From 9adf294efc31c37ab59e649365f1936376eb4b14 Mon Sep 17 00:00:00 2001 From: Daichimarukana Date: Tue, 28 Oct 2025 00:06:47 +0900 Subject: [PATCH] uwuzu v1.6.5 Hapuego --- abi/addabi.php | 2 +- addauthcode.php | 301 ++++++------- admin/addadmin.php | 5 +- admin/index.php | 70 ++- api/auth.php | 1 - api/me/index.php | 20 +- api/ueuse/replies.php | 2 + api/users/index.php | 22 +- api/users/unfollow.php | 1 - authcodechk.php | 92 ++-- authlogin.php | 436 ++++++++++--------- bookmark/index.php | 1 - check.php | 163 ++++--- css/home.css | 43 +- emoji/index.php | 1 - function/function.php | 618 ++++++++++++++++++++++----- home/index.php | 25 +- js/view_function.js | 193 +++++++-- login.php | 26 +- migration/index.php | 7 +- new.php | 9 +- nextpage/bookmarktimeline.php | 7 +- nextpage/followtimeline.php | 8 +- nextpage/foryoutimeline.php | 28 +- nextpage/localtimeline.php | 9 +- nextpage/searchtimeline.php | 9 +- nextpage/ueusetimeline.php | 16 +- notice/addnotice.php | 1 - notice/index.php | 1 - notification/index.php | 1 - others/account_migration.php | 1 - others/account_migration_done.php | 1 - others/index.php | 1 - others/token.php | 1 - search/index.php | 1 - server/uwuzuinfo.txt | 4 +- server/uwuzurelease.txt | 46 +- settings/addauthcode.php | 16 +- settings/index.php | 1 - settings/success.php | 1 - settings_admin/actionlog_admin.php | 1 - settings_admin/ad_admin.php | 1 - settings_admin/addemoji_admin.php | 1 - settings_admin/codeadmin.php | 1 - settings_admin/customize_admin.php | 1 - settings_admin/ipblock_admin.php | 1 - settings_admin/jobs_admin.php | 3 +- settings_admin/maintenance_admin.php | 1 - settings_admin/moderation_admin.php | 3 +- settings_admin/overview_admin.php | 7 +- settings_admin/plugin_admin.php | 1 - settings_admin/role_admin.php | 1 - settings_admin/serveradmin.php | 1 - settings_admin/update_admin.php | 1 - settings_admin/useradmin.php | 257 ++++++----- settings_admin/userinfo.php | 7 +- success.php | 56 ++- ueuse/index.php | 28 +- update.json | 66 ++- user/index.php | 56 +-- user/report.php | 1 - user/success.php | 1 - uwuzu_database.sql | 57 ++- uwuzu_error_code.txt | 1 + 64 files changed, 1763 insertions(+), 982 deletions(-) diff --git a/abi/addabi.php b/abi/addabi.php index 85e4d80..cee4b52 100644 --- a/abi/addabi.php +++ b/abi/addabi.php @@ -57,7 +57,7 @@ if (safetext(isset($_POST['uniqid'])) && safetext(isset($_POST['abitext'])) && s if($result2["loginid"] === $loginid){ if($result["abi"] == "none" && (!($result2["role"] == "ice"))){ // 文字数を確認 - if( (int)safetext(file_get_contents($mojisizefile)) < mb_strlen($abitext, 'UTF-8') ) { + if( (int)safetext(file_get_contents($mojisizefile)) < mb_strlen(str_replace("\r\n", "\n", $abitext), 'UTF-8') ) { $err = "content_to_".safetext(file_get_contents($mojisizefile))."_characters"; $response = array( 'error_code' => $err, diff --git a/addauthcode.php b/addauthcode.php index 3839e68..73a0da1 100644 --- a/addauthcode.php +++ b/addauthcode.php @@ -32,15 +32,6 @@ $stmt = null; $res = null; $option = null; - -if( !empty($_SESSION['userid']) ) { - $userid = $_SESSION['userid']; -}else{ - header("Location: login.php"); - exit; -} - - try { $option = array( @@ -55,134 +46,140 @@ try { $error_message[] = $e->getMessage(); } -//ログイン認証--------------------------------------------------- -blockedIP($_SERVER['REMOTE_ADDR']); -$is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); -if(!($is_login === false)){ - header("Location: /home/"); - exit; -} -//------------------------------------------------------------- - -require_once 'authcode/GoogleAuthenticator.php'; - -if(empty($_SESSION['secretcode'])){ - $authcode = new PHPGangsta_GoogleAuthenticator(); - $secret = $authcode->createSecret(); - $_SESSION['secretcode'] = $secret; -}else{ - $authcode = new PHPGangsta_GoogleAuthenticator(); - $secret = $_SESSION['secretcode']; -} - -if(!(empty($pdo))){ - // ユーザーデータ取得 - $userQuery = $pdo->prepare("SELECT * FROM account WHERE userid = :userid"); - $userQuery->bindValue(':userid', $userid); - $userQuery->execute(); - $userData = $userQuery->fetch(); -} - -if( !empty($_POST['btn_submit']) ) { - $chkauthcode = new PHPGangsta_GoogleAuthenticator(); - //二段階認証の確認 - $userauthcode = $_POST['usercode']; - - $discrepancy = 2; - - $checkResult = $chkauthcode->verifyCode($secret, $userauthcode, $discrepancy); - if ($checkResult) { - if( empty($error_message) ) { - $backupcode = random(); - $hashbackupcode = uwuzu_password_hash($backupcode); - $secret = $_SESSION['secretcode']; - - if(!(empty($userData["encryption_ivkey"]))){ - $userEnckey = GenUserEnckey($userData["datetime"]); - $enc_seacret = EncryptionUseEncrKey($secret, $userEnckey, $userData["encryption_ivkey"]); - }else{ - $ivLength = openssl_cipher_iv_length('aes-256-cbc'); - $randomBytes = random_bytes($ivLength); - $randomhash = hash('sha3-512', $randomBytes); - $iv = substr($randomhash, 0, $ivLength); - // トランザクション開始 - $pdo->beginTransaction(); - try { - // SQL作成 - $stmt = $pdo->prepare("UPDATE account SET encryption_ivkey = :encryption_ivkey WHERE userid = :userid;"); - $stmt->bindParam(':encryption_ivkey', $iv, PDO::PARAM_STR); - $stmt->bindValue(':userid', $userid, PDO::PARAM_STR); - $res = $stmt->execute(); - $res = $pdo->commit(); - } catch (Exception $e) { - $pdo->rollBack(); - } - if (!($res)) { - $error_message[] = "アカウント操作に失敗しました(ERROR)"; - } - $stmt = null; - - $userEnckey = GenUserEnckey($userData["datetime"]); - $enc_seacret = EncryptionUseEncrKey($secret, $userEnckey, $iv); - } - - // トランザクション開始 - $pdo->beginTransaction(); - - try { - - // SQL作成 - $stmt = $pdo->prepare("UPDATE account SET authcode = :authcode,backupcode = :backupcode WHERE userid = :userid"); - - $stmt->bindValue(':authcode', $enc_seacret, PDO::PARAM_STR); - $stmt->bindValue(':backupcode', $hashbackupcode, PDO::PARAM_STR); - - // ユーザーIDのバインド（WHERE句に必要） - $stmt->bindValue(':userid', $userid, PDO::PARAM_STR); - - // SQLクエリの実行 - $res = $stmt->execute(); - - // コミット - $res = $pdo->commit(); - - - } catch (Exception $e) { - - // エラーが発生した時はロールバック - $pdo->rollBack(); - } - - if ($res) { - if (isset($_SERVER['HTTP_COOKIE'])) { - $cookies = explode(';', $_SERVER['HTTP_COOKIE']); - foreach($cookies as $cookie) { - $parts = explode('=', $cookie); - $name = trim($parts[0]); - setcookie($name, '', time()-1000); - setcookie($name, '', time()-1000, '/'); - } - } - $userid = ""; - $_SESSION['backupcode'] = $backupcode; - // リダイレクト先のURLへ転送する - $url = 'success.php'; - header('Location: ' . $url, true, 303); - exit; - } else { - $error_message[] = '更新に失敗しました。(REGISTERED_DAME)'; - } - - // プリペアドステートメントを削除 - $stmt = null; +if( !empty($pdo) ) { + $userData = getUserData($pdo, $_SESSION['userid']); + if(!(empty($userData))){ + if($_SESSION['is_register_account'] === true){ + $userid = $userData["userid"]; + }else{ + header("Location: login.php"); + exit; + } + }else{ + $_SESSION = array(); + header("Location: index.php"); + exit; + } + + //ログイン認証--------------------------------------------------- + blockedIP($_SERVER['REMOTE_ADDR']); + $is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); + if(!($is_login === false)){ + header("Location: /home/"); + exit; + } + //------------------------------------------------------------- + + require_once 'authcode/GoogleAuthenticator.php'; + + if(empty($_SESSION['secretcode'])){ + $authcode = new PHPGangsta_GoogleAuthenticator(); + $secret = $authcode->createSecret(); + $_SESSION['secretcode'] = $secret; + }else{ + $authcode = new PHPGangsta_GoogleAuthenticator(); + $secret = $_SESSION['secretcode']; + } + + if(!(empty($pdo))){ + // ユーザーデータ取得 + $userQuery = $pdo->prepare("SELECT * FROM account WHERE userid = :userid"); + $userQuery->bindValue(':userid', $userid); + $userQuery->execute(); + $userData = $userQuery->fetch(); + } + + if( !empty($_POST['btn_submit']) ) { + $chkauthcode = new PHPGangsta_GoogleAuthenticator(); + //二段階認証の確認 + $userauthcode = $_POST['usercode']; + + $discrepancy = 2; + + $checkResult = $chkauthcode->verifyCode($secret, $userauthcode, $discrepancy); + if ($checkResult) { + if( empty($error_message) ) { + $backupcode = random(); + $hashbackupcode = uwuzu_password_hash($backupcode); + $secret = $_SESSION['secretcode']; + + if(!(empty($userData["encryption_ivkey"]))){ + $userEnckey = GenUserEnckey($userData["datetime"]); + $enc_seacret = EncryptionUseEncrKey($secret, $userEnckey, $userData["encryption_ivkey"]); + }else{ + $ivLength = openssl_cipher_iv_length('aes-256-cbc'); + $randomBytes = random_bytes($ivLength); + $randomhash = hash('sha3-512', $randomBytes); + $iv = substr($randomhash, 0, $ivLength); + // トランザクション開始 + $pdo->beginTransaction(); + try { + // SQL作成 + $stmt = $pdo->prepare("UPDATE account SET encryption_ivkey = :encryption_ivkey WHERE userid = :userid;"); + $stmt->bindParam(':encryption_ivkey', $iv, PDO::PARAM_STR); + $stmt->bindValue(':userid', $userid, PDO::PARAM_STR); + $res = $stmt->execute(); + $res = $pdo->commit(); + } catch (Exception $e) { + $pdo->rollBack(); + } + if (!($res)) { + $error_message[] = "アカウント操作に失敗しました(ERROR)"; + } + $stmt = null; + + $userEnckey = GenUserEnckey($userData["datetime"]); + $enc_seacret = EncryptionUseEncrKey($secret, $userEnckey, $iv); + } + + // トランザクション開始 + $pdo->beginTransaction(); + + try { + + // SQL作成 + $stmt = $pdo->prepare("UPDATE account SET authcode = :authcode,backupcode = :backupcode WHERE userid = :userid"); + + $stmt->bindValue(':authcode', $enc_seacret, PDO::PARAM_STR); + $stmt->bindValue(':backupcode', $hashbackupcode, PDO::PARAM_STR); + + // ユーザーIDのバインド（WHERE句に必要） + $stmt->bindValue(':userid', $userid, PDO::PARAM_STR); + + // SQLクエリの実行 + $res = $stmt->execute(); + + // コミット + $res = $pdo->commit(); + + + } catch (Exception $e) { + + // エラーが発生した時はロールバック + $pdo->rollBack(); + } + + if ($res) { + $_SESSION["userid"] = $userid; + $_SESSION['backupcode'] = $backupcode; + $_SESSION['is_register_account'] = true; + // リダイレクト先のURLへ転送する + $url = 'success.php'; + header('Location: ' . $url, true, 303); + exit; + } else { + $error_message[] = '更新に失敗しました。(REGISTERED_DAME)'; + } + + // プリペアドステートメントを削除 + $stmt = null; + } + } else { + $error_message[] = "二段階認証が出来ませんでした。再度お試しください。(AUTHCODE_CHECK_DAME)"; } - } else { - $error_message[] = "二段階認証が出来ませんでした。再度お試しください。(AUTHCODE_CHECK_DAME)"; } } - - // データベースの接続を閉じる $pdo = null; @@ -216,7 +213,7 @@ $pdo = null;

二段階認証

-

以下の二次元コードより二段階認証をセットアップしてください。

+

以下の二次元コードを読み込むか、二次元コードの下の秘密鍵を認証アプリに入力して二段階認証をセットアップしてください。

セットアップが完了したら入力ボックスにコードを入力して「次へ」ボタンを押してください！
注意:まだ二段階認証の設定は終わっていません。次へを押すと設定が完了します。

@@ -236,7 +233,8 @@ $pdo = null; $qrCodeUrl = $authcode->getQRCodeUrl($name, $secret, $title); ?>
- + +
@@ -250,36 +248,11 @@ $pdo = null;
- - - diff --git a/admin/addadmin.php b/admin/addadmin.php index 5db44f6..73af838 100644 --- a/admin/addadmin.php +++ b/admin/addadmin.php @@ -421,6 +421,7 @@ if( !empty($_POST['btn_submit']) ) { // リダイレクト先のURLへ転送する $_SESSION['form_data'] = array(); $_SESSION['userid'] = $userid; + $_SESSION['is_register_account'] = true; $url = 'success'; header('Location: ' . $url, true, 303); @@ -506,13 +507,13 @@ $pdo = null;

パスワード *

ログイン時に必要となります。
最大256文字まで使用可能です。
※サービス管理者が確認できません。
- +

パスワード再確認 *

- +
diff --git a/admin/index.php b/admin/index.php index e01627c..ee034a3 100644 --- a/admin/index.php +++ b/admin/index.php @@ -98,37 +98,24 @@ if(!(empty(DB_NAME) && empty(DB_HOST) && empty(DB_USER) && empty(DB_PASS))){ $db_php = false; } -if (in_array("gd", get_loaded_extensions())) { - $check_gd = true; -} else { - $check_gd = false; +$extensions_to_check = [ + "gd" => "GD", + "fileinfo" => "Fileinfo", + "mbstring" => "mbstring", + "pdo_mysql" => "pdo_mysql", + "mysqli" => "mysqli", + "zip" => "ZipArchive", + "curl" => "cURL" +]; + +$loaded_extensions = get_loaded_extensions(); +$extension_status = []; + +foreach ($extensions_to_check as $extension_id => $display_name){ + $is_loaded = in_array($extension_id, $loaded_extensions); + $extension_status[$display_name] = $is_loaded; } -if (in_array("fileinfo", get_loaded_extensions())) { - $check_fileinfo = true; -} else { - $check_fileinfo = false; -} -if (in_array("mbstring", get_loaded_extensions())) { - $check_mbstring = true; -} else { - $check_mbstring = false; -} -if (in_array("pdo_mysql", get_loaded_extensions())) { - $check_pdo_mysql = true; -} else { - $check_pdo_mysql = false; -} -if (in_array("mysqli", get_loaded_extensions())) { - $check_mysqli = true; -} else { - $check_mysqli = false; -} -if (in_array("zip", get_loaded_extensions())) { - $check_zip = true; -} else { - $check_zip = false; -} -// データベースの接続を閉じる + $pdo = null; ?> @@ -186,17 +173,20 @@ $pdo = null; これらのデータをあなたが知っているのであれば早速セットアップを開始しましょう！

- セットアップ中にエラーに遭遇した場合はdocs.uwuzu.xyzを確認し、解消に向けて取り組みましょう！

+ セットアップ中にエラーに遭遇した場合はdocs.uwuzu.comを確認し、解消に向けて取り組みましょう！

-
-
Already setが設定済みでNot setが未設定です。
-

GD :

-

Fileinfo :

-

mbstring :

-

pdo_mysql :

-

mysqli :

-

ZipArchive :

-
+
+
Already setが設定済みでNot setが未設定です。
+
PHPの必須モジュールの確認は全ての必須モジュールを対象に行われるものではありません。php側にてデフォルトでインストール・有効になっているものはチェック・表示しない場合がございます。
+ $status): ?> +

+ : + +

+ +

uwuzu
Version :

diff --git a/api/auth.php b/api/auth.php index 71e4ea2..039386b 100644 --- a/api/auth.php +++ b/api/auth.php @@ -68,7 +68,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/api/me/index.php b/api/me/index.php index d98ab59..9ce69b7 100644 --- a/api/me/index.php +++ b/api/me/index.php @@ -113,24 +113,18 @@ if(isset($_GET['token']) || (!(empty($Get_Post_Json)))) { }else{ $isAdmin = false; } - if(!(empty($userdata["follow"]))){ - $followee = preg_split("/,/", decode_yajirushi(htmlspecialchars_decode($userdata["follow"]))); - array_shift($followee); - }else{ + + $followee = getFolloweeList($pdo, $userdata["userid"]); + if($followee === false){ $followee = array(); } - if(!(empty($userdata["follower"]))){ - $follower = preg_split("/,/", decode_yajirushi(htmlspecialchars_decode($userdata["follower"]))); - array_shift($follower); - }else{ + $follower = getFollowerList($pdo, $userdata["userid"]); + if($follower === false){ $follower = array(); } - $followcnts = explode(',', $userdata["follow"]); - $userdata["follow_cnt"] = (int)count($followcnts)-1; - - $followercnts = explode(',', $userdata["follower"]); - $userdata["follower_cnt"] = (int)count($followercnts)-1; + $userdata["follow_cnt"] = (int)count($followee); + $userdata["follower_cnt"] = (int)count($follower); $allueuse = $pdo->prepare("SELECT account FROM ueuse WHERE account = :userid"); $allueuse->bindValue(':userid', $userdata["userid"]); diff --git a/api/ueuse/replies.php b/api/ueuse/replies.php index c46d94c..d7a6b37 100644 --- a/api/ueuse/replies.php +++ b/api/ueuse/replies.php @@ -119,6 +119,8 @@ if(isset($_GET['token']) || (!(empty($Get_Post_Json)))) { } $favcnts = explode(',', $ueusedata["favorite"]); $ueusedata["favorite_cnt"] = count($favcnts) - 1; + + $userData = getUserData($pdo, $ueusedata["account"]); if ($userData) { $now_userdata = array( diff --git a/api/users/index.php b/api/users/index.php index f4d5fc0..1ffbdef 100644 --- a/api/users/index.php +++ b/api/users/index.php @@ -73,7 +73,7 @@ if(isset($_GET['token']) || (!(empty($Get_Post_Json)))) { if( !empty($pdo) ) { $AuthData = APIAuth($pdo, $token, "read:users"); if($AuthData[0] === true){ - $userdata = $AuthData[2]; + $userdata = getUserData($pdo, $userid); if (empty($userdata)){ $response = array( @@ -130,24 +130,18 @@ if(isset($_GET['token']) || (!(empty($Get_Post_Json)))) { }else{ $isAdmin = false; } - if(!(empty($userdata["follow"]))){ - $followee = preg_split("/,/", decode_yajirushi(htmlspecialchars_decode($userdata["follow"]))); - array_shift($followee); - }else{ + + $followee = getFolloweeList($pdo, $userdata["userid"]); + if($followee === false){ $followee = array(); } - if(!(empty($userdata["follower"]))){ - $follower = preg_split("/,/", decode_yajirushi(htmlspecialchars_decode($userdata["follower"]))); - array_shift($follower); - }else{ + $follower = getFollowerList($pdo, $userdata["userid"]); + if($follower === false){ $follower = array(); } - $followcnts = explode(',', $userdata["follow"]); - $userdata["follow_cnt"] = (int)count($followcnts)-1; - - $followercnts = explode(',', $userdata["follower"]); - $userdata["follower_cnt"] = (int)count($followercnts)-1; + $userdata["follow_cnt"] = (int)count($followee); + $userdata["follower_cnt"] = (int)count($follower); $allueuse = $pdo->prepare("SELECT account FROM ueuse WHERE account = :userid"); $allueuse->bindValue(':userid', $userdata["userid"]); diff --git a/api/users/unfollow.php b/api/users/unfollow.php index 0d71346..430cb86 100644 --- a/api/users/unfollow.php +++ b/api/users/unfollow.php @@ -80,7 +80,6 @@ if(isset($_GET['token']) || (!(empty($Get_Post_Json)))) { $Follow_userdata = $DataQuery->fetch(); $userid = $userData["userid"]; - $myfollowlist = $userData["follow"]; if(!(empty($Follow_userdata))){ if(!($userid == $Follow_userdata['userid'])){ diff --git a/authcodechk.php b/authcodechk.php index 5488513..dd1cc0f 100644 --- a/authcodechk.php +++ b/authcodechk.php @@ -27,17 +27,7 @@ $stmt = null; $res = null; $option = null; - -if( !empty($_SESSION['userid']) ) { - $userid = $_SESSION['userid']; -}else{ - header("Location: login.php"); - exit; -} - - // データベースに接続 - try { $option = array( @@ -52,42 +42,60 @@ try { $error_message[] = $e->getMessage(); } -//ログイン認証--------------------------------------------------- -blockedIP($_SERVER['REMOTE_ADDR']); -$is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); -if(!($is_login === false)){ - header("Location: /home/"); - exit; -} -//------------------------------------------------------------- +if( !empty($pdo) ) { + $userData = getUserData($pdo, $_SESSION['userid']); + if(!(empty($userData))){ + if($_SESSION['is_register_account'] === true){ + $userid = $userData["userid"]; + }else{ + header("Location: login.php"); + exit; + } + }else{ + $_SESSION = array(); + header("Location: index.php"); + exit; + } + + //ログイン認証--------------------------------------------------- + blockedIP($_SERVER['REMOTE_ADDR']); + $is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); + if(!($is_login === false)){ + header("Location: /home/"); + exit; + } + //------------------------------------------------------------- -if( !empty($_POST['btn_submit']) ) { - $_SESSION['userid'] = $userid; - // リダイレクト先のURLへ転送する - $url = 'addauthcode.php'; - header('Location: ' . $url, true, 303); + if( !empty($_POST['btn_submit']) ) { + $_SESSION['userid'] = $userid; + $_SESSION['is_register_account'] = true; + // リダイレクト先のURLへ転送する + $url = 'addauthcode.php'; + header('Location: ' . $url, true, 303); - // すべての出力を終了 - exit; -} + // すべての出力を終了 + exit; + } -if( !empty($_POST['skip_submit']) ) { - if (isset($_SERVER['HTTP_COOKIE'])) { - $cookies = explode(';', $_SERVER['HTTP_COOKIE']); - foreach($cookies as $cookie) { - $parts = explode('=', $cookie); - $name = trim($parts[0]); - setcookie($name, '', time()-1000); - setcookie($name, '', time()-1000, '/'); - } - } - $userid = ""; - // リダイレクト先のURLへ転送する - $url = 'success.php'; - header('Location: ' . $url, true, 303); + if( !empty($_POST['skip_submit']) ) { + if (isset($_SERVER['HTTP_COOKIE'])) { + $cookies = explode(';', $_SERVER['HTTP_COOKIE']); + foreach($cookies as $cookie) { + $parts = explode('=', $cookie); + $name = trim($parts[0]); + setcookie($name, '', time()-1000); + setcookie($name, '', time()-1000, '/'); + } + } + $userid = ""; + $_SESSION['is_register_account'] = true; + // リダイレクト先のURLへ転送する + $url = 'success.php'; + header('Location: ' . $url, true, 303); - // すべての出力を終了 - exit; + // すべての出力を終了 + exit; + } } // データベースの接続を閉じる diff --git a/authlogin.php b/authlogin.php index 52ba753..83886f0 100644 --- a/authlogin.php +++ b/authlogin.php @@ -36,249 +36,271 @@ session_set_cookie_params([ session_start(); session_regenerate_id(true); -if( !empty($_SESSION['userid']) ) { - $userid = $_SESSION['userid']; -}else{ - header("Location: login.php"); - exit; -} try { - $option = array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::MYSQL_ATTR_MULTI_STATEMENTS => false ); $pdo = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $option); - - $userData = getUserData($pdo, $userid); } catch(PDOException $e) { - // 接続エラーのときエラー内容を取得する $error_message[] = $e->getMessage(); } -//ログイン認証--------------------------------------------------- -blockedIP($_SERVER['REMOTE_ADDR']); -$is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); -if(!($is_login === false)){ - header("Location: /home/"); - exit; -} -//------------------------------------------------------------- -//パスワード試行回数制限------------------------------------------- -if (!isset($_SESSION['login_passtry'])) { - $_SESSION['login_passtry'] = 0; -} -//------------------------------------------------------------- - -if( !empty($_POST['btn_submit']) ) { - if ($_SESSION["login_passtry"] <= 5) { - $delay = $_SESSION["login_passtry"] * 2; - } else { - $delay = min(pow(2, $_SESSION["login_passtry"] - 2), 60); +if( !empty($pdo) ) { + if( !empty($_SESSION['userid']) ) { + if($_SESSION['auth_status'] === "2fa_required"){ + $userData = getUserData($pdo, $_SESSION['userid']); + if(!(empty($userData))){ + $userid = $userData["userid"]; + }else{ + $_SESSION = array(); + header("Location: login.php"); + exit; + } + }elseif($_SESSION['auth_status'] === "authenticated"){ + header("Location: check.php"); + exit; + }else{ + $_SESSION = array(); + header("Location: login.php"); + exit; + } + }else{ + $_SESSION = array(); + header("Location: login.php"); + exit; } - sleep($delay); - $useragent = safetext($_SERVER['HTTP_USER_AGENT']); - $device = UserAgent_to_Device($useragent); + //ログイン認証--------------------------------------------------- + blockedIP($_SERVER['REMOTE_ADDR']); + $is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); + if(!($is_login === false)){ + header("Location: /home/"); + exit; + } + //------------------------------------------------------------- + //パスワード試行回数制限------------------------------------------- + if (!isset($_SESSION['login_passtry'])) { + $_SESSION['login_passtry'] = 0; + } + //------------------------------------------------------------- - $userbackupcode = $_POST['userbackupcode']; + if( !empty($_POST['btn_submit']) ) { + if ($_SESSION["login_passtry"] <= 5) { + $delay = $_SESSION["login_passtry"] * 2; + } else { + $delay = min(pow(2, $_SESSION["login_passtry"] - 2), 60); + } + sleep($delay); - $options = array( - // SQL実行失敗時に例外をスルー - PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, - // デフォルトフェッチモードを連想配列形式に設定 - PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, - // バッファードクエリを使う（一度に結果セットを全て取得し、サーバー負荷を軽減） - // SELECTで得た結果に対してもrowCountメソッドを使えるようにする - PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true, - ); + $useragent = safetext($_SERVER['HTTP_USER_AGENT']); + $device = UserAgent_to_Device($useragent); - $dbh = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $options); + $userbackupcode = $_POST['userbackupcode']; - require_once 'authcode/GoogleAuthenticator.php'; + $options = array( + // SQL実行失敗時に例外をスルー + PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, + // デフォルトフェッチモードを連想配列形式に設定 + PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, + // バッファードクエリを使う（一度に結果セットを全て取得し、サーバー負荷を軽減） + // SELECTで得た結果に対してもrowCountメソッドを使えるようにする + PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true, + ); - $result = $dbh->prepare("SELECT * FROM account WHERE userid = :userid"); + $dbh = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $options); - $result->bindValue(':userid', $userid); - // SQL実行 - $result->execute(); + require_once 'authcode/GoogleAuthenticator.php'; - if(!(empty($userbackupcode))){ - $row = $result->fetch(); - $backuplogin = false; - if(mb_strlen($row["backupcode"]) === 32 && mb_strlen($userbackupcode) === 32){ - if($row["backupcode"] === $userbackupcode){ - $backuplogin = true; + $result = $dbh->prepare("SELECT * FROM account WHERE userid = :userid"); + + $result->bindValue(':userid', $userid); + // SQL実行 + $result->execute(); + + if(!(empty($userbackupcode))){ + $row = $result->fetch(); + $backuplogin = false; + if(mb_strlen($row["backupcode"]) === 32 && mb_strlen($userbackupcode) === 32){ + if($row["backupcode"] === $userbackupcode){ + $backuplogin = true; + }else{ + $backuplogin = false; + } }else{ $backuplogin = false; } - }else{ - $backuplogin = false; - } - - if($backuplogin === true || uwuzu_password_verify($userbackupcode,$row["backupcode"])){ - $pdo->beginTransaction(); - try { - $touserid = $userid; - $datetime = date("Y-m-d H:i:s"); - $msg = "バックアップコードを使用しログインされました！\nバックアップコード変更のために二段階認証を再設定することを強くおすすめします。\nまた、もしバックアップコードを利用してログインした覚えがない場合は「その他」よりセッショントークンを再生成し、設定画面よりパスワードを変更し、二段階認証を再設定してください！\n\nログインした端末 : ".$device; - $title = '🔴バックアップコード使用のお知らせ🔴'; - $url = '/settings'; - $userchk = 'none'; - // 通知用SQL作成 - $stmt = $pdo->prepare("INSERT INTO notification (fromuserid, touserid, msg, url, datetime, userchk, title) VALUES (:fromuserid, :touserid, :msg, :url, :datetime, :userchk, :title)"); - - $stmt->bindParam(':fromuserid', safetext("uwuzu-fromsys"), PDO::PARAM_STR); - $stmt->bindParam(':touserid', safetext($touserid), PDO::PARAM_STR); - $stmt->bindParam(':msg', safetext($msg), PDO::PARAM_STR); - $stmt->bindParam(':url', safetext($url), PDO::PARAM_STR); - $stmt->bindParam(':userchk', safetext($userchk), PDO::PARAM_STR); - $stmt->bindParam(':title', safetext($title), PDO::PARAM_STR); + if($backuplogin === true || uwuzu_password_verify($userbackupcode,$row["backupcode"])){ + $pdo->beginTransaction(); + + try { + $touserid = $userid; + $datetime = date("Y-m-d H:i:s"); + $msg = "バックアップコードを使用しログインされました！\nバックアップコード変更のために二段階認証を再設定することを強くおすすめします。\nまた、もしバックアップコードを利用してログインした覚えがない場合は「その他」よりセッショントークンを再生成し、設定画面よりパスワードを変更し、二段階認証を再設定してください！\n\nログインした端末 : ".$device; + $title = '🔴バックアップコード使用のお知らせ🔴'; + $url = '/settings'; + $userchk = 'none'; + // 通知用SQL作成 + $stmt = $pdo->prepare("INSERT INTO notification (fromuserid, touserid, msg, url, datetime, userchk, title) VALUES (:fromuserid, :touserid, :msg, :url, :datetime, :userchk, :title)"); + + $stmt->bindParam(':fromuserid', safetext("uwuzu-fromsys"), PDO::PARAM_STR); + $stmt->bindParam(':touserid', safetext($touserid), PDO::PARAM_STR); + $stmt->bindParam(':msg', safetext($msg), PDO::PARAM_STR); + $stmt->bindParam(':url', safetext($url), PDO::PARAM_STR); + $stmt->bindParam(':userchk', safetext($userchk), PDO::PARAM_STR); + $stmt->bindParam(':title', safetext($title), PDO::PARAM_STR); - $stmt->bindParam(':datetime', safetext($datetime), PDO::PARAM_STR); + $stmt->bindParam(':datetime', safetext($datetime), PDO::PARAM_STR); - // SQLクエリの実行 - $res = $stmt->execute(); + // SQLクエリの実行 + $res = $stmt->execute(); - // コミット - $res = $pdo->commit(); + // コミット + $res = $pdo->commit(); - } catch(Exception $e) { + } catch(Exception $e) { - // エラーが発生した時はロールバック - $pdo->rollBack(); - } - - clearstatcache(); - - if (isset($_SERVER['HTTP_COOKIE'])) { - $cookies = explode(';', $_SERVER['HTTP_COOKIE']); - foreach($cookies as $cookie) { - $parts = explode('=', $cookie); - $name = trim($parts[0]); - setcookie($name, '', time()-1000); + // エラーが発生した時はロールバック + $pdo->rollBack(); } - } - setcookie('loginid', $userData["loginid"],[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - - $userEncKey = GenUserEnckey($userData["datetime"]); - $userLoginKey = hash_hmac('sha256', $userData["loginid"], $userEncKey); - setcookie('loginkey', $userLoginKey,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - - $_SESSION['userid'] = $userid; - $_SESSION['loginid'] = $userData["loginid"]; - $_SESSION['loginkey'] = $userLoginKey; - - $_SESSION['username'] = $username; - $_SESSION['password'] = null; - $_SESSION["login_passtry"] = 0; - - // リダイレクト先のURLへ転送する - $url = '/home'; - header('Location: ' . $url, true, 303); - - // すべての出力を終了 - exit; - }else{ - $_SESSION["login_passtry"]++; - $error_message[] = "そのバックアップコードは使用できません。(BACKUPCODE_DAME)"; - } - }else{ - - if($result->rowCount() > 0) { - $row = $result->fetch(); - - if(!(empty($row["encryption_ivkey"])) && (!(mb_strlen($row["authcode"]) === 16))){ - $tousercode = DecryptionUseEncrKey($row["authcode"], GenUserEnckey($row["datetime"]), $row["encryption_ivkey"]); - }else{ - $tousercode = $row["authcode"]; - } - - $chkauthcode = new PHPGangsta_GoogleAuthenticator(); - - $userauthcode = $_POST['usercode']; - - if(empty($userauthcode)){ - $error_message[] = "コードを入力してください。(AUTHCODE_INPUT_PLEASE)"; - }else{ - - $discrepancy = 2; - - $checkResult = $chkauthcode->verifyCode($tousercode, $userauthcode, $discrepancy); - if ($checkResult) { - - $msg = "アカウントにログインがありました。\nもしログインした覚えがない場合は「その他」よりセッショントークンを再生成し、パスワードを変更し、二段階認証を再設定してください。\n\nログインした端末 : ".$device; - send_notification($userid,"uwuzu-fromsys","🚪ログイン通知🚪",$msg,"/settings", "login"); - - clearstatcache(); - - if (isset($_SERVER['HTTP_COOKIE'])) { - $cookies = explode(';', $_SERVER['HTTP_COOKIE']); - foreach($cookies as $cookie) { - $parts = explode('=', $cookie); - $name = trim($parts[0]); - setcookie($name, '', time()-1000); - } + clearstatcache(); + + if (isset($_SERVER['HTTP_COOKIE'])) { + $cookies = explode(';', $_SERVER['HTTP_COOKIE']); + foreach($cookies as $cookie) { + $parts = explode('=', $cookie); + $name = trim($parts[0]); + setcookie($name, '', time()-1000); } - - setcookie('loginid', $userData["loginid"],[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - - $userEncKey = GenUserEnckey($userData["datetime"]); - $userLoginKey = hash_hmac('sha256', $userData["loginid"], $userEncKey); - setcookie('loginkey', $userLoginKey,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); - - $_SESSION['userid'] = $userid; - $_SESSION['loginid'] = $userData["loginid"]; - $_SESSION['loginkey'] = $userLoginKey; - - $_SESSION['username'] = $username; - $_SESSION['password'] = null; - $_SESSION["login_passtry"] = 0; - - // リダイレクト先のURLへ転送する - $url = '/home'; - header('Location: ' . $url, true, 303); - - // すべての出力を終了 - exit; - - }else { - $_SESSION["login_passtry"]++; - $error_message[] = '二段階認証が出来ませんでした。再度お試しください。(AUTHCODE_CHECK_DAME)'; } + + setcookie('loginid', $userData["loginid"],[ + 'expires' => time() + 60 * 60 * 24 * 28, + 'path' => '/', + 'samesite' => 'lax', + 'secure' => true, + 'httponly' => true, + ]); + + $userEncKey = GenUserEnckey($userData["datetime"]); + $userLoginKey = hash_hmac('sha256', $userData["loginid"], $userEncKey); + setcookie('loginkey', $userLoginKey,[ + 'expires' => time() + 60 * 60 * 24 * 28, + 'path' => '/', + 'samesite' => 'lax', + 'secure' => true, + 'httponly' => true, + ]); + + $_SESSION['userid'] = $userid; + $_SESSION['loginid'] = $userData["loginid"]; + $_SESSION['loginkey'] = $userLoginKey; + + $_SESSION['username'] = $username; + $_SESSION['password'] = null; + $_SESSION["login_passtry"] = 0; + + //ログイン失敗履歴のお掃除 + cleanupOldLoginLogs($pdo); + + // リダイレクト先のURLへ転送する + $url = '/home'; + header('Location: ' . $url, true, 303); + + // すべての出力を終了 + exit; + }else{ + $_SESSION["login_passtry"]++; + $error_message[] = "そのバックアップコードは使用できません。(BACKUPCODE_DAME)"; } }else{ - $error_message[] = 'データの取得が出来ませんでした。再度お試しください。(AUTHCODE_GET_ACCOUNT_NOT_FOUND)'; - } - } + if($result->rowCount() > 0) { + $row = $result->fetch(); + + if(!(empty($row["encryption_ivkey"])) && (!(mb_strlen($row["authcode"]) === 16))){ + $tousercode = DecryptionUseEncrKey($row["authcode"], GenUserEnckey($row["datetime"]), $row["encryption_ivkey"]); + }else{ + $tousercode = $row["authcode"]; + } + + $chkauthcode = new PHPGangsta_GoogleAuthenticator(); + + $userauthcode = $_POST['usercode']; + + if(empty($userauthcode)){ + $error_message[] = "コードを入力してください。(AUTHCODE_INPUT_PLEASE)"; + }else{ + + $discrepancy = 2; + + $checkResult = $chkauthcode->verifyCode($tousercode, $userauthcode, $discrepancy); + if ($checkResult) { + + $msg = "アカウントにログインがありました。\nもしログインした覚えがない場合は「その他」よりセッショントークンを再生成し、パスワードを変更し、二段階認証を再設定してください。\n\nログインした端末 : ".$device; + send_notification($userid,"uwuzu-fromsys","🚪ログイン通知🚪",$msg,"/settings", "login"); + + clearstatcache(); + + if (isset($_SERVER['HTTP_COOKIE'])) { + $cookies = explode(';', $_SERVER['HTTP_COOKIE']); + foreach($cookies as $cookie) { + $parts = explode('=', $cookie); + $name = trim($parts[0]); + setcookie($name, '', time()-1000); + } + } + + setcookie('loginid', $userData["loginid"],[ + 'expires' => time() + 60 * 60 * 24 * 28, + 'path' => '/', + 'samesite' => 'lax', + 'secure' => true, + 'httponly' => true, + ]); + + $userEncKey = GenUserEnckey($userData["datetime"]); + $userLoginKey = hash_hmac('sha256', $userData["loginid"], $userEncKey); + setcookie('loginkey', $userLoginKey,[ + 'expires' => time() + 60 * 60 * 24 * 28, + 'path' => '/', + 'samesite' => 'lax', + 'secure' => true, + 'httponly' => true, + ]); + + $_SESSION['userid'] = $userid; + $_SESSION['loginid'] = $userData["loginid"]; + $_SESSION['loginkey'] = $userLoginKey; + + $_SESSION['username'] = $username; + $_SESSION['password'] = null; + $_SESSION["login_passtry"] = 0; + + //ログイン失敗履歴のお掃除 + cleanupOldLoginLogs($pdo); + + // リダイレクト先のURLへ転送する + $url = '/home'; + header('Location: ' . $url, true, 303); + + // すべての出力を終了 + exit; + + }else { + $_SESSION["login_passtry"]++; + $error_message[] = '二段階認証が出来ませんでした。再度お試しください。(AUTHCODE_CHECK_DAME)'; + } + } + }else{ + $error_message[] = 'データの取得が出来ませんでした。再度お試しください。(AUTHCODE_GET_ACCOUNT_NOT_FOUND)'; + } + } + + } } // データベースの接続を閉じる diff --git a/bookmark/index.php b/bookmark/index.php index 65706c7..6a26686 100644 --- a/bookmark/index.php +++ b/bookmark/index.php @@ -55,7 +55,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/check.php b/check.php index 471f6e3..33d61af 100644 --- a/check.php +++ b/check.php @@ -35,21 +35,44 @@ session_regenerate_id(true); // データベースに接続 try { - $option = array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::MYSQL_ATTR_MULTI_STATEMENTS => false ); $pdo = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $option); +} catch(PDOException $e) { + // 接続エラーのときエラー内容を取得する + $error_message[] = $e->getMessage(); +} + + +if( !empty($pdo) ) { if( !empty($_SESSION['userid']) ) { - $userid = $_SESSION['userid']; + if($_SESSION['auth_status'] === "authenticated"){ + $userData = getUserData($pdo, $_SESSION['userid']); + if(!(empty($userData))){ + $userid = $userData["userid"]; + }else{ + $_SESSION = array(); + header("Location: login.php"); + exit; + } + }elseif($_SESSION['auth_status'] === "2fa_required"){ + header("Location: authlogin.php"); + exit; + }else{ + $_SESSION = array(); + header("Location: login.php"); + exit; + } }else{ + $_SESSION = array(); header("Location: login.php"); exit; } - $userData = getUserData($pdo, $userid); + $userData = getUserData($pdo, $userid); $roles = explode(',', $userData["role"]); // カンマで区切られたロールを配列に分割 $roleDataArray = array(); @@ -60,87 +83,85 @@ try { $rerole->execute(); $roleDataArray[$roleId] = $rerole->fetch(); } -} catch(PDOException $e) { - // 接続エラーのときエラー内容を取得する - $error_message[] = $e->getMessage(); -} + //ログイン認証--------------------------------------------------- + blockedIP($_SERVER['REMOTE_ADDR']); + $is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); + if(!($is_login === false)){ + header("Location: /home/"); + exit; + } + //------------------------------------------------------------- -//ログイン認証--------------------------------------------------- -blockedIP($_SERVER['REMOTE_ADDR']); -$is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "user"); -if(!($is_login === false)){ - header("Location: /home/"); - exit; -} -//------------------------------------------------------------- + if( !empty($_POST['btn_submit']) ) { + $useragent = safetext($_SERVER['HTTP_USER_AGENT']); + $device = UserAgent_to_Device($useragent); -if( !empty($_POST['btn_submit']) ) { - $useragent = safetext($_SERVER['HTTP_USER_AGENT']); - $device = UserAgent_to_Device($useragent); + $msg = "アカウントにログインがありました。\nもしログインした覚えがない場合は「その他」よりセッショントークンを再生成し、パスワードを変更してください。\n\nログインした端末 : ".$device; + send_notification($userid,"uwuzu-fromsys","🚪ログイン通知🚪",$msg,"/settings", "login"); - $msg = "アカウントにログインがありました。\nもしログインした覚えがない場合は「その他」よりセッショントークンを再生成し、パスワードを変更してください。\n\nログインした端末 : ".$device; - send_notification($userid,"uwuzu-fromsys","🚪ログイン通知🚪",$msg,"/settings", "login"); + clearstatcache(); - clearstatcache(); - - if (isset($_SERVER['HTTP_COOKIE'])) { - $cookies = explode(';', $_SERVER['HTTP_COOKIE']); - foreach($cookies as $cookie) { - $parts = explode('=', $cookie); - $name = trim($parts[0]); - setcookie($name, '', time()-1000); + if (isset($_SERVER['HTTP_COOKIE'])) { + $cookies = explode(';', $_SERVER['HTTP_COOKIE']); + foreach($cookies as $cookie) { + $parts = explode('=', $cookie); + $name = trim($parts[0]); + setcookie($name, '', time()-1000); + } } + + setcookie('loginid', $userData["loginid"],[ + 'expires' => time() + 60 * 60 * 24 * 28, + 'path' => '/', + 'samesite' => 'lax', + 'secure' => true, + 'httponly' => true, + ]); + + $userEncKey = GenUserEnckey($userData["datetime"]); + $userLoginKey = hash_hmac('sha256', $userData["loginid"], $userEncKey); + setcookie('loginkey', $userLoginKey,[ + 'expires' => time() + 60 * 60 * 24 * 28, + 'path' => '/', + 'samesite' => 'lax', + 'secure' => true, + 'httponly' => true, + ]); + + $_SESSION['userid'] = $userid; + $_SESSION['loginid'] = $userData["loginid"]; + $_SESSION['loginkey'] = $userLoginKey; + + $_SESSION['username'] = $username; + $_SESSION['password'] = null; + + //ログイン失敗履歴のお掃除 + cleanupOldLoginLogs($pdo); + + // リダイレクト先のURLへ転送する + $url = '/home'; + header('Location: ' . $url, true, 303); + + // すべての出力を終了 + exit; } - setcookie('loginid', $userData["loginid"],[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); + if( !empty($_POST['btn_submit2']) ) { - $userEncKey = GenUserEnckey($userData["datetime"]); - $userLoginKey = hash_hmac('sha256', $userData["loginid"], $userEncKey); - setcookie('loginkey', $userLoginKey,[ - 'expires' => time() + 60 * 60 * 24 * 28, - 'path' => '/', - 'samesite' => 'lax', - 'secure' => true, - 'httponly' => true, - ]); + $_SESSION['admin_login'] = false; + $_SESSION['userid'] = ""; - $_SESSION['userid'] = $userid; - $_SESSION['loginid'] = $userData["loginid"]; - $_SESSION['loginkey'] = $userLoginKey; + $_SESSION['username'] = ""; - $_SESSION['username'] = $username; - $_SESSION['password'] = null; + // リダイレクト先のURLへ転送する + $url = 'index.php'; + header('Location: ' . $url, true, 303); - // リダイレクト先のURLへ転送する - $url = '/home'; - header('Location: ' . $url, true, 303); - - // すべての出力を終了 - exit; + // すべての出力を終了 + exit; + } } - -if( !empty($_POST['btn_submit2']) ) { - - $_SESSION['admin_login'] = false; - $_SESSION['userid'] = ""; - - $_SESSION['username'] = ""; - - // リダイレクト先のURLへ転送する - $url = 'index.php'; - header('Location: ' . $url, true, 303); - - // すべての出力を終了 - exit; -} - // データベースの接続を閉じる $pdo = null; diff --git a/css/home.css b/css/home.css index 8ca78f6..b733f4c 100644 --- a/css/home.css +++ b/css/home.css @@ -4131,9 +4131,9 @@ label>input { .loading { text-align: center; font-size: 48px; - /* 絵文字のサイズ */ animation: rotate 0.5s infinite linear; - /* アニメーションを適用 */ + width: fit-content; + margin: auto; } @keyframes rotate { @@ -5123,7 +5123,6 @@ summary { padding-left: 12px; padding-right: 12px; padding-top: 8px; - padding-bottom: 4px; background-color: var(--background-color); border: 1px solid var(--border-color); width: auto; @@ -5147,8 +5146,32 @@ summary { list-style: none; } -.server_code summary::-webkit-details-marker { - display: none; +.report_summary{ + display:flex; + justify-content:space-between; + align-items:center; + width:100%; +} + +.report_summary .count{ + font-size: 16px; + color: var(--subtext-color); + padding: 2px 8px; + background-color: var(--tl-color); + border: solid 1px var(--border-color); + border-radius: 32px; +} + +.report-entry { + background-color: var(--tl-color); + border: solid 1px var(--border-color); + margin-bottom: 10px; + padding: 12px; + padding-bottom: 0px; + border-radius: 8px; +} +.report-entry .p2{ + margin: 0px; } @keyframes slideInYopen { @@ -8822,6 +8845,16 @@ noscript .noscript_modal .inner .center_text p { color: var(--dark-subtext-color); } + .report_summary .count{ + color: var(--subtext-color); + background-color: var(--dark-sub-color); + border: solid 1px var(--dark-border-color); + } + + .report-entry { + background-color: var(--dark-sub-color); + border: solid 1px var(--dark-border-color); + } .terms { background-color: var(--dark-sub-color); diff --git a/emoji/index.php b/emoji/index.php index c67264d..a4eb8e1 100644 --- a/emoji/index.php +++ b/emoji/index.php @@ -59,7 +59,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/function/function.php b/function/function.php index 7e07bdd..e75b1d4 100644 --- a/function/function.php +++ b/function/function.php @@ -1389,7 +1389,7 @@ function send_ueuse($userid,$rpUniqid,$ruUniqid,$ueuse,$photo1,$photo2,$photo3,$ $error_message[] = '内容を入力してください。(INPUT_PLEASE)'; } else { // 文字数を確認 - if((int)safetext(file_get_contents($mojisizefile)) < mb_strlen($ueuse, 'UTF-8')) { + if((int)safetext(file_get_contents($mojisizefile)) < mb_strlen(str_replace("\r\n", "\n", $ueuse), 'UTF-8')) { $error_message[] = '内容は'.safetext(file_get_contents($mojisizefile)).'文字以内で入力してください。(INPUT_OVER_MAX_COUNT)'; } @@ -1710,6 +1710,8 @@ function send_ueuse($userid,$rpUniqid,$ruUniqid,$ueuse,$photo1,$photo2,$photo3,$ $mentionedUsers = array_unique(get_mentions_userid($ueuse)); $mentions = implode(",", $mentionedUsers); + $res = false; + if(empty($rpUniqid) && empty($ruUniqid)){ //-----------通常ユーズ----------- // トランザクション開始 @@ -2115,40 +2117,34 @@ function follow_user($pdo, $to_userid, $userid){ return false; } - $other_settings_me = is_OtherSettings($pdo, $userid); - $other_settings_user = is_OtherSettings($pdo, $to_userid); - if($other_settings_me === true && $other_settings_user === true){ - // トランザクションを開始 - $pdo->beginTransaction(); - try { - // フォローボタンが押された場合の処理 - $followerList = explode(',', $userData['follower'] ?? ''); - if (!(in_array($userid, $followerList))) { - // 自分が相手をフォローしていない場合、相手のfollowerカラムと自分のfollowカラムを更新 - $followerList[] = $userid; - $followerList = array_values(array_unique(array_filter($followerList))); - $newFollowerList = implode(',', $followerList); + if(isMeFollow($pdo, $userid, $to_userid)){ + actionLog($userid, "error", "follow_user", $to_userid, "すでにフォローしています。", 3); + return false; + } - // UPDATE文を実行してフォロー情報を更新 - $updateQuery = $pdo->prepare("UPDATE account SET follower = :follower WHERE userid = :userid"); - $updateQuery->bindValue(':follower', $newFollowerList, PDO::PARAM_STR); - $updateQuery->bindValue(':userid', $userData['userid'], PDO::PARAM_STR); - $res = $updateQuery->execute(); + if((migrationFollowNetwork($pdo, $userid) === true) && (migrationFollowNetwork($pdo, $to_userid) === true)){ + $other_settings_me = is_OtherSettings($pdo, $userid); + $other_settings_user = is_OtherSettings($pdo, $to_userid); + if($other_settings_me === true && $other_settings_user === true){ + $uniqid = createUniqId(); + $datetime = date("Y-m-d H:i:s"); + // トランザクションを開始 + $pdo->beginTransaction(); + try { + // SQL作成 + $stmt = $pdo->prepare("INSERT INTO follow (uniqid, follower_id, followee_id, datetime) VALUES (:uniqid, :follower_id, :followee_id, :datetime)"); - // 自分のfollowカラムを更新 - $myflwlist = explode(',', $myData["follow"]); - $myflwlist[] = $userData['userid']; - $myflwlist = array_values(array_unique(array_filter($myflwlist))); - $newFollowList = implode(',', $myflwlist); + $stmt->bindParam(':uniqid', $uniqid, PDO::PARAM_STR); + $stmt->bindParam(':follower_id', $userid, PDO::PARAM_STR); + $stmt->bindParam(':followee_id', $to_userid, PDO::PARAM_STR); + $stmt->bindParam(':datetime', $datetime, PDO::PARAM_STR); - $updateQuery = $pdo->prepare("UPDATE account SET follow = :follow WHERE userid = :userid"); - $updateQuery->bindValue(':follow', $newFollowList, PDO::PARAM_STR); - $updateQuery->bindValue(':userid', $userid, PDO::PARAM_STR); - $res_follow = $updateQuery->execute(); + // SQLクエリの実行 + $res = $stmt->execute(); send_notification($userData["userid"], $userid, "🎉" . $userid . "さんにフォローされました！🎉", "" . $userid . "さんにフォローされました。", "/@" . $userid . "", "follow", $userid); - if ($res && $res_follow) { + if ($res) { $pdo->commit(); return true; } else { @@ -2156,13 +2152,13 @@ function follow_user($pdo, $to_userid, $userid){ actionLog($userid, "error", "follow_user", $to_userid, "フォローに失敗", 3); return false; } - }else{ - $pdo->commit(); - return true; + } catch(Exception $e) { + // エラーが発生した時はロールバック + $pdo->rollBack(); + actionLog($userid, "error", "follow_user", null, $e, 4); + return false; } - } catch (Exception $e) { - $pdo->rollBack(); - actionLog($userid, "error", "follow_user", $to_userid, $e, 4); + }else{ return false; } }else{ @@ -2174,58 +2170,34 @@ function follow_user($pdo, $to_userid, $userid){ } function unfollow_user($pdo, $to_userid, $userid){ if (!(empty($pdo)) && !(empty($to_userid)) && !(empty($userid))){ - $myData = getUserData($pdo, $userid); - $userData = getUserData($pdo, $to_userid); + if((migrationFollowNetwork($pdo, $userid) === true) && (migrationFollowNetwork($pdo, $to_userid) === true)){ + $other_settings_me = is_OtherSettings($pdo, $userid); + $other_settings_user = is_OtherSettings($pdo, $to_userid); + if($other_settings_me === true && $other_settings_user === true){ + // トランザクション開始 + $pdo->beginTransaction(); + try { + // 削除クエリを実行 + $deleteQuery = $pdo->prepare("DELETE FROM follow WHERE follower_id = :follower_id AND followee_id = :followee_id"); + $deleteQuery->bindValue(':follower_id', $userid, PDO::PARAM_STR); + $deleteQuery->bindValue(':followee_id', $to_userid, PDO::PARAM_STR); + $res = $deleteQuery->execute(); - $other_settings_me = is_OtherSettings($pdo, $userid); - $other_settings_user = is_OtherSettings($pdo, $to_userid); - if($other_settings_me === true && $other_settings_user === true){ - // トランザクションを開始 - $pdo->beginTransaction(); - try { - // フォロー解除ボタンが押された場合の処理 - $followerList = explode(',', $userData['follower']); - if (in_array($userid, $followerList)) { - // 自分が相手をフォローしている場合、相手のfollowerカラムと自分のfollowカラムを更新 - $followerList = array_diff($followerList, array($userid)); - $followerList = array_values(array_unique(array_filter($followerList))); - $newFollowerList = implode(',', $followerList); - - // UPDATE文を実行してフォロー情報を更新 - $updateQuery = $pdo->prepare("UPDATE account SET follower = :follower WHERE userid = :userid"); - $updateQuery->bindValue(':follower', $newFollowerList, PDO::PARAM_STR); - $updateQuery->bindValue(':userid', $userData['userid'], PDO::PARAM_STR); - $res = $updateQuery->execute(); - - $myflwlist = explode(',', $myData["follow"]); - $delfollowList = array_diff($myflwlist, array($userData['userid'])); - $delfollowList = array_values(array_unique(array_filter($delfollowList))); - $deluserid = implode(',', $delfollowList); - - // 自分のfollowカラムから相手のユーザーIDを削除 - $updateQuery = $pdo->prepare("UPDATE account SET follow = :follow WHERE userid = :userid"); - $updateQuery->bindValue(':follow', $deluserid, PDO::PARAM_STR); - $updateQuery->bindValue(':userid', $userid, PDO::PARAM_STR); - $res_follow = $updateQuery->execute(); - - if ($res && $res_follow) { - // コミット + if ($res) { $pdo->commit(); return true; } else { - // ロールバック $pdo->rollBack(); actionLog($userid, "error", "unfollow_user", $to_userid, "フォロー解除に失敗", 3); return false; } - }else{ - $pdo->commit(); - return true; + } catch(PDOException $e) { + // ロールバック + $pdo->rollBack(); + actionLog($userid, "error", "unfollow_user", $to_userid, $e, 4); + return false; } - } catch (Exception $e) { - // ロールバック - $pdo->rollBack(); - actionLog($userid, "error", "unfollow_user", $to_userid, $e, 4); + }else{ return false; } }else{ @@ -2235,6 +2207,232 @@ function unfollow_user($pdo, $to_userid, $userid){ return false; } } + +function migrationFollowData($pdo, $userid){ + if (!(empty($pdo)) && !(empty($userid))){ + $pdo->beginTransaction(); + try { + $stmt = $pdo->prepare("SELECT userid, follow FROM account WHERE userid = ?"); + $stmt->execute([$userid]); + $user = $stmt->fetch(PDO::FETCH_ASSOC); + + if (!(empty($user['follow']))) { + $followerId = $user['userid']; + $follows = array_filter(explode(",", $user['follow'])); + + $insert = $pdo->prepare("INSERT IGNORE INTO follow (uniqid, follower_id, followee_id, datetime) VALUES (?, ?, ?, ?)"); + + foreach ($follows as $followeeId) { + $uniqid = createUniqId(); + $datetime = date("Y-m-d H:i:s"); + + $followeeId = trim($followeeId); // 数値にキャストせず文字列を保持 + if ($followeeId !== "" && $followerId !== $followeeId) { + $insert->execute([$uniqid ,$followerId, $followeeId, $datetime]); + } + } + + $clear = $pdo->prepare("UPDATE account SET follow = '', follower = '' WHERE userid = ?"); + $clear->execute([$userid]); + + $pdo->commit(); + actionLog($userid, "info", "migrationFollowData", $userid, "フォロー情報の移行に成功しました！", 0); + return true; + }else{ + $pdo->commit(); + return true; + } + } catch (Exception $e) { + $pdo->rollBack(); + actionLog($userid, "error", "migrationFollowData", $userid, $e, 4); + return false; + } + }else{ + actionLog($userid, "error", "migrationFollowData", $userid, "フォロー情報の移行関数が呼び出されましたが値が不足しています。", 3); + return false; + } +} + +function migrationFollowNetwork($pdo, $startUserId) { + if (empty($pdo) || empty($startUserId)) { + actionLog($startUserId, "error", "migrationFollowNetwork", $startUserId, "関数呼び出し時の値が不足しています。", 3); + return false; + } + + $queue = [$startUserId]; + $visited = []; + + while (!empty($queue)) { + $userid = array_shift($queue); + + if (isset($visited[$userid])) continue; + + $stmt = $pdo->prepare("SELECT userid, follow, follower FROM account WHERE userid = ?"); + $stmt->execute([$userid]); + $user = $stmt->fetch(PDO::FETCH_ASSOC); + + if (!$user) continue; + + $isMigrated = + (empty($user['follow']) || trim($user['follow']) === '') && + (empty($user['follower']) || trim($user['follower']) === ''); + + if ($isMigrated) { + $visited[$userid] = true; + continue; + } + + $pdo->beginTransaction(); + try { + $followerId = $user['userid']; + $follows = array_filter(array_map('trim', explode(",", $user['follow'] ?? ''))); + $followers = array_filter(array_map('trim', explode(",", $user['follower'] ?? ''))); + + $relations = []; + + foreach ($follows as $followeeId) { + if ($followeeId !== "" && $followerId !== $followeeId) { + $relations[] = [$followerId, $followeeId]; + $queue[] = $followeeId; + } + } + + foreach ($followers as $followerUserId) { + if ($followerUserId !== "" && $followerUserId !== $followerId) { + $relations[] = [$followerUserId, $followerId]; + $queue[] = $followerUserId; + } + } + + + if (!empty($relations)) { + $insert = $pdo->prepare(" + INSERT IGNORE INTO follow (uniqid, follower_id, followee_id, datetime) + VALUES (?, ?, ?, ?) + "); + $datetime = date("Y-m-d H:i:s"); + + $check = $pdo->prepare("SELECT 1 FROM follow WHERE follower_id = ? AND followee_id = ? LIMIT 1"); + + foreach ($relations as [$from, $to]) { + $check->execute([$from, $to]); + if ($check->fetchColumn()) { + continue; + } + + $uniqid = createUniqId(); + $insert->execute([$uniqid, $from, $to, $datetime]); + } + } + + $clear = $pdo->prepare("UPDATE account SET follow = '', follower = '' WHERE userid = ?"); + $clear->execute([$userid]); + + $pdo->commit(); + + $visited[$userid] = true; + actionLog($userid, "info", "migrationFollowNetwork", $userid, "フォロー情報の移行に成功しました！", 0); + } catch (Exception $e) { + $pdo->rollBack(); + actionLog($userid, "error", "migrationFollowNetwork", $userid, $e->getMessage(), 4); + } + } + return true; +} + +function checkFollowMigrationProgress($pdo) { + if (!(empty($pdo))) { + $stmtTotal = $pdo->query("SELECT COUNT(*) FROM account"); + $total = (int)$stmtTotal->fetchColumn(); + + $stmtPending = $pdo->query(" + SELECT COUNT(*) + FROM account + WHERE (follow IS NOT NULL AND TRIM(follow) <> '') + OR (follower IS NOT NULL AND TRIM(follower) <> '') + "); + $pending = (int)$stmtPending->fetchColumn(); + + $migrated = $total - $pending; + + $progress = $total > 0 ? round(($migrated / $total) * 100, 2) : 0; + + return [ + 'total' => $total,//総ユーザー数 + 'migrated' => $migrated,//移行済み + 'pending' => $pending,//未移行 + 'progress' => $progress//％ + ]; + } +} + +function getFolloweeList($pdo, $userid){ + if (!(empty($pdo)) && !(empty($userid))){ + $query = $pdo->prepare("SELECT followee_id FROM follow WHERE follower_id = :follower_id ORDER BY datetime DESC"); + $query->bindValue(':follower_id', $userid, PDO::PARAM_STR); + $query->execute(); + $all_followee = $query->fetchAll(PDO::FETCH_COLUMN); + + if($all_followee){ + return $all_followee; + }else{ + $userdata = getUserData($pdo, $userid); + $followeeIds = array_filter(explode(',', $userdata['follow'])); + if($followeeIds){ + return $followeeIds; + }else{ + return array(); + } + } + }else{ + return array(); + } +} +function getFollowerList($pdo, $userid){ + if (!(empty($pdo)) && !(empty($userid))){ + $query = $pdo->prepare("SELECT follower_id FROM follow WHERE followee_id = :followee_id ORDER BY datetime DESC"); + $query->bindValue(':followee_id', $userid, PDO::PARAM_STR); + $query->execute(); + $all_follower = $query->fetchAll(PDO::FETCH_COLUMN); + + if($all_follower){ + return $all_follower; + }else{ + $userdata = getUserData($pdo, $userid); + $followerIds = array_filter(explode(',', $userdata['follower'])); + if($followerIds){ + return $followerIds; + }else{ + return array(); + } + } + }else{ + return array(); + } +} +function isMeFollow($pdo, $userid, $to_userid){ + if (!(empty($pdo)) && !(empty($userid)) && !(empty($to_userid))){ + $query = $pdo->prepare("SELECT * FROM follow WHERE follower_id = :follower_id AND followee_id = :followee_id"); + $query->bindValue(':follower_id', $userid, PDO::PARAM_STR); + $query->bindValue(':followee_id', $to_userid, PDO::PARAM_STR); + $query->execute(); + $is_follower = $query->fetch(PDO::FETCH_ASSOC); + + if($is_follower){ + return true; + }else{ + $is_inUserdata = getFolloweeList($pdo, $userid); + if(in_array($to_userid, $is_inUserdata)){ + return true; + }else{ + return false; + } + } + }else{ + return false; + } +} + function block_user($pdo, $to_userid, $userid){ if (!(empty($pdo)) && !(empty($to_userid)) && !(empty($userid))){ $myData = getUserData($pdo, $userid); @@ -2630,30 +2828,35 @@ function changePopularity($pdo, $uniqid, $userid, $change_range){ $pdo->beginTransaction(); try { // 投稿のいいね情報を取得 - $stmt = $pdo->prepare("SELECT popularity FROM ueuse WHERE uniqid = :uniqid"); + $stmt = $pdo->prepare("SELECT account, popularity FROM ueuse WHERE uniqid = :uniqid"); $stmt->bindValue(':uniqid', $uniqid, PDO::PARAM_STR); $stmt->execute(); $post = $stmt->fetch(PDO::FETCH_ASSOC); if (!(empty($post))) { - $new_popularity = (int)$post['popularity'] + (int)$change_range; - if($new_popularity >= 2147483647){ - $new_popularity = 2147483647; - } + if(!($post['account'] == $userid)){ + $new_popularity = (int)$post['popularity'] + (int)$change_range; + if($new_popularity >= 2147483647){ + $new_popularity = 2147483647; + } - $updateQuery = $pdo->prepare("UPDATE ueuse SET popularity = :popularity WHERE uniqid = :uniqid"); - $updateQuery->bindValue(':popularity', $new_popularity, PDO::PARAM_INT); - $updateQuery->bindValue(':uniqid', $uniqid, PDO::PARAM_STR); - $res = $updateQuery->execute(); + $updateQuery = $pdo->prepare("UPDATE ueuse SET popularity = :popularity WHERE uniqid = :uniqid"); + $updateQuery->bindValue(':popularity', $new_popularity, PDO::PARAM_INT); + $updateQuery->bindValue(':uniqid', $uniqid, PDO::PARAM_STR); + $res = $updateQuery->execute(); - if ($res) { - $pdo->commit(); - return true; - } else { + if ($res) { + $pdo->commit(); + return true; + } else { + $pdo->rollBack(); + actionLog($userid, "error", "changePopularity", $uniqid, "いいねに失敗しました", 3); + return false; + } + }else{ $pdo->rollBack(); - actionLog($userid, "error", "changePopularity", $uniqid, "いいねに失敗しました", 3); - return false; - } + return true; + } } else { $pdo->rollBack(); return false; @@ -2758,8 +2961,16 @@ function getUserDataForUpdate($pdo, $userid) { return $query->fetch(); } -function getUeuseData($pdo, $uniqid) { - $query = $pdo->prepare("SELECT * FROM ueuse WHERE uniqid = :uniqid"); +function getUeuseData($pdo, $uniqid, $myblocklist = null) { + if(!(empty($myblocklist))){ + $blocked_accounts = sqlBlockAccountList('account', $myblocklist); + $query = $pdo->prepare("SELECT * FROM ueuse WHERE uniqid = :uniqid {$blocked_accounts['sql']}"); + foreach ($blocked_accounts['params'] as $ph => $val) { + $query->bindValue($ph, $val, PDO::PARAM_STR); + } + }else{ + $query = $pdo->prepare("SELECT * FROM ueuse WHERE uniqid = :uniqid"); + } $query->bindValue(':uniqid', $uniqid, PDO::PARAM_STR); $query->execute(); $ueuseDatas = $query->fetch(); @@ -2903,6 +3114,194 @@ function actionLog($userid, $type, $place, $target, $content, $importance){ } } +function secondsToHms($seconds){ + if ($seconds < 0) { + $seconds = 0; + } + $date = new DateTimeImmutable('@0', new DateTimeZone('UTC')); + $futureDate = $date->modify("+{$seconds} seconds"); + $interval = $date->diff($futureDate); + return $interval->format('%H時間%I分%S秒'); +} + +function createServerHashedParam($param){ + return hash('sha3-512', ENC_KEY . $param); +} + +function cleanupOldLoginLogs($pdo) { + try { + $threshold = date('Y-m-d H:i:s', strtotime('-7 days')); + + $stmt = $pdo->prepare(" + DELETE FROM loginlog + WHERE last_attack_datetime < :threshold + "); + $stmt->bindValue(':threshold', $threshold, PDO::PARAM_STR); + $stmt->execute(); + + actionLog(null, "info", "cleanupOldLoginLogs", null, "".$stmt->rowCount()."件の古いログイン失敗履歴を削除しました！", 0); + return true; + } catch (Exception $e) { + actionLog(null, "error", "cleanupOldLoginLogs", null, $e->getMessage(), 4); + return false; + } +} + +function isUserLockedByloginLog($pdo, $userid, $ip_addr) { + $log = getloginLog($pdo, $userid, $ip_addr); + if (empty($log)) { + return [false, 0]; + } + + $now = time(); + $blocked_until = strtotime($log['blocked_until_datetime']); + + if ($blocked_until <= $now && $log['failure_count'] > 0) { + $stmt = $pdo->prepare(" + UPDATE loginlog + SET failure_count = 0 + WHERE uniqid = :uniqid + "); + $stmt->bindValue(':uniqid', $log['uniqid'], PDO::PARAM_STR); + $stmt->execute(); + } + + if ($blocked_until > $now) { + $remaining = $blocked_until - $now; + return [true, $remaining]; + } else { + return [false, 0]; + } +} + +function getloginLog($pdo, $userid, $ip_addr){ + if(empty($pdo) ||empty($userid) || empty($ip_addr)){ + actionLog(null, "error", "getloginLog", null, "パラメータが不足しています。", 3); + return false; + } + + $hash_ip_addr = createServerHashedParam($ip_addr); + + if(!(empty($pdo))){ + $query = $pdo->prepare("SELECT * FROM loginlog WHERE attack_userid = :userid AND ip_hash = :ip_hash ORDER BY datetime ASC LIMIT 1"); + $query->bindParam(':userid', $userid, PDO::PARAM_STR); + $query->bindParam(':ip_hash', $hash_ip_addr, PDO::PARAM_STR); + $query->execute(); + $log = $query->fetch(PDO::FETCH_ASSOC); + + if($log){ + return $log; + }else{ + return false; + } + } +} + +function addloginLog($pdo, $userid, $ip_addr){ + //基本的にログイン失敗時のみ呼び出す + if(empty($pdo) ||empty($userid) || empty($ip_addr)){ + actionLog(null, "error", "addloginLog", null, "パラメータが不足しています。", 3); + return false; + } + + $hash_ip_addr = createServerHashedParam($ip_addr); + + if(!(empty($pdo))){ + $alreadyloginlog = getloginLog($pdo, $userid, $ip_addr); + $datetime = date('Y-m-d H:i:s'); + $max_block_seconds = 86400; + + if (!empty($alreadyloginlog)) { + $failure_count = $alreadyloginlog["failure_count"] + 1; + + if ($failure_count <= 5) { + $block_seconds = $failure_count * 2; + } else { + $block_seconds = pow(2, $failure_count - 2); + } + + if ($block_seconds > $max_block_seconds) { + $block_seconds = $max_block_seconds; + } + + $blocked_until_datetime = date('Y-m-d H:i:s', strtotime($datetime) + $block_seconds); + + $pdo->beginTransaction(); + try { + $updateQuery = $pdo->prepare(" + UPDATE loginlog + SET failure_count = :failure_count, + last_attack_datetime = :last_attack_datetime, + blocked_until_datetime = :blocked_until_datetime + WHERE uniqid = :uniqid + "); + $updateQuery->bindValue(':failure_count', $failure_count, PDO::PARAM_INT); + $updateQuery->bindValue(':last_attack_datetime', $datetime, PDO::PARAM_STR); + $updateQuery->bindValue(':blocked_until_datetime', $blocked_until_datetime, PDO::PARAM_STR); + $updateQuery->bindValue(':uniqid', $alreadyloginlog['uniqid'], PDO::PARAM_STR); + + $res = $updateQuery->execute(); + + if ($res) { + $pdo->commit(); + return true; + } else { + $pdo->rollBack(); + actionLog($userid, "error", "addLoginLog(Update)", null, "ログイン失敗ログの更新に失敗しました", 3); + return false; + } + } catch (Exception $e) { + actionLog($userid, "error", "addLoginLog(Update)", null, $e->getMessage(), 4); + $pdo->rollBack(); + return false; + } + + } else { + $uniqid = createUniqId(); + $failure_count = 1; + $block_seconds = 2; + $blocked_until_datetime = date('Y-m-d H:i:s', strtotime($datetime) + $block_seconds); + + $pdo->beginTransaction(); + try { + $stmt = $pdo->prepare(" + INSERT INTO loginlog ( + uniqid, attack_userid, ip_hash, failure_count, + last_attack_datetime, blocked_until_datetime, datetime + ) VALUES ( + :uniqid, :attack_userid, :ip_hash, :failure_count, + :last_attack_datetime, :blocked_until_datetime, :datetime + ) + "); + + $stmt->bindParam(':uniqid', $uniqid, PDO::PARAM_STR); + $stmt->bindParam(':attack_userid', $userid, PDO::PARAM_STR); + $stmt->bindParam(':ip_hash', $hash_ip_addr, PDO::PARAM_STR); + $stmt->bindParam(':failure_count', $failure_count, PDO::PARAM_INT); + $stmt->bindParam(':last_attack_datetime', $datetime, PDO::PARAM_STR); + $stmt->bindParam(':blocked_until_datetime', $blocked_until_datetime, PDO::PARAM_STR); + $stmt->bindParam(':datetime', $datetime, PDO::PARAM_STR); + + $res = $stmt->execute(); + + if ($res) { + $pdo->commit(); + return true; + } else { + $pdo->rollBack(); + return false; + } + } catch (Exception $e) { + actionLog(null, "error", "addLoginLog", null, $e->getMessage(), 3); + $pdo->rollBack(); + return false; + } + } + + } +} + + function addJob($pdo, $userid, $job, $step){ $userid = getUserData($pdo, $userid)["userid"]; if(empty($userid)){ @@ -3306,7 +3705,6 @@ function GetActivityPubUser($userid, $domain) { } function FormatUeuseItem(array $value, string $myblocklist, string $mybookmark, $pdo, string $userId): ?array { - if (in_array(safetext($value['account']), explode(",", $myblocklist))) return null; if ($value["role"] === "ice") return null; $value['iconname'] = filter_var($value['iconname'], FILTER_VALIDATE_URL) @@ -3334,7 +3732,7 @@ function FormatUeuseItem(array $value, string $myblocklist, string $mybookmark, } elseif (!empty($value['ruuniqid'])) { $value["type"] = "Reuse"; - $reused = getUeuseData($pdo, $value['ruuniqid']); + $reused = getUeuseData($pdo, $value['ruuniqid'], $myblocklist); if ($reused) { $reusedUserData = getUserData($pdo, $reused['account']); $reusedUserData["role"] = explode(',', $reusedUserData["role"]); @@ -3688,4 +4086,28 @@ function getDatasUeuse(PDO $pdo, array $messages): array { return $messages; } +function sqlBlockAccountList($column, $myblocklist){ + if (is_string($myblocklist)) { + $myblocklist = array_filter(array_map('trim', explode(',', $myblocklist))); + } + + if (empty($myblocklist)) { + return ['sql' => '', 'params' => []]; // 条件なし + } + + $placeholders = []; + $params = []; + foreach ($myblocklist as $i => $id) { + $ph = ":block_$i"; + $placeholders[] = $ph; + $params[$ph] = $id; + } + + return [ + 'sql' => "AND {$column} NOT IN (" . implode(',', $placeholders) . ")", + 'params' => $params + ]; +} + + ?> \ No newline at end of file diff --git a/home/index.php b/home/index.php index d4b976b..a86c164 100644 --- a/home/index.php +++ b/home/index.php @@ -66,7 +66,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } @@ -77,13 +76,6 @@ $notiData = $notiQuery->fetch(PDO::FETCH_ASSOC); $notificationcount = $notiData['notification_count']; -//-----------------URLから取得---------------- -if(isset($_GET['text'])) { - $ueuse = safetext(urldecode($_GET['text'])); -}elseif(isset($_COOKIE['ueuse'])) { - $ueuse = safetext($_COOKIE['ueuse']); -} - require('../logout/logout.php'); @@ -188,7 +180,7 @@ if ("serviceWorker" in navigator) {
- +
`; - inyo = ``; - contentHtml = "リユーズ元のユーズは削除されました。"; + inyo = `
+

+ リユーズ元のユーズは削除されました。 +

+
`; + contentHtml = ""; + is_reuse_getted = true; uniqid = ueuse["uniqid"]; userid = ueuse["userdata"]["userid"]; username = ueuse["userdata"]["username"]; @@ -812,9 +900,12 @@ async function createUeuseHtml(ueuse, selectedUniqid = null) { contentHtml = contentHtml + YouTube_and_nicovideo_Links(ueuse["ueuse"]); } } else { - if (YouTube_and_nicovideo_Links(ueuse["reuse"]["ueuse"])) { - contentHtml = contentHtml + YouTube_and_nicovideo_Links(ueuse["reuse"]["ueuse"]); + if (ueuse["reuse"] != null) { + if (YouTube_and_nicovideo_Links(ueuse["reuse"]["ueuse"])) { + contentHtml = contentHtml + YouTube_and_nicovideo_Links(ueuse["reuse"]["ueuse"]); + } } + } } else { @@ -839,30 +930,40 @@ async function createUeuseHtml(ueuse, selectedUniqid = null) { favbox = ""; } - html = ` -
- `+ reuse + ` -
- -
` + await replaceCustomEmojis(username) + `
 -
- @` + userid + ` + if (is_reuse_getted != true) { + html = ` +
+ `+ reuse + ` +
+ +
` + await replaceCustomEmojis(username) + `
 +
+ @` + userid + ` +
+ `+ bot + ` + `+ check + ` +
`+ formatSmartDate(datetime) + `
- `+ bot + ` - `+ check + ` -
`+ formatSmartDate(datetime) + `
+ `+ nsfw_html + ` + `+ nsfw_start_html + ` +
`+ contentHtml + `
+ `+ img_html + ` + `+ vid_html + ` + `+ inyo + ` + `+ abi_html + ` + `+ nsfw_end_html + ` + `+ favbox + `
- `+ nsfw_html + ` - `+ nsfw_start_html + ` -
`+ contentHtml + `
- `+ img_html + ` - `+ vid_html + ` - `+ inyo + ` - `+ abi_html + ` - `+ nsfw_end_html + ` - `+ favbox + ` -
- `; + `; + } else { + html = ` +
+ `+ reuse + ` + `+ inyo + ` +
+ `; + } + return html; } function createAdsHtml(ads) { @@ -925,28 +1026,28 @@ async function createNotificationHtml(notification) { let url = notification["url"]; - if(notification["is_read"] == false) { + if (notification["is_read"] == false) { is_readclass = "this"; } html = ` -
+
-
`+formatSmartDate(datetime)+`
+
`+ formatSmartDate(datetime) + `
- - + +
- `+await replaceCustomEmojis(username)+` + ` + await replaceCustomEmojis(username) + `
-

`+await replaceCustomEmojis(title)+`

-

`+content+`

- 詳細をみる +

`+ await replaceCustomEmojis(title) + `

+

`+ content + `

+ 詳細をみる
`; return html; diff --git a/login.php b/login.php index 59d2381..e9d6110 100644 --- a/login.php +++ b/login.php @@ -183,15 +183,22 @@ if( !empty($_POST['btn_submit']) ) { if( empty($password) ) { $error_message[] = 'パスワードを入力してください。(PASSWORD_INPUT_PLEASE)'; } + + if ($_SESSION["login_passtry"] <= 5) { + $delay = $_SESSION["login_passtry"] * 2; + } else { + $delay = min(pow(2, $_SESSION["login_passtry"] - 2), 60); + } + sleep($delay); + + $locknow_loginLog = isUserLockedByloginLog($pdo, $userid, $_SERVER['REMOTE_ADDR']); + if($locknow_loginLog[0] === true){ + $_SESSION["login_passtry"]++; + addloginLog($pdo, $userid, $_SERVER['REMOTE_ADDR']); + $error_message[] = '現在あなたのアカウントは保護のためロックされています。しばらく時間を開けてから再度お試しください。'; + } if(empty($error_message)){ - if ($_SESSION["login_passtry"] <= 5) { - $delay = $_SESSION["login_passtry"] * 2; - } else { - $delay = min(pow(2, $_SESSION["login_passtry"] - 2), 60); - } - sleep($delay); - if($result->rowCount() > 0) { $row = $result->fetch(); // ここでデータベースから取得した値を $row に代入する @@ -200,6 +207,7 @@ if( !empty($_POST['btn_submit']) ) { if(empty($row["authcode"])){ $_SESSION['userid'] = $userid; $_SESSION["login_passtry"] = 0; + $_SESSION['auth_status'] = 'authenticated'; $_SESSION['form_data'] = array();//フォーム初期化 // リダイレクト先のURLへ転送する @@ -211,6 +219,7 @@ if( !empty($_POST['btn_submit']) ) { }else{ $_SESSION['userid'] = $userid; $_SESSION["login_passtry"] = 0; + $_SESSION['auth_status'] = '2fa_required'; $_SESSION['form_data'] = array();//フォーム初期化 $url = 'authlogin.php'; @@ -221,14 +230,17 @@ if( !empty($_POST['btn_submit']) ) { } }else{ $_SESSION["login_passtry"]++; + addloginLog($pdo, $userid, $_SERVER['REMOTE_ADDR']); $error_message[] = 'IDまたはパスワードが違います(PASS_AND_ID_CHIGAUYANKE)'; } }else{ $_SESSION["login_passtry"]++; + addloginLog($pdo, $userid, $_SERVER['REMOTE_ADDR']); $error_message[] = 'IDまたはパスワードが違います(PASS_AND_ID_CHIGAUYANKE)'; } }else { $_SESSION["login_passtry"]++; + addloginLog($pdo, $userid, $_SERVER['REMOTE_ADDR']); $error_message[] = 'IDまたはパスワードが違います(PASS_AND_ID_CHIGAUYANKE)'; } } diff --git a/migration/index.php b/migration/index.php index dde3a0a..4b47113 100644 --- a/migration/index.php +++ b/migration/index.php @@ -2,7 +2,7 @@ $banuseridfile = "../server/banuserid.txt"; $banuserid_info = file_get_contents($banuseridfile); -$banuserid = preg_split("/\r\n|\n|\r/", $banuserid_info); +$banuserid = array_map('strtolower', preg_split("/\r\n|\n|\r/", $banuserid_info)); $badpassfile = "../server/badpass.txt"; $badpass_info = file_get_contents($badpassfile); @@ -333,7 +333,7 @@ if( !empty($_POST['btn_submit']) ) { $error_message[] = 'IDは20文字以内で入力してください。(USERID_OVER_MAX_COUNT)'; } - if(in_array($new_userid, $banuserid) === true ){ + if(in_array(strtolower($userid), $banuserid) === true ){ $error_message[] = 'そのIDは登録禁止になっています。(USERID_CONTAINS_PROHIBITED)'; } @@ -465,9 +465,11 @@ if( !empty($_POST['btn_submit']) ) { $done_data = json_decode($done_chk,true); if($done_data["done"] == "success"){ $_SESSION['userid'] = $new_userid; + $_SESSION['is_register_account'] = true; $_SESSION['done'] = true; }else{ $_SESSION['userid'] = $new_userid; + $_SESSION['is_register_account'] = true; $_SESSION['done'] = false; } $_SESSION['form_data'] = array(); @@ -477,6 +479,7 @@ if( !empty($_POST['btn_submit']) ) { }else{ $_SESSION['userid'] = $new_userid; $_SESSION['done'] = false; + $_SESSION['is_register_account'] = true; $_SESSION['form_data'] = array(); $url = '../success'; header('Location: ' . $url, true, 303); diff --git a/new.php b/new.php index eeefffc..1182dc8 100644 --- a/new.php +++ b/new.php @@ -2,7 +2,7 @@ $banuseridfile = "server/banuserid.txt"; $banuserid_info = file_get_contents($banuseridfile); -$banuserid = preg_split("/\r\n|\n|\r/", $banuserid_info); +$banuserid = array_map('strtolower', preg_split("/\r\n|\n|\r/", $banuserid_info)); $badpassfile = "server/badpass.txt"; $badpass_info = file_get_contents($badpassfile); @@ -328,7 +328,7 @@ if( !empty($_POST['btn_submit']) ) { $error_message[] = 'IDは20文字以内で入力してください。(USERID_OVER_MAX_COUNT)'; } - if(in_array($userid, $banuserid) === true ){ + if(in_array(strtolower($userid), $banuserid) === true ){ $error_message[] = 'そのIDは登録禁止になっています。(USERID_CONTAINS_PROHIBITED)'; } @@ -453,6 +453,7 @@ if( !empty($_POST['btn_submit']) ) { if ($res) { // リダイレクト先のURLへ転送する $_SESSION['userid'] = $userid; + $_SESSION['is_register_account'] = true; $_SESSION['form_data'] = array();//フォーム初期化 $url = 'authcodechk'; @@ -561,13 +562,13 @@ $pdo = null;

パスワード *

ログイン時に必要となります。
最大256文字まで使用可能です。
※サービス管理者が確認できません。
- +

パスワード再確認 *

- +
diff --git a/nextpage/bookmarktimeline.php b/nextpage/bookmarktimeline.php index 9ecfe24..372efde 100644 --- a/nextpage/bookmarktimeline.php +++ b/nextpage/bookmarktimeline.php @@ -53,6 +53,8 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $list_Page = max(0, (int)$pageNumber - 1); $messages = []; + $blocked_accounts = sqlBlockAccountList('account', $myblocklist); + if (!empty($bookmarkList[$list_Page])) { $currentPageUniqIds = $bookmarkList[$list_Page]; @@ -69,13 +71,16 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $sql = "SELECT ueuse.* FROM ueuse LEFT JOIN account ON ueuse.account = account.userid - WHERE ueuse.uniqid IN ($placeholderStr) AND account.role != 'ice' + WHERE ueuse.uniqid IN ($placeholderStr) AND account.role != 'ice' {$blocked_accounts['sql']} ORDER BY FIELD(ueuse.uniqid, $placeholderStr)"; $stmt = $pdo->prepare($sql); foreach ($params as $key => $val) { $stmt->bindValue($key, $val, PDO::PARAM_STR); } + foreach ($blocked_accounts['params'] as $ph => $val) { + $stmt->bindValue($ph, $val, PDO::PARAM_STR); + } $stmt->execute(); $messages = $stmt->fetchAll(PDO::FETCH_ASSOC); } diff --git a/nextpage/followtimeline.php b/nextpage/followtimeline.php index a1423db..6f54c36 100644 --- a/nextpage/followtimeline.php +++ b/nextpage/followtimeline.php @@ -40,13 +40,7 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe } $offset = ($pageNumber - 1) * $itemsPerPage; - $followQuery = $pdo->prepare("SELECT follow FROM account WHERE userid = :userid"); - $followQuery->bindValue(':userid', $userId); - $followQuery->execute(); - $followData = $followQuery->fetch(); - $follow = $followData['follow']/*.",".$userid*/; - $followList = explode(',', $follow); - + $followList = getFolloweeList($pdo, $userId); $messages = array(); // 初期化 // 空ならエラー回避 diff --git a/nextpage/foryoutimeline.php b/nextpage/foryoutimeline.php index e63bd6f..f85fe4d 100644 --- a/nextpage/foryoutimeline.php +++ b/nextpage/foryoutimeline.php @@ -41,16 +41,21 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $offset = ($pageNumber - 1) * $itemsPerPage; $messages = array(); + + $blocked_accounts = sqlBlockAccountList('account', $myblocklist); //------------------------------------------すべてのユーズを取得---------------------------------------------- $all_sql = "SELECT ueuse.* FROM ueuse LEFT JOIN account ON ueuse.account = account.userid - WHERE ueuse.rpuniqid = '' AND account.role != 'ice' + WHERE ueuse.rpuniqid = '' AND account.role != 'ice' {$blocked_accounts['sql']} ORDER BY ueuse.datetime DESC LIMIT :offset, :itemsPerPage"; $all_stmt = $pdo->prepare($all_sql); + foreach ($blocked_accounts['params'] as $ph => $val) { + $all_stmt->bindValue($ph, $val, PDO::PARAM_STR); + } $all_stmt->bindValue(':offset', $offset, PDO::PARAM_INT); $all_stmt->bindValue(':itemsPerPage', $itemsPerPage, PDO::PARAM_INT); $all_stmt->execute(); @@ -64,11 +69,10 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $day_count_sql = "SELECT ueuse.* FROM ueuse LEFT JOIN account ON ueuse.account = account.userid - WHERE ueuse.datetime >= NOW() - INTERVAL 7 DAY AND ueuse.rpuniqid = '' AND account.role != 'ice' + WHERE ueuse.datetime >= NOW() - INTERVAL 7 DAY AND ueuse.rpuniqid = '' AND account.role != 'ice' ORDER BY ueuse.datetime DESC LIMIT 1000"; $cnt_stmt = $pdo->prepare($day_count_sql); - $cnt_stmt->execute(); $Before7daysPosts = $cnt_stmt->fetchAll(PDO::FETCH_ASSOC); // 結果が15件に満たない場合 @@ -98,12 +102,16 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe ueuse.rpuniqid = '' AND account.role != 'ice' + {$blocked_accounts['sql']} ORDER BY ueuse.popularity DESC LIMIT :offset, :itemsPerPage; "; $pop_stmt = $pdo->prepare($pop_sql); + foreach ($blocked_accounts['params'] as $ph => $val) { + $pop_stmt->bindValue($ph, $val, PDO::PARAM_STR); + } $pop_stmt->bindValue(':getday', $get_day, PDO::PARAM_INT); $pop_stmt->bindValue(':offset', $offset, PDO::PARAM_INT); $pop_stmt->bindValue(':itemsPerPage', $itemsPerPage, PDO::PARAM_INT); @@ -115,17 +123,20 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe } //------------------------------------------フォローしているユーザーから取得---------------------------------------------- - $followList = explode(',', getUserData($pdo, $userId)["follow"]); + $followList = getFolloweeList($pdo, $userId); foreach ($followList as $followUserId) { $flw_sql = "SELECT ueuse.* FROM ueuse LEFT JOIN account ON ueuse.account = account.userid - WHERE ueuse.rpuniqid = '' AND account.role != 'ice' AND ueuse.account = :follow_account AND ueuse.datetime >= NOW() - INTERVAL :getday DAY + WHERE ueuse.rpuniqid = '' AND account.role != 'ice' AND ueuse.account = :follow_account AND ueuse.datetime >= NOW() - INTERVAL :getday DAY {$blocked_accounts['sql']} ORDER BY ueuse.datetime DESC LIMIT :offset, :itemsPerPage"; $flw_stmt = $pdo->prepare($flw_sql); + foreach ($blocked_accounts['params'] as $ph => $val) { + $flw_stmt->bindValue($ph, $val, PDO::PARAM_STR); + } $flw_stmt->bindValue(':getday', $get_day, PDO::PARAM_INT); $flw_stmt->bindValue(':offset', $offset, PDO::PARAM_INT); $flw_stmt->bindValue(':itemsPerPage', $itemsPerPage, PDO::PARAM_INT); @@ -148,7 +159,7 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $fav_sql = "SELECT ueuse.*, (LENGTH(ueuse.favorite) - LENGTH(REPLACE(ueuse.favorite, ',', '')) - 1) AS favorite_count FROM ueuse - WHERE FIND_IN_SET(:userid, ueuse.favorite) > 0 + WHERE FIND_IN_SET(:userid, ueuse.favorite) > 0 ORDER BY ueuse.datetime DESC LIMIT 100 "; @@ -167,11 +178,14 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $favget_sql = "SELECT ueuse.* FROM ueuse LEFT JOIN account ON ueuse.account = account.userid - WHERE ueuse.rpuniqid = '' AND account.role != 'ice' AND ueuse.account = :fav_account AND ueuse.datetime >= NOW() - INTERVAL :getday DAY + WHERE ueuse.rpuniqid = '' AND account.role != 'ice' AND ueuse.account = :fav_account AND ueuse.datetime >= NOW() - INTERVAL :getday DAY {$blocked_accounts['sql']} ORDER BY ueuse.datetime DESC LIMIT :offset, :itemsPerPage"; $favget_stmt = $pdo->prepare($favget_sql); + foreach ($blocked_accounts['params'] as $ph => $val) { + $favget_stmt->bindValue($ph, $val, PDO::PARAM_STR); + } $favget_stmt->bindValue(':getday', $get_day, PDO::PARAM_INT); $favget_stmt->bindValue(':offset', $offset, PDO::PARAM_INT); $favget_stmt->bindValue(':itemsPerPage', $itemsPerPage, PDO::PARAM_INT); diff --git a/nextpage/localtimeline.php b/nextpage/localtimeline.php index f880603..7e17b9a 100644 --- a/nextpage/localtimeline.php +++ b/nextpage/localtimeline.php @@ -40,16 +40,23 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe } $offset = ($pageNumber - 1) * $itemsPerPage; + $blocked_accounts = sqlBlockAccountList('account', $myblocklist); + $messages = array(); $sql = "SELECT ueuse.* FROM ueuse LEFT JOIN account ON ueuse.account = account.userid - WHERE ueuse.rpuniqid = '' AND account.role != 'ice' + WHERE ueuse.rpuniqid = '' AND account.role != 'ice' {$blocked_accounts['sql']} ORDER BY ueuse.datetime DESC LIMIT :offset, :itemsPerPage"; $stmt = $pdo->prepare($sql); + + foreach ($blocked_accounts['params'] as $ph => $val) { + $stmt->bindValue($ph, $val, PDO::PARAM_STR); + } + $stmt->bindValue(':offset', $offset, PDO::PARAM_INT); $stmt->bindValue(':itemsPerPage', $itemsPerPage, PDO::PARAM_INT); $stmt->execute(); diff --git a/nextpage/searchtimeline.php b/nextpage/searchtimeline.php index 633858a..ca30f9e 100644 --- a/nextpage/searchtimeline.php +++ b/nextpage/searchtimeline.php @@ -135,13 +135,8 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $userItems = array(); if(!empty($users)){ foreach ($users as $value) { - $follower = $value['follower']; - $followerIds = array_reverse(array_values(array_filter(explode(',', $follower)))); - $followerCount = count($followerIds); - - $follow = $value['follow']; - $followIds = array_reverse(array_values(array_filter(explode(',', $follow)))); - $followCount = count($followIds); + $followerCount = count(getFollowerList($pdo, $value["userid"])); + $followCount = count(getFolloweeList($pdo, $value["userid"])); $user = array( "type" => "User", diff --git a/nextpage/ueusetimeline.php b/nextpage/ueusetimeline.php index e3091b6..7b46d19 100644 --- a/nextpage/ueusetimeline.php +++ b/nextpage/ueusetimeline.php @@ -17,6 +17,11 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe exit; } + if(empty($uniqid)){ + echo json_encode(['success' => false, 'error' => 'no_ueuse']); + exit; + } + // データベースに接続 try { $option = array( @@ -42,8 +47,12 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe $offset = ($pageNumber - 1) * $itemsPerPage; $messages = array(); + $blocked_accounts = sqlBlockAccountList('account', $myblocklist); - $messageQuery = $pdo->prepare("SELECT * FROM ueuse WHERE uniqid = :ueuseid OR rpuniqid = :rpueuseid ORDER BY datetime ASC LIMIT :offset, :itemsPerPage"); + $messageQuery = $pdo->prepare("SELECT * FROM ueuse WHERE (uniqid = :ueuseid OR rpuniqid = :rpueuseid) {$blocked_accounts['sql']} ORDER BY datetime ASC LIMIT :offset, :itemsPerPage"); + foreach ($blocked_accounts['params'] as $ph => $val) { + $messageQuery->bindValue($ph, $val, PDO::PARAM_STR); + } $messageQuery->bindValue(':ueuseid', $uniqid, PDO::PARAM_STR); $messageQuery->bindValue(':rpueuseid', $uniqid, PDO::PARAM_STR); $messageQuery->bindValue(':offset', $offset, PDO::PARAM_INT); @@ -56,7 +65,10 @@ if (safetext(isset($_POST['page'])) && safetext(isset($_POST['userid'])) && safe foreach ($message_array as $row) { if(!(empty($row["rpuniqid"]))){ if(!($row["rpuniqid"] == $uniqid)){ - $up_messageQuery = $pdo->prepare("SELECT * FROM ueuse WHERE uniqid = :ueuseid ORDER BY datetime ASC LIMIT :offset, :itemsPerPage"); + $up_messageQuery = $pdo->prepare("SELECT * FROM ueuse WHERE uniqid = :ueuseid {$blocked_accounts['sql']} ORDER BY datetime ASC LIMIT :offset, :itemsPerPage"); + foreach ($blocked_accounts['params'] as $ph => $val) { + $up_messageQuery->bindValue($ph, $val, PDO::PARAM_STR); + } $up_messageQuery->bindValue(':ueuseid', $row["rpuniqid"]); $up_messageQuery->bindValue(':offset', $offset, PDO::PARAM_INT); $up_messageQuery->bindValue(':itemsPerPage', $itemsPerPage, PDO::PARAM_INT); diff --git a/notice/addnotice.php b/notice/addnotice.php index a92c807..c539ded 100644 --- a/notice/addnotice.php +++ b/notice/addnotice.php @@ -57,7 +57,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/notice/index.php b/notice/index.php index 498b0ca..485a544 100644 --- a/notice/index.php +++ b/notice/index.php @@ -59,7 +59,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/notification/index.php b/notification/index.php index 53d59a8..e19f9b1 100644 --- a/notification/index.php +++ b/notification/index.php @@ -56,7 +56,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/others/account_migration.php b/others/account_migration.php index 403db24..97a9841 100644 --- a/others/account_migration.php +++ b/others/account_migration.php @@ -68,7 +68,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/others/account_migration_done.php b/others/account_migration_done.php index 346b188..30b92e9 100644 --- a/others/account_migration_done.php +++ b/others/account_migration_done.php @@ -56,7 +56,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/others/index.php b/others/index.php index 26bab72..40ff345 100644 --- a/others/index.php +++ b/others/index.php @@ -57,7 +57,6 @@ if ($is_login === false) { $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/others/token.php b/others/token.php index b43b25e..6b5287a 100644 --- a/others/token.php +++ b/others/token.php @@ -56,7 +56,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/search/index.php b/search/index.php index 4f1155e..8cfbc79 100644 --- a/search/index.php +++ b/search/index.php @@ -58,7 +58,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/server/uwuzuinfo.txt b/server/uwuzuinfo.txt index 40c3403..3f641a2 100644 --- a/server/uwuzuinfo.txt +++ b/server/uwuzuinfo.txt @@ -1,4 +1,4 @@ uwuzu -1.6.4 -2025/08/20 +1.6.5 +2025/10/27 daichimarukana,putonfps \ No newline at end of file diff --git a/server/uwuzurelease.txt b/server/uwuzurelease.txt index 67d568b..a66cb48 100644 --- a/server/uwuzurelease.txt +++ b/server/uwuzurelease.txt @@ -1,7 +1,49 @@ ## リリースノートだぜぇぇぇぇぇぇい！！！！！！！ ここにはuwuzuの更新情報を載せてくぜぇ～！(いやまてテンションおかしいだろ...) -## Version 1.6.4 +## Version 1.6.5 (Hapuego) +2025/10/27 +fix: ユーズに返信をするページにて、選択しているユーズがどれかを表示する点が表示されない問題を修正しました！ +fix: プロフィールのメディアやユーズ、いいね欄の切り替えで正常にその欄のユーズが表示されないおそれのある問題を修正しました！ +fix: たくさんのユーザーをブロックしている際にタイムラインを読み進められなくなるおそれのある問題を修正しました！ +fix: 一部APIで、レスポンスのaccount欄が全てAPI使用者のアカウント情報になってしまう問題を修正しました！ +fix: アカウント登録に関する脆弱性を修正しました！ +fix: ジョブ管理画面のタイトルがログになっていた問題を修正しました。 +fix: ユーズの表示に関する問題を修正しました！ +fix: ユーズの投稿フォームで、下書きの保存がCookieの最大サイズを超えてしまった際に保存されなくなってしまう問題を修正しました！ + 今後、下書きは最後の入力から180日間ローカルストレージに保存されます。 +fix: ユーズの投稿フォームで残り文字数がまだあるのにも関わらず、ユーズが文字数オーバーでできなくなってしまう問題を修正しました！ +fix: 二段階認証が回避可能な脆弱性を修正しました。 +fix: ログインしていない状態で二段階認証の設定を上書きできるおそれのある脆弱性を修正しました。 +chg: 自分で自分のユーズにいいねやリプライなどを操作した場合におすすめタイムラインに表示されやすかったところを表示されにくいように変更しました！ +chg: ブロックしているユーザーのユーズが他のブロックしていないユーザーにリユーズされた場合に表示されないように変更しました！(もしリユーズされた場合は「リユーズ元のユーズは削除されました。」と表示されます) +chg: アカウント登録時のパスワード入力欄の仕様を変更しました。 +chg: フォロー管理の仕組みを大幅に改修しました！ + これにより、uwuzuのDBに以下の内容でのfollowテーブルの追加が必要となります。 + - sysid(int):AUTO_INCREMENT:システムID + - uniqid(varchar(256)):指定なし:ユニークID + - follower_id(varchar(512)):指定なし:フォローしている側のユーザーID + - followee_id(varchar(512)):指定なし:フォローされている側のユーザーID + - datetime(datetime):指定なし:フォロー日時 +chg: 一部UIを変更しました！ +chg: 管理者向けページより、ユーザー管理の通報確認UIを改善しました！ + 通報されたユーザーがまとまって表示されます。 +new: 二段階認証の追加を二次元コードのタップでできるようにする機能を追加しました！ + これでスマホからでも簡単に二段階認証の設定ができるようになります。 +new: ActivityPubでのリモートユーザーのユーザーID(@ example@ example.comのような形式)がユーズ内に含まれている際に自動でリンク化する機能を実装しました！ + なお、この機能では実際にリモートサーバーに接続してユーザーの有無の確認をするわけではないので、存在しないユーザーでもリンク化される場合がございます。 +new: ブルートフォースアタックからアカウントを保護するためのログインブロック機能を追加しました。 + これにより、uwuzuのDBに以下の内容でのloginlogテーブルの追加が必要となります。 + - sysid(int):AUTO_INCREMENT:システムID + - uniqid(varchar(256)):指定なし:ユニークID + - attack_userid(varchar(512)):指定なし:ログインを試行されたユーザーのID + - ip_hash(varchar(1024)):指定なし:ログインを試行した端末のIPアドレスのハッシュ値 + - failure_count(int):指定なし:ログイン失敗回数 + - last_attack_datetime:指定なし:最終ログイン失敗日時 + - blocked_until_datetime:指定なし:ブロック終了日時 + - datetime(datetime):指定なし:最初の失敗ログイン記録日時 + +## Version 1.6.4 (Hapuego) 2025/08/20 fix: 画像のアップロード時に発生するおそれのある脆弱性を修正しました！ fix: 前回のアップデートで配信予定だったbanuserid.txtの修正配信忘れの修正を行いました！ @@ -10,7 +52,7 @@ chg: gif画像を除くユーズ添付画像ファイルはすべてwebp形式 del: svg・tiff・ico形式の画像の対応機能を削除しました！ Special thanks: @modurili デバッグ用画像をご提供いただきました。 -## Version 1.6.3 +## Version 1.6.3 (Hapuego) 2025/08/10 fix: 「0」のみのユーズが行えない問題を修正しました！ fix: banuserid.txt(登録禁止ユーザーID)内のinfomationという誤った綴りををinformationに修正しました！ diff --git a/settings/addauthcode.php b/settings/addauthcode.php index 2452302..051f7e6 100644 --- a/settings/addauthcode.php +++ b/settings/addauthcode.php @@ -67,7 +67,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); @@ -208,10 +207,12 @@ $pdo = null; ?> -

以下の二次元コードより二段階認証をセットアップしてください。

-

セットアップが完了したら入力ボックスにコードを入力して「次へ」ボタンを押してください！
注意:まだ二段階認証の設定は終わっていません。次へを押すと設定が完了します。

+

以下の二次元コードを読み込むか、二次元コードの下の秘密鍵を認証アプリに入力して二段階認証をセットアップしてください。

+

セットアップが完了したら入力ボックスにコードを入力して「次へ」ボタンを押してください！

+
まだ二段階認証の設定は終わっていません。次へを押すと設定が完了します。
- + +

二段階認証コード

@@ -229,4 +230,11 @@ $pdo = null; + + \ No newline at end of file diff --git a/settings/index.php b/settings/index.php index 2306ada..ecc5f69 100644 --- a/settings/index.php +++ b/settings/index.php @@ -65,7 +65,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/settings/success.php b/settings/success.php index 9aac321..8d03742 100644 --- a/settings/success.php +++ b/settings/success.php @@ -61,7 +61,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } $notiQuery = $pdo->prepare("SELECT COUNT(*) as notification_count FROM notification WHERE touserid = :userid AND userchk = 'none'"); diff --git a/settings_admin/actionlog_admin.php b/settings_admin/actionlog_admin.php index 0aa672a..594ec0d 100644 --- a/settings_admin/actionlog_admin.php +++ b/settings_admin/actionlog_admin.php @@ -60,7 +60,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/ad_admin.php b/settings_admin/ad_admin.php index 23aacea..42057c4 100644 --- a/settings_admin/ad_admin.php +++ b/settings_admin/ad_admin.php @@ -60,7 +60,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/addemoji_admin.php b/settings_admin/addemoji_admin.php index 708e3ca..a872512 100644 --- a/settings_admin/addemoji_admin.php +++ b/settings_admin/addemoji_admin.php @@ -58,7 +58,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/codeadmin.php b/settings_admin/codeadmin.php index aa0e892..11ec325 100644 --- a/settings_admin/codeadmin.php +++ b/settings_admin/codeadmin.php @@ -62,7 +62,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/customize_admin.php b/settings_admin/customize_admin.php index 896c1e8..e424ee9 100644 --- a/settings_admin/customize_admin.php +++ b/settings_admin/customize_admin.php @@ -73,7 +73,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/ipblock_admin.php b/settings_admin/ipblock_admin.php index b320f45..3f2507b 100644 --- a/settings_admin/ipblock_admin.php +++ b/settings_admin/ipblock_admin.php @@ -56,7 +56,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/jobs_admin.php b/settings_admin/jobs_admin.php index fb88682..6838cd3 100644 --- a/settings_admin/jobs_admin.php +++ b/settings_admin/jobs_admin.php @@ -60,7 +60,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } @@ -94,7 +93,7 @@ if (!empty($pdo)) { -ログ - <?php echo safetext($serversettings["serverinfo"]["server_name"]);?> +ジョブ - <?php echo safetext($serversettings["serverinfo"]["server_name"]);?> diff --git a/settings_admin/maintenance_admin.php b/settings_admin/maintenance_admin.php index bda0a32..420d99e 100644 --- a/settings_admin/maintenance_admin.php +++ b/settings_admin/maintenance_admin.php @@ -72,7 +72,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/moderation_admin.php b/settings_admin/moderation_admin.php index 938f5c4..2fe774e 100644 --- a/settings_admin/moderation_admin.php +++ b/settings_admin/moderation_admin.php @@ -73,7 +73,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } @@ -243,7 +242,7 @@ require('../logout/logout.php');

登録禁止ユーザーid

-
ここに入力してあるユーザーidは登録できません。
改行で禁止するユーザーidを指定できます。
すでにあるアカウントは影響を受けません。
+
ここに入力してあるユーザーidは登録できません。
改行で禁止するユーザーidを指定できます。
すでにあるアカウントは影響を受けません。
マルチバイト文字は使用できません。
diff --git a/settings_admin/overview_admin.php b/settings_admin/overview_admin.php index c51c8e7..6fa35c1 100644 --- a/settings_admin/overview_admin.php +++ b/settings_admin/overview_admin.php @@ -73,7 +73,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } @@ -101,6 +100,8 @@ if(!empty($pdo)){ $result4 = $mysqli->query("SELECT userid FROM account WHERE sacinfo = 'bot'"); $count4 = $result4->num_rows; + $migrationUserFollow = checkFollowMigrationProgress($pdo); + //DB_Data try { $dbname = DB_NAME; @@ -317,6 +318,10 @@ require('../logout/logout.php');

過去1分間のロードアベレージ :

+

ユーザーのフォロー情報の移行進捗

+
uwuzu v1.6.5にて行われたユーザーのフォロー情報の保持方法の改良における進捗の表示です。
+

進捗: % ( / )

+

自動停止ロードアベレージ上限

uwuzuが自動停止するロードアベレージの上限です。
"-1"で無制限です。

diff --git a/settings_admin/plugin_admin.php b/settings_admin/plugin_admin.php index 551ec2a..870761b 100644 --- a/settings_admin/plugin_admin.php +++ b/settings_admin/plugin_admin.php @@ -83,7 +83,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/role_admin.php b/settings_admin/role_admin.php index 929bd2b..29b4118 100644 --- a/settings_admin/role_admin.php +++ b/settings_admin/role_admin.php @@ -60,7 +60,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/serveradmin.php b/settings_admin/serveradmin.php index d732aea..08dc92d 100644 --- a/settings_admin/serveradmin.php +++ b/settings_admin/serveradmin.php @@ -72,7 +72,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/update_admin.php b/settings_admin/update_admin.php index a6d1172..80ba285 100644 --- a/settings_admin/update_admin.php +++ b/settings_admin/update_admin.php @@ -56,7 +56,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } diff --git a/settings_admin/useradmin.php b/settings_admin/useradmin.php index 443b069..eb24fbf 100644 --- a/settings_admin/useradmin.php +++ b/settings_admin/useradmin.php @@ -3,8 +3,9 @@ $serversettings_file = "../server/serversettings.ini"; $serversettings = parse_ini_file($serversettings_file, true); -function random_code($length = 8){ - return substr(str_shuffle('1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'), 0, $length); +function random_code($length = 8) +{ + return substr(str_shuffle('1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'), 0, $length); } require('../db.php'); @@ -24,43 +25,41 @@ $option = null; session_name('uwuzu_s_id'); session_set_cookie_params([ - 'lifetime' => 0, - 'path' => '/', - 'domain' => '', - 'secure' => true, - 'httponly' => true, - 'samesite' => 'Lax' + 'lifetime' => 0, + 'path' => '/', + 'domain' => '', + 'secure' => true, + 'httponly' => true, + 'samesite' => 'Lax' ]); session_start(); session_regenerate_id(true); try { - $option = array( - PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, - PDO::MYSQL_ATTR_MULTI_STATEMENTS => false - ); - $pdo = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $option); + $option = array( + PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, + PDO::MYSQL_ATTR_MULTI_STATEMENTS => false + ); + $pdo = new PDO('mysql:charset=utf8mb4;dbname=' . DB_NAME . ';host=' . DB_HOST, DB_USER, DB_PASS, $option); +} catch (PDOException $e) { -} catch(PDOException $e) { - - // 接続エラーのときエラー内容を取得する - $error_message[] = $e->getMessage(); + // 接続エラーのときエラー内容を取得する + $error_message[] = $e->getMessage(); } //ログイン認証--------------------------------------------------- blockedIP($_SERVER['REMOTE_ADDR']); $is_login = uwuzuUserLogin($_SESSION, $_COOKIE, $_SERVER['REMOTE_ADDR'], "admin"); -if($is_login === false){ +if ($is_login === false) { header("Location: ../index.php"); exit; -}else{ +} else { $userid = safetext($is_login['userid']); $username = safetext($is_login['username']); $loginid = safetext($is_login["loginid"]); $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } @@ -71,9 +70,9 @@ $notiData = $notiQuery->fetch(PDO::FETCH_ASSOC); $notificationcount = $notiData['notification_count']; -if( !empty($_POST['btn_submit']) ) { +if (!empty($_POST['btn_submit'])) { - // 空白除去 + // 空白除去 $target_userid = safetext(str_replace('@', '', $_POST['target_userid'])); if (!empty($pdo)) { @@ -85,176 +84,198 @@ if( !empty($_POST['btn_submit']) ) { $userdata = $rerole->fetch(); // ここでデータベースから取得した値を $role に代入する - if(empty($userdata)){ + if (empty($userdata)) { $error_message[] = "ユーザーがいません(USER_NOT_FOUND)"; - }else{ + } else { $_SESSION['query_userid'] = $userdata["userid"]; // リダイレクト先のURLへ転送する $url = 'userinfo'; header('Location: ' . $url, true, 303); - + // すべての出力を終了 exit; } - } } -if( !empty($_POST['report_done']) ) { +if (!empty($_POST['report_done'])) { $report_id = safetext($_POST['report_id']); if (!empty($pdo)) { - $dbh = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST, DB_USER, DB_PASS, array( - PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, - PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, - PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true, - )); + $dbh = new PDO('mysql:charset=utf8mb4;dbname=' . DB_NAME . ';host=' . DB_HOST, DB_USER, DB_PASS, array( + PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, + PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, + PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true, + )); $newchk = "done"; // トランザクション開始 $pdo->beginTransaction(); - + try { $stmt = $pdo->prepare("UPDATE report SET admin_chk = :adchk WHERE uniqid = :uniqid"); - + $stmt->bindValue(':adchk', $newchk, PDO::PARAM_STR); - - $stmt->bindValue(':uniqid', $report_id , PDO::PARAM_STR); - + + $stmt->bindValue(':uniqid', $report_id, PDO::PARAM_STR); + // SQLクエリの実行 $res = $stmt->execute(); - + // コミット $res = $pdo->commit(); - + if ($res) { $url = (empty($_SERVER['HTTPS']) ? 'http://' : 'https://') . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']; - header("Location:".$url.""); - exit; + header("Location:" . $url . ""); + exit; } else { $error_message[] = '発行に失敗しました。(REGISTERED_DAME)'; } - } catch (Exception $e) { $error_message[] = "えらー(ERROR)"; // エラーが発生した時はロールバック $pdo->rollBack(); } - } } require('../logout/logout.php'); -if(isset($_GET['q'])){ +if (isset($_GET['q'])) { $keyword = safetext($_GET['q']); -}else{ +} else { $keyword = ""; } if (!empty($pdo)) { - - $sql = "SELECT * FROM report WHERE admin_chk = 'none' ORDER BY datetime DESC"; - $allreport = $pdo->query($sql); - while ($row = $allreport->fetch(PDO::FETCH_ASSOC)) { + $sql = "SELECT * FROM report WHERE admin_chk = 'none' ORDER BY datetime DESC"; + $allreport = $pdo->query($sql); - $reports[] = $row; - } + while ($row = $allreport->fetch(PDO::FETCH_ASSOC)) { + + $reports[] = $row; + } } ?> + - - - - - - - - -ユーザー管理 - <?php echo safetext($serversettings["serverinfo"]["server_name"]);?> + + + + + + + + + ユーザー管理 - <?php echo safetext($serversettings["serverinfo"]["server_name"]); ?> - +
- -
    - -

    ・

    - -
- -
- - -
- -

ユーザー管理

-
-

ユーザーID

- -
- - - -
-
- + +
    + +

    ・

    + +
+ +
+ +
+ +

ユーザー管理

+
+

ユーザーID

+
-
- - -
-

通報

- - + + +
+
+ + +
+
+ + + +
+

通報

+ + + $userReports) { ?>
- @ -
-

通報先アカウント名:@

-

通報元アカウント名:@

-
-

通報元アカウントよりメッセージ

-

-
-

通報日時:

-
-

アカウント操作を行う場合は上の「ユーザーID」にアカウントをしたいユーザーIDを入れて対応してください。

-
-
-

解決ボタンを押すとこの件は解決済みとなります。

- " style="display:none;" > - + +
+ @ + 件
- + +
+

通報先アカウント名: @

+

このユーザーに関する通報は以下の通りです：

+
+ + +
+

通報元アカウント名: @

+
メッセージ
+

+
通報日時:
+
+
+

解決ボタンを押すとこの件は解決済みとなります。

+ "> + +
+
+
+ + +

アカウント操作を行う場合は上の「ユーザーID」にアカウントをしたいユーザーIDを入れて対応してください。

- - -

通報されたアカウントはありません。

- + + + +

通報されたアカウントはありません。

+ +
-
- - - + + + diff --git a/settings_admin/userinfo.php b/settings_admin/userinfo.php index 9e7edf0..e8b6b15 100644 --- a/settings_admin/userinfo.php +++ b/settings_admin/userinfo.php @@ -60,7 +60,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } @@ -107,11 +106,9 @@ if (!empty($pdo)) { $roleDataArray[$roleId] = $rerole->fetch(); } - $followIds = explode(',', $userdata['follow']); - $followCount = count($followIds)-1; + $followCount = count(getFolloweeList($pdo, $userdata['userid'])); - $followerIds = explode(',', $userdata['follower']); - $followerCount = count($followerIds)-1; + $followerCount = count(getFollowerList($pdo, $userdata['userid'])); $result = $pdo->prepare("SELECT ueuse FROM ueuse WHERE account = :userid ORDER BY datetime"); $result->bindValue(':userid', $userdata["userid"]); diff --git a/success.php b/success.php index 527cf86..6763d9c 100644 --- a/success.php +++ b/success.php @@ -1,19 +1,59 @@ 0, + 'path' => '/', + 'domain' => '', + 'secure' => true, + 'httponly' => true, + 'samesite' => 'Lax' +]); +session_start(); +session_regenerate_id(true); -if(!(empty($_SESSION['backupcode']))){ - $backupcode = $_SESSION['backupcode']; -}else{ - $backupcode = null; +// データベースに接続 +try { + $option = array( + PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, + PDO::MYSQL_ATTR_MULTI_STATEMENTS => false + ); + $pdo = new PDO('mysql:charset=utf8mb4;dbname='.DB_NAME.';host='.DB_HOST , DB_USER, DB_PASS, $option); +} catch(PDOException $e) { + + // 接続エラーのときエラー内容を取得する + $error_message[] = $e->getMessage(); } -if(!(empty($_SESSION['done']))){ - if($_SESSION['done'] == false){ - $error_message[] = "アカウント移行の終了処理が完了できていません。\n前使用していたサーバーでアカウントの移行を取り消してください。"; + +if( !empty($pdo) ) { + $userData = getUserData($pdo, $_SESSION['userid']); + if(!(empty($userData))){ + if($_SESSION['is_register_account'] === true){ + $userid = $userData["userid"]; + $_SESSION['is_register_account'] = false; + }else{ + header("Location: login.php"); + exit; + } + }else{ + $_SESSION = array(); + header("Location: index.php"); + exit; + } + + if(!(empty($_SESSION['backupcode']))){ + $backupcode = $_SESSION['backupcode']; + }else{ + $backupcode = null; + } + if(!(empty($_SESSION['done']))){ + if($_SESSION['done'] == false){ + $error_message[] = "アカウント移行の終了処理が完了できていません。\n前使用していたサーバーでアカウントの移行を取り消してください。"; + } } } ?> diff --git a/ueuse/index.php b/ueuse/index.php index 2cfa67d..4c73b44 100644 --- a/ueuse/index.php +++ b/ueuse/index.php @@ -69,7 +69,6 @@ if($is_login === false){ $role = safetext($is_login["role"]); $sacinfo = safetext($is_login["sacinfo"]); $myblocklist = safetext($is_login["blocklist"]); - $myfollowlist = safetext($is_login["follow"]); $is_Admin = safetext($is_login["admin"]); } @@ -83,6 +82,8 @@ if (!(empty($pdo))) { if(isset($_GET['ueuseid'])) { $ueuseid = safetext(str_replace('!', '', $_GET['ueuseid'])); + }else{ + $ueuseid = null; } } @@ -100,14 +101,6 @@ if (!(empty($pdo))) { } } -//-----------------URLから取得---------------- -if(isset($_GET['text'])) { - $ueuse = safetext(urldecode($_GET['text'])); -}elseif(isset($_COOKIE['ueuse'])) { - $ueuse = safetext($_COOKIE['ueuse']); -} - - if( !empty($_POST['logout']) ) { if (isset($_SERVER['HTTP_COOKIE'])) { $cookies = explode(';', $_SERVER['HTTP_COOKIE']); @@ -188,7 +181,7 @@ $pdo = null;
- +