From 26dae819f912323fbd51de685cd71686c766f515 Mon Sep 17 00:00:00 2001
From: jakani24 <janis.st44@gmail.com>
Date: Sat, 8 Jun 2024 19:57:50 +0200
Subject: [PATCH] adding server log

---
 .../api/php/log/add_server_entry.php          |  22 ++
 .../cyberhex-code/install/create_db.php       |  20 ++
 .../system/insecure_zone/php/login.php        |   1 +
 .../insecure_zone/php/login_backend.php       |   1 +
 .../secure_zone/php/view_server_log.php       | 218 ++++++++++++++++++
 5 files changed, 262 insertions(+)
 create mode 100644 src/server/cyberhex-code/api/php/log/add_server_entry.php
 create mode 100644 src/server/cyberhex-code/system/secure_zone/php/view_server_log.php

diff --git a/src/server/cyberhex-code/api/php/log/add_server_entry.php b/src/server/cyberhex-code/api/php/log/add_server_entry.php
new file mode 100644
index 0000000..95a8605
--- /dev/null
+++ b/src/server/cyberhex-code/api/php/log/add_server_entry.php
@@ -0,0 +1,22 @@
+<?php
+
+	function log($loglevel,$logtext,$userid){
+		include "../../../config.php";
+		$conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);
+		if ($conn->connect_error) {
+			die("conn_err");
+		}
+		
+		$time=date("Y-m-d H:i:s");
+		
+		$sql="INSERT INTO server_log (loglevel,logtext,userid,time) VALUES (?,?,?,?);";
+		$stmt = $conn->prepare($sql);
+		$stmt->bind_param("ssss", $loglevel,$logtext,$userid,$time);
+		// Execute the statement
+		$stmt->execute();
+		$stmt->close();
+		$conn->close();
+		
+	}
+
+?>
\ No newline at end of file
diff --git a/src/server/cyberhex-code/install/create_db.php b/src/server/cyberhex-code/install/create_db.php
index cfc5c53..23f20e3 100644
--- a/src/server/cyberhex-code/install/create_db.php
+++ b/src/server/cyberhex-code/install/create_db.php
@@ -94,6 +94,26 @@
 				time VARCHAR(255)
 			)";
 
+			if ($conn->query($sql) === TRUE) {
+					echo '<br><div class="alert alert-success" role="alert">
+						Table log created successfully!
+				</div>';
+			} else {
+				$success=0;
+					echo '<br><div class="alert alert-danger" role="alert">
+						Error creating table log: ' . $conn->error .'
+				</div>';
+			}
+			
+			// Create server log table
+			$sql = "CREATE TABLE IF NOT EXISTS server_log (
+				id INT AUTO_INCREMENT PRIMARY KEY,
+				logtext VARCHAR(500) NOT NULL,
+				loglevel VARCHAR(255) NOT NULL,
+				userid INT,
+				time VARCHAR(255)
+			)";
+
 			if ($conn->query($sql) === TRUE) {
 					echo '<br><div class="alert alert-success" role="alert">
 						Table log created successfully!
diff --git a/src/server/cyberhex-code/system/insecure_zone/php/login.php b/src/server/cyberhex-code/system/insecure_zone/php/login.php
index 99146d7..5ab3938 100644
--- a/src/server/cyberhex-code/system/insecure_zone/php/login.php
+++ b/src/server/cyberhex-code/system/insecure_zone/php/login.php
@@ -305,6 +305,7 @@ async function checkRegistration() {
 											$_SESSION["login"]=true;
 											$_SESSION["perms"]=$row["perms"];
 											$_SESSION["email"]=$row["email"];
+											$_SESSION["id"]=$row["id"];
 											$_SESSION["telegram_id"]=$row["telegram_id"];
 											$_SESSION["allow_pw_login"]=$row["allow_pw_login"];
 											$_SESSION["send_login_message"]=$row["send_login_message"];
diff --git a/src/server/cyberhex-code/system/insecure_zone/php/login_backend.php b/src/server/cyberhex-code/system/insecure_zone/php/login_backend.php
index 4e33980..19c9a30 100644
--- a/src/server/cyberhex-code/system/insecure_zone/php/login_backend.php
+++ b/src/server/cyberhex-code/system/insecure_zone/php/login_backend.php
@@ -174,6 +174,7 @@ try {
 		$_SESSION["username"]=htmlspecialchars($row["username"]);
 		$_SESSION["login"]=true;
 		$_SESSION["perms"]=$row["perms"];
+		$_SESSION["id"]=$row["id"];
 		$_SESSION["email"]=$row["email"];
 		$_SESSION["telegram_id"]=$row["telegram_id"];
 		$_SESSION["allow_pw_login"]=$row["allow_pw_login"];
diff --git a/src/server/cyberhex-code/system/secure_zone/php/view_server_log.php b/src/server/cyberhex-code/system/secure_zone/php/view_server_log.php
new file mode 100644
index 0000000..bd3370f
--- /dev/null
+++ b/src/server/cyberhex-code/system/secure_zone/php/view_server_log.php
@@ -0,0 +1,218 @@
+<?php
+session_start();
+
+// Check if the user is logged in
+if (!isset($_SESSION['username']) or !isset($_SESSION["login"])) {
+    // Redirect to the login page or handle unauthorized access
+    header("Location: /login.php");
+    exit();
+}
+
+$username = $_SESSION['username'];
+$perms = $_SESSION["perms"];
+$email = $_SESSION["email"];
+if($perms[2]!=="1"){
+    header("location:/system/insecure_zone/php/no_access.php");
+    $block=1;
+    exit();
+}else{
+    $block=0;
+}
+include "create_log_backup.php";
+// Handle filter submission
+
+$loglevel = htmlspecialchars(isset($_GET["loglevel"]) ? $_GET["loglevel"] : "");
+$logtext = htmlspecialchars(isset($_GET["logtext"]) ? $_GET["logtext"] : "");
+$search_username = htmlspecialchars(isset($_GET["username"]) ? $_GET["username"] : "");
+$time = htmlspecialchars(isset($_GET["time"]) ? $_GET["time"] : "");
+$filter_query = "&loglevel=$loglevel&logtext=$logtext&username=$username&time=$time";
+
+include "../../../config.php";
+//get data for pie chart
+$conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);
+if ($conn->connect_error) {
+	die("Connection failed: " . $conn->connect_error);
+}
+
+$stmt->close();
+$conn->close();
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js" integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM" crossorigin="anonymous"></script>
+     <title>View log</title>
+
+</head>
+<body>
+<br><br>
+<div class="container-fluid">
+    <div class="row justify-content-center">
+        <div class="col-md-12">
+            <div class="card">
+                <div class="card-header">
+                    <h4>View server log</h4>
+                </div>
+                <div class="card-body" style="overflow-x:auto">
+                    <!-- table with all log entrys => delete button -->
+                    <?php
+                        //delete entry if requested and if user has rights to do that
+                        if(isset($_GET["delete"])){
+                            if($perms[3]!=="1"){
+                                echo '<div class="alert alert-danger" role="alert">
+                                                You are not allowed to delete log entries. (insufficient permissions)
+                                </div>';
+                            }else{
+                                $id=htmlspecialchars($_GET["delete"]);
+                                $conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);
+                                if ($conn->connect_error) {
+                                    die("Connection failed: " . $conn->connect_error);
+                                }
+								create_log_backup($conn);
+                                $sql = "DELETE FROM server_log WHERE id = ?";
+                                $stmt = $conn->prepare($sql);
+                                $stmt->bind_param("i", $id);
+                                // Execute the statement
+                                $stmt->execute();
+                                $stmt->close();
+                                $conn->close();
+                                echo '<div class="alert alert-success" role="alert">
+                                                Log entry deleted.
+                                </div>';
+                            }
+                        }
+						if(isset($_GET["delete_all"])){
+                            if($perms[3]!=="1"){
+                                echo '<div class="alert alert-danger" role="alert">
+                                                You are not allowed to delete log entries. (insufficient permissions)
+                                </div>';
+                            }else{
+                                $conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);
+                                if ($conn->connect_error) {
+                                    die("Connection failed: " . $conn->connect_error);
+                                }
+								create_log_backup($conn);
+                                $sql = "DELETE FROM server_log";
+                                $stmt = $conn->prepare($sql);
+                                // Execute the statement
+                                $stmt->execute();
+                                $stmt->close();
+                                $conn->close();
+                                echo '<div class="alert alert-success" role="alert">
+                                                Log deleted.
+                                </div>';
+                            }
+                        }
+                        
+                        // Define page size and current page
+                        $page_size = 50;
+                        $current_page = htmlspecialchars(isset($_GET['page']) ? intval($_GET['page']) : 1);
+                        $offset = ($current_page - 1) * $page_size;
+                        
+                        // Get total number of log entries based on filters
+                        $conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);
+                        if ($conn->connect_error) {
+                            die("Connection failed: " . $conn->connect_error);
+                        }
+                        $sql = "SELECT count(server_log.id) AS log_count FROM users,server_log WHERE userid=users.id AND username LIKE ? loglevel LIKE ? AND logtext LIKE ? AND time LIKE ?";
+                        $stmt = $conn->prepare($sql);
+                        $loglevel = "%" . $loglevel . "%";
+                        $logtext = "%" . $logtext . "%";
+						$search_username = "%" . $search_username . "%";
+                        $time = "%" . $time . "%";
+                        $stmt->bind_param("ssss",$search_username, $loglevel, $logtext, $time);
+                        $stmt->execute();
+                        $result = $stmt->get_result();
+                        $row = $result->fetch_assoc();
+                        $total_entries = $row["log_count"];
+                        
+                        // Calculate total pages
+                        $total_pages = ceil(($total_entries) / $page_size);
+                        
+                        // Query log entries for the current page with filters
+                        $sql = "SELECT * FROM users,server_log WHERE userid=users.id AND username LIKE ? loglevel LIKE ? AND logtext LIKE ? AND time LIKE ? ORDER BY log.id DESC LIMIT ?, ?";
+                        $stmt = $conn->prepare($sql);
+                       $loglevel = "%" . $loglevel . "%";
+                        $logtext = "%" . $logtext . "%";
+						$search_username = "%" . $search_username . "%";
+                        $time = "%" . $time . "%";
+                        $stmt->bind_param("ssssii", $search_username, $loglevel, $logtext, $time, $offset, $page_size);
+                        $stmt->execute();
+                        $result = $stmt->get_result();
+                        if($current_page==1){
+							echo("<div id='log_spread' style='width: 700px; height: 350px;'></div>");
+							//echo("<div style='display:none' class='col' id='machine_spread' style='width: 30%; height: auto;'></div></div>");
+						}
+                        // Display log entries
+                        echo '<table class="table" style="overflow-x:auto">';
+                        echo '<thead>';
+                        echo '<tr>'; 
+                        echo '<th>Entry id</th><th>Loglevel</th><th>Logtext</th><th>Username</th><th>Time & date</th><th>Delete entry</th>';
+                        echo '</tr>';
+                        echo '</thead>';
+                        echo '<tbody>';
+                        
+                        // Display filter options
+                        echo '<tr>';
+                        echo '<form action="view_server_log.php" method="get">';
+                        echo '<input type="hidden" name="filter_submit" value="true">';
+                        echo '<td><button type="submit" class="btn btn-primary btn-block">Filter</button></td>';
+                        echo '<td><input type="text" class="form-control" name="loglevel" placeholder="' . str_replace("%","",$loglevel) . '"></td>';
+                        echo '<td><input type="text" class="form-control" name="logtext" placeholder="' . str_replace("%","",$logtext) . '"></td>';
+                        echo '<td><input type="text" class="form-control" name="username" placeholder="' . str_replace("%","",$search_username) . '"></td>';
+                        echo '<td><input type="text" class="form-control" name="time" placeholder="' . str_replace("%","",$time) . '"></td>';
+                        echo '<td><button type="button" class="btn btn-danger" data-bs-toggle="modal" data-bs-target="#delete_all">Delete log</button></td>';
+                        echo '</form>';
+                        echo '</tr>';
+                        
+                        while($row = $result->fetch_assoc()) {
+                            echo '<tr>';
+                            echo '<td>' . $row["id"] . '</td>';
+                            echo '<td>' . $row["loglevel"] . '</td>';
+                            echo '<td>' . $row["logtext"] . '</td>';
+                            echo '<td>' . $row["username"] . '</td>';
+                            echo '<td>' . $row["time"] . '</td>';
+                            echo '<td><a href="view_server_log.php?delete=' . $row["id"] . $filter_query . '&page=' . $current_page . '">delete</a></td>';
+                            echo '</tr>';
+                        }
+                        
+                        echo '</tbody>';
+                        echo '</table>';
+                        $conn->close();
+                        
+                        // Display pagination links with filter query
+                        echo '<nav aria-label="Page navigation">';
+                        echo '<ul class="pagination justify-content-center">';
+                        for ($i = 1; $i <= $total_pages; $i++) {
+                            echo '<li class="page-item ' . ($i == $current_page ? 'active' : '') . '"><a class="page-link" href="view_server_log.php?page=' . $i . $filter_query . '">' . $i . '</a></li>';
+                        }
+                        echo '</ul>';
+                        echo '</nav>';
+                    ?>
+                </div>
+            </div>
+        </div>
+    </div>
+	<div class="modal fade" id="delete_all" tabindex="-1" aria-labelledby="delete_all_label" aria-hidden="true">
+	  <div class="modal-dialog">
+		<div class="modal-content">
+		  <div class="modal-header">
+			<h5 class="modal-title" id="delete_all_label">WARNING</h5>
+			<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+		  </div>
+		  <div class="modal-body">
+			Warning! You are about to delete the entyre System0 log.<br>This cannot be undone.<br>We highly recommend exporting the entyre log, before deleting it.<br>
+			You will not be able to undo this step. Important security evidence will be lost, if you press the "delete" button!
+		  </div>
+		  <div class="modal-footer">
+			<button style="width:70%" type="button" class="btn btn-primary" data-bs-dismiss="modal">Cancel</button>
+			<a style="width:25%" class="btn btn-danger" href="view_server_log.php?delete_all">Delete log</a>
+		  </div>
+		</div>
+	  </div>
+</div>
+</div>
+</body>
+</html>