<?php
/**
* @package admin
* @copyright Copyright 2003-2012 Zen Cart Development Team
* @copyright Portions Copyright 2003 osCommerce
* @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
* @version GIT: $Id: Author: DrByte  Tue Aug 28 16:03:47 2012 -0400 Modified in v1.5.1 $
*/
if (!defined('IS_ADMIN_FLAG')) {
die('Illegal Access');
}
// log page visit into admin activity history
if (basename($PHP_SELF) != FILENAME_DEFAULT . '.php') {
$sql = "SELECT ip_address from " . TABLE_ADMIN_ACTIVITY_LOG . " LIMIT 1";
$result = $db->Execute($sql);
if ($result->RecordCount() < 1) {
$sql_data_array = array( 'access_date' => 'now()',
'admin_id' => (isset($_SESSION['admin_id'])) ? (int)$_SESSION['admin_id'] : 0,
'page_accessed' =>  'Log found to be empty. Logging started.',
'page_parameters' => '',
'gzpost' => '',
'ip_address' => substr($_SERVER['REMOTE_ADDR'],0,45)
);
zen_db_perform(TABLE_ADMIN_ACTIVITY_LOG, $sql_data_array);
}
$flagged = 0;
$notes = $gzpostdata = $postdata = '';
if (isset($_POST) && sizeof($_POST) > 0) {
$postdata = $_POST;
foreach ($postdata as $key=>$nul) {
if (in_array($key, array('x','y','secur'.'ityTo'.'ken','admi'.'n_p'.'ass','pass'.'word','confirm', 'newpwd-'.$_SESSION['securityToken'],'oldpwd-'.$_SESSION['securityToken'],'confpwd-'.$_SESSION['securityToken']))) unset($postdata[$key]);
if (strtolower(CHARSET) != 'utf-8') {
if (is_string($nul)) $postdata[$key] = utf8_encode($nul);
if (is_array($nul)) {
foreach ($nul as $key2=>$val) {
if (is_string($val)) $postdata[$key][$key2] = utf8_encode($val);
if (is_array($val)) $postdata[$key][$key2] = utf8_encode(print_r($val, TRUE));
}
}
}
}
$notes = zen_parse_for_rogue_post(print_r($postdata, true));
$postdata = json_encode($postdata);
$gzpostdata = gzdeflate($postdata, 7);
$flagged = ($notes === FALSE) ? 0 : 1;
}
$sql_data_array = array( 'access_date' => 'now()',
'admin_id' => (isset($_SESSION['admin_id'])) ? (int)$_SESSION['admin_id'] : 0,
'page_accessed' =>  basename($PHP_SELF) . (!isset($_SESSION['admin_id']) || (int)$_SESSION['admin_id'] == 0 ? ' ' . (isset($_POST['admin_name']) ? $_POST['admin_name'] : (isset($_POST['admin_email']) ? $_POST['admin_email'] : '') ) : ''),
'page_parameters' => zen_get_all_get_params(),
'ip_address' => substr($_SERVER['REMOTE_ADDR'],0,45),
'gzpost' => $gzpostdata,
'flagged' => (int)$flagged,
'attention' => ($notes === FALSE ? '' : $notes),
);
zen_db_perform(TABLE_ADMIN_ACTIVITY_LOG, $sql_data_array);
unset($flagged, $postdata, $notes, $gzpostdata, $sql_data_array, $key, $nul);
}
function zen_parse_for_rogue_post($string) {
$matches = '';
if (preg_match_all('~(file://|<iframe|<frame|<embed|<script|<meta)~i', $string, $matches)) {
return htmlspecialchars(WARNING_REVIEW_ROGUE_ACTIVITY . "\n" . implode(' and ', $matches[1]), ENT_COMPAT, CHARSET, TRUE);
} else {
return FALSE;
}
}