86 lines
2.6 KiB
PHP
86 lines
2.6 KiB
PHP
|
<?php
|
||
|
|
if (!defined('SVRJS_MOD_DIRECTORY')) die;
|
||
|
|
if (!defined('SVRJS_MOD_DIRECTORY_MODERATION')) die;
|
||
|
|
|
||
|
|
// THIS PHP SCRIPT INCLUDE IS JUST FOR HTML PAGES! IT'S NOT INTENDED FOR OTHER FORMATS
|
||
|
|
ob_start();
|
||
|
|
|
||
|
|
// Enable session strict mode
|
||
|
|
ini_set('session.use_strict_mode', '1');
|
||
|
|
|
||
|
|
// Set session cookie flags
|
||
|
|
ini_set('session.cookie_httponly', '1');
|
||
|
|
if (isset($_SERVER['HTTPS'])) ini_set('session.cookie_secure', '1');
|
||
|
|
|
||
|
|
// Register the custom session handler
|
||
|
|
$sessionHandler = new MySQLSessionHandler($connection);
|
||
|
|
session_set_save_handler(
|
||
|
|
array($sessionHandler, 'open'),
|
||
|
|
array($sessionHandler, 'close'),
|
||
|
|
array($sessionHandler, 'read'),
|
||
|
|
array($sessionHandler, 'write'),
|
||
|
|
array($sessionHandler, 'destroy'),
|
||
|
|
array($sessionHandler, 'gc'),
|
||
|
|
array($sessionHandler, 'create_sid'),
|
||
|
|
array($sessionHandler, 'validate_sid')
|
||
|
|
);
|
||
|
|
|
||
|
|
if (session_start()) {
|
||
|
|
setupHeaders();
|
||
|
|
if (isset($_SESSION['user'])) {
|
||
|
|
$statement = $connection->prepare("SELECT id, username, is_moderator FROM users WHERE id = ? AND is_suspended = 0 AND is_deleted = 0 AND is_verified = 1");
|
||
|
|
if (!$statement) {
|
||
|
|
unset($_SESSION['user']);
|
||
|
|
} else {
|
||
|
|
$statement->bind_param("i", $_SESSION['user']);
|
||
|
|
$statement->execute();
|
||
|
|
|
||
|
|
$result = $statement->get_result();
|
||
|
|
if (!$result) {
|
||
|
|
unset($_SESSION['user']);
|
||
|
|
} else {
|
||
|
|
$row = $result->fetch_assoc();
|
||
|
|
if (!$row) {
|
||
|
|
unset($_SESSION['user']);
|
||
|
|
} elseif (!$row['is_moderator']) {
|
||
|
|
http_response_code(403);
|
||
|
|
include 'moderation_notallowed.php';
|
||
|
|
include 'moderation_final.php';
|
||
|
|
include 'final.php';
|
||
|
|
exit();
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
if (!isset($_SESSION['user'])) {
|
||
|
|
http_response_code(403);
|
||
|
|
include 'moderation_notallowed.php';
|
||
|
|
include 'moderation_final.php';
|
||
|
|
include 'final.php';
|
||
|
|
exit();
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
setupHeaders();
|
||
|
|
http_response_code(403);
|
||
|
|
include 'moderation_notallowed.php';
|
||
|
|
include 'moderation_final.php';
|
||
|
|
include 'final.php';
|
||
|
|
exit();
|
||
|
|
}
|
||
|
|
|
||
|
|
$csrfToken = "";
|
||
|
|
if (isset($_SESSION['moderation_csrf'])) {
|
||
|
|
$csrfToken = $_SESSION['moderation_csrf'];
|
||
|
|
} else {
|
||
|
|
if (function_exists('random_bytes')) {
|
||
|
|
$csrfToken = bin2hex(random_bytes(32));
|
||
|
|
} else {
|
||
|
|
$csrfToken = '';
|
||
|
|
for ($i = 0; $i < 32; $i++) {
|
||
|
|
$csrfToken = $csrfToken . bin2hex(rand(0, 255));
|
||
|
|
}
|
||
|
|
}
|
||
|
|
$_SESSION['moderation_csrf'] = $csrfToken;
|
||
|
|
}
|