public function __construct()
 {
     parent::__construct();
     $log_details = new stdClass();
     stdlog($log_details);
     unset($log_details);
 }

 public function __construct()
 {
     parent::__construct();
     // log the attempt
     $log_details = new stdClass();
     $log_details->severity = 6;
     stdlog($log_details);
     unset($log_details);
 }

 public function __construct()
 {
     parent::__construct();
     // must be an admin to access this page
     if ($this->user->admin != 'y') {
         if (isset($_SERVER['HTTP_REFERER']) and $_SERVER['HTTP_REFERER'] > "") {
             redirect($_SERVER['HTTP_REFERER']);
         } else {
             redirect('main/list_groups');
         }
     }
     $this->load->helper(array('form', 'url'));
     // log the attempt
     $log_details = new stdClass();
     stdlog($log_details);
     unset($log_details);
 }

 public function __construct()
 {
     parent::__construct();
     // log the attempt
     stdlog();
     # ensure our URL doesn't have a trailing / as this may break image (and other) relative paths
     $this->load->helper('url');
     if (strrpos($_SERVER['REQUEST_URI'], '/') === strlen($_SERVER['REQUEST_URI']) - 1) {
         redirect(uri_string());
     }
     $this->load->helper('input');
     $this->load->helper('output');
     $this->load->helper('error');
     $this->load->model('m_networks');
     inputRead();
     $this->output->url = $this->config->item('oa_web_index');
 }

 public function activate_group()
 {
     $log_details = new stdClass();
     if ($handle = opendir(BASEPATH . '../application/controllers/groups')) {
         $i = 0;
         $this->load->model("m_oa_group");
         while (false !== ($file = readdir($handle))) {
             if (mb_strpos($file, ".xml") !== false) {
                 $group_name = '';
                 $file_handle = fopen(BASEPATH . '../application/controllers/groups/' . $file, "rb");
                 $contents = fread($file_handle, filesize(BASEPATH . '../application/controllers/groups/' . $file));
                 try {
                     $xml = @new SimpleXMLElement($contents);
                 } catch (Exception $error) {
                     // $errors = libxml_get_errors();
                     // print_r($errors);
                     $log_details->message = "Invalid XML for group in file " . BASEPATH . '../application/controllers/groups/' . $file;
                     $log_details->file = 'system';
                     stdlog($log_details);
                     continue;
                 }
                 $group_name = $xml->details->group_name;
                 $group_icon = $xml->details->group_icon;
                 $group_description = $xml->details->group_description;
                 unset($xml);
                 fclose($file_handle);
                 $this->data['query'][$i]['file'] = $file;
                 $this->data['query'][$i]['group_name'] = $group_name;
                 $this->data['query'][$i]['group_icon'] = $group_icon;
                 $this->data['query'][$i]['group_description'] = $group_description;
                 $this->data['query'][$i]['activated'] = $this->m_oa_group->get_group_id($group_name);
                 $i++;
                 // echo "$file<br />\n";
             }
         }
         closedir($handle);
     }
     $this->data['heading'] = 'Activate Groups';
     $this->data['include'] = 'v_add_groups';
     $this->data['sortcolumn'] = '1';
     $this->load->view('v_template', $this->data);
 }

 public function __construct()
 {
     parent::__construct();
     $this->load->library('session');
     $this->load->helper('url');
     $this->load->helper('form');
     $this->load->helper('log');
     $this->load->model('m_oa_config');
     $this->m_oa_config->load_config();
     $this->load->helper('report_helper');
     check_default_reports();
     $this->load->helper('group_helper');
     if ($this->config->config['internal_version'] >= '20160620') {
         check_default_groups();
     }
     // log the attempt
     $log_details = new stdClass();
     $log_details->severity = 6;
     stdlog($log_details);
     unset($log_details);
 }

 function log_error($error_code, $model = '')
 {
     $CI =& get_instance();
     # ensure we have an array in the $response object to hold our error
     if (!empty($CI->response)) {
         if (!isset($CI->response->errors) or is_null($CI->response->errors)) {
             $CI->response->errors = array();
         }
     }
     # this object will hold this specific error data and be added to the above array at the end
     $error = new stdClass();
     $error->code = $error_code;
     $error->file = 'system';
     $error->model = $model;
     if (function_exists('getError')) {
         $error = getError($error->code);
         $error->message = $error->title;
     }
     // log the details of the error to the log file
     stdlog($error);
     if (!empty($error->controller) and !empty($eror->function)) {
         $error->controller = $error->controller . '::' . $error->function;
     } else {
         $error->controller = '';
     }
     unset($error->function);
     // if the error is severe enough, set the error in the response object
     if (isset($error->severity) and $error->severity <= 3) {
         error_reporting(E_ALL);
         unset($error->file);
         # we don't care about where this was logged (into which file)
         unset($error->message);
         # this is for logging only and is already contained in the $error->title
         $error->link = $CI->config->config['oa_web_folder'] . '/index.php/errors/' . $error->code;
         if (!empty($CI->response)) {
             $CI->response->errors[] = $error;
             $CI->response->meta->header = $error->status;
         }
     }
 }

 public function __construct()
 {
     parent::__construct();
     // log the attempt
     stdlog();
     # ensure our URL doesn't have a trailing / as this may break image (and other) relative paths
     $this->load->helper('url');
     if (strrpos($_SERVER['REQUEST_URI'], '/') === strlen($_SERVER['REQUEST_URI']) - 1) {
         redirect(uri_string());
     }
     $this->load->helper('network');
     $this->load->helper('output');
     $this->load->helper('error');
     $this->load->helper('input');
     $this->load->model('m_devices');
     $this->load->model('m_orgs');
     inputRead();
     $this->output->url = $this->config->item('oa_web_index');
     if ($this->response->meta->id != '') {
         $access_level = $this->m_devices->get_user_device_org_access();
         if ($access_level < 1) {
             // we should determine if the device does actually exist or not
             // then we can throw the correct status code of 404 or 403
             $sql = "SELECT system.id FROM system WHERE system.id = ?";
             $data = array($this->response->meta->id);
             $query = $this->db->query($sql, $data);
             $result = $query->result();
             if (count($result) == 0) {
                 $this->response->errors[] = getError('ERR-0007');
             } else {
                 $this->response->errors[] = getError('ERR-0008');
             }
             $this->response->meta->header = $this->response->errors[0]->status;
             output($this->response);
             exit;
         }
     }
 }

 function snmp_audit($ip, $credentials, $display)
 {
     error_reporting(E_ALL);
     $CI =& get_instance();
     $log = new stdClass();
     $log->file = 'system';
     $log->severity = 7;
     if ($display == 'y') {
         $log->display = 'y';
     } else {
         $log->display = 'n';
     }
     if (!extension_loaded('snmp')) {
         $log->message = 'SNMP PHP function not loaded hence not attempting to run snmp_helper::snmp_audit function';
         $log->severity = 5;
         stdlog($log);
         unset($log);
         return false;
     } else {
         $log->message = 'SNMP PHP function loaded and attempting to run snmp_helper::snmp_audit function';
         stdlog($log);
     }
     # we need an ip address
     if (empty($ip)) {
         $log->message = 'SNMP command received no ip address';
         $log->severity = 5;
         stdlog($log);
         unset($log);
         return false;
     } elseif (!filter_var($ip, FILTER_VALIDATE_IP)) {
         $log->message = 'SNMP command received invalid ip address';
         $log->severity = 5;
         stdlog($log);
         unset($log);
         return false;
     } else {
         $log->message = 'snmp_helper::snmp_audit function received ip ' . $ip;
         stdlog($log);
     }
     if (empty($credentials) or !is_object($credentials)) {
         $log->message = 'SNMP snmp_helper::snmp_audit received no credentials for ' . $ip;
         $log->severity = 5;
         stdlog($log);
         unset($log);
         return false;
     } else {
         $log->message = 'snmp_helper::snmp_audit function received credentials for ip ' . $ip;
         stdlog($log);
     }
     # new in 1.5 - remove the type from the returned SNMP query.
     # this affects the snmp_clean function in this file
     snmp_set_valueretrieval(SNMP_VALUE_PLAIN);
     snmp_set_oid_output_format(SNMP_OID_OUTPUT_NUMERIC);
     $details = new stdClass();
     $module = new stdclass();
     $return_ips = new stdClass();
     $return_ips->item = array();
     $details->ip = (string) $ip;
     $details->manufacturer = '';
     $details->serial = '';
     $details->model = '';
     $details->type = '';
     $details->sysDescr = my_snmp_get($ip, $credentials, "1.3.6.1.2.1.1.1.0");
     $details->description = $details->sysDescr;
     $details->sysContact = my_snmp_get($ip, $credentials, "1.3.6.1.2.1.1.4.0");
     $details->contact = $details->sysContact;
     $details->sysName = my_snmp_get($ip, $credentials, "1.3.6.1.2.1.1.5.0");
     $details->hostname = $details->sysName;
     $details->name = $details->sysName;
     $details->sysLocation = my_snmp_get($ip, $credentials, "1.3.6.1.2.1.1.6.0");
     $details->location = $details->sysLocation;
     // uptime
     $details->sysUpTime = intval(my_snmp_get($ip, $credentials, "1.3.6.1.6.3.10.2.1.3.0")) * 100;
     if (empty($details->sysUpTime)) {
         $details->sysUpTime = my_snmp_get($ip, $credentials, "1.3.6.1.2.1.1.3.0");
     }
     if (empty($details->sysUpTime)) {
         $i = my_snmp_get($ip, $credentials, "1.3.6.1.2.1.1.3.0");
         if ($i > '' and strpos($i, ")") !== false) {
             $j = explode(")", $i);
             $details->uptime = intval(trim($j[1]) * 24 * 60 * 60);
         } else {
             $details->uptime = '';
         }
     }
     // OID
     $details->sysObjectID = my_snmp_get($ip, $credentials, "1.3.6.1.2.1.1.2.0");
     $details->snmp_oid = $details->sysObjectID;
     if ($details->snmp_oid > '') {
         $details->manufacturer = get_oid($details->snmp_oid);
         if ($details->manufacturer == 'net-snmp') {
             $details->manufacturer = (string) '';
         }
     }
     # sometimes we get an OID, but not enough to specify a manufacturer
     $explode = explode(".", $details->snmp_oid);
     if (!isset($explode[6])) {
         $vendor_oid = 0;
         if (strpos($details->sysDescr, "ZyXEL") !== false) {
             # we have a Zyxel device
//.........这里部分代码省略.........

 public function edit_user()
 {
     $this->load->model("m_oa_user");
     $this->load->model("m_oa_group");
     $this->load->helper('url');
     $this->data['url'] = current_url();
     if (!isset($_POST['submit'])) {
         # load the initial form
         $this->data['user'] = $this->m_oa_user->get_user_details($this->data['id']);
         $this->data['user_group'] = $this->m_oa_group->get_all_user_groups($this->data['id']);
         $this->data['heading'] = 'Edit User';
         $this->data['include'] = 'v_edit_user';
         $this->data['sortcolumn'] = '1';
         $this->load->view('v_template', $this->data);
     } else {
         # process the form
         $error = '0';
         $details = new stdClass();
         foreach ($_POST as $key => $value) {
             $details->{$key} = $value;
         }
         if ($details->user_password != $details->user_password_confirm) {
             $error = '1';
             $this->data['error_message'] = "Passwords must match.";
             $this->data['user'] = $this->m_oa_user->get_user_details($details->user_id);
             $this->data['user_group'] = $this->m_oa_group->get_all_user_groups($details->user_id);
             $this->data['heading'] = 'Edit User';
             $this->data['include'] = 'v_edit_user';
             $this->load->view('v_template', $this->data);
         }
         if ($this->m_oa_user->check_user_name($details->user_name, $details->user_id) == false) {
             $error = '1';
             $this->data['error_message'] = "Username already exists.";
             $this->data['user'] = $this->m_oa_user->get_user_details($details->user_id);
             $this->data['user_group'] = $this->m_oa_group->get_all_user_groups($details->user_id);
             $this->data['heading'] = 'Edit User';
             $this->data['include'] = 'v_edit_user';
             $this->load->view('v_template', $this->data);
         }
         if ($error == '0') {
             $this->m_oa_user->edit_user($details);
             $this->m_oa_group->edit_user_groups($details);
             // Reset the admin user password in OAE
             if ($details->user_name == 'admin') {
                 $server_os = php_uname('s');
                 if ($server_os == 'Windows NT') {
                     if (file_exists('c:\\xampplite\\apache\\bin\\htpasswd.exe')) {
                         $command_string = 'c:\\xampplite\\apache\\bin\\htpasswd.exe -mb c:\\omk\\conf\\users.dat admin ' . $details->user_password . ' 2>&1';
                     }
                 }
                 if (php_uname('s') == 'Linux' or php_uname('s') == "Darwin") {
                     if (file_exists('/usr/local/opmojo/conf/users.dat')) {
                         $command_string = 'htpasswd -mb /usr/local/opmojo/conf/users.dat admin ' . $details->user_password . ' 2>&1';
                     }
                     if (file_exists('/usr/local/omk/conf/users.dat')) {
                         $command_string = 'htpasswd -mb /usr/local/omk/conf/users.dat admin ' . $details->user_password . ' 2>&1';
                     }
                 }
                 exec($command_string, $output, $return_var);
                 if ($return_var != '0') {
                     $log_details = new stdClass();
                     $log_details->log_file = 'system';
                     $log_details->message = 'Admin user password reset attempt for Open-AudIT and Open-AudIT Enterprise has failed';
                     stdlog($log_details);
                     unset($log_details);
                 } else {
                     $log_details = new stdClass();
                     $log_details->log_file = 'system';
                     $log_details->message = 'Admin user password reset attempt for Open-AudIT and Open-AudIT Enterprise has succeeded';
                     stdlog($log_details);
                     unset($log_details);
                 }
                 $command_string = null;
                 $output = null;
                 $return_var = null;
             }
             redirect('admin_user/list_users');
         }
     }
 }

    /**
    * Insert a new device into the system table using whatever values we have and insert corresponding rows into the sys_edit_log table
    *
    * @param array $details the array of attributes from the system table
    * @access  public
    *
    * @return string $id which is the id of the device in the system table
    */
    public function create(&$details)
    {
        # nasty hack because when a simplexmlobject is sent (ie, from audit_windows.vbs)
        # the foreach iterators below don't work.
        # if we cast it to an "object", it stays as a SimpleXMLObject and doesn't work
        # because our XML is quite simple, we can cast it to an array and back to a 'normal'
        # object and the foreach below works.
        $details = (object) $details;
        $details = (array) $details;
        $details = (object) $details;
        # this is an insert - we do NOT want a system.id
        unset($details->id);

        // get a name we can use
        if (!empty($details->name)) {
            $name = $details->name;
        } elseif (!empty($details->hostname)) {
            $name = $details->hostname;
            $details->name = $details->hostname;
        } elseif (!empty($details->sysName)) {
            $name = $details->sysName;
            $details->name = $details->sysName;
        } elseif (!empty($details->dns_hostname)) {
            $name = $details->dns_hostname;
            $details->name = $details->dns_hostname;
        }

        if (!isset($details->ip)) {
            $details->ip = '';
        }

        $log_details = new stdClass();
        $log_details->message = 'System insert start for '.ip_address_from_db($details->ip).' ('.$name.')';
        $log_details->severity = 7;
        $log_details->file = 'system';
        stdlog($log_details);

        # remove some characters from the OS string
        if ( ! empty($details->os_name)) {
            $details->os_name = str_ireplace("(r)", "", $details->os_name);
            $details->os_name = str_ireplace("(tm)", "", $details->os_name);
        }


        if (empty($details->status)) {
            $details->status = 'production';
        }
        if (empty($details->type)) {
            $details->type = 'unknown';
        } else {
            $details->type = strtolower($details->type);
        }
        if (empty($details->environment)) {
            $details->environment = 'production';
        }

        # we now set a default location - 0 the location_id
        if (!isset($details->location_id)) {
            $details->location_id = '0';
        }

        # Set the form factor to virtual if required
        if ( ! empty($details->manufacturer)) {
            if ((strripos($details->manufacturer, "vmware") !== false) or
                (strripos($details->manufacturer, "parallels") !== false) or
                (strripos($details->manufacturer, "virtual") !== false)) {
                if (!isset($details->class) or $details->class != 'hypervisor') {
                    $details->form_factor = 'Virtual';
                }
            }
        }
        if ( ! empty($details->model)) {
            if (strripos($details->model, "bhyve") !== false) {
                if (!isset($details->class) or $details->class != 'hypervisor') {
                    $details->form_factor = 'Virtual';
                }
            }
        }

        # Pad the IP address
        if ( ! empty($details->ip)) {
            $details->ip = ip_address_to_db($details->ip);
        }

        if ( ! empty($details->hostname) and  ! empty($details->domain) and empty($details->fqdn)) {
            $details->fqdn = $details->hostname.".".$details->domain;
        }

        $sql = "SHOW COLUMNS FROM system";
        $query = $this->db->query($sql);
        $columns = $query->result();

//.........这里部分代码省略.........

    function wmi_audit($ip = '', $credentials, $display = 'n')
    {
        if (strtolower($display) != 'y') {
            $display = 'n';
        } else {
            $display = 'y';
        }

        $log = new stdClass();
        $log->severity = 7;
        $log->file = 'system';
        $log->display = $display;

        if (empty($ip)) {
            $log->message = 'No IP supplied to wmi_helper::wmi_audiy.';
            stdlog($log);
            return false;
        }

        if (!filter_var($ip, FILTER_VALIDATE_IP)) {
            $log->message = 'No valid IP supplied to wmi_helper::wmi_audit.';
            stdlog($log);
            return false;
        }
        if (!is_object($credentials)) {
            $log->message = 'No credentials supplied to wmi_helper::wmi_audit.';
            stdlog($log);
            return false;
        }

        $details = new stdClass();

        # UUID
        $command = 'csproduct get uuid';
        $wmi_result = wmi_command($ip, $credentials, $command, $display);
        if ($wmi_result['status'] == 0) {
            $details->uuid = $wmi_result['output'][1];
        }

        # Serial
        $command = 'csproduct get IdentifyingNumber';
        $wmi_result = wmi_command($ip, $credentials, $command, $display);
        if ($wmi_result['status'] == 0) {
            $details->serial = $wmi_result['output'][1];
        }

        # Manufacturer
        $command = 'csproduct get vendor';
        $wmi_result = wmi_command($ip, $credentials, $command, $display);
        if ($wmi_result['status'] == 0) {
            $details->manufacturer = $wmi_result['output'][1];
        }

        # Description
        $command = 'os get description';
        $wmi_result = wmi_command($ip, $credentials, $command, $display);
        if ($wmi_result['status'] == 0) {
            $details->description = $wmi_result['output'][1];
        }

        # Hostname / name
        $command = 'computersystem get name';
        $wmi_result = wmi_command($ip, $credentials, $command, $display);
        if ($wmi_result['status'] == 0) {
            $details->hostname = strtolower($wmi_result['output'][1]);
            $details->name = $details->hostname;
        }

        # Domain / fqdn
        $command = 'computersystem get domain';
        $wmi_result = wmi_command($ip, $credentials, $command, $display);
        if ($wmi_result['status'] == 0) {
            $details->domain = strtolower($wmi_result['output'][1]);
            $details->fqdn = $details->hostname . '.' . $details->domain;
        }

        # OS Name
        $command = 'os get name';
        $wmi_result = wmi_command($ip, $credentials, $command, $display);
        if ($wmi_result['status'] == 0) {
            $details->os_name = $wmi_result['output'][1];
            $details->os_name = trim(substr($details->os_name, 0, stripos($details->os_name, '|')));
            if (stripos($details->os_name, " 95") !== false) {
                $details->os_family = "Windows 95";
            }
            if (stripos($details->os_name, " 98") !== false) {
                $details->os_family = "Windows 98";
            }
            if (stripos($details->os_name, " NT") !== false) {
                $details->os_family = "Windows NT";
            }
            if (stripos($details->os_name, " 2000") !== false) {
                $details->os_family = "Windows 2000";
            }
            if (stripos($details->os_name, " XP") !== false) {
                $details->os_family = "Windows XP";
            }
            if (stripos($details->os_name, "2003") !== false) {
                $details->os_family = "Windows 2003";
            }
//.........这里部分代码省略.........

 public function process_subnet()
 {
     // accept or process the output of the discover subnet script - nmap details
     if (!isset($_POST['form_details'])) {
         $this->load->view('v_process_subnet', $this->data);
     } else {
         $display = '';
         if ($this->input->post('debug') and strpos($_SERVER['HTTP_ACCEPT'], 'html')) {
             $display = 'y';
             echo "<pre>\n";
             echo "DEBUG - Starting process_subnet.\n";
             echo "***********************************************************************************\n";
             echo "* NOTE - THIS PAGE WILL CONTINUOUSLY RENDER UNTIL THE DISCOVERY HAS FINISHED      *\n";
             echo "* WATCH YOUR BROSWER TO SEE WHEN THE PAGE FINISHES RENDERING                      *\n";
             echo "* DO NOT REFRESH THIS PAGE OR ATTEMPT TO GO 'back' UNTIL THE PAGE HAS COMPLETED   *\n";
             echo "***********************************************************************************\n";
         }
         $this->load->model('m_oa_user');
         $this->load->model('m_scripts');
         if (isset($this->session->userdata['user_id']) and is_numeric($this->session->userdata['user_id'])) {
             $this->user = $this->m_oa_user->get_user_details($this->session->userdata['user_id']);
         }
         // all logging will be as below, only the message will change
         $log_details = new stdClass();
         $log_details->severity = 7;
         $log_details->file = 'system';
         $log_details->display = $display;
         if (!$this->m_oa_config->check_blessed($_SERVER['REMOTE_ADDR'], '')) {
             if ($display == 'y') {
                 $log_details->message = "Audit submission from an IP (" . $_SERVER['REMOTE_ADDR'] . ") not in the list of blessed subnets, exiting.";
                 echo "\n" . $log_details->message . "\n";
                 stdlog($log_details);
             }
             exit;
         }
         $this->load->helper('url');
         $this->load->model('m_credentials');
         if ($display == 'y') {
             echo 'DEBUG - <a href=\'' . base_url() . "index.php/discovery/discover_subnet'>Back to input page</a>\n";
             echo 'DEBUG - <a href=\'' . base_url() . "index.php'>Front Page</a>\n";
         }
         if (php_uname('s') != 'Windows NT') {
             $filepath = $this->config->config['base_path'] . '/other';
         } else {
             $filepath = $this->config->config['base_path'] . '\\other';
         }
         $this->load->helper('xml');
         $xml_input = $_POST['form_details'];
         try {
             $xml = new SimpleXMLElement($xml_input);
         } catch (Exception $error) {
             // not a valid XML string
             $log_details->message = 'Invalid XML input for discovery from ' . $_SERVER['REMOTE_ADDR'];
             stdlog($log_details);
             exit;
         }
         $this->load->helper('url');
         $this->load->library('encrypt');
         $this->load->helper('ipmi');
         if (extension_loaded('snmp')) {
             $this->load->helper('snmp');
             $this->load->helper('snmp_oid');
         }
         $this->load->model('m_system');
         $this->load->model('m_oa_group');
         $this->load->model('m_audit_log');
         $this->load->model('m_change_log');
         $this->load->model('m_devices_components');
         $this->load->model('m_devices');
         $timestamp = $this->config->config['timestamp'];
         $count = 0;
         foreach ($xml->children() as $details) {
             $details = (object) $details;
             if (isset($details->complete) and $details->complete == 'y') {
                 // delete the credential set
                 if ($display == 'y') {
                     echo "DEBUG - ----------------------------------------------------\n";
                 }
                 $this->echo_details($details);
                 sleep(5);
                 $log_details->message = 'Deleting credential set for ' . $details->subnet_range . ' submitted on ' . $details->subnet_timestamp;
                 stdlog($log_details);
                 $sql = '/* discovery::process_subnet */ DELETE FROM oa_temp WHERE temp_name = \'Subnet Credentials - ' . $details->subnet_range . '\' and temp_timestamp = \'' . $details->subnet_timestamp . '\' ';
                 $query = $this->db->query($sql);
             } else {
                 $skip = false;
                 if (stripos(' ' . $this->config->config['discovery_ip_exclude'] . ' ', ' ' . $details->ip . ' ') !== false) {
                     # Our ip address matched an ip in the discovery_ip_exclude list - exit
                     $log_details->message = $details->ip . ' is in the list of excluded ip addresses - skipping.';
                     stdlog($log_details);
                     $skip = true;
                 }
                 if (!$skip) {
                     $log_details->message = 'Start processing ' . $details->ip;
                     stdlog($log_details);
                     $count++;
                     $details->last_seen = $timestamp;
                     $details->last_user = '';
                     $details->last_seen_by = 'nmap';
                     $details->domain = '';
//.........这里部分代码省略.........

 /**
  * Process the supplied data and update an existing object
  *
  * @access public
  * @return NULL
  */
 public function create()
 {
     // Only admin's
     if ($this->user->admin !== 'y') {
         log_error('ERR-0008');
         output($this->response);
         exit;
     }
     echo "<pre>\n";
     $file = $_POST['file'];
     $log = new stdClass();
     $log->log_level = 7;
     $log->severity = 6;
     $log->message = 'NMIS import, importing nodes from ' . $file;
     $log->display = 'y';
     stdlog($log);
     $this->load->model('m_system');
     $this->load->model('m_devices');
     $timestamp = $this->config->config['timestamp'];
     $node_array = array();
     $file_handle = fopen($file, 'r');
     $string = fread($file_handle, filesize($file));
     $string = str_replace(PHP_EOL, ' ', $string);
     $string = str_replace("\r\n", ' ', $string);
     $string = str_replace("\n", ' ', $string);
     $string = str_replace(chr(13), ' ', $string);
     $string = str_replace('%hash = (', '{', $string);
     $string = str_replace(');', '}', $string);
     $string = str_replace('=>', ':', $string);
     $string = str_replace("'undef'", "''", $string);
     $string = str_replace('undef', "''", $string);
     $string = str_replace("'", '"', $string);
     $nodes = json_decode($string, true);
     unset($string);
     unset($file_handle);
     unset($file);
     switch (json_last_error()) {
         case JSON_ERROR_NONE:
             // no errors
             break;
         case JSON_ERROR_DEPTH:
             echo "Error importing Nmis.nodes file<br />\n";
             echo 'JSON_ERROR_DEPTH - Maximum stack depth exceeded<br />';
             exit;
             break;
         case JSON_ERROR_STATE_MISMATCH:
             echo "Error importing Nmis.nodes file<br />\n";
             echo 'JSON_ERROR_STATE_MISMATCH - Underflow or the modes mismatch<br />';
             exit;
             break;
         case JSON_ERROR_CTRL_CHAR:
             echo "Error importing Nmis.nodes file<br />\n";
             echo 'JSON_ERROR_CTRL_CHAR - Unexpected control character found<br />';
             exit;
             break;
         case JSON_ERROR_SYNTAX:
             echo "Error importing Nmis.nodes file<br />\n";
             echo 'JSON_ERROR_SYNTAX - Syntax error, malformed JSON<br />';
             print_r($string);
             exit;
             break;
         case JSON_ERROR_UTF8:
             echo "Error importing Nmis.nodes file<br />\n";
             echo 'JSON_ERROR_UTF8 - Malformed UTF-8 characters, possibly incorrectly encoded<br />';
             exit;
             break;
         default:
             echo "Error importing Nmis.nodes file<br />\n";
             echo 'Unknown error<br />';
             exit;
             break;
     }
     $nodes_in_file = 0;
     $nodes_collect = 0;
     $nodes_total = 0;
     foreach ($nodes as $node) {
         $nodes_in_file++;
         if (@$node['collect'] == 'true') {
             $nodes_collect++;
             #echo "=======================\n";
             $device = new stdClass();
             $device->name = strtolower(@$node['name']);
             if (!filter_var($node['host'], FILTER_VALIDATE_IP) === false) {
                 $device->ip = $node['host'];
             } else {
                 if (strpos($node['host'], '.') !== false) {
                     $device->fqdn = $node['host'];
                     $temp = explode('.', $device->fqdn);
                     $device->hostname = $temp[0];
                     unset($temp);
                 } else {
                     $device->hostname = $node['host'];
                 }
             }
//.........这里部分代码省略.........

    public function validate_user($username, $password)
    {
        $this->load->library('session');
        $this->load->helper('log');
        $log_details = new stdClass();
        $log_details->file = 'system';
        $log_details->severity = 7;


        $sql = "SELECT * FROM oa_user WHERE oa_user.name = ? LIMIT 1";
        $sql = '/* M_userlogin::validate_user */ ' . $sql;
        $data = array("$username");
        $query = $this->db->query($sql, $data);
        if ($query->num_rows() > 0) {
            $row = $query->row();
            $user_id = $row->id;
            $hash_password = $row->password;
            $user_data = array(    'username' => $row->name, 'logged_in' => true, 'user_id' => $row->id,
                            'user_full_name' => $row->full_name, 'user_lang' => $row->lang,
                            'user_theme' => $row->theme, 'user_admin' => $row->admin,
                            'user_debug' => 'n', 'user_sam' => $row->sam, );

            # make sure to validate if we have any older style MD5 passwords
            if ($hash_password == md5($password)) {
                # change the password to a salted SHA256
                # get 256 random bits in hex
                $salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
                # prepend the salt, then hash
                $hash = hash("sha256", $salt.$password);
                # store the salt and hash in the same string, so only 1 DB column is needed
                $encrypted_password = $salt.$hash;
                $sql = "/* m_userlogin::validate_user */ UPDATE oa_user SET password = ? WHERE id = ?";
                $data = array("$encrypted_password", "$user_id");
                $query = $this->db->query($sql, $data);

                return $user_data;
            }

            # compare the supplied and salted sha256 passwords
            # get the salt from the front of the hash
            $salt = substr($hash_password, 0, 64);
            # the SHA256 form the end of the hash
            $valid_hash = substr($hash_password, 64, 64);
            # hash the password being tested
            $test_hash = hash("sha256", $salt.$password);
            # if the hashes are exactly the same, the password is valid
            if ($test_hash == $valid_hash) {
                # correct password
                # NOTE - we must test if user is active when DB version > 20130512 release.
                # this releave (v1.0) added a flag to the users table for user_active.
                $sql = "/* m_userlogin::validate_user */ SELECT config_value FROM oa_config WHERE config_name = 'internal_version'";
                $query = $this->db->query($sql);
                $row = $query->row();
                $db_version = $row->config_value;
                if ($db_version < '20130512') {
                    # we have not updgraded the DB yet, so need to not attempt to check if user is active
                } else {
                    # this is a 1.0 (or above) version of the database
                    # only log user on to system if user is 'active'
                    $sql = "/* m_userlogin::validate_user */ SELECT active FROM oa_user WHERE id = ?";
                    $data = array($user_id);
                    $query = $this->db->query($sql, $data);
                    $row = $query->row();
                    if ($row->active == 'y') {
                        # we have an active user
                    } else {
                        $log_details->message = "User $username not set to active in DB.";
                        stdlog($log_details);
                        # remove the $data array
                        unset($user_data);
                        $user_data = 'fail';
                    }
                }
            } else {
                $log_details->message = "Password does not match hash for $username.";
                stdlog($log_details);
                unset($user_data);
                $user_data = 'fail';
            }
        } else {
            $log_details->message = "Cound not find username $username in DB.";
            stdlog($log_details);
            unset($user_data);
            $user_data = 'fail';
        }

        return $user_data;
    }

 public function add_nmap()
 {
     if (!isset($_POST['form_nmap'])) {
         $this->load->view('v_system_add_nmap', $this->data);
     } else {
         // check if the submitting IP is in the list of allowable subnets
         if (!$this->m_oa_config->check_blessed($_SERVER['REMOTE_ADDR'], '')) {
             exit;
         }
         $log_details = new stdClass();
         $log_details->severity = 7;
         $log_details->file = 'system';
         $log_details->message = 'Start processing nmap submitted data';
         stdlog($log_details);
         $log_details->message = 'ATTENTION - audit_subnet script being used. This is deprecated. Please use discovery scripts instead.';
         $log_details->severity = 5;
         stdlog($log_details);
         unset($log_details);
         $this->load->helper('url');
         $this->load->helper('xml');
         $this->load->helper('network');
         $this->load->library('encrypt');
         if (extension_loaded('snmp')) {
             $this->load->helper('snmp');
             $this->load->helper('snmp_oid');
         }
         $this->load->model('m_system');
         $this->load->model('m_oa_group');
         $this->load->model('m_audit_log');
         $timestamp = $this->config->config['timestamp'];
         $xml_input = $_POST['form_nmap'];
         try {
             $xml_post = new SimpleXMLElement($xml_input);
         } catch (Exception $error) {
             // not a valid XML string
             $log_details = new stdClass();
             $log_details->severity = 5;
             $log_details->file = 'system';
             $log_details->message = 'Invalid XML input for NMap import';
             stdlog($log_details);
             unset($log_details);
             exit;
         }
         $count = 0;
         foreach ($xml_post->children() as $details) {
             $details = (object) $details;
             if (isset($this->session->userdata['user_id']) and is_numeric($this->session->userdata['user_id'])) {
                 echo 'Device IP: ' . $details->ip . "\n";
             }
             $count++;
             $details->last_seen = $timestamp;
             $details->last_user = '';
             $details->hostname = '';
             if ($this->config->item('discovery_use_dns') == 'y') {
                 $details = dns_validate($details);
             }
             $details->audits_ip = ip_address_to_db($_SERVER['REMOTE_ADDR']);
             $log_details = new stdClass();
             $log_details->severity = 7;
             $log_details->file = 'system';
             $log_details->message = 'Processing nmap audit result for ' . $details->ip . ' (' . $details->hostname . ')';
             stdlog($log_details);
             unset($log_details);
             if (!isset($details->type) or $details->type === '') {
                 $details->type = 'unknown';
             }
             if (extension_loaded('snmp')) {
                 // try to get more information using SNMP
                 if (!isset($details->access_details)) {
                     $details->access_details = $this->m_system->get_access_details($details->id);
                 }
                 $decoded_access = $this->encrypt->decode($det