CVE-2014-3773 (PHP, published 2014-08-07T11:13Z)
Description: value: Multiple SQL injection vulnerabilities in TeamPass before 2.1.20 allow remote attackers to execute arbitrary SQL commands via the login parameter in a (1) send_pw_by_email or (2) generate_new_password action in sources/main.queries.php; iDisplayStart parameter to (3) datatable.logs.php or (4) a file in source/datatable/; or iDisplayLength parameter to (5) datatable.logs.php or (6) a file in source/datatable/; or allow remote authenticated users to execute arbitrary SQL commands via a sSortDir_ parameter to (7) datatable.logs.php or (8) a file in source/datatable/.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/nilsteampassnet/TeamPass
Files changed:
admin.php
admin.settings.php
admin.settings_categories.php
changelog.md
datatable.logs.php
error.php
find.php
folders.php
home.php
includes/include.php
includes/language/english.php
includes/libraries/Authentication/GoogleAuthenticator/GoogleAuthenticator.php
includes/libraries/Database/Core/DbCore.php
includes/settings.php
index.php
items.load.php
items.php
kb.php
load.php
roles.php
sources/admin.queries.php
sources/categories.queries.php
sources/checks.php
sources/core.php
sources/datatable/datatable.item_edition.php
sources/datatable/datatable.kb.php
sources/datatable/datatable.logs.php
sources/datatable/datatable.users_logged.php
sources/export.queries.php
sources/favourites.queries.php
sources/find.queries.php
sources/folders.queries.php
sources/import.queries.php
sources/items.queries.php
sources/kb.queries.php
sources/logs.queries.php
sources/main.functions.php
sources/main.queries.php
sources/roles.queries.php
sources/upload/upload.attachments.php
sources/upload/upload.files.php
sources/users.queries.php
sources/views.queries.php
users.load.php
users.php
views.php
views_database.php
views_logs.php
Commit message: 2.1.20


Vulnerable code:
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
    $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."'");
            $data_time = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."_time'");
$nb_emails = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."emails WHERE status = 'not_sent' OR status = ''");
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE personal_folder=0 AND id = ".$folder->id);
 * @file          datatable.users_logged.php
 * @author        Nils Laumaill�
 * @copyright     (c) 2009-2014 Nils Laumaill�
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
        $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
                $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
                        ".mysql_real_escape_string($_GET['sSortDir_'.$i]) .", ";
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
        $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$t->parent_id);
        $node_data = $db->fetchRow(
        echo '<tr class="ligne0" id="row_'.$t->id.'">
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">'.$t->id.'</td>
                        <td width="50%" onclick="open_edit_folder_dialog('.$t->id.')">
                            '.$ident.'<span id="title_'.$t->id.'">'.$t->title.'</span>
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            <span id="complexite_'.$t->id.'">'.@$pwComplexity[$node_data[0]][1].'</span>
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            <span id="parent_'.$t->id.'">'.$data[0].'</span>
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            '.$t->nlevel.'
                        </td>
                        <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                            <span id="renewal_'.$t->id.'">'.$node_data[1].'</span>
                        </td>
                        <td align="center">
                            <img src="includes/images/folder--minus.png" onclick="supprimer_groupe(\''.$t->id.'\')" style="cursor:pointer;" />
                        </td>';
        $data3 = $db->fetchRow("SELECT bloquer_creation,bloquer_modification FROM ".$pre."nested_tree WHERE id = ".$t->id);
                        <td align="center">
                            <input type="checkbox" id="cb_droit_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'creation\')"', isset($data3[0]) && $data3[0] == 1 ? 'checked' : '', ' />
                        </td>
                        <td align="center">
                            <input type="checkbox" id="cb_droit_modif_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'modification\')"', isset($data3[1]) && $data3[1] == 1 ? 'checked' : '', ' />
                        </td>
                        <td>
                            <input type="hidden"  id="parent_id_'.$t->id.'" value="'.$t->parent_id.'" />
                            <input type="hidden"  id="renewal_id_'.$t->id.'" value="'.$node_data[0].'" />
                        </td>
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$record['id']."' AND action = 'at_delete'");
$k['copyright'] = "&nbsp;&copy;&nbsp;copyright 2009-2014";
$txt['user_ga_code'] = "Send GoogleAuthenticator to user by email";
$txt['send_ga_code'] = "Google Authenticator for user";
$txt['error_no_email'] = "This user has no email set!";
$txt['error_no_user'] = "No user found!";
$txt['email_ga_subject'] = "Your Google Authenticator flash code for Teampass";
$txt['email_ga_text'] = "Hello,<br><br>Please click this <a href='#link#'>LINK</a> and flash it with GoogleAuthenticator application to get your OTP credentials for Teampass.<br /><br />Cheers";

$txt['purge_done'] = "Purge done! Number of elements deleted: ";
    public function checkCode($secret, $code, $discrepancy = 3)
        /*
       $time = floor(time() / 30);
   		*/
    	$currentTimeSlice = floor(time() / 30);

    	for ($i = -$discrepancy; $i <= $discrepancy; $i++) {
    		$calculatedCode = $this->getCode($secret, $currentTimeSlice + $i);
    		if ($calculatedCode == $code ) {
    			return true;
    		}
    	}
    }#-#fetchArray()
        
        
        } else {            
$database = "tp";
@define('SECUREPATH', 'E:/xampp/security');
require_once "E:/xampp/security/sk.php";
    $dataLanguage =
        );
            <button title="'.$txt['login_copy'].'" style="margin-bottom:5px;" id="menu_button_copy_login" class="copy_clipboard"><img src="includes/images/ui-text-field.png" id="div_copy_login" alt="" /></button>
        "sources/items.queries.php",
            type    : "pw_generate",
        	data = prepareExchangedData(data, "decode");
            $("#"+elem+"pw1").val(data.key).focus();
			$("#visible_pw").text(data.key);
        $("#menu_button_edit_item, #menu_button_del_item, #menu_button_copy_item, #menu_button_add_fav, #menu_button_del_fav, #menu_button_show_pw, #menu_button_copy_pw, #menu_button_copy_login, #menu_button_copy_link").attr("disabled","disabled");
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['login'])) {
    break;
                $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$node);
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$folder->id);
</div>';
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1
        || $_SESSION['settings']['enable_kb'] != 1
) {
                login:    login,
                key :    key
                type    : "change_user_language",
                lang    : lang
<?php
session_start();

include './includes/settings.php';
include './sources/main.functions.php';

require_once './sources/SplClassLoader.php';

// connect to the server
$db = new SplClassLoader('Database\Core', './includes/libraries');
$db->register();
$db = new Database\Core\DbCore($server, $user, $pass, $database, $pre);
$db->connect();

$rows = $db->fetchAllArray("SELECT id, pw FROM ".$pre."items WHERE perso = '0'");
foreach ($rows as $reccord) {
	$pw = decrypt($reccord['pw']);
	if (!empty($pw) && strlen($pw) > 30 && isutf8($pw)) {

		$key = substr($pw, 0, 15);
		$pw = substr($pw,30);

		$pw = $key . $pw;

		$pw = encrypt($pw);

		$db->queryUpdate(
			'items',
			array(
			    'pw' => $pw
			),
			"id='".$reccord['id']."'"
		);
	}
}

?>
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$record['id']."' AND parent_id = 0");
            $row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = @$db->fetchRow("SELECT COUNT(*) FROM ".$pre."keys WHERE `id`='".$reccord['id']."' AND `table` = 'items'");
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
                    $row = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id=".$folder);
    $dataSession = $db->fetchRow("SELECT key_tempo FROM ".$pre."users WHERE id=".$_SESSION['user_id']);
    $row = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type = 'admin' AND intitule = 'cpassman_version'");
    $sql="SELECT * FROM ".$pre."users WHERE id = '".$_SESSION['user_id']."'";
    $row = $db->query($sql);
    $data = $db->fetchArray($row);
$queryCount = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."users WHERE timestamp >= '".(time() - 600)."'");
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
        $sWhere .= $aColumns[$i]." LIKE '%".mysql_real_escape_string($_GET['sSearch'])."%' OR ";
    $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
    $ret_cat = $db->fetchRow("SELECT category FROM ".$pre."kb_categories WHERE id = ".$reccord['category_id']);
    $ret_author = $db->fetchRow("SELECT login FROM ".$pre."users WHERE id = ".$reccord['author_id']);
        $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
                $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
    $sLimit = "LIMIT ". $_GET['iDisplayStart'] .", ". $_GET['iDisplayLength'] ;
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
			<td align="center"><span class="span_pw" id="span_'.$elem['id'].'"><a href="#" onclick="decryptme('.$elem['id'].', \''.$encPw.'\')">Decrypt </a></span><input type="hidden" id="hide_'.$elem['id'].'" value="'.$encPw.'" /></td>
            $data = $db->fetchRow("SELECT favourites FROM ".$pre."users WHERE id = '".$_SESSION['user_id']."'");
$row = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = ".$_SESSION['user_id']);
$rows = $db->fetchAllArray(
    "SELECT id FROM ".$pre."nested_tree WHERE personal_folder=1 AND NOT parent_id = ".$row[0].
    " AND NOT title = ".$_SESSION['user_id']
);
foreach ($rows as $reccord) {
    if (!in_array($reccord['id'], $arrayPf)) {
        //build an array of personal folders ids
        array_push($arrayPf, $reccord['id']);
        //build also a string with those ids
        if (empty($listPf)) {
            $listPf = $reccord['id'];
        } else {
            $listPf .= ', '.$reccord['id'];
        }
    }
    $sLimit = "LIMIT ". intval($_GET['iDisplayStart']) .", ". intval($_GET['iDisplayLength']);
            $sOrder .= $aColumns[ intval($_GET['iSortCol_'.$i]) ]."
            ".$_GET['sSortDir_'.$i] .", ";

        "SELECT role_id FROM ".$pre."restriction_to_roles WHERE item_id = ".$reccord['id']
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
    $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$_POST['newparent_id']);
    $tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type = 'complex' AND intitule = '".$id[1]."'");
                $data = $db->fetchRow(
                    "SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'"
                $data = $db->fetchRow("SELECT personal_folder FROM ".$pre."nested_tree WHERE id = '".$parentId."'");
                $data = $db->fetchRow(
            $data = $db->fetchRow("SELECT authorized FROM ".$pre."rights WHERE tree_id = '".$val[0]."' AND fonction_id= '".$val[1]."'");
        $data_fld = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$_POST['folder']."'");
                    $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE nlevel = ".($folderLevel+$startPathLevel)." AND title = \"".$fold."\" AND parent_id = ".$parent_id);
                        $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE nlevel = '".($folderLevel+$startPathLevel)."' AND title = '".$fold."' AND parent_id = '".$parent_id."'");
                    $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE id_tree = '".$foldersArray[$item[1]]['id']."' AND label = \"".$item[2]."\"");

                        $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$folderId."'");
                $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE label = '".addslashes($label)."' AND inactif=0");
                                    WHERE i.field_id = '".$field_data[0]."'
                                    AND i.item_id=".$dataReceived['id']
                        $dataTmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."automatic_del WHERE item_id = '".$dataReceived['id']."'");
            $dataDeleted = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_delete'");
            $dataRestored = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_restored'");
        	"SELECT *
            /*
        * CASE
        * Generate a password
        */
        case "pw_generate":
            $pwgen = new SplClassLoader('Encryption\PwGen', '../includes/libraries');
            $pwgen->register();
            $pwgen = new Encryption\PwGen\pwgen();
            // Set pw size
            $pwgen->setLength($_POST['size']);
            // Include at least one number in the password
            $pwgen->setNumerals(($_POST['num'] == "true")? true : false);
            // Include at least one capital letter in the password
            $pwgen->setCapitalize(($_POST['maj'] == "true")? true : false);
            // Include at least one symbol in the password
            $pwgen->setSymbols(($_POST['symb'] == "true")? true : false);
            // Complete random, hard to memorize password
            if (isset($_POST['secure']) && $_POST['secure'] == "true") {
                $pwgen->setSecure(true);
                $pwgen->setSymbols(true);
                $pwgen->setCapitalize(true);
                $pwgen->setNumerals(true);
            } else {
                $pwgen->setSecure(false);
            }
            echo prepareExchangedData(array("key" => $pwgen->generate()), "encode");
            break;

                $data = $db->fetchRow("SELECT id, title FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'");
            $tmp = $db->fetchRow(
                $data_count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif = 0");
                $whereArg = " AND i.id_tree=".$_POST['id'];
                $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");//echo ">".$dataTmp[0];
                    $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");
            $data = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type='complex' AND intitule = '".$_POST['groupe']."'");
            $data = $db->fetchRow("SELECT name,id_item,file FROM ".$pre."files WHERE id = '".$_POST['file_id']."'");
            $data = $db->fetchRow("SELECT date FROM ".$pre."log_items WHERE action = 'at_modification' AND id_item = '".$_POST['item_id']."' ORDER BY date DESC");
    $data = $db->fetchRow("SELECT bloquer_creation,bloquer_modification,personal_folder FROM ".$pre."nested_tree WHERE id = '".$groupe."'");
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])
        || !isset($_SESSION['settings']['enable_kb']) || $_SESSION['settings']['enable_kb'] != 1
) {
                $row = $db->query("SELECT anyone_can_modify, author_id FROM ".$pre."kb WHERE id = ".$id);
                $ret = $db->fetchArray($row);
                $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."kb_categories WHERE category = '".mysql_real_escape_string($category)."'");
            $row = $db->query(
                "SELECT k.id as id, k.label as label, k.description as description, k.category_id as category_id, k.author_id as author_id, k.anyone_can_modify as anyone_can_modify,
                u.login as login, c.category as category
                FROM ".$pre."kb as k
                INNER JOIN ".$pre."kb_categories as c ON (c.id = k.category_id)
                INNER JOIN ".$pre."users as u ON (u.id = k.author_id)
                WHERE k.id = '".$_POST['id']."'"
            $ret = $db->fetchArray($row);
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
        $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
            $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
        $sql = "SELECT label, description, id_tree, perso, restricted_to, login
        $data = $db->fetchArray($row);
        $itemTags = $db->fetchAllArray("SELECT tag FROM ".$pre."tags WHERE item_id=".$id);
            "id='".$id."'"
        $sql = "SELECT i.label, i.description, i.id_tree as id_tree, i.perso, i.restricted_to, i.id, i.login
        $data = $db->fetchArray($row);
 * @author        Nils Laumaillé
 * @copyright     (c) 2009-2014 Nils Laumaillé
            $row = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id=".$dataReceived['user_id']);
        $data = $db->fetchRow(
            "SELECT COUNT(*) FROM ".$pre."users WHERE email = '".
            mysql_real_escape_string(stripslashes(($_POST['email'])))."'"
            "&login=".$_POST['login']."\">".$_SESSION['settings']['cpassman_url'].
            "/index.php?action=password_recovery&key=".$key."&login=".$_POST['login']."</a>.<br><br>".$txt['thku'];
        $textMailAlt = $txt['forgot_pw_email_altbody_1']." ".$txt['at_login']." : ".$data['login']." - ".
                mysql_real_escape_string(stripslashes(($_POST['email'])))."'"
            $data = $db->fetchRow(
                "SELECT COUNT(*) FROM ".$pre."misc WHERE intitule = '".
                $_POST['login']."' AND type = 'password_recovery'"
                            'intitule' => $_POST['login']
                            'intitule' => $_POST['login'],
        $data = $db->fetchRow(
            $_POST['login']."' AND type = 'password_recovery'"
        if ($_POST['key'] == $data[0]) {
                "login = '".$_POST['login']."'"
                    'intitule' => $_POST['login'],
            $dataUser = $db->queryFirst("SELECT email FROM ".$pre."users WHERE login = '".$_POST['login']."'");
                    'user_language' => $_POST['lang']
            $_SESSION['user_language'] = $_POST['lang'];
            $_SESSION['user_language'] = $_POST['lang'];
        //Generate
        $pwgen->setLength($_POST['length']);
        $pwgen->setSecure($_POST['secure']);
        $pwgen->setSymbols($_POST['symbols']);
        $pwgen->setCapitalize($_POST['capitalize']);
        $pwgen->setNumerals($_POST['numerals']);
        echo Encryption\Crypt\aesctr::encrypt($pwgen->generate(), $_SESSION['key'], 256);
        $sql = "SELECT * FROM ".$pre."users WHERE login = '".addslashes($_POST['userId'])."'";
        $data = $db->fetchArray($row);
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            $tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".mysql_real_escape_string(stripslashes($_POST['name']))."'");
            $tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE id != '".$_POST['id']."' AND title = '".mysql_real_escape_string(stripslashes($_POST['title']))."'");
                        $count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_values WHERE folder_id = ".$node->id." AND role_id = ".$role);
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
 * @link          http://www.teampass.net
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            $data = $db->fetchRow("SELECT ".$_POST['type']." FROM ".$pre."users WHERE id = ".$val[0]);
            $data = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = $val[0]");
                $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_POST['id']."' AND personal_folder = 1");    // Get personal folder ID
            $data = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id = '".$_POST['id']."'");
            $data_user = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->fetchRow("SELECT groupes_visibles FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->fetchRow("SELECT groupes_interdits FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$_POST['domain']."' AND parent_id = 0");
            $data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".$_POST['domain']."'");
                    WHERE l.id_user = ".$_POST['id'].$sql_filter
                    WHERE l.id_user = ".$_POST['id'].$sql_filter."
                    LIMIT $start,".$_POST['nb_items_by_page']
                $data = $db->fetchRow(
                    "SELECT COUNT(*)
                    FROM ".$pre."log_system
                    WHERE type = 'user_mngt' AND field_1=".$_POST['id']
                $admin_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".$_SESSION['user_id']."' AND personal_folder = 1");
                $user_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".$user_id."' AND personal_folder = 1");
                        WHERE l.action = 'at_creation' AND i.perso=1 AND i.id_tree=".$folder->id
                    "id = ".$_POST['user_id']
                    "id = ".$reccord['id']
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || !isset($_SESSION['key']) || empty($_SESSION['key'])) {
            WHERE l.action = 'at_shown'".$sqlFilter
            WHERE l.action = 'at_copy'".$sqlFilter
            WHERE i.label LIKE '%".$_POST['filter']."%'"
            WHERE l.type = 'admin_action'".$sqlFilter
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".strtotime($_POST['purgeTo'])."'"
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".
                    strtotime($_POST['purgeTo'])."'"
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".
                    strtotime($_POST['purgeTo'])."'"
                    "AND date BETWEEN '".strtotime($_POST['purgeFrom'])."' AND '".
                    strtotime($_POST['purgeTo'])."'"
                            numerals   : true,
                            var pw = htmlspecialchars_decode(aes_decrypt(data));
                        	$("#change_user_pw_newpw_confirm, #change_user_pw_newpw").val(pw);
                    		$("#change_user_pw_newpw").focus();
        "sources/items.queries.php",
            type    : "pw_generate",
            data = $.parseJSON(data);
            $("#"+elem).val(data.key).focus();
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
 * @author        Nils Laumaillé
 * @copyright     (c) 2009-2014 Nils Laumaillé

if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {
include $_SESSION['settings']['cpassman_dir'].'/includes/include.php';
if (!isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1) {

Fixed code:
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "users.php")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

    //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."'");
    $data = $db->queryCount(
        "misc",
        array(
            "type" => $type,
            "intitule" => $setting
        )
    );
            //$data_time = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type='".$type."' AND intitule = '".$setting."_time'");
            $data_time = $db->queryCount(
                "misc",
                array(
                    "type" => $type,
                    "intitule" => $setting."_time"
                )
            );
//$nb_emails = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."emails WHERE status = 'not_sent' OR status = ''");
$nb_emails = $db->queryCount(
    "emails",
    "status = 'not_sent' OR status = ''"
);
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE personal_folder=0 AND id = ".$folder->id);
            $data = $db->queryCount(
                "nested_tree",
                array(
                    "personal_folder" => 0,
                    "id" => $folder->id
                )
            );
 #xxx - Off-line mode, link make the page scroll up
 * @file          datatable.logs.php
 * @author        Nils Laumaillé
 * @copyright     (c) 2009-2014 Nils Laumaillé
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key']))
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

        $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", ". mysql_real_escape_string($_GET['iDisplayLength']) ."" ;
                $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
                        '".mysql_real_escape_string($_GET['sSortDir_'.$i]) ."', ";
    } elseif (@$_SESSION['error']['code'] == ERR_VALID_SESSION) {
        echo '
        <div class="ui-state-error ui-corner-all error" style="text-align:center;" >'.$txt['error_not_authorized'].'<br /><br /><a href="index.php" />'.$txt['home'] .'</a></div>';
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

        //$data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$t->parent_id);
        $data = $db->queryGetRow(
            "nested_tree",
            array(
                "title"
            ),
            array(
                "id" => intval($t->parent_id)
            )
        );
        /*$node_data = $db->fetchRow(
        );*/
        $node_data = $db->queryGetRow(
            array(
                "misc" => "m",
                "nested_tree" => "n"
            ),
            array(
                "m.valeur" => "valeur",
                "n.renewal_period" => "renewal_period"
            ),
            array(
                "m.type" => "complex",
                "m.intitule" => intval(n.id),
                "m.intitule" => intval($t->id)
            )
        echo '
                <tr class="ligne0" id="row_'.$t->id.'">
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">'.$t->id.'</td>
                    <td width="50%" onclick="open_edit_folder_dialog('.$t->id.')">
                        '.$ident.'<span id="title_'.$t->id.'">'.$t->title.'</span>
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        <span id="complexite_'.$t->id.'">'.@$pwComplexity[$node_data[0]][1].'</span>
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        <span id="parent_'.$t->id.'">'.$data[0].'</span>
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        '.$t->nlevel.'
                    </td>
                    <td align="center" onclick="open_edit_folder_dialog('.$t->id.')">
                        <span id="renewal_'.$t->id.'">'.$node_data[1].'</span>
                    </td>
                    <td align="center">
                        <img src="includes/images/folder--minus.png" onclick="supprimer_groupe(\''.$t->id.'\')" style="cursor:pointer;" />
                    </td>';
        //$data3 = $db->fetchRow("SELECT bloquer_creation,bloquer_modification FROM ".$pre."nested_tree WHERE id = ".$t->id);
        $data3 = $db->queryGetRow(
            array(
                "bloquer_creation",
                "bloquer_modification"
            ),
            "nested_tree",
            array(
                "id" => intval($t->id)
            )
        );
                    <td align="center">
                        <input type="checkbox" id="cb_droit_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'creation\')"', isset($data3[0]) && $data3[0] == 1 ? 'checked' : '', ' />
                    </td>
                    <td align="center">
                        <input type="checkbox" id="cb_droit_modif_'.$t->id.'" onchange="Changer_Droit_Complexite(\''.$t->id.'\',\'modification\')"', isset($data3[1]) && $data3[1] == 1 ? 'checked' : '', ' />
                    </td>
                    <td>
                        <input type="hidden"  id="parent_id_'.$t->id.'" value="'.$t->parent_id.'" />
                        <input type="hidden"  id="renewal_id_'.$t->id.'" value="'.$node_data[0].'" />
                    </td>
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$record['id']."' AND action = 'at_delete'");
            $data = $db->queryCount(
                "log_items",
                array(
                    "id_item" => intval($record['id']),
                    "action" => "at_delete"
                )
            );
$txt['purge_done'] = "The purge has been performed!<br />Number of elements deleted: ";
    public function checkCode($secret, $code)
        $time = floor(time() / 30);
    }#-#fetchRow()

    #-#############################################
    # desc: builds the sql query
    # param: tables, inputs, conditions, extras
    # return: string SQL query
    public function prepareData($table, $data, $where, $extra = "", $inner = "")
    {
        $q = "SELECT ";

        // data
        $d = "";
        if (is_array($data)) {
            foreach ($data as $key => $val) {
                if (is_int($key)) {
                    $d .= "`".$this->escape($val)."`, ";
                } else {
                    if (strpos($key,'.') === false) {
                        $d .= "`$key` AS $val, ";
                    } else {
                        $d .= "$key AS $val, ";
                    }
                }
            }
            $q .= substr_replace($d, "", -2);
        } else {
            $d = $data." ";
        }

        // table
        if (is_array($table)) {
            $t = "";
            $q .= " FROM ";
            foreach ($table as $key => $val) {
                $t .= "`".$this->pre.$key."` AS ".$this->escape($val).", ";
            }
            $q .= substr_replace($t, "", -2)." ";
        } else {
            $q .= " FROM `".$this->pre.$table."` ";
        }

        // inner join conditions
        if (!empty($inner)) {
            $i = "";
            foreach ($inner as $key => $val) {
                $i .= "INNER JOIN ".$this->pre.$key." ON ".$val." ";
            }
            $q .= $i;
        }

        // where
        $w = "";
        foreach ($where as $key => $val) {
            if (strtolower($val) == 'null') {
                $w .= "`$key` = NULL, ";
            } elseif (strtolower($val)=='now()') {
                $w .= "`$key` = NOW(), ";
            } else {
                if (strpos($key,'.') === false) {
                    $w .= "`$key` = '".$this->escape($val)."' AND ";
                } else {
                    $w .= "$key = '".$this->escape($val)."' AND ";
                }
            }
        }

        // compile
        return rtrim($q, ', ').' WHERE '. rtrim($w, ' AND ') . $extra .';';
    }#-#prepareData()

    #-#############################################
    # desc: fetches and return result of one line
    # param: table (no prefix), array of fields to return, array for where conditions
    # return: (array) fetched record
    public function queryGetRow($table, $data, $where, $extra = "", $inner = "")
    {
        $q =  $this->prepareData($table, $data, $where, $extra, $inner);

        $query_id = $this->query($q);

        if (isset($this->query_id)) {
            $record = mysql_fetch_row($this->query_id);
        } else {
            $this->oops("Invalid query_id: <b>$this->query_id</b>. Records could not be fetched.");
        }

        $this->freeResult($query_id);

        return $record;
    }#-#queryGetRow()

    #-#############################################
    # desc: fetches and return result of one line
    # param: table (no prefix), array of fields to return, array for where conditions
    # return: (array) fetched record
    public function queryGetArray($table, $data, $where, $extra = "", $inner = "")
    {
        $q =  $this->prepareData($table, $data, $where, $extra, $inner);

        $query_id = $this->query($q);

        if (isset($this->query_id)) {
            $record = mysql_fetch_assoc($this->query_id) or die(mysql_error()." | ".$q);
        } else {
            $this->oops("Invalid query_id: <b>$this->query_id</b>. Records could not be fetched.");
        }

        $this->freeResult($query_id);

        return $record;
    }#-#queryGetRow()

    #-#############################################
    # desc: fetches and return the number of lines
    # param: table (no prefix), array of fields to return, array for where conditions
    # return: (array) fetched record
    public function queryCount($table, $where)
    {
        $q = "SELECT COUNT(*) FROM `".$this->pre.$table."` ";

        if (is_array($where)) {
            $w = "";
            foreach ($where as $key => $val) {
                if (strtolower($val) == 'null') {
                    $w .= "`$key` = NULL, ";
                } elseif (strtolower($val)=='now()') {
                    $w .= "`$key` = NOW(), ";
                } else {
                    $w .= "`$key`='".$this->escape($val)."' AND ";
                }
            }
        } else {
            $w = $where;
        }
        $q = rtrim($q, ', ').' WHERE '. rtrim($w, ' AND ') .';';

        $query_id = $this->query($q);
        $out = mysql_fetch_row($query_id);
        $this->freeResult($query_id);

        return $out;
    }


        } else {
$database = "tpssl";
@define('SECUREPATH', 'C:/nils.laumaille/utils/xamppssl/security');
require_once "C:/nils.laumaille/utils/xamppssl/security/sk.php";

    /*$dataLanguage =
        );*/
    $dataLanguage = $db->queryGetRow(
        "misc",
        array(
            "valeur"
        ),
        array(
            "type" => "admin",
            "intitule" => "default_language"
        )
    );
            <button title="'.$txt['login_copy'].'" id="menu_button_copy_login" class="copy_clipboard"><img src="includes/images/ui-text-field.png" id="div_copy_login" alt="" /></button>
            <br />
            <button title="'.$txt['url_copy'].'" style="margin-bottom:5px;" id="menu_button_copy_url" class="copy_clipboard"><img src="includes/images/ui-toolbar-bookmark.png" id="div_copy_url" alt="" /></button>
} elseif ((!isset($_SESSION['validite_pw']) || empty($_SESSION['validite_pw']) || empty($_SESSION['user_id'])) && isset($_GET['otv']) && $_GET['otv'] == "true") {
    // case where one-shot viewer
    if (isset($_GET['session']) && !empty($_GET['session'])) {
        include 'otv.php?session='.$_GET['session'];
    } else {
        $_SESSION['error']['code'] = ERR_VALID_SESSION;
        $_SESSION['initial_url'] = substr($_SERVER["REQUEST_URI"], strpos($_SERVER["REQUEST_URI"], "index.php?"));
        include 'error.php';
    }    
        "sources/main.queries.php",
            type    : "generate_a_password",
			data = prepareExchangedData(data, "decode");
           	if (data.error == "true") {
           		$("#div_dialog_message_text").html(data.error_msg);
           		$("#div_dialog_message").dialog("open");
           	} else {
           		$("#"+elem+"pw1").val(data.key).focus();
				$("#visible_pw").text(data.key);
           	}
        $("#menu_button_edit_item, #menu_button_del_item, #menu_button_copy_item, #menu_button_add_fav, #menu_button_del_fav, #menu_button_show_pw, #menu_button_copy_pw, #menu_button_copy_login, menu_button_copy_url, #menu_button_copy_link").attr("disabled","disabled");
                        // #XXX
                        if (data.url != "") {
                            var clip = new ZeroClipboard.Client();
                            clip.setText(data.url);
                            clip.addEventListener('complete', function(client, text) {
                                    $("#message_box").html("<?php echo addslashes($txt['url_copied_clipboard']);?>").show().fadeOut(1000);
                            });
                            clip.glue('menu_button_copy_url');
                        }
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    //include 'error.php';
    exit();
                //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$node);
                $data = $db->queryCount(
                    "items",
                    array(
                        "inactif" => 0,
                        "id_tree" => intval($node)
                    )
                );
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif=0 AND id_tree = ".$folder->id);
            $data = $db->queryCount(
                "items",
                array(
                    "inactif" => 0,
                    "id_tree" => intval($folder->id)
                )
            );
</div><br />';
if (
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
        || $_SESSION['settings']['enable_kb'] != 1)
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

        // prepare data
        data = \'{"login":"\'+sanitizeString(login)+\'" ,\'+
            \'"key":"\'+sanitizeString(key)+\'"}\';
    		    data : prepareExchangedData(data, "encode")
        data = \'{"lang":"\'+sanitizeString(lang)+\'"}\';    		        
                type : "change_user_language",
                data : prepareExchangedData(data, "encode")
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])
){
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_settings")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$record['id']."' AND parent_id = 0");
            $data = $db->queryCount(
                "nested_tree",
                array(
                    "title" => $record['id'],
                    "parent_id" => 0
                )
            );
            //$row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $item['id'],
                    "action" => "at_creation"
                )
            );
            //$row = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item=".$item['id']." AND action = 'at_creation'");
            $row = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $item['id'],
                    "action" => "at_creation"
                )
            );
            //$row = @$db->fetchRow("SELECT COUNT(*) FROM ".$pre."keys WHERE `id`='".$reccord['id']."' AND `table` = 'items'");
            $row = $db->queryCount(
                "keys",
                array(
                    "id" => $reccord['id'],
                    "table" => "items"
                )
            );
require_once('sessions.php');
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_settings")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

                    //$row = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id=".$folder);
                    $row = $db->queryGetRow(
                        "nested_tree",
                        array(
                            "title"
                        ),
                        array(
                            "id" => intval($folder)
                        )
                    );
<?php
/**
 *
 * @file          checks.php
 * @author        Nils Laumaillé
 * @version       2.1.20
 * @copyright     (c) 2009-2014 Nils Laumaillé
 * @licensing     GNU AFFERO GPL 3.0
 * @link		  http://www.teampass.net
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */

$pagesRights = array(
    "user" => array(
        "home", "items", "find", "kb", "favourites"
    ),
    "manager" => array(
        "home", "items", "find", "kb", "favourites", "manage_roles", "manage_folders", "manage_views", "manage_users"
    ),
    "admin" => array(
        "home", "items", "find", "kb", "favourites", "manage_roles", "manage_folders", "manage_views", "manage_users", "manage_settings", "manage_main"
    )
);

function curPage()
{
    parse_str(substr($_SERVER["REQUEST_URI"], strpos($_SERVER["REQUEST_URI"], "?")+1), $result);
    return $result['page'];
}

function checkUser($userId, $userKey, $pageVisited)
{
    global $pagesRights;

    if (empty($userId) || empty($pageVisited) || empty($userKey)) {
        return false;
    }

    include $_SESSION['settings']['cpassman_dir'].'/includes/settings.php';
    require_once $_SESSION['settings']['cpassman_dir'].'/includes/language/'.$_SESSION['user_language'].'.php';
    require_once $_SESSION['settings']['cpassman_dir'].'/sources/SplClassLoader.php';

    // Connect to mysql server
    $db = new SplClassLoader('Database\Core', $_SESSION['settings']['cpassman_dir'].'/includes/libraries');
    $db->register();
    $db = new Database\Core\DbCore($server, $user, $pass, $database, $pre);
    $db->connect();

    // load user's data
    /*$sql = "SELECT * FROM ".$pre."users WHERE id = '$userId'";
    $row = $db->query($sql);
    $data = $db->fetchArray($row);*/
    $data = $db->queryGetArray(
        "users",
        array(
            "login",
            "key_tempo",
            "admin",
            "gestionnaire"
        ),
        array(
            "id" => intval($userId)
        )
    );

    // check if user exists and tempo key is coherant
    if (empty($data['login']) || empty($data['key_tempo']) || $data['key_tempo'] != $userKey) {
        return false;
    }

    // check if user is allowed to see this page
    if (empty($data['admin']) && empty($data['gestionnaire']) && !in_array($pageVisited, $pagesRights['user'])) {
        return false;
    } else if (empty($data['admin']) && !empty($data['gestionnaire']) && !in_array($pageVisited, $pagesRights['manager'])) {
        return false;
    } else if (!empty($data['admin']) && !in_array($pageVisited, $pagesRights['admin'])) {
        return false;
    }

    return true;
}
    //$dataSession = $db->fetchRow("SELECT key_tempo FROM ".$pre."users WHERE id=".$_SESSION['user_id']);
    $dataSession = $db->queryGetRow(
        "users",
        array(
            "key_tempo"
        ),
        array(
            "id" => intval($_SESSION['user_id'])
        )
    );
    //$row = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type = 'admin' AND intitule = 'cpassman_version'");
    $row = $db->queryGetRow(
        "misc",
        array(
            "valeur"
        ),
        array(
            "type" => "admin",
            "intitule" => "cpassman_version"
        )
    );
    $data = $db->queryGetArray(
        "users",
        array(
            "admin",
            "gestionnaire",
            "groupes_visibles",
            "groupes_interdits",
            "fonction_id"
        ),
        array(
            "id" => intval($_SESSION['user_id'])
        )
    );
$queryCount = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."users WHERE timestamp >= '".intval((time() - 600))."'");
            $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
    $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", "
            . mysql_real_escape_string($_GET['iDisplayLength']) ;
            $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
    //$ret_cat = $db->fetchRow("SELECT category FROM ".$pre."kb_categories WHERE id = ".$reccord['category_id']);
    $ret_cat = $db->queryGetRow(
        "kb_categories",
        array(
            "category"
        ),
        array(
            "id" => intval($reccord['category_id'])
        )
    );
    //$ret_author = $db->fetchRow("SELECT login FROM ".$pre."users WHERE id = ".$reccord['author_id']);
    $ret_author = $db->queryGetRow(
        "users",
        array(
            "login"
        ),
        array(
            "id" => intval($reccord['author_id'])
        )
    );
        $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", "
                . mysql_real_escape_string($_GET['iDisplayLength']) ;
                $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
    $sLimit = "LIMIT ". mysql_real_escape_string($_GET['iDisplayStart']) .", "
            . mysql_real_escape_string($_GET['iDisplayLength']);
            $sOrder .= $aColumns[ intval(mysql_real_escape_string($_GET['iSortCol_'.$i])) ]."
			<td align="center"><span class="span_pw" id="span_'.$elem['id'].'"><a href="#" onclick="decryptme('.$elem['id'].', \''.$encPw.'\');return false;">Decrypt </a></span><input type="hidden" id="hide_'.$elem['id'].'" value="'.$encPw.'" /></td>
            //$data = $db->fetchRow("SELECT favourites FROM ".$pre."users WHERE id = '".$_SESSION['user_id']."'");
            $data = $db->queryGetRow(
                "users",
                array(
                    "favourites"
                ),
                array(
                    "id" => intval($_SESSION['user_id'])
                )
            );
// $row = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".intval($_SESSION['user_id'])."'");
$row = $db->queryGetRow(
    "nested_tree",
    array(
        "id"
    ),
    array(
        "title" => intval($_SESSION['user_id'])
    )
);
if (empty($row[0])) {
	$rows = $db->fetchAllArray(
	    "SELECT id FROM ".$pre."nested_tree WHERE personal_folder=1 AND NOT parent_id = '".intval($row[0]).
	    "' AND NOT title = '".intval($_SESSION['user_id'])."'"
	);
	foreach ($rows as $reccord) {
		if (!in_array($reccord['id'], $arrayPf)) {
			//build an array of personal folders ids
			array_push($arrayPf, $reccord['id']);
			//build also a string with those ids
			if (empty($listPf)) {
				$listPf = $reccord['id'];
			} else {
				$listPf .= ', '.$reccord['id'];
			}
		}
	}

    $sLimit = "LIMIT ". intval($_GET['iDisplayStart']) .", ". intval($_GET['iDisplayLength'])."";
            $sOrder .= "".$aColumns[ intval($_GET['iSortCol_'.$i]) ]." "
            .mysql_real_escape_string($_GET['sSortDir_'.$i]) .", ";
//echo $sOrder;
        "SELECT role_id FROM ".$pre."restriction_to_roles WHERE item_id = '".$reccord['id']."'"
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_folders")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

    // $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = ".$_POST['newparent_id']);
    $row = $db->queryGetRow(
        "nested_tree",
        array(
            "title"
        ),
        array(
            "id" => $_POST['newparent_id']
        )
    );
    //$tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."misc WHERE type = 'complex' AND intitule = '".$id[1]."'");
    $tmp = $db->queryCount(
        "misc",
        array(
            "intitule" => $id[1],
            "type" => "complex"
        )
    );
                //$data = $db->fetchRow(
                //    "SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'"
                //);
                $data = $db->queryCount(
                    "nested_tree",
                    array(
                        "title" => addslashes($title)
                    )
                // $data = $db->fetchRow("SELECT personal_folder FROM ".$pre."nested_tree WHERE id = '".$parentId."'");
                $row = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "personal_folder"
                    ),
                    array(
                        "id" => intval($parentId)
                    )
                );
                /*$data = $db->fetchRow(
                );*/
                $data = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "id",
                        "title"
                    ),
                    array(
                        "title" => addslashes($title)
                    )
            // $data = $db->fetchRow("SELECT authorized FROM ".$pre."rights WHERE tree_id = '".$val[0]."' AND fonction_id= '".$val[1]."'");
            $data = $db->queryGetRow(
                "rights",
                array(
                    "authorized"
                ),
                array(
                    "tree_id" => intval($val[0]),
                    "fonction_id" => intval($val[1])
                )
            );
        // $data_fld = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$_POST['folder']."'");
        $data_fld = $db->queryGetRow(
            "nested_tree",
            array(
                "title"
            ),
            array(
                "id" => intval($_POST['folder'])
            )
        );
                    //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE nlevel = ".($folderLevel+$startPathLevel)." AND title = \"".$fold."\" AND parent_id = ".$parent_id);
                    $data = $db->queryCount(
                        "nested_tree",
                        array(
                            "nlevel" => intval($folderLevel+$startPathLevel),
                            "title" => $fold,
                            "parent_id" => intval(parent_id)
                        )
                    );
                        // $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE nlevel = '".($folderLevel+$startPathLevel)."' AND title = '".$fold."' AND parent_id = '".$parent_id."'");
                        $row = $db->queryGetRow(
                            "nested_tree",
                            array(
                                "id"
                            ),
                            array(
                                "nlevel" => intval($folderLevel+$startPathLevel),
                                "title" => $fold,
                                "parent_id" => intval($parent_id)
                            )
                        );
                    //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE id_tree = '".$foldersArray[$item[1]]['id']."' AND label = \"".$item[2]."\"");
                    $data = $db->queryCount(
                        "items",
                        array(
                            "id_tree" => intval($foldersArray[$item[1]]['id']),
                            "label" => $item[2]
                        )
                    );
                        // $data = $db->fetchRow("SELECT title FROM ".$pre."nested_tree WHERE id = '".$folderId."'");
                        $data = $db->queryGetRow(
                            "nested_tree",
                            array(
                                "title"
                            ),
                            array(
                                "id" => intval($folderId)
                            )
                        );
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "home")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    //include 'error.php';
    exit();
}

                //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE label = '".addslashes($label)."' AND inactif=0");
                $data = $db->queryCount(
                    "items",
                    array(
                        "label" => addslashes($label),
                        "inactif" => "0"
                    )
                );
                                    WHERE i.field_id = '".intval($field_data[0])."'
                                    AND i.item_id=".intval($dataReceived['id'])
                        //$dataTmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."automatic_del WHERE item_id = '".$dataReceived['id']."'");
                        $dataTmp = $db->queryCount(
                            "automatic_del",
                            array(
                                "item_id" => $dataReceived['id']
                            )
                        );
            //$dataDeleted = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_delete'");
            //$dataRestored = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."log_items WHERE id_item = '".$_POST['id']."' AND action = 'at_restored'");
            $dataDeleted = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $_POST['id'],
                     "action" => "at_delete"
                )
            );
            $dataRestored = $db->queryCount(
                "log_items",
                array(
                    "id_item" => $_POST['id'],
                     "action" => "at_restored"
                )
            );
        	    "SELECT *
                // $data = $db->fetchRow("SELECT id, title FROM ".$pre."nested_tree WHERE title = '".addslashes($title)."'");
                $data = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "title",
                        "id"
                    ),
                    array(
                        "title" => addslashes($title)
                    )
                );
            /*$tmp = $db->fetchRow(
            );*/
            $tmp = $db->queryGetRow(
                "nested_tree",
                array(
                    "title",
                    "parent_id",
                    "personal_folder"
                ),
                array(
                    "id" => intval($dataReceived['folder'])
                )
                //$data_count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."items WHERE inactif = 0");
                $data_count = $db->queryCount(
                    "items",
                    array(
                        "inactif" => "0"
                    )
                );
                $whereArg = " AND i.id_tree=".intval($_POST['id']);
                // $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");//echo ">".$dataTmp[0];
                $dataTmp = $db->queryGetRow(
                    "items_edition",
                    array(
                        "timestamp",
                        "user_id"
                    ),
                    array(
                        "item_id" => intval($_POST['item_id'])
                    )
                );
                    // $dataTmp = $db->fetchRow("SELECT timestamp, user_id FROM ".$pre."items_edition WHERE item_id = '".$_POST['item_id']."'");
                    $dataTmp = $db->queryGetRow(
                        "items_edition",
                        array(
                            "timestamp",
                            "user_id"
                        ),
                        array(
                            "item_id" => intval($_POST['item_id'])
                        )
                    );
            // $data = $db->fetchRow("SELECT valeur FROM ".$pre."misc WHERE type='complex' AND intitule = '".$_POST['groupe']."'");
            $data = $db->queryGetRow(
                "misc",
                array(
                    "valeur"
                ),
                array(
                    "intitule" => $_POST['groupe'],
                    "type" => "complex"
                )
            );
            // $data = $db->fetchRow("SELECT name,id_item,file FROM ".$pre."files WHERE id = '".$_POST['file_id']."'");
            $data = $db->queryGetRow(
                "files",
                array(
                    "name",
                    "id_item",
                    "file"
                ),
                array(
                    "id" => intval($_POST['file_id'])
                )
            );
            // $data = $db->fetchRow("SELECT date FROM ".$pre."log_items WHERE action = 'at_modification' AND id_item = '".$_POST['item_id']."' ORDER BY date DESC");
            $data = $db->queryGetRow(
                "log_items",
                array(
                    "date"
                ),
                array(
                    "action" => "at_modification",
                    "id_item" => intval($_POST['item_id'])
                ),
                " ORDER BY date DESC"
            );
    // $data = $db->fetchRow("SELECT bloquer_creation,bloquer_modification,personal_folder FROM ".$pre."nested_tree WHERE id = '".$groupe."'");
    $data = $db->queryGetRow(
        "nested_tree",
        array(
            "bloquer_creation",
            "bloquer_modification",
            "personal_folder"
        ),
        array(
            "id" => intval($groupe)
        )
    );
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
        || !isset($_SESSION['settings']['enable_kb'])
        || $_SESSION['settings']['enable_kb'] != 1)
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "kb")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

                $ret = $db->queryGetArray(
                    "kb",
                    array(
                        "anyone_can_modify",
                        "author_id"
                    ),
                    array(
                        "id" => intval($id)
                    )
                );
                //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."kb_categories WHERE category = '".mysql_real_escape_string($category)."'");
                $data = $db->queryCount(
                    "kb_categories",
                    array(
                        "category" => $category
                    )
                );
            $ret = $db->queryGetArray(
                array(
                    "kb" => "k"
                ),
                array(
                    "k.id" => "id",
                    "k.label" => "label",
                    "k.description" => "description",
                    "k.category_id" => "category_id",
                    "k.author_id" => "author_id",
                    "k.anyone_can_modify" => "anyone_can_modify",
                    "u.login" => "login",
                    "c.category" => "category"
                ),
                array(
                    "k.id" => intval($_POST['id'])
                ),
                "",
                array(
                    "kb_categories AS c" => "(c.id = k.category_id)",
                    "users AS u" => "(u.id = k.author_id)"
                )
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}


        // $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
        $pf = $db->queryGetRow(
            "nested_tree",
            array(
                "id"
            ),
            array(
                "title" => $_SESSION['user_id']
            )
        );
        // $pf = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_SESSION['user_id']."'");
        $pf = $db->queryGetRow(
            "nested_tree",
            array(
                "id"
            ),
            array(
                "title" => intval($_SESSION['user_id'])
            )
        );
        /*$sql = "SELECT label, description, id_tree, perso, restricted_to, login
        $data = $db->fetchArray($row);*/
        $ret = $db->queryGetArray(
            "items",
            array(
                "label",
                "description",
                "id_tree",
                "perso",
                "restricted_to",
                "login"
            ),
            array(
                "id" => intval($id)
            )
        );
        $itemTags = $db->fetchAllArray("SELECT tag FROM ".$pre."tags WHERE item_id=".intval($id));
            "id='".intval($id)."'"
        /*$sql = "SELECT i.label, i.description, i.id_tree as id_tree, i.perso, i.restricted_to, i.id, i.login
        $data = $db->fetchArray($row);*/
        $data = $db->queryGetArray(
            array(
                "items" => "i"
            ),
            array(
                "i.label" => "label",
                "i.description" => "description",
                "i.id_tree" => id_tree,
                "i.perso" => "perso",
                "i.restricted_to" => "restricted_to",
                "i.login" => "login",
                "i.id" => "id"
            ),
            array(
                "i.id" => intval($id),
                "l.action" => "at_creation"
            ),
            "",
            array(
                "log_items as l" => "(l.id_item = i.id)"
            )
        );
 * @author        Nils LaumaillÃ©
 * @copyright     (c) 2009-2014 Nils LaumaillÃ©
            // $row = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id=".$dataReceived['user_id']);
            $row = $db->queryGetRow(
                "users",
                array(
                    "email"
                ),
                array(
                    "id" => intval($dataReceived['user_id'])
                )
            );
        $data = $db->queryCount(
            "users",
            array(
                "email" => mysql_real_escape_string(stripslashes($_POST['email']))
            )
            "&login=".mysql_real_escape_string($_POST['login'])."\">".$_SESSION['settings']['cpassman_url'].
            "/index.php?action=password_recovery&key=".$key."&login=".mysql_real_escape_string($_POST['login'])."</a>.<br><br>".$txt['thku'];
        $textMailAlt = $txt['forgot_pw_email_altbody_1']." ".$txt['at_login']." : ".mysql_real_escape_string($_POST['login'])." - ".
                mysql_real_escape_string(stripslashes($_POST['email']))."'"
            //$data = $db->fetchRow(
            //    "SELECT COUNT(*) FROM ".$pre."misc WHERE intitule = '".
            //    mysql_real_escape_string($_POST['login'])."' AND type = 'password_recovery'"
            //);
            $data = $db->queryCount(
                "misc",
                array(
                    "intitule" => $_POST['login'],
                    "type" => "password_recovery"
                )
                            'intitule' => mysql_real_escape_string($_POST['login'])
                            'intitule' => mysql_real_escape_string($_POST['login']),
        // decrypt and retreive data in JSON format
        $dataReceived = prepareExchangedData($_POST['data'], "decode");
        // Prepare variables
        $login = htmlspecialchars_decode($dataReceived['login']);
        $key = htmlspecialchars_decode($dataReceived['key']);
        /*$data = $db->fetchRow(
            mysql_real_escape_string($login)."' AND type = 'password_recovery'"
        );*/
        $data = $db->queryGetRow(
            "misc",
            array(
                "valeur"
            ),
            array(
                "type" => "password_recovery",
                "intitule" => $login
            )
        if ($key == $data[0]) {
                "login = '".mysql_real_escape_string($login)."'"
                    'intitule' => mysql_real_escape_string($login),
            $dataUser = $db->queryFirst("SELECT email FROM ".$pre."users WHERE login = '".mysql_real_escape_string($login)."'");
            // decrypt and retreive data in JSON format
            $dataReceived = prepareExchangedData($_POST['data'], "decode");
            // Prepare variables
            $language = $dataReceived['lang'];
                    'user_language' => $language
            $_SESSION['user_language'] = $language;
            $_SESSION['user_language'] = $language;
    	if ($_POST['size'] > $_SESSION['settings']['pwd_maximum_length']) {
    		echo prepareExchangedData(
	    		array(
		    		"error_msg" => "Password length is too long!",
		    		"error" => "true"
	    		),
	    		"encode"
    		);
    		break;
    	}

    	$pwgen->setLength($_POST['size']);
    	if (isset($_POST['secure']) && $_POST['secure'] == "true") {
    		$pwgen->setSecure(true);
    		$pwgen->setSymbols(true);
    		$pwgen->setCapitalize(true);
    		$pwgen->setNumerals(true);
    	} else {
    		$pwgen->setSecure(($_POST['secure'] == "true")? true : false);
    		$pwgen->setNumerals(($_POST['numerals'] == "true")? true : false);
    		$pwgen->setCapitalize(($_POST['capitalize'] == "true")? true : false);
    		$pwgen->setSymbols(($_POST['symbols'] == "true")? true : false);
    	}

        echo prepareExchangedData(
        	array(
	        	"key" => $pwgen->generate(),
	        	"error" => ""
        	),
        	"encode"
        );
        /*$sql = "SELECT * FROM ".$pre."users WHERE login = '".addslashes($_POST['userId'])."'";
        $data = $db->fetchArray($row);*/
        $data = $db->queryGetArray(
            "users",
            array(
                "login",
                "psk"
            ),
            array(
                "login" => $_POST['userId']
            )
        );
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_roles")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            //$tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".mysql_real_escape_string(stripslashes($_POST['name']))."'");
            $tmp = $db->queryCount(
                "roles_title",
                array(
                    "title" => stripslashes($_POST['name'])
                )
            );
            //$tmp = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE id != '".$_POST['id']."' AND title = '".mysql_real_escape_string(stripslashes($_POST['title']))."'");
            $tmp = $db->queryCount(
                "roles_title",
                array(
                    "title" => stripslashes($_POST['title']),
                    "id" => intval($_POST['id'])
                )
            );
                        //$count = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_values WHERE folder_id = ".$node->id." AND role_id = ".$role);
                        $count = $db->queryCount(
                            "roles_values",
                            array(
                                "folder_id" => intval($node->id),
                                "role_id" => intval($role)
                            )
                        );
if (
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
) {
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "items")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    handleError('Not allowed to ...', 110);
    exit();
}

if (
        !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
        !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
        !isset($_SESSION['key']) || empty($_SESSION['key'])
) {
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "items")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    handleError('Not allowed to ...', 110);
    exit();
}

 * @link		http://www.teampass.net
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_users")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            // $data = $db->fetchRow("SELECT ".$_POST['type']." FROM ".$pre."users WHERE id = ".$val[0]);
            $data = $db->queryGetRow(
                "users",
                array(
                    $_POST['type']
                ),
                array(
                    "id" => intval($val[0])
                )
            );
            // $data = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = $val[0]");
            $data = $db->queryGetRow(
                "users",
                array(
                    "fonction_id"
                ),
                array(
                    "id" => intval($val[0])
                )
            );
                // $data = $db->fetchRow("SELECT id FROM ".$pre."nested_tree WHERE title = '".$_POST['id']."' AND personal_folder = 1");    // Get personal folder ID
                $data = $db->queryGetRow(
                    "nested_tree",
                    array(
                        "id"
                    ),
                    array(
                        "title" => intval($_POST['id']),
                        "personal_folder" => "1"
                    )
                );
            // $data = $db->fetchRow("SELECT email FROM ".$pre."users WHERE id = '".$_POST['id']."'");
            $data = $db->queryGetRow(
                "users",
                array(
                    "email"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            // $data_user = $db->fetchRow("SELECT fonction_id FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data = $db->queryGetRow(
                "users",
                array(
                    "fonction_id"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            // $data_user = $db->fetchRow("SELECT groupes_visibles FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->queryGetRow(
                "users",
                array(
                    "groupes_visibles"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            // $data_user = $db->fetchRow("SELECT groupes_interdits FROM ".$pre."users WHERE id = ".$_POST['id']);
            $data_user = $db->queryGetRow(
                "users",
                array(
                    "groupes_interdits"
                ),
                array(
                    "id" => intval($_POST['id'])
                )
            );
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."nested_tree WHERE title = '".$_POST['domain']."' AND parent_id = 0");
            $data = $db->queryCount(
                "nested_tree",
                array(
                    "title" => $_POST['domain'],
                    "parent_id" => "0"
                )
            );
            //$data = $db->fetchRow("SELECT COUNT(*) FROM ".$pre."roles_title WHERE title = '".$_POST['domain']."'");
            $data = $db->queryCount(
                "roles_title",
                array(
                    "title" => $_POST['domain']
                )
            );
                    WHERE l.id_user = ".intval($_POST['id'].$sql_filter)
                    WHERE l.id_user = ".intval($_POST['id'].$sql_filter)."
                    LIMIT ".intval($start).",".intval($_POST['nb_items_by_page'])
                //$data = $db->fetchRow(
                //    "SELECT COUNT(*)
                //    FROM ".$pre."log_system
                //    WHERE type = 'user_mngt' AND field_1=".$_POST['id']
                //);
                $data = $db->queryCount(
                    "log_system",
                    array(
                        "type" => "user_mngt",
                        "field_1" => $_POST['id']
                    )
                $admin_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".intval($_SESSION['user_id'])."' AND personal_folder = 1");
                $user_folder = $db->queryFirst("SELECT id FROM ".$pre."nested_tree WHERE title='".intval($user_id)."' AND personal_folder = 1");
                        WHERE l.action = 'at_creation' AND i.perso=1 AND i.id_tree=".intval($folder->id)
                    "id = ".intval($_POST['user_id'])
                    "id = ".intval($reccord['id'])
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

            WHERE l.action = 'at_shown'".mysql_real_escape_string($sqlFilter)
            WHERE l.action = 'at_copy'".mysql_real_escape_string($sqlFilter)
            WHERE i.label LIKE '%".mysql_real_escape_string($_POST['filter'])."%'"
            WHERE l.type = 'admin_action'".mysql_real_escape_string($sqlFilter)
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".intval(strtotime($_POST['purgeTo']))."'"
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".
                    intval(strtotime($_POST['purgeTo']))."'"
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".
                    intval(strtotime($_POST['purgeTo']))."'"
                    "AND date BETWEEN '".intval(strtotime($_POST['purgeFrom']))."' AND '".
                    intval(strtotime($_POST['purgeTo']))."'"
                            numerals   : true
                        	data = prepareExchangedData(data, "decode");
                        	if (data.error == "true") {
                        		$("#div_dialog_message_text").html(data.error_msg);
                        		$("#div_dialog_message").dialog("open");
                        	} else {
                        		$("#change_user_pw_newpw_confirm, #change_user_pw_newpw").val(pw);
                        		$("#change_user_pw_newpw").focus();
                        	}
        "sources/main.queries.php",
            type    : "generate_a_password",
        	data = prepareExchangedData(data, "decode");
        	if (data.error == "true") {
        		$("#div_dialog_message_text").html(data.error_msg);
        		$("#div_dialog_message").dialog("open");
        	} else {
        		$("#"+elem).val(data.key).focus();
        	}
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], curPage())) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

 * @author        Nils LaumaillÃ©
 * @copyright     (c) 2009-2014 Nils LaumaillÃ©
if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 ||
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) ||
    !isset($_SESSION['key']) || empty($_SESSION['key']))
{
/* do checks */
include $_SESSION['settings']['cpassman_dir'].'/includes/include.php';
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}

if (
    !isset($_SESSION['CPM']) || $_SESSION['CPM'] != 1 || 
    !isset($_SESSION['user_id']) || empty($_SESSION['user_id']) || 
    !isset($_SESSION['key']) || empty($_SESSION['key'])) 
{
/* do checks */
require_once $_SESSION['settings']['cpassman_dir'].'/sources/checks.php';
if (!checkUser($_SESSION['user_id'], $_SESSION['key'], "manage_views")) {
    $_SESSION['error']['code'] = ERR_NOT_ALLOWED; //not allowed page
    include 'error.php';
    exit();
}