username` = '$username'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$userbanned = str_replace("{reason}", $reason, $userbanned);
}
@@ -687,17 +498,23 @@
));
break;
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$username, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $username));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$username' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$username' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
$ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
$response = json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
"info" => $resp,
- "nonce" => misc\etc\generateRandomString(32)
+ "nonce" => misc\etc\generateRandomString(32)
));
- break;
+ break;
}
$sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : 'No encryption key supplied';
header("signature: {$sig}");
@@ -710,44 +527,8 @@
$enckey = $session["enckey"];
$checkkey = misc\etc\sanitize($_POST['key'] ?? $_GET['key']);
- if(strlen($checkkey) > 70) {
- $response = json_encode(array(
- "success" => false,
- "message" => "Key must be shorter than 70 characters"
- ));
-
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
- header("signature: {$sig}");
-
- die($response);
- }
-
$hwid = misc\etc\sanitize($_POST['hwid'] ?? $_GET['hwid']);
- if(strlen($hwid) < $minHwid && !is_null($hwid)) {
- $response = json_encode(array(
- "success" => false,
- "message" => "HWID must be {$minHwid} or more characters, change this in app settings."
- ));
-
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
- header("signature: {$sig}");
-
- die($response);
- }
-
- if($forceHwid && is_null($hwid)) {
- $response = json_encode(array(
- "success" => false,
- "message" => "Force HWID is enabled, disable in app settings if you want to use blank HWIDs"
- ));
-
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : NULL;
- header("signature: {$sig}");
-
- die($response);
- }
-
$resp = api\v1_0\login($checkkey, $checkkey, $hwid, $secret, $hwidenabled);
switch ($resp) {
@@ -762,8 +543,9 @@
break;
case 'user_banned':
if (strpos($userbanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `users` WHERE `app` = ? AND `username` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `users` WHERE `app` = '$secret' AND `username` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$userbanned = str_replace("{reason}", $reason, $userbanned);
}
@@ -797,15 +579,21 @@
));
break;
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$checkkey, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $checkkey));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$checkkey' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$checkkey' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
$ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
$response = json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
"info" => $resp,
- "nonce" => misc\etc\generateRandomString(32)
+ "nonce" => misc\etc\generateRandomString(32)
));
break;
}
@@ -851,8 +639,9 @@
break;
case 'key_banned':
if (strpos($keybanned, '{reason}') !== false) {
- $query = misc\mysql\query("SELECT `banned` FROM `keys` WHERE `app` = ? AND `key` = ?", [$secret, $checkkey]);
- $row = mysqli_fetch_array($query->result);
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ $result = mysqli_query($link, "SELECT `banned` FROM `keys` WHERE `app` = '$secret' AND `key` = '$checkkey'");
+ $row = mysqli_fetch_array($result);
$reason = $row['banned'];
$keybanned = str_replace("{reason}", $reason, $keybanned);
}
@@ -874,13 +663,21 @@
));
break;
default:
- misc\mysql\query("UPDATE `sessions` SET `validated` = 1,`credential` = ? WHERE `id` = ?", [$checkkey, $sessionid]);
- misc\cache\update('KeyAuthState:'.$secret.':'.$sessionid.'', array("validated" => 1, "credential" => $checkkey));
+ include_once (($_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/panel" || $_SERVER['DOCUMENT_ROOT'] == "/usr/share/nginx/html/api") ? "/usr/share/nginx/html" : $_SERVER['DOCUMENT_ROOT']) . '/includes/connection.php'; // create connection with MySQL
+ if ($killOtherSessions) {
+ mysqli_query($link, "DELETE FROM `sessions` WHERE `id` != '$sessionid' AND `credential` = '$checkkey' AND `app` = '$secret'");
+ misc\cache\purgePattern('KeyAuthState:' . $secret);
+ }
+ mysqli_query($link, "UPDATE `sessions` SET `validated` = 1,`credential` = '$checkkey' WHERE `id` = '$sessionid'");
+ misc\cache\purge('KeyAuthState:' . $secret . ':' . $sessionid);
+
+ $ip = api\shared\primary\getIp();
+ misc\cache\purge('KeyAuthStateDuplicates:' . $secret . ':' . $ip);
$response = json_encode(array(
"success" => true,
"message" => "$loggedInMsg",
"info" => $resp,
- "nonce" => misc\etc\generateRandomString(32)
+ "nonce" => misc\etc\generateRandomString(32)
));
}
$sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : 'No encryption key supplied';
@@ -891,79 +688,67 @@
$sessionid = misc\etc\sanitize($_POST['sessionid'] ?? $_GET['sessionid']);
$session = api\shared\primary\getSession($sessionid, $secret);
$enckey = $session["enckey"];
+
+ $un = misc\etc\sanitize($_POST['username'] ?? $_GET['username']);
+ $email = strtolower(misc\etc\sanitize($_POST['email'] ?? $_GET['email']));
- $un = misc\etc\sanitize($_POST['username'] ?? $_GET['username']);
- $email = strtolower(misc\etc\sanitize($_POST['email'] ?? $_GET['email']));
-
- $row = misc\cache\fetch('KeyAuthUser:' . $secret . ':' . $un, "SELECT * FROM `users` WHERE `username` = ? AND `app` = ?", [$un, $secret], 0);
- if ($row == "not_found") {
- $response = json_encode(array(
+ $row = misc\cache\fetch('KeyAuthUser:' . $secret . ':' . $un, "SELECT * FROM `users` WHERE `username` = '$un' AND `app` = '$secret'", 0);
+ if ($row == "not_found") {
+ $response = json_encode(array(
"success" => false,
"message" => "No user found with that username!"
));
- $sig = !is_null($enckey) ? hash_hmac('sha256', $response, $enckey) : 'No encryption key supplied';
- header("signature: {$sig}");
-
- die($response);
- }
-
- $emailHashed = $row['email'];
-
- if (sha1($email) != $emailHashed) {
- if(is_null($emailHashed)) {
- $response = json_encode(array(
- "success" => false,
- "message" => "Email address not provided during register, ask developer to edit your account and change email."
- ));
- }
- else {
- $response = json_encode(array(
- "success" => false,
- "message" => "Email address doesn't match!"
- ));
- }
- } else {
- $algos = array(
- 'ripemd128',
- 'md5',
- 'md4',
- 'tiger128,4',
- 'haval128,3',
- 'haval128,4',
- 'haval128,5'
- );
- $emailSecret = hash($algos[array_rand($algos)], misc\etc\generateRandomString());
-
- misc\mysql\query("INSERT INTO `resetUsers` (`secret`, `email`, `username`, `app`, `time`) VALUES (?, SHA1(?), ?, ?, ?)", [$emailSecret, $email, $un, $secret, time()]);
-
- $body = '
-
Hello '.$un.',
-
You recently requested to reset your password for the software '.$name.'. Use the button below to reset it. The link is only valid for the next 24 hours.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/app/layout/_footer.php b/app/layout/_footer.php
new file mode 100644
index 0000000..5982213
--- /dev/null
+++ b/app/layout/_footer.php
@@ -0,0 +1,16 @@
+
+
+
\ No newline at end of file
diff --git a/app/layout/_loader.php b/app/layout/_loader.php
new file mode 100644
index 0000000..7187055
--- /dev/null
+++ b/app/layout/_loader.php
@@ -0,0 +1,9 @@
+
+
+
+
+
+ Loading...
+
+
+
\ No newline at end of file
diff --git a/app/layout/_scrolltop.php b/app/layout/_scrolltop.php
new file mode 100644
index 0000000..a9d0a55
--- /dev/null
+++ b/app/layout/_scrolltop.php
@@ -0,0 +1,14 @@
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/app/layout/aside.php b/app/layout/aside.php
deleted file mode 100644
index f78d9d5..0000000
--- a/app/layout/aside.php
+++ /dev/null
@@ -1,190 +0,0 @@
-
-
-
-
-
diff --git a/app/layout/aside/_base.php b/app/layout/aside/_base.php
new file mode 100644
index 0000000..e32e62e
--- /dev/null
+++ b/app/layout/aside/_base.php
@@ -0,0 +1,53 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/app/layout/aside/_menu.php b/app/layout/aside/_menu.php
new file mode 100644
index 0000000..64bfac9
--- /dev/null
+++ b/app/layout/aside/_menu.php
@@ -0,0 +1,348 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/app/layout/header/_menu.php b/app/layout/header/_menu.php
new file mode 100644
index 0000000..9b1c19d
--- /dev/null
+++ b/app/layout/header/_menu.php
@@ -0,0 +1,31 @@
+
+
+
+
\ No newline at end of file
diff --git a/app/layout/topbar/partials/_user-menu.php b/app/layout/topbar/partials/_user-menu.php
new file mode 100644
index 0000000..4d8b78a
--- /dev/null
+++ b/app/layout/topbar/partials/_user-menu.php
@@ -0,0 +1,43 @@
+
+